Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Examiner Notes
Examiner cites particular columns and line numbers in the references as applied to the claims below for convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references cited in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Specification
The disclosure is objected to because of the following informalities: In paragraph [0018], line 4, “This limit centralized management systems” should recite “This limits centralized management systems”.
Appropriate correction is required.
Claim Objections
Claims 13 and 16 are objected to because of the following informalities:
In claim 13, line 5, “substation, a second virtual machine” should recite “substation, and a second virtual machine”.
In claim 13, line 8, “machine, a fourth virtual machine” should recite “machine, and a fourth virtual machine”.
In claim 16, line 1, “The VPAC system of claim 15 wherein” should recite “The VPAC system of claim 15, wherein”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 8 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 8 recites the limitation "the first functions" in line 2. There is insufficient antecedent basis for this limitation in the claim.
For clarity of the record, the Examiner has interpreted “the first functions” to be referring to those recited in claim 7, “wherein the first virtual machine represents first functions of the power substation”.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 6, and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer et al. (DE 102007032611 A1), hereinafter Klingelhoefer, in view of Kunsman et al. (U.S. Pub. No. 2011/0307114), hereinafter Kunsman, and Zhang et al. (U.S. Pub. No. 2018/0337984), hereinafter Zhang.
In the following rejections, references will be made to page numbers of Klingelhoefer corresponding to the English translation provided in the present Office Action (see Non-Patent Literature document U cited on the attached PTO-892).
Regarding claim 1, Klingelhoefer teaches A virtual protection, automation, and control (VPAC) system for power [infrastructure] (Fig. 1, Page 1 – “The invention relates to an operating and monitoring system of a technical Plant or a technical process, in particular for power plant applications”), the VPAC system comprising:
a first physical server comprising first virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 73, 74 on hardware server 60; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the first virtual machines comprising a first virtual machine representing a first physical component of a power [infrastructure] (Fig. 1, e.g., one of the instances of virtual server 72 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”), a second virtual machine representing a backup of the first virtual machine (Fig. 1, one of the instances of virtual server 72 on hardware server 60; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), […]; and
a second physical server comprising second virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 74, 75, 76 on hardware server 61; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the second virtual machines comprising a fourth virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the first virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”), a fifth virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the second virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), […].
Klingelhoefer fails to expressly teach the virtual protection, automation, and control system for power substations comprising virtual machines representing physical components of a power substation. Klingelhoefer further fails to teach the first physical server comprising a third virtual machine configured to evaluate a health of the first physical server and the second physical server comprising a sixth virtual machine configured to evaluate a health of the second physical server.
However, Kunsman teaches a virtual protection, automation, and control system for power substations ([0003] – “Substations in high and medium-voltage power networks can include primary devices such as electrical cables, lines, bus bars, switches, power transformers and instrument transformers, which are generally arranged in switch yards and/or bays. These primary devices are operated in an automated way via a Substation Automation (SA) system. The SA system comprises secondary devices, among which Intelligent Electronic Devices (IED) are responsible for protection, control and monitoring of the primary devices.”) comprising virtual machines representing physical components of a power substation ([0030] – “FIG. 1 illustrates a substation in accordance with the prior art. FIG. 1 shows a portion of a prior art Substation Automation (SA) setup from the perspective of a communication infrastructure with installed functionality. Each of the station-level functionalities is hosted on a separate and dedicated computing device: Supervision workstation, or Station PC, with SCADA functionality and a HMI 1, Engineering PC 2, Gateway device 3, firewall 4, and optional station computer or IED 5 for executing Protection and Control functionality.”; [0031] – “FIG. 2 illustrates an architecture of an SA device with multiple processing units in accordance with an exemplary embodiment. FIG. 2 shows an architecture of an SA device 1 with multiple Processing Units 21, 22, 23 mounted on a single circuit board (motherboard), or even being part of a single multi-core CPU 20 […] The SA Device includes several execution environments or Virtual Machines 11-15, enabled and supported by a virtualization layer 10 on top of the processing hardware. The different execution environments host the functions and applications to be executed, by providing or emulating the full hardware chain of an independent PC. […] The different execution environments run different Operating Systems (OS) which in turn execute the different station-level functionality such as SCADA 11, Engineering 12, Gateway 13, and optionally Control 14 and Protection 15 applications. When reverting to the original OS, the set-up of the functions and applications is substantially unchanged as compared to their conventional implementation on distinct devices.”; [0024] – “Each execution environment, also called Virtual Machine (VM)”. Each VM implemented in the SA device of Fig. 2 represents a distinct physical computing device of the substation automation system implemented in a substation as depicted in Fig. 1.).
Klingelhoefer and Kunsman are considered to be analogous art to the claimed invention because they are in the same field of virtualized control systems for power infrastructure. Thus, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman similarly suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the functionalities in separate execution environments on the same substation automation device (see Kunsman: [0028]).
The combination of Klingelhoefer in view of Kunsman fails to expressly teach the first physical server comprising a third virtual machine configured to evaluate a health of the first physical server and the second physical server comprising a sixth virtual machine configured to evaluate a health of the second physical server.
However, Zhang teaches the first physical server comprising a third virtual machine configured to evaluate a health of the first physical server and the second physical server comprising a sixth virtual machine configured to evaluate a health of the second physical server ([0029] – “The cloud infrastructure may include hardware resources provided by multiple physical machines (such as servers)”; Claim 7 – “A physical machine, comprising: a hardware layer, a virtual machine monitor (VMM) running on the hardware layer, and a virtual machine (VM) running on the VMM, wherein an application is running on the VM, and the VM runs an executable program using hardware resources of the hardware layer, which cause the VM to: determine a resource adjustment policy according to first status information of the physical machine”; Claim 8 – “The physical machine according to claim 7, wherein the VM is further configured to: determine a health condition of the physical machine according to the first status information”).
Zhang is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using a redundant system to ensure high-availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman such that each physical server comprises a virtual machine configured to evaluate the health of the physical server on which is it implemented as taught by Zhang. Doing so would improve resource utilization of the servers by ensuring proper resources are configured for the applications (i.e., software) executing in the virtual machines operating on the servers according to the health of the physical servers (see Zhang: [0008]-[0009]).
Regarding claim 6, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1. Klingelhoefer, in view of Kunsman as applied to claim 1, further teaches the system further comprising a seventh virtual machine representing a second physical component of the power substation (Fig. 1, e.g., virtual server 71 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”) and an eighth virtual machine representing a backup of the seventh virtual machine (Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), and further comprising a ninth virtual machine representing a backup of the seventh virtual machine (Fig. 1, e.g. virtual server 71 on hardware server 61; Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”) and a tenth virtual machine representing a backup of the eighth virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the functionalities in separate execution environments on the same substation automation device (see Kunsman: [0028]).
Regarding claim 9, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1. Kunsman further teaches wherein the first virtual machines and the second virtual machines represent digital protection relay, bay control unit, or substation gateway hardware ([0024] – “Each execution environment, also called Virtual Machine (VM)”; [0026] – “In an exemplary embodiment of the present disclosure, even protection and/or control functionality, either for centralized, station-wide schemes or on behalf of an individual substation bay, is also hosted by one of the execution environments. This set-up achieves backup functionality on behalf of dedicated protection & control Intelligent Electronic Devices (IEDs ), or bay units, without adding hardware”; [0028] – “various levels of redundancy can be achieved by duplication, or even triplication of, the entire SA device […] reliability can be increased by means of software redundancy, with each of the functionalities being instantiated several times on the same SA device in separate execution environments, or by combined hardware and software redundancy.”; [0030] – “FIG. 1 illustrates a substation in accordance with the prior art. FIG. 1 shows a portion of a prior art Substation Automation (SA) setup from the perspective of a communication infrastructure with installed functionality. Each of the station-level functionalities is hosted on a separate and dedicated computing device: Supervision workstation, or Station PC, with SCADA functionality and a HMI 1, Engineering PC 2, Gateway device 3, firewall 4, and optional station computer or IED 5 for executing Protection and Control functionality.”; [0031] – “The SA Device includes several execution environments or Virtual Machines 11-15, enabled and supported by a virtualization layer 10 on top of the processing hardware. The different execution environments host the functions and applications to be executed, by providing or emulating the full hardware chain of an independent PC. […] The different execution environments run different Operating Systems (OS) which in tum execute the different station-level functionality such as SCADA 11, Engineering 12, Gateway 13, and optionally Control 14 and Protection 15 applications.”
For clarity of the record, the claim recites limitations listed in the alternative, e.g. “digital protection relay, bay control unit, or substation gateway hardware”. Accordingly, only one of the listed alternatives is required in the claimed invention. The Examiner has pointed to excerpts of Kunsman which teach at least the “bay control unit” and “substation gateway hardware” alternatives. ).
It would have been obvious to one of ordinary skill in the art to have modified the virtual machines representing physical components of the power substation as taught by Klingelhoefer in view of Kunsman such that the physical components represented include a bay control unit or substation gateway hardware as taught by Kunsman. Using virtual machines which represent substation gateway hardware and bay control units would, respectively, provide functionality for communication with a network control center or other substations and for converting protocol information (see Kunsman: [0006]) and backup functionality for the physical bay IED devices which protect and control the primary devices of the power substation (see Kunsman: [0003], [0009], [0011], and [0026]).
Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 1 above, and further in view of Chang (TW M611324 U).
In the following rejections, references will be made to page numbers of Chang corresponding to the English translation provided in the present Office Action (see Non-Patent Literature document V cited on the attached PTO-892).
Regarding claim 2, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1, but fails to expressly teach wherein one of the first physical server or the second physical server connects to an information technology (IT) network while the other of the first physical server or the second physical server connects to an operational technology (OT) network to isolate OT network traffic from IT network traffic.
However, Chang teaches wherein one of the first physical server or the second physical server connects to an information technology (IT) network while the other of the first physical server or the second physical server connects to an operational technology (OT) network to isolate OT network traffic from IT network traffic (Pages 3-4 – “the first server and the second domain end are physically isolated through the two-way transmission device […] the operation technology (OT) server is used as the first server, and the information technology (IT) server is used as the second server […] The OT server 110 is permanently connected to the OT network domain, and the IT server 120 is controlled by the OT server 110 to connect to the IT network domain. […] The bidirectional transmission device 130 is coupled to the OT server 110, and is configured to conduct or disconnect the connection between the OT server 110 and the IT server 120, and conduct or disconnect the IT server according to the instructions of the OT server 110 The connection between 120 and the IT network domain. For example, upon receiving the first command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the IT server 120 and the IT network domain, and opens the connection between the OT server 110 and the IT server 120. At this time, the IT server 120 is physically separated from the IT network domain. When receiving the second command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the OT server 110 and the IT server 120, and opens the connection between the IT server 120 and the IT network domain. At this time, the OT server 110 and the IT server 120 are physically separated.”).
Chang is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of protecting a power substation connected to an IT and an OT network. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the first and second physical servers of the virtual protection automation and control system of the power substation taught by the combination of Klingelhoefer in view of Kunsman and Zhang to incorporate the teachings of Chang. Doing so would protect the control system of the power substation from risks while enabling safe two-way communication with an IT system (see Chang: Pages 1-2).
Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman, Zhang and Chang as applied to claim 2 above, and further in view of Millett et al. (WO 202507073 A1), hereinafter Millett.
In the following rejections, references will be made to page numbers of Chang corresponding to the English translation provided in the present Office Action (see Non-Patent Literature document V cited on the attached PTO-892).
Regarding claim 3, the combination of Klingelhoefer in view of Kunsman, Zhang and Chang teaches The VPAC system of claim 2. Chang further teaches the one of the first physical server or the second physical server connecting to the IT network and the other of the first physical server or the second physical server connecting to the OT network (Pages 3-4 – “the first server and the second domain end are physically isolated through the two-way transmission device […] the operation technology (OT) server is used as the first server, and the information technology (IT) server is used as the second server […] The OT server 110 is permanently connected to the OT network domain, and the IT server 120 is controlled by the OT server 110 to connect to the IT network domain.”), wherein one of the first physical server or the second physical server connecting to the IT network is disconnected from an external network connection based on detection, by the other of the first physical server or the second physical server connecting to the OT network of [a network abnormality] (Page 4 – “upon receiving the first command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the IT server 120 and the IT network domain […] the IT server 120 is connected to the IT domain through the IT network port 240.”; Page 5 – “The OT server 110 is configured to use general-purpose input/output (GPIO) commands to control the network switching device 250. […] The first command (GPIO command) is sent to the network switching device 250 to enable the network switching device 250. After receiving the first command, the network switching device 250 controls the second hub device 220 to disconnect the connection between the IT server 120 and the IT network port 240 […] the OT server 110 performs detection of the network status, […]. If the detection is abnormal, the OT abnormal condition alarm file of the OT server 110 is updated, and the first command is sent to the network switching device 250 to enable the network switching device 250.”).
It would have been obvious to one of ordinary skill in the art to have modified the first and second physical servers of the virtual protection automation and control system of the power substation taught by the combination of Klingelhoefer in view of Kunsman and Zhang to incorporate the teachings of Chang. Doing so would protect the control system of the power substation from risks while enabling safe two-way communication between an OT system and an IT system (see Chang: Pages 1-2).
The combination of Klingelhoefer in view of Kunsman, Zhang and Chang fails to expressly teach digital twins virtually modeling the servers and that the server connected to the IT network is disconnected based on detection of a deviation of the IT network traffic from operation criteria.
However, Millett teaches digital twins virtually modeling the servers ([0149] – “a real system (1905) can be re-created as a digital twin (1910) using simulation and/or emulation. As described herein, a digital twin (1910) can be a one-to-one recreation of a real system (1905). A digital twin can include information extracted from a real system which encompasses, but is not limited to, cyber physical systems, software components, internet-of-thing (loT) components, embedded hardware, operation technology (OT) components, information technology (IT) components, networking, networking information, and data traffic of a network mimicking normal operation. Information from a digital twin of the real system can be used to create or compile a normal profile data (1930) of the digital twin (1930). Normal profile data (1930) of a digital twin can be based on a profile of network traffic (e.g., prior to a simulated attack) (1915), a profile of inter-device communication patterns (1920), and a profile of intra-device inter-software / hardware patterns (1925).” ) and that the server connected to the IT network is disconnected based on detection of a deviation of the IT network traffic from operation criteria ([0032] – “the defense pathway comprises one or more of: scanning a network of the digital replica for an anomaly; modifying a topology (e.g., connections of) of the map of the digital replica; and disconnecting one or more hosts (e.g., devices) from the network of the digital replica.”; [0133] – “A defense move (e.g., a counter action (CA)) (1510) of a defense pathway can include performing one or more actions including, but not limited to, scanning the network of a virtual system replica (digital twin) for an anomaly, modifying the topology of the network of a virtual system replica (digital twin) (e.g., by isolating a device), bringing down a host (or more than one host), and disconnecting one or more hosts from the system”; [0140] – “take action(s) (e.g., a defense action, a counter-action) to remediate the access of the attacker on the network. In some embodiments, an action can include, but is not limited to, modification of a network (e.g., the topology of the network) and disconnection of a host from a network.”; [0149]-[0150] – “A digital twin can include information extracted from a real system which encompasses, but is not limited to, cyber physical systems, software components, internet-of-thing (loT) components, embedded hardware, operation technology (OT) components, information technology (IT) components, networking, networking information, and data traffic of a network mimicking normal operation […] Normal profile data (1930) of a digital twin can be based on a profile of network traffic (e.g., prior to a simulated attack) […] A digital twin can then be used for simulation of attacks on the real system (1935). For example, Al (artificial intelligence) frameworks can be used to simulate attacks on a digital twin. An attack on a digital twin can be used to generate one or more profiles from the attacked digital twin, thus creating a profile of a system under attack. Comparing the normal profile data of a system in normal operation (e.g., not under attack) with a profile of an attacked system can reveal discrepancies between the two sets of data. Analyses (1935) of the simulated attacks can be used to create a model for detecting deviations of a system from its normal behavior (1940). Models trained for detecting deviations from normal (1940) can be used to detect a real attack (1950) on a real system (1905) under a real attack (1945).”).
Millett is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of protecting a power substation connected to an IT and an OT network from cyber attacks. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman, Zhang, and Chang to incorporate the teachings of Millett. Using digital twins of the physical system components, such as the physical servers taught by Klingelhoefer in view of Kunsman, Zhang, and Chang, would enable simulation of attacks and detection of real attack, and would enable remediation of the attack (see Millett: [0140] and [0150]).
Claims 4 and 5 are rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 1 above, and further in view of Baba (U.S. Pub. No. 2013/0061086).
Regarding claim 4, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1, but fails to expressly teach wherein the first physical server comprises a first hypervisor, wherein the second physical server comprises a second hypervisor, wherein the first virtual machine and the second virtual machine communicate using the first hypervisor, and wherein the fourth virtual machine and the fifth virtual machine communicate using the second hypervisor.
However, Baba teaches wherein the first physical server comprises a first hypervisor (Fig. 1, server 1 with hypervisor 150), wherein the second physical server comprises a second hypervisor (Fig. 1, server 2 with hypervisor 250), wherein the first virtual machine and the second virtual machine communicate using the first hypervisor ([0040] – “The hypervisor 150 includes a virtual NIC 152 for the virtual machine 110 to conduct LAN communication and a virtual NIC 154 for the virtual machine 120 to conduct LAN communication as virtual interfaces. The hypervisor 150 further includes a virtual LAN switch 156 simulating the LAN switch 5.”), and wherein the fourth virtual machine and the fifth virtual machine communicate using the second hypervisor ([0038] – “The servers 1 and 2 have the same configuration. Here, the configuration of the server 1 will be described on behalf of them.”; [0044] – “The server 2 includes hardware 21 including a processor 211, a storage 212, an NIC 213, and a communication unit 214, and a memory 20 on which a hypervisor 250 and virtual machines 210 and 220 run, and has the same configuration as the server 1. The hypervisor 250 includes a virtual NIC 252, a virtual NIC 254, and a virtual LAN switch 256.” As described in paragraph [0040] with respect to server 1, the virtual NIC 252, virtual NIC 254, and virtual LAN switch 256 of the hypervisor 250 enable the virtual machines on server 2 to conduct communications.).
Baba is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using a redundant system of two servers to ensure availability of virtual machines on the servers. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the system of Klingelhoefer in view of Kunsman and Zhang comprising two physical servers running multiple virtual machines to incorporate the teachings of Baba such that each server comprises a hypervisor which the virtual machines operating on each server use to communicate. Incorporating the communication methods of Baba would enable the communication of data of a primary virtual machine to a secondary or standby virtual machine paired with the primary virtual machine in order to provide a fault-tolerant system (see Baba: [0003], [0051], [0066]).
Regarding claim 5, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1, but fails to expressly teach wherein the first physical server and the second physical server communicate with each other at a network interface controller level.
However, Baba teaches wherein the first physical server (Fig. 1, server 1 with NIC 113) and the second physical server (FIG. 1, server 2 with NIC 213) communicate with each other at a network interface controller level ([0064]-[0066] – “The hypervisor 150 periodically transfers a copy of data on the virtual machine 110 stored in the storage 112 to the LAN switch 5 via the NIC 113. The LAN switch 5 transfers the copy of data on the virtual machine 110 received from the NIC 113 to the NIC 213. The NIC 213 transfers the received copy of data on the virtual machine 110 to the virtual LAN switch 256 of the hypervisor 250 run by the processor 211 on the memory 20. The virtual LAN switch 256 transfers the received copy of data on the virtual machine 110 to the storage 212. As described above, a copy of data on the primary virtual machine 110 is periodically transferred to the storage 212 of the server 2 including the secondary virtual machine 210. In this way, the virtual machine 110 on the server 1 serves as the primary and the virtual machine 210 on the server 2 serves as the secondary for the job A.”).
Baba is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using a redundant system of two servers to ensure availability of virtual machines on the servers. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the system of Klingelhoefer in view of Kunsman and Zhang comprising two physical servers running multiple virtual machines to incorporate the teachings of Baba such that the two physical servers communicate at the network interface controller level. Incorporating the communication methods of Baba would enable the communication of data of a primary virtual machine, e.g. on a first physical server, to a secondary or standby virtual machine, e.g. on a second physical server, paired with the primary virtual machine in order to provide a fault-tolerant system (see Baba: [0003], [0051], [0066]).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 6 above, and further in view of Maurice et al. (U.S. Patent No. 10,382,255), hereinafter Maurice.
Regarding claim 7, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 6. Klingelhoefer, in view of Kunsman as applied to claim 1, further teaches wherein the first virtual machine (Fig. 1, e.g., virtual server 72 of hardware server 60) represents first functions of the power substation, wherein the seventh virtual machine (Fig. 1, e.g., virtual server 71 of hardware server 60) represents second functions of the power substation different than the first functions (Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77”), and wherein an order of backup functionality for the first virtual machine comprises the fourth virtual machine (Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software has a failed virtual server ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ) and / or the failed server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) automatically restarts on an alternate server host. Operator control and monitoring system according to claim 6, characterized in that the virtualization software is intended to detect the line boundaries of the server host and automatically a live migration to another hardware server ( 60 . 61 . 62 ).”) […].
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device (see Kunsman: [0022] and [0028]).
The combination of Klingelhoefer in view of Kunsman and Zhang fails to expressly teach the order of backup functionality is based on a backup sequence and priority set by a user.
However, Maurice teaches the order of backup functionality is based on a backup sequence and priority set by a user (Col. 1, lines 8-16 – “In order to provide more reliable service, computing clusters may include both primary and backup nodes. In the event that a primary node fails, a backup node may begin performing functions previously performed by the failed primary node. In some cases, the backup node may operate in a standby mode, such that it is immediately available to assume the role of the primary. For example, data may be continually replicated from a primary node to a backup while the primary is operating normally.”; Col. 4, lines 20-30 – “The administrative client 101 may provide identifiers establishing a soft priority for selecting computing nodes for promotion during a failover. Promotion, as used herein, refers to selection of a node to perform a computing function previously performed by a node that is failing over. The soft prior may be specified by associating each of the computing nodes 108-116 with an identifier, typically an integer number, which may be used to rank subsets of the computing nodes 108-116 with respect to each other. The rankings of the subsets may then be used, in combination with other factors, to identify a candidate for promotion.”; Col. 7, lines 8-32 – “The administrative client 101 may provide identifiers establishing a soft priority for selecting computing nodes for promotion during a failover. Promotion, as used herein, refers to selection of a node to perform a computing function previously performed by a node that is failing over. The soft prior may be specified by associating each of the computing nodes 108-116 with an identifier, typically an integer number, which may be used to rank subsets of the computing nodes 108-116 with respect to each other. The rankings of the subsets may then be used, in combination with other factors, to identify a candidate for promotion. […] the interface may comprise various combinations of elements that allow a user to define associations between computing nodes and identifiers indicative of promotion order, i.e. promotion tier.”; Col. 10, lines 13-38 – “Computing nodes 710b and 710c are depicted as operating on virtual machine host 712 […] A computing node may refer to various types of computing resources, such as personal computers, servers, clustered computing devices, and so forth. […] Computing nodes also encompass virtualized computing resources, such as virtual machines implemented with or without a hypervisor, virtualized bare-metal environments, and so forth.”; Col. 13, lines 20-23 – “An instance may represent a physical server hardware platform, a virtual machine instance executing on a server, or some combination of the two.”).
Maurice is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundant (i.e., standby or backup) virtual machines to ensure high-availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman and Zhang to incorporate the teachings of Maurice such that the order of backup functionality including the other VMs that are backups for the first VM is based on a backup sequence and priority set by a user. Incorporating the methods of Maurice would provide to a user control over the computing nodes (e.g., virtual machines and/or servers) that make up a cluster which performs computing functions and would increase reliability by providing support for failover (see Maurice: Col. 1, lines 5-33 and Col. 3, lines 58-65).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 6 above, and further in view of Scales et al. (U.S. Pub. No. 2009/0119538), hereinafter Scales.
Regarding claim 8, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 6. Klingelhoefer further teaches wherein […] the first virtual machine of the first virtual machines […] associated with the first functions (Fig. 1, e.g., virtual server 72 of hardware server 60; Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77” ).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device, where each execution environment hosts a single functionality (see Kunsman: [0022] and [0028]).
The combination of Klingelhoefer in view of Kunsman and Zhang fails to expressly teach only the first virtual machine communicates data associated with the first functions.
However, Scales teaches only the first virtual machine communicates data associated with the first functions ([0002] – “In this fault-tolerant mode of operation, only the primary VM communicates with the outside world, i.e., providing services as needed to other computer systems or devices connected over a network or system bus.”; [0033] – “When in a fault tolerance (FT) execution mode, i.e., not during fail-over, virtualization software 15-1 passes IO requests from primary VM 20-1 to host system hardware 10-1, allowing VM 20-1 to communicate externally of system 105. In contrast, virtualization software 15-2 blocks external communication sent by VM 20-2 when not in a fail-over mode.”).
Scales is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundant (i.e., standby or backup) virtual machines to improve availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman and Zhang such that only the first virtual machine representing the first functions communicates data associated with the first functions. Preventing the virtual machines which are backups to the first virtual machine from communicating data associated with the functions of the first virtual machine as described in Scales would provide the advantage of preventing race conditions resulting from conflicting I/O operations (see Scales: [0006] and [0053]).
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 1 above, and further in view of Krishnan et al. (U.S. Pub. No. 2019/0324820), hereinafter Krishnan, and Lehmer et al. (U.S. Pub. No. 2023/0021214), hereinafter Lehmer.
Regarding claim 10, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1. Zhang further teaches wherein the health of the first physical server and the health of the second physical server are based on […] operating conditions of the first physical server and the second physical server, […] communications of the first physical server and the second physical server ([0029] – “The cloud infrastructure may include hardware resources provided by multiple physical machines (such as servers)”; Claim 7 – “A physical machine, comprising: a hardware layer, a virtual machine monitor (VMM) running on the hardware layer, and a virtual machine (VM) running on the VMM, wherein an application is running on the VM, and the VM runs an executable program using hardware resources of the hardware layer, which cause the VM to: determine a resource adjustment policy according to first status information of the physical machine”; Claim 8 – “The physical machine according to claim 7, wherein the VM is further configured to: determine a health condition of the physical machine according to the first status information”; [0033] – “a factor such as a quantity of access requests to the App or a response time of the App”; [0045] – “the first status information of the cloud platform may include at least one of the following items: […] a quantity of remaining resources of the cloud platform, an average response time of the application, […] The health condition of the cloud platform may be determined according to the first status information, and therefore, the health condition may be determined according to one or more of the foregoing status information. For example, it may be set that a larger quantity of remaining resources of the cloud platform indicates a higher health condition of the cloud platform; […] a longer response time of the App indicates a lower health condition of the cloud platform.”; [0083]-[0084] – “the health condition of the cloud platform may be determined according to at least one of the following items: […] the quantity of remaining resources of the cloud platform, the average response time of the application”).
It would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman such that each physical server comprises a virtual machine configured to evaluate the health of the physical server on which is it implemented as taught by Zhang. Doing so would improve resource utilization of the servers by ensuring proper resources are configured for the applications (i.e., software) executing in the virtual machines operating on the servers according to the health of the physical servers (see Zhang: [0008]-[0009]).
The combination of Klingelhoefer in view of Kunsman and Zhang fails to expressly teach the health based on ambient temperature data, design specifications of the first physical server and the second physical server, security of the first physical server and the second physical server, and time synchronization of the first physical server and the second physical server.
However, Krishnan teaches the health based on ambient temperature data ([0036] – “virtual server rack 106 of the illustrated example enables abstracting hardware resources (e.g., physical hardware resources 124, 126, etc. .). In some examples, the virtual server rack 106 includes a set of physical units ( e.g., one or more racks, etc. .) with each unit including hardware such as server nodes […] For example, a VMWARE ESXI™ cluster is a group of physical servers in the physical hardware resources that run VMWARE ESXI™ hypervisors to virtualize processor, memory, storage, and networking resources into logical resources to run multiple VMs”; [0040] – “The example HMS 108, 114 uses IB management to periodically monitor status and health of the physical hardware resources 124, 126 […] Example IB operations performed by the HMS 108, 114 include controlling power state, accessing temperature sensors, controlling Basic Input/Output System (BIOS) inventory of hardware (e.g., CPUs, memory, disks, etc.), event monitoring, and logging events.”; [0072] – “In other examples, the workload domain manager 208 obtains the health information from the HMS 108, 114 of FIGS. 1-2. In some examples, the workload domain manager 208 determines one or more health statuses, parameters, etc., based on the health information and evaluates the one or more health statuses, parameters, etc.”), design specifications of the first physical server and the second physical server ([0085] – “the workload domain manager 208 includes the policy analyzer 410 to obtain and process the policy 304 of FIG. 3. In some examples, the policy analyzer 410 maps requirements, specifications, etc., from the data center operator 306, the external client 308, etc., into a quantity and/or a type of the physical resources 124, 126. For example, the policy analyzer 410 may map an availability requirement, a performance requirement, and/or a capacity requirement to the physical resources 124, 126 including storage resources, networking resources, GPU resources, security resources (e.g., firewalls, intrusion detection systems, decryption/encryption equipment, etc.).”; [0086] – “the policy rule may correspond to a firmware version, a hardware version, etc., of a resource. In some examples, the policy rule may correspond to a server configuration including one or more configuration parameters. For example, the configuration parameter may correspond to a quantity of storage resources, computing resources, security resources, etc. In other examples, the configuration parameter may correspond to a hardware version, a software version, etc., associated with the server.”; [0087] – “the health status thresholds are defined by and/or otherwise based on the policy 304”; [0032] – health statuses need to comply with the policy rules), security of the first physical server and the second physical server ([0081] – “The performance health status of the third workload domain 133 may correspond […], the decryption/encryption speeds of security resources”; [0085] – “the workload domain manager 208 includes the policy analyzer 410 to obtain and process the policy 304 of FIG. 3. In some examples, the policy analyzer 410 maps requirements, specifications, etc., from the data center operator 306, the external client 308, etc., into a quantity and/or a type of the physical resources 124, 126. For example, the policy analyzer 410 may map an availability requirement, a performance requirement, and/or a capacity requirement to the physical resources 124, 126 including storage resources, networking resources, GPU resources, security resources (e.g., firewalls, intrusion detection systems, decryption/encryption equipment, etc.).”; [0086] – “the policy rule may correspond to a firmware version, a hardware version, etc., of a resource. In some examples, the policy rule may correspond to a server configuration including one or more configuration parameters. For example, the configuration parameter may correspond to a quantity of storage resources, computing resources, security resources, etc. In other examples, the configuration parameter may correspond to a hardware version, a software version, etc., associated with the server.”; [0087] – “a security health status […] the health status thresholds are defined by and/or otherwise based on the policy 304”; [0032] – health statuses need to comply with the policy rules).
Krishnan is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of monitoring the health of a plurality of physical servers implementing virtual machines and using redundancy to improve availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman and Zhang to incorporate the teachings of Krishnan to improve performance, efficiency, and resource management of various virtual and physical servers executing an application (see Krishnan: [0017], [0027], and [0197]).
The combination of Klingelhoefer in view of Kunsman, Zhang and Krishnan fails to expressly teach the health based on time synchronization of the first physical server and the second physical server.
However, Lehmer teaches the health based on time synchronization of the first physical server and the second physical server ([0074] – “Cyber-Physical Health Characterization is a complex process that should be performed accurately in real-time, reducing the time needed to detect and restore the system to a healthy state. In some embodiments, overall system health monitoring is performed in real-time, in the sense that both cyber and physical components are evaluated together in real-time schemes.”; [0076] – “each anomaly affects the health of the system”; [0079] – “Time-series data from sensors may be converted into time-frequency images for detecting anomalies”; [0101] – “Hardware 206 for the cyber system 212 may include control center servers/aggregators 230 (e.g., SPDC, server racks).”; [0104] – “Cyber-physical systems may also include servers”; [0112] – “time synchronization is one of the primary elements in smart grids that enables accurate monitoring and protection and optimal control.”; [0113] – “The requirement for time synchronization may vary from one microsecond to hundreds of nanoseconds, depending on the device used, customer demands, and application of interest.”; [0114] – “The time synchronization requirements for power grids are often satisfied using GPS- or protocol-based time synchronization. In GPS-based time synchronization, a standard-reference atomic time signal into substations' components is used. Protocol-based time synchronization uses network-based time-distribution protocols such as the Network Time Protocol (NTP).”; [0118] – “Network Time Protocol (NTP) is designed to synchronize clocks of multiple computers over a packet network.”; [0225] – “Anomaly detection may be performed on data received both from physical sensor devices and the cyber communication network of an industrial control environment. Cyber and physical data may be integrated in an anomaly detection system, and detected anomalies may be synchronized temporally. This temporal synchronization enables detection of whether a physical anomaly was caused due to a cyberattack or not”).
Lehmer is considered to be analogous art to the claimed invention because it is in the same field of control systems for power substations. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman, Zhang and Krishnan to incorporate the teachings of Lehmer. Incorporating time synchronization of the servers such that the evaluated health is based on the time synchronization would enable accurate monitoring and protection and optimal control, and would allow for the detection of anomalies, such as those due to cyberattacks (see Lehman: [0112] and [0225]).
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 1 above, and further in view of Scales and Maurice.
Regarding claim 11, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1. Klingelhoefer further teaches wherein […] the first virtual machine is configured […] related to functions of the power substation (Fig. 1, e.g., virtual server 72 of hardware server 60; Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77” ), and wherein an order of backup functionality for the first virtual machine comprises the fourth virtual machine (Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software has a failed virtual server ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ) and / or the failed server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) automatically restarts on an alternate server host. Operator control and monitoring system according to claim 6, characterized in that the virtualization software is intended to detect the line boundaries of the server host and automatically a live migration to another hardware server ( 60 . 61 . 62 ).”) […].
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device, where each execution environment hosts a single functionality (see Kunsman: [0022] and [0028]).
The combination of Klingelhoefer in view of Kunsman and Zhang fails to expressly teach only the first virtual machine is configured to communicate data related to the functions, and the order of backup functionality is based on a backup sequence and priority set by a user.
However, Scales teaches only the first virtual machine is configured to communicate data related to the functions ([0002] – “In this fault-tolerant mode of operation, only the primary VM communicates with the outside world, i.e., providing services as needed to other computer systems or devices connected over a network or system bus.”; [0033] – “When in a fault tolerance (FT) execution mode, i.e., not during fail-over, virtualization software 15-1 passes IO requests from primary VM 20-1 to host system hardware 10-1, allowing VM 20-1 to communicate externally of system 105. In contrast, virtualization software 15-2 blocks external communication sent by VM 20-2 when not in a fail-over mode.”).
Scales is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundant (i.e., standby or backup) virtual machines to improve availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman and Zhang such that only the first virtual machine representing the first functions communicates data associated with the first functions. Preventing the virtual machines which are backups to the first virtual machine from communicating data associated with the functions of the first virtual machine as described in Scales would provide the advantage of preventing race conditions resulting from conflicting I/O operations (see Scales: [0006] and [0053]).
The combination of Klingelhoefer in view of Kunsman and Zhang, and further in view of Scales fails to expressly teach the order of backup functionality is based on a backup sequence and priority set by a user.
However, Maurice teaches the order of backup functionality is based on a backup sequence and priority set by a user (Col. 1, lines 8-16 – “In order to provide more reliable service, computing clusters may include both primary and backup nodes. In the event that a primary node fails, a backup node may begin performing functions previously performed by the failed primary node. In some cases, the backup node may operate in a standby mode, such that it is immediately available to assume the role of the primary. For example, data may be continually replicated from a primary node to a backup while the primary is operating normally.”; Col. 4, lines 20-30 – “The administrative client 101 may provide identifiers establishing a soft priority for selecting computing nodes for promotion during a failover. Promotion, as used herein, refers to selection of a node to perform a computing function previously performed by a node that is failing over. The soft prior may be specified by associating each of the computing nodes 108-116 with an identifier, typically an integer number, which may be used to rank subsets of the computing nodes 108-116 with respect to each other. The rankings of the subsets may then be used, in combination with other factors, to identify a candidate for promotion.”; Col. 7, lines 8-32 – “The administrative client 101 may provide identifiers establishing a soft priority for selecting computing nodes for promotion during a failover. Promotion, as used herein, refers to selection of a node to perform a computing function previously performed by a node that is failing over. The soft prior may be specified by associating each of the computing nodes 108-116 with an identifier, typically an integer number, which may be used to rank subsets of the computing nodes 108-116 with respect to each other. The rankings of the subsets may then be used, in combination with other factors, to identify a candidate for promotion. […] the interface may comprise various combinations of elements that allow a user to define associations between computing nodes and identifiers indicative of promotion order, i.e. promotion tier.”; Col. 10, lines 13-38 – “Computing nodes 710b and 710c are depicted as operating on virtual machine host 712 […] A computing node may refer to various types of computing resources, such as personal computers, servers, clustered computing devices, and so forth. […] Computing nodes also encompass virtualized computing resources, such as virtual machines implemented with or without a hypervisor, virtualized bare-metal environments, and so forth.”; Col. 13, lines 20-23 – “An instance may represent a physical server hardware platform, a virtual machine instance executing on a server, or some combination of the two.”).
Maurice is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundant (i.e., standby or backup) virtual machines to ensure high-availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman, Zhang, and Scales to incorporate the teachings of Maurice such that the order of backup functionality including the other VMs that are backups for the first VM is based on a backup sequence and priority set by a user. Incorporating the methods of Maurice would provide to a user control over the computing nodes (e.g., virtual machines and/or servers) that make up a cluster which performs computing functions and would increase reliability by providing support for failover (see Maurice: Col. 1, lines 5-33 and Col. 3, lines 58-65).
Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman and Zhang as applied to claim 1 above, and further in view of Dehganpour et al. (U.S. Pub. No. 2021/0286689), hereinafter Dehganpour, and Bonomi et al. (U.S. Pub. No. 2018/0115519), hereinafter Bonomi.
Regarding claim 12, the combination of Klingelhoefer in view of Kunsman and Zhang teaches The VPAC system of claim 1. Klingelhoefer further teaches wherein when […] the first physical server [fails], the second physical server is configured to assume operations performed by the first physical server (Page 2 – “Also detects the VMWare Infrastructure 3 when an increase in activity in one virtual machine reaches the line limits of an ESX Server host and automatically causes a live migration to another ESX server. This is a shift of the virtual machines during operation given to other ESX server nodes, so all the necessary requirements met the resource allocation become.”; Page 4 – “that the virtualization software has a failed virtual server ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ) and / or the failed server ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ) automatically restarts on an alternate server host. Operator control and monitoring system according to claim 6, characterized in that the virtualization software is intended to detect the line boundaries of the server host and automatically a live migration to another hardware server ( 60 . 61 . 62 ).”).
The combination of Klingelhoefer in view of Kunsman and Zhang fails to expressly teach wherein when the health of the first physical server exceeds a threshold criteria, the second physical server is configured to assume operations performed by the first physical server and to connect to both an IT network and an OT network until the health of the first physical server is below the threshold criteria.
However, Dehganpour teaches wherein when the health of the first physical server exceeds a threshold criteria, the second physical server is configured to assume operations performed by the first physical server […] until the health of the first physical server is below the threshold criteria ([0012] – “A replica processor 108 may include a back-up or standby processor, application, device, or system that may be used in case of failure or slowdown of primary processor 104. For example, replica processor 108 may be configured to execute all (or a subset) of the applications executing on primary processor 104 when it is activated or the appropriate computing resources, network bandwidth, etc. are allocated to it—in the case of a failure of primary processor 104.”; [0014] – “PHMS 102 may monitor primary processor 104 (which may include multiple different devices operating asynchronously) based on a number of different metrics 110 to determine a state or health of primary processor 104.”; [0016] – “An example metric 110 may indicate that if more than two or more errors are generated per hour (e.g., threshold 112), there is a problem with the system health of primary processor 104, which may trigger a failure event 114.”; [0017]-[0018] – “Another example metric 110 may include monitoring the time it takes for primary processor 104 to process one or more messages 106. In an embodiment, the SLA may indicate that new messages 106 must be processed within two hours of receipt. PHMS 102 may then mark the two hours as a threshold value 112 for a processing message metric 110. PHMS 102 may track or monitor the time between the receipt of a message 106 by using timestamps. […] If the difference between the beginning timestamp and the ending timestamp begins increasing towards the threshold value 112, or exceeds the two-hour threshold 112, then that may signal to PHMS 102 that there is a failure event 114 that has occurred.”; [0020] – “once one or more metrics 110 drop below (or exceed) their respective thresholds 112, such that a healthy system state is no longer detected, PHMS 102 may detect or signal a failure event 114.”; [0025] – “activate replica processor 108, including one or more applications thereon that may be used for processing messages 106 in a similar or identical manner as primary processor 104.”; [0030] – “PHMS 102 may continue monitoring the state or health of primary processor 104 (based metrics 110 and thresholds 112) to determine when a recovery event 124 has occurred. During this post-failure monitoring, PHMS 102 may monitor the same or different metrics 110 to determine when primary processor 104 has return to a healthy state to resume message processing. For example, if a particular metric 110 falling below a threshold 112 signals a failure event 114, then the same metric 110 exceeding the threshold 112 (after the activation or occurrence of a failure event 114), may signal a recovery event 124”; [0034]-[0035] – “Upon detection of recovery event 124, recovery timestamp 116B may be provided to primary processor 104 with activation request 118, indicating primary processor 104 is now enabled to process and provide output to messages 106 beginning at timestamp 116B. PHMS 102 may also automatically provide a deactivation request 122 to replica processor 108.”; [0039] – “replica servers 208 relative to the primary servers 204”).
Dehganpour is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundancy (e.g. backup servers) to ensure availability of workloads. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman and Zhang to incorporate the teachings of Dehganpour. Doing so would maintain system uptime and availability while maximizing or improving resource usage (see Dehganpour: [0010]).
Klingelhoefer in view of Kunsman, Zhang, and Dehganpour fails to expressly teach the second server to connect to both an IT network and an OT network.
However, Bonomi teaches the second server to connect to both an IT network and an OT network ([0027] – “FIG. 1 illustrates an example system architecture 100 that provides security between a plurality of domains, such as an IT domain 102 and an OT domain 104, as well as between the IT domain 102 and the OT domain 104 […] The system architecture 100 can also comprise a forwarder 108, a data bus 109, OT virtual machines 110A-B, IT virtual machines 112A-B, an administrative VM 114, a host operating system and hypervisor layer 116, as well as a hardware layer 118, and a switch layer 120.”; [0051] – “The system architecture 100, and specifically the fognode OS enables a variety of compute and network services in the foglet 122 that provide isolation, protection, and privacy enablement between, for example, different OT networks, OT devices and OT applications on the fognode 124. Isolation and clean separation between the different OT networks (if multiple OT networks/domains are present) and between the IT domain is advantageous.”; [0056] – “The system architecture 100 supports security technology methods and algorithms that enable co-location of the IT/OT devices and other infrastructure components on the fognode 124 that enable operation of the IT and OT software components without interfering with other software components.”; [0080]-[0082] – “The method includes a step 306 of initiating virtual machines for a plurality of domains, as well as a step 308 of isolating the plurality of domains from one another by a step 310 of executing virtual network functions within the virtual machines, and a step 312 of provisioning switches for the virtual machines that provide domain isolation. The virtual machines are assigned compute and storage resources from a host OS and hypervisor layer that assigns compute resources, for example, from a hardware layer. The switches also control communication between the virtual machines in the foglet and the end point devices (e.g., OT/IT devices). These switches assist in isolating domains from one another by forcing devices to communicate only with assigned virtual machines. This type of communication can occur through or around the host OS/hypervisor”; [0085] – “FIG. 4 is a diagrammatic representation of an example machine in the form of a computer system 1, within which a set of instructions for causing the machine to perform any one or more of the methodologies discussed herein may be executed. […] the machine may operate in the capacity of a server”).
Bonomi is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of protecting a control system for a power substation connected to an IT network and an OT network. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman, Zhang, and Dehganpour to incorporate the teachings of Bonomi. Doing so would enable zero touch remote management, single pane of asset management, system condition monitoring, predictive maintenance, and remote software upgrade of devices in the power substation, with the main objective of increasing productivity and decreasing operations costs, while also ensuring isolation and security of OT devices and OT network (see Bonomi: [0013],[0014] and [0019]).
Claims 13, 15-16, 18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman.
Regarding claim 13, Klingelhoefer teaches A virtual protection, automation, and control (VPAC) system for power [infrastructure] (Fig. 1, Page 1 – “The invention relates to an operating and monitoring system of a technical Plant or a technical process, in particular for power plant applications”), the VPAC system comprising:
first virtual machines operating on a first physical server (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 73, 74 on hardware server 60; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the first virtual machines comprising a first virtual machine representing a first physical component of a power [infrastructure] (Fig. 1, e.g., one of the instances of virtual server 72 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”), a second virtual machine representing a backup of the first virtual machine (Fig. 1, one of the instances of virtual server 72 on hardware server 60; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”); and
second virtual machines operating on a second physical server (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 74, 75, 76 on hardware server 61; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the second virtual machines comprising a third virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the first virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”), a fourth virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the second virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”).
Klingelhoefer fails to expressly teach the virtual protection, automation, and control system for power substations comprising virtual machines representing physical components of a power substation.
However, Kunsman teaches a virtual protection, automation, and control system for power substations ([0003] – “Substations in high and medium-voltage power networks can include primary devices such as electrical cables, lines, bus bars, switches, power transformers and instrument transformers, which are generally arranged in switch yards and/or bays. These primary devices are operated in an automated way via a Substation Automation (SA) system. The SA system comprises secondary devices, among which Intelligent Electronic Devices (IED) are responsible for protection, control and monitoring of the primary devices.”) comprising virtual machines representing physical components of a power substation ([0030] – “FIG. 1 illustrates a substation in accordance with the prior art. FIG. 1 shows a portion of a prior art Substation Automation (SA) setup from the perspective of a communication infrastructure with installed functionality. Each of the station-level functionalities is hosted on a separate and dedicated computing device: Supervision workstation, or Station PC, with SCADA functionality and a HMI 1, Engineering PC 2, Gateway device 3, firewall 4, and optional station computer or IED 5 for executing Protection and Control functionality.”; [0031] – “FIG. 2 illustrates an architecture of an SA device with multiple processing units in accordance with an exemplary embodiment. FIG. 2 shows an architecture of an SA device 1 with multiple Processing Units 21, 22, 23 mounted on a single circuit board (motherboard), or even being part of a single multi-core CPU 20 […] The SA Device includes several execution environments or Virtual Machines 11-15, enabled and supported by a virtualization layer 10 on top of the processing hardware. The different execution environments host the functions and applications to be executed, by providing or emulating the full hardware chain of an independent PC. […] The different execution environments run different Operating Systems (OS) which in turn execute the different station-level functionality such as SCADA 11, Engineering 12, Gateway 13, and optionally Control 14 and Protection 15 applications. When reverting to the original OS, the set-up of the functions and applications is substantially unchanged as compared to their conventional implementation on distinct devices.”; [0024] – “Each execution environment, also called Virtual Machine (VM)”. Each VM implemented in the SA device of Fig. 2 represents a distinct physical computing device of the substation automation system implemented in a substation as depicted in Fig. 1.).
Klingelhoefer and Kunsman are considered to be analogous art to the claimed invention because they are in the same field of virtualized control systems for power infrastructure. Thus, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the functionalities in separate execution environments on the same substation automation device (see Kunsman: [0028]).
Regarding claim 15, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 13. Klingelhoefer, in view of Kunsman as applied to claim 13, further teaches wherein the first virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 73, 74 on hardware server 60) further comprise a fifth virtual machine representing a second physical component of the power substation (Fig. 1, e.g., virtual server 71 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”) and a sixth virtual machine representing a backup of the fifth virtual machine (Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), and wherein the second virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 74, 75, 76 on hardware server 61) comprise a seventh virtual machine representing a backup of the fifth virtual machine (Fig. 1, e.g. virtual server 71 on hardware server 61; Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”) and an eighth virtual machine representing a backup of the sixth virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the functionalities in separate execution environments on the same substation automation device (see Kunsman: [0028]).
Regarding claim 16, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 15. Klingelhoefer, in view of Kunsman as applied to claim 15, further teaches wherein the first virtual machine (Fig. 1, e.g., virtual server 72 of hardware server 60) represents first functions of the power substation, and wherein the fifth virtual machine (Fig. 1, e.g., virtual server 71 of hardware server 60) represents second functions of the power substation different than the first functions (Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77”).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device (see Kunsman: [0022] and [0028]).
Regarding claim 18, Klingelhoefer teaches A virtual protection, automation, and control (VPAC) system for power [infrastructure] (Fig. 1, Page 1 – “The invention relates to an operating and monitoring system of a technical Plant or a technical process, in particular for power plant applications”), the VPAC system comprising:
a first physical server comprising first virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 73, 74 on hardware server 60; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the first virtual machines comprising a first virtual machine representing a first physical component of a power [infrastructure] (Fig. 1, e.g., one of the instances of virtual server 72 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”), a second virtual machine representing a backup of the first virtual machine (Fig. 1, one of the instances of virtual server 72 on hardware server 60; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), a third virtual machine representing a second physical component of the power [infrastructure] (Fig. 1, e.g., virtual server 71 of hardware server 60; Page 3 – “The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77 , The respective virtual server 71 . 72 . 73 . 74 . 75 . 76 . 77 is a replica of a corresponding real hardware server with the server functionalities”; Page 1 – “Currently used Operator control and monitoring systems in power plants have a large number from servers to high availability, especially regarding the To ensure redundancy of the plant. Usually each will have multiple Aspect Servers (application servers), connectivity Server for providing the communication capability of devices of different types Production, history server for collection, long-term storage and for archiving process or measurement data, domain controllers, So control units for one specific area within the system, composer server as an engineering tool for the company-wide Management and process control system, configuration server and application server used.” Each virtual server is a replica of (i.e., is “representing”) a corresponding real hardware server (a “physical component”) with the server functionalities, where these hardware servers are found in a power plant, e.g., in “currently used Operator control and monitoring systems in power plants”), and a fourth virtual machine representing a backup of the third virtual machine (Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”); and
a second physical server comprising second virtual machines (Fig. 1, virtual servers (i.e., virtual machines) 71, 72, 74, 75, 76 on hardware server 61; Page 4 – “Operator control and monitoring system according to claim 1, characterized in that the virtualization software on the hardware servers ( 60 . 61 . 62 ) each provide multiple virtual machines, which is capable of the various virtual servers ( 71 . 72 . 73 . 74 . 75 . 76 . 77 ).”), the second virtual machines comprising a fifth virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the first virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”), a sixth virtual machine (Fig. 1, e.g. one of the instances of virtual server 72 on hardware server 61) representing a backup to the second virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”), a seventh virtual machine representing a backup of the third virtual machine (Fig. 1, e.g. virtual server 71 on hardware server 61; Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”), and an eighth virtual machine representing a backup of the fourth virtual machine (Page 2 – “the operating and monitoring system of a technical system or a technical process a variety of server functionalities which in a virtual environment of at least two hardware servers are installed. The number of at least two hardware servers results from the redundancy requirement”; Page 3 – “Corresponding predetermined redundancy requirements are selected server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , such as Aspect Server 71 , Connectivity Server 72 , History Server 75 and domain controllers 74 , each on at least two different hardware servers 60 . 61 . 62 arranged.”; Page 4 – “Operator control and monitoring system according to one of the preceding claims, characterized in that the virtualization software is provided by at least one selectable virtual server (71 . 72 . 73 . 74 . 75 . 76 . 77 ) create a backup copy.”; Page 2 – “Further Benefits of virtualizing with the ESX VMWare Infrastructure software 3 are based on the fact that it is possible with the ESX server a selectable virtual server, for example, before an update, clone and to create such a backup, which reuses as needed can be.”).
Klingelhoefer fails to expressly teach the virtual protection, automation, and control system for power substations comprising virtual machines representing different physical components of a power substation.
However, Kunsman teaches a virtual protection, automation, and control system for power substations ([0003] – “Substations in high and medium-voltage power networks can include primary devices such as electrical cables, lines, bus bars, switches, power transformers and instrument transformers, which are generally arranged in switch yards and/or bays. These primary devices are operated in an automated way via a Substation Automation (SA) system. The SA system comprises secondary devices, among which Intelligent Electronic Devices (IED) are responsible for protection, control and monitoring of the primary devices.”) comprising virtual machines representing different physical components of a power substation ([0030] – “FIG. 1 illustrates a substation in accordance with the prior art. FIG. 1 shows a portion of a prior art Substation Automation (SA) setup from the perspective of a communication infrastructure with installed functionality. Each of the station-level functionalities is hosted on a separate and dedicated computing device: Supervision workstation, or Station PC, with SCADA functionality and a HMI 1, Engineering PC 2, Gateway device 3, firewall 4, and optional station computer or IED 5 for executing Protection and Control functionality.”; [0031] – “FIG. 2 illustrates an architecture of an SA device with multiple processing units in accordance with an exemplary embodiment. FIG. 2 shows an architecture of an SA device 1 with multiple Processing Units 21, 22, 23 mounted on a single circuit board (motherboard), or even being part of a single multi-core CPU 20 […] The SA Device includes several execution environments or Virtual Machines 11-15, enabled and supported by a virtualization layer 10 on top of the processing hardware. The different execution environments host the functions and applications to be executed, by providing or emulating the full hardware chain of an independent PC. […] The different execution environments run different Operating Systems (OS) which in turn execute the different station-level functionality such as SCADA 11, Engineering 12, Gateway 13, and optionally Control 14 and Protection 15 applications. When reverting to the original OS, the set-up of the functions and applications is substantially unchanged as compared to their conventional implementation on distinct devices.”; [0024] – “Each execution environment, also called Virtual Machine (VM)”. Each VM implemented in the SA device of Fig. 2 represents a distinct physical computing device of the substation automation system implemented in a substation as depicted in Fig. 1.).
Klingelhoefer and Kunsman are considered to be analogous art to the claimed invention because they are in the same field of virtualized control systems for power infrastructure. Thus, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the functionalities in separate execution environments on the same substation automation device (see Kunsman: [0028]).
Regarding claim 20, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 18. Klingelhoefer, in view of Kunsman as applied to claim 18, further teaches wherein the first virtual machine (Fig. 1, e.g., virtual server 72 of hardware server 60) represents first functions of the power substation, and wherein the third virtual machine (Fig. 1, e.g., virtual server 71 of hardware server 60) represents second functions of the power substation different than the first functions (Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77”).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device (see Kunsman: [0022] and [0028]).
Claim 17 is rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman as applied to claim 16 above, and further in view of Scales.
Regarding claim 17, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 16, Klingelhoefer further teaches wherein […] the first virtual machine of the first virtual machines […] associated with the first functions (Fig. 1, e.g., virtual server 72 of hardware server 60; Page 3 – “The hardware servers 60 . 61 . 62 each have different virtual server functionalities 71 . 72 . 73 . 74 . 75 . 76 . 77 , also referred to as virtual servers, on. The virtual servers 71 . 72 . 73 . 74 . 75 . 76 . 77 are for example Aspect Server 71 , Connectivity Server 72 , History Server 75 , Domain controller 74 , Composer Server 76 , Configuration Server 73 and / or application server 77” ).
For clarity of the record, it would have been obvious to one of ordinary skill in the art that configuration of multiple servers implementing multiple virtual machines corresponding to different functionalities of the operation and control system for a power plant taught by Klingelhoefer would provide the same disclosed benefits when applied to a system for operation and controlling a power substation as taught by Kunsman. Specifically, applying the configuration of multiple servers comprising multiple virtual machines and backups of the virtual machines of the operation and control system taught by Klingelhoefer to the substation automation system used to control and monitor the substation taught by Kunsman would provide the benefit of ensuring redundancy and availability of the functions of the operation and control system while also reducing the amount of hardware needed (see Klingelhoefer: Pages 1-2). Further, Kunsman suggests implementing redundant hardware, e.g., by duplicating the entire substation automation device, and/or redundant software, e.g., by implementing multiple instances of the multiple different substation automation system functionalities in separate execution environments on the same substation automation device, where each execution environment hosts a single functionality (see Kunsman: [0022] and [0028]).
The combination of Klingelhoefer in view of Kunsman fails to expressly teach only the first virtual machine communicates data associated with the first functions.
However, Scales teaches only the first virtual machine communicates data associated with the first functions ([0002] – “In this fault-tolerant mode of operation, only the primary VM communicates with the outside world, i.e., providing services as needed to other computer systems or devices connected over a network or system bus.”; [0033] – “When in a fault tolerance (FT) execution mode, i.e., not during fail-over, virtualization software 15-1 passes IO requests from primary VM 20-1 to host system hardware 10-1, allowing VM 20-1 to communicate externally of system 105. In contrast, virtualization software 15-2 blocks external communication sent by VM 20-2 when not in a fail-over mode.”).
Scales is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of using redundant (i.e., standby or backup) virtual machines to improve availability. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the teachings of Klingelhoefer in view of Kunsman such that only the first virtual machine representing the first functions communicates data associated with the first functions. Preventing the virtual machines which are backups to the first virtual machine from communicating data associated with the functions of the first virtual machine as described in Scales would provide the advantage of preventing race conditions resulting from conflicting I/O operations (see Scales: [0006] and [0053]).
Claims 14 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Klingelhoefer in view of Kunsman as applied to claims 13 and 18 above, and further in view of Chang.
In the following rejections, references will be made to page numbers of Chang corresponding to the English translation provided in the present Office Action (see Non-Patent Literature document V cited on the attached PTO-892).
Regarding claim 14, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 13. Kunsman further teaches the one of the physical servers connects to an operational technology (OT) network and controls operations of the physical components of the power substation ([0026] – “measurements and control commands are available to the SA device via the station/process bus. Substation configuration information can in this case advantageously be shared between the different protection and control applications; [0027] – “the SA device can adapted to be used in SA systems with separate communication networks for process and station bus applications. This can be realized given the fact that SCADA, Engineering and the gateway applications are directly allocated to the corresponding Station Bus Network Interface Card (NIC), whereas the protection and control functions additionally utilize the process bus NIC in order to receive and send messages from and to the process bus.”; [0032] – “FIG. 3 illustrates a portion of a substation with an SA device […] The station bus network interface 31 connects via switches 40 to a redundant station bus 41, 41' for exchanging actuator commands, alarms and events with IEDs 5, 5' of the substation. As the SA device itself also hosts (backup) protection functionality 15, can be equipped with a process bus interface 32 which connects via switches to a redundant process bus 42, 42'. Sensors 52 such as CTNT sensors are located in respective bays and provide their measurements or other operational data, e.g. via IED 5' or Merging Unit 53, to the process bus 42, 42'. Other combinations of sensors connected to IED devices and/or the process bus, as well as other redundancy schemes for protection and control can be possible.”).
It would have been obvious to one of ordinary skill in the art to have modified the physical servers implementing virtual machines representing physical components of the power substation as taught by Klingelhoefer in view of Kunsman such that at least one of the servers connects to an operational technology network to control physical components of the substation as taught by Kunsman. Using virtual machines on the server which represent and communicate with physical bay control units (IEDs) via a process bus network would provide backup functionality for the physical bay IED devices which protect and control the primary devices of the power substation (see Kunsman: [0003], [0009], [0011], and [0026]).
The combination of Klingelhoefer in view of Kunsman fails to expressly teach wherein one of the first physical server or the second physical server connects to an information technology (IT) network without direct connection to physical components of the power substation while the other of the first physical server or the second physical server connects to the operational technology (OT) network, wherein the one of the first physical server or the second physical server connected to the IT network communicates, using secure private network-based inter-server communications, with the other of the first physical server or the second physical server connected to the OT network, and wherein when the one of the first physical server or the second physical server connected to the IT network is deactivated, the other of the first physical server or the second physical server connected to the OT network accesses the IT network and the OT network.
However, Chang teaches wherein one of the first physical server or the second physical server connects to an information technology (IT) network without direct connection to physical components of the power substation while the other of the first physical server or the second physical server connects to the operational technology (OT) network (Pages 3-4 – “the first server and the second domain end are physically isolated through the two-way transmission device […] the operation technology (OT) server is used as the first server, and the information technology (IT) server is used as the second server […] The OT server 110 is permanently connected to the OT network domain, and the IT server 120 is controlled by the OT server 110 to connect to the IT network domain. […] The bidirectional transmission device 130 is coupled to the OT server 110, and is configured to conduct or disconnect the connection between the OT server 110 and the IT server 120, and conduct or disconnect the IT server according to the instructions of the OT server 110 The connection between 120 and the IT network domain. For example, upon receiving the first command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the IT server 120 and the IT network domain, and opens the connection between the OT server 110 and the IT server 120. At this time, the IT server 120 is physically separated from the IT network domain. When receiving the second command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the OT server 110 and the IT server 120, and opens the connection between the IT server 120 and the IT network domain. At this time, the OT server 110 and the IT server 120 are physically separated.” When the IT server is connected to the IT network domain, it is physically disconnect/separated from the OT server by the bidirectional transmission device. As previously shown with respect to Kunsman, the physical servers implementing virtual machines communicate with the physical components of the power substation via an operational technology network, e.g. a process bus. Further, page 1 of Chang teaches the machines and equipment being controlled by an industrial control system, e.g., the claimed VPAC system for power substations taught by Klingelhoefer in view of Kunsman, are communicated with/controlled over an OT network. Thus, physically separating the IT server from the OT server when it is connected to the IT network domain is teaching the IT server “connects with to an information technology (IT) network without direct connection to physical components of the power substation”.), wherein the one of the first physical server or the second physical server connected to the IT network communicates, using secure private network-based inter-server communications, with the other of the first physical server or the second physical server connected to the OT network (Page 5 – “The OT server 110 is configured to use general-purpose input/output (GPIO) commands to control the network switching device 250. For example, the OT server 110 can be configured to execute the data transmission schedule every 5 minutes after the processor of the OT server 110 encrypts the files to be transmitted in the temporary storage area of the memory to obtain encrypted files, and then send The first command (GPIO command) is sent to the network switching device 250 to enable the network switching device 250. After receiving the first command, the network switching device 250 controls the second hub device 220 to disconnect the connection between the IT server 120 and the IT network port 240, and controls the first hub device 210 to turn on the OT server 110 The connection with the IT server 120. That is, when the OT server 110 transmits data to the IT server 120, it maintains a disconnected physical isolation state from the IT network port 240 to the OT network port 230. […] After the network switching device 250 is enabled, when the connection between the IT server 120 and the IT network domain is disconnected, and the connection between the OT server 110 and the IT server 120 is opened, SFTP is used to encrypt The file is transferred to the IT server 120. […] after receiving the encrypted file, the IT server 120 stores the encrypted file in the memory of the IT server 120 for the client device in the IT network domain to retrieve it through the SFTP protocol.”) and wherein when the one of the first physical server or the second physical server connected to the IT network (IT server 120) is deactivated (Page 5 – “when the connection between the IT server 120 and the IT network domain is disconnected), the other of the first physical server or the second physical server connected to the OT network (OT server 110) accesses the IT network (Page 3 – “the OT server 110 operates in a client mode of the Secure File Transfer Protocol (SFTP). The IT server 120 operates in the SFTP server mode.”; Page 5 – “The OT server 110 is configured to use general-purpose input/output (GPIO) commands to control the network switching device 250. For example, the OT server 110 can be configured to execute the data transmission schedule every 5 minutes after the processor of the OT server 110 encrypts the files to be transmitted in the temporary storage area of the memory to obtain encrypted files, and then send The first command (GPIO command) is sent to the network switching device 250 to enable the network switching device 250. […] After receiving the first command, the network switching device 250 controls the second hub device 220 to disconnect the connection between the IT server 120 and the IT network port 240, and controls the first hub device 210 to turn on the OT server 110 The connection with the IT server 120. […] After the network switching device 250 is enabled, when the connection between the IT server 120 and the IT network domain is disconnected, and the connection between the OT server 110 and the IT server 120 is opened, SFTP is used to encrypt The file is transferred to the IT server 120 […] after receiving the encrypted file, the IT server 120 stores the encrypted file in the memory of the IT server 120 for the client device in the IT network domain to retrieve it through the SFTP protocol.” The OT server “accesses the IT network” by sending the encrypted file to the IT server where it is made available in the IT network domain.) and the OT network (Page 3 – “The OT server 110 is permanently connected to the OT network domain”).
Chang is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of protecting a power substation connected to an IT and an OT network. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the first and second physical servers of the virtual protection automation and control system of the power substation taught by the combination of Klingelhoefer in view of Kunsman to incorporate the teachings of Chang. Doing so would protect the control system of the power substation from risks while enabling safe two-way communication between and OT system and an IT system (see Chang: Pages 1-2).
Regarding claim 19, the combination of Klingelhoefer in view of Kunsman teaches The VPAC system of claim 18, but fails to teach wherein one of the first physical server or the second physical server connects to an information technology (IT) network while the other of the first physical server or the second physical server connects to an operational technology (OT) network to isolate OT network traffic from IT network traffic.
However Chang teaches wherein one of the first physical server or the second physical server connects to an information technology (IT) network while the other of the first physical server or the second physical server connects to an operational technology (OT) network to isolate OT network traffic from IT network traffic (Pages 3-4 – “the first server and the second domain end are physically isolated through the two-way transmission device […] the operation technology (OT) server is used as the first server, and the information technology (IT) server is used as the second server […] The OT server 110 is permanently connected to the OT network domain, and the IT server 120 is controlled by the OT server 110 to connect to the IT network domain. […] The bidirectional transmission device 130 is coupled to the OT server 110, and is configured to conduct or disconnect the connection between the OT server 110 and the IT server 120, and conduct or disconnect the IT server according to the instructions of the OT server 110 The connection between 120 and the IT network domain. For example, upon receiving the first command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the IT server 120 and the IT network domain, and opens the connection between the OT server 110 and the IT server 120. At this time, the IT server 120 is physically separated from the IT network domain. When receiving the second command from the OT server 110, the bidirectional transmission device 130 disconnects the connection between the OT server 110 and the IT server 120, and opens the connection between the IT server 120 and the IT network domain. At this time, the OT server 110 and the IT server 120 are physically separated.”).
Chang is considered to be analogous art to the claimed invention because it is reasonably pertinent to the problem faced by the inventor of protecting a power substation connected to an IT and an OT network. Therefore, it would have been obvious to one of ordinary skill in the art to have modified the first and second physical servers of the virtual protection automation and control system of the power substation taught by the combination of Klingelhoefer in view of Kunsman to incorporate the teachings of Chang. Doing so would protect the control system of the power substation from risks while enabling safe two-way communication with an IT system (see Chang: Pages 1-2).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Dayabhai et al. (NPL Document: “A Substation Automation Solution That Uses Virtualization to Reduce Cost While Ensuring Redundancy and Security Compliance”) teaches using a plurality of servers as virtualization platforms, to provide redundancy for applications, in a substation, and discusses traffic partitioning to facilitate data transfer and comply with cybersecurity requirements, such as separation between IT and OT traffic (see entire document).
Kabbara et al. (NPL Document: “Towards Software-Defined Protection, Automation, and Control in Power Systems: Concepts, State of the Art, and Future Challenges”) teaches Protection, Automation, and Control systems supporting power systems which comprise a set of functionalities, where PAC systems are currently deployed across IEDs in substations, power plants, and DERs. It further suggests there may be redundancy, backup, and high-availability benefits from leveraging virtualization to implement these systems (see entire document).
Keller et al. (U.S. Pub. No. 2014/0371941) teaches the electrical grid comprising energy infrastructure including power plants and substations (see [0002] and [0004]-[0005]). It further teaches using virtual machines to implement IEDs configurable for one or more functions, e.g. for protection, monitoring, and control in a substation, and using redundant IEDs in case of a failure (see [0018], [0030], and [0034]).
Fakhar et al. (U.S. Patent No. 12,142,916) teaches an energy management system to monitor, control, and optimize energy usage in power plants and utility grids, in which servers are used as controllers to enable the virtualization of monitoring and control functions needed to operate power infrastructure (see Col. 1, lines 34-37, Col. 2, line 54-Col. 3, line 3). It further teaches implementing EMS software in virtual machines on a server cluster, using one or more backup servers which continuously mirror the functionality of the primary EMS system and which can be used to assume a workload when one server fails (see Col. 4, line 14-Col. 5, line 40). Further, it teaches implementing digital twins of power plant systems and equipment which can be used for simulation, integration, testing, monitoring and maintenance (see Col. 10, lines 5-63). Lastly, it teaches backup instances of EMS software may be launched in hot-standby, where the hot-standby software monitors the health of the primary system (see Col. 12, lines 29-45).
Mirth et al. (U.S. Pub. No. 2024/0028009) teaches using digital twins of components, e.g., an OT asset, in monitoring an industrial automation system and teaches detecting suspicious network traffic (see [0036] and [0041]).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JENNIFER MARIE GUTMAN whose telephone number is (703)756-1572. The examiner can normally be reached M-F: 9:00 am - 5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kevin Young can be reached at 571-270-3180. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JENNIFER MARIE GUTMAN/Examiner, Art Unit 2194 /KEVIN L YOUNG/Supervisory Patent Examiner, Art Unit 2194
Prosecution Insights