CTNF 18/647,977 CTNF 84545 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Claims 1-20 are presented for examination. Priority The claim for priority from US Provisional 63/571,275 filed on 28 March 2024 is duly noted. Claim Rejections - 35 USC § 101 07-04-01 AIA 07-04 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) determine a change in a first operating condition of an asset, identify a first damage scenario, and assess a result of the first damage scenario. The limitation of determine a change in a first operating condition of an asset, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “a processor,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “a processor” language, “determine” in the context of this claim encompasses the user manually determining whether a change has occurred. Similarly, the limitation of identify a first damage scenario, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “a processor,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “a processor” language, “identify” in the context of this claim encompasses the user manually identifying a first scenario. Further, the limitation of assess a result of the first damage scenario, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “a processor,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “a processor” language, “assess” in the context of this claim encompasses the user manually assessing a result. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea. This judicial exception is not integrated into a practical application. In particular, the claim only recites using a processor coupled to a non-transitory storage memory to perform the determining, identifying, and assessing steps. The processor in both steps is recited at a high-level of generality (i.e. as a generic processor performing a generic computer function of assessing a result) such that it amounts to no more than mere instructions to apply the exception using a generic computer component. Accordingly this additional element does not integrate the abstract idea into a practical application because it does not impose meaningful limits on practicing the abstract idea. The claims are directed to an abstract idea. The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of using a processor to perform the storing steps amounts to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible. Claims 12 and 17 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) identifying an operational condition, determining whether the operational condition of the asset deleteriously impacts operation of the item, and indicating that the asset is susceptible to the cyber-attack. The limitation of identifying an operational condition, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “by a device comprising a processor,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “a processor” language, “identifying” in the context of this claim encompasses the user manually identifying an operational condition of an asset. Similarly, the limitation of determining whether the operational condition of the asset deleteriously impacts operation of the item, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “by the device,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “by the device” language, “determining” in the context of this claim encompasses the user manually determining whether the operational condition deleteriously impacts operation. Further, the limitation of indicating that the asset is susceptible to the cyber-attack, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “by the device,” nothing in the claim element precludes the step from practically being performed in the mind. For example, but for the “by the device” language, “indicating” in the context of this claim encompasses the user manually indicating the asset is susceptible. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea. This judicial exception is not integrated into a practical application. In particular, the claim only recites using a processor coupled to a non-transitory storage memory to perform the identifying, determining, and indicating steps. The processor in both steps is recited at a high-level of generality (i.e. as a generic processor performing a generic computer function of indicating) such that it amounts to no more than mere instructions to apply the exception using a generic computer component. Accordingly this additional element does not integrate the abstract idea into a practical application because it does not impose meaningful limits on practicing the abstract idea. The claims are directed to an abstract idea. The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible. Claims 2-11, 13-16, and 18-20 are rejected as being dependent on rejected base claims. Claim Rejections - 35 USC § 102 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-07-aia AIA 07-07 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – 07-08-aia AIA (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. 07-15-aia AIA Claim(s) 1, 3-5, 12-15, and 17-20 is/are rejected under 35 U.S.C. 102 (a)(1) as being anticipated by Agerstam et al. (US 2019/0138423 A1 and Agerstam hereinafter) . As to claim 1, Agerstam discloses a system and method for detecting anomalies of a monitored system, the system and method having: a memory that stores computer executable components (0132, lines 1-6) ; a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise (0126, lines 1-5) : a threat analysis and risk assessment (TARA) tool configured to: determine a change in a first operating condition of an asset, wherein the asset represents an operational condition of an item, the change in operating condition results from a cyber-attack on the asset, and the change in operating condition generates a second operating condition of the asset (0028, lines 8-16) ; identify a first damage scenario (anomaly) pertaining to the second operating condition of the asset (0028, lines 8-16 0029, lines 1-5) ; assess a result of the first damage scenario on operational condition of the item based on the second operating condition of the asset (0029, lines 5-9) . As to claim 3, Agerstam discloses: wherein the item is located on a vehicle (0016, lines 8-13) . As to claim 4, Agerstam discloses: wherein the vehicle is a software-defined vehicle (0016, lines 8-13) . As to claim 5, Agerstam discloses: wherein the item is one of a software application, an electronic control unit (ECU), or a network device (0016, lines 8-13; 0020) . As to claims 12 and 17, Agerstam discloses: identifying, by a device comprising a processor, an operational condition of an asset resulting from a cyber-attack implemented on the asset, wherein the asset represents a functionality of an item (0028, lines 8-16; 0029, lines 1-5) ; determining, by the device, whether the operational condition of the asset deleteriously impacts operation of the item (0028, lines 8-16; 0029, lines 1-5) ; in response to a determination that the operation of the item is deleteriously impacted by the cyber-attack, indicating, by the device, that the asset is susceptible to the cyber-attack (0029, lines 5-9) . As to claims 13 and 18, Agerstam discloses: wherein the item is included in a computer system implemented on a software-defined vehicle (0016, lines 8-13) . As to claim 14, Agerstam discloses: wherein the item is one of a function type item, a hardware type item, or a network type item, wherein a function type item indicates the item is a software application, the hardware type item indicates the item is an electronic control unit (ECU), and the network type item indicates the item is one of a network device or network infrastructure (0016, lines 8-13; 0020) . As to claim 15, Agerstam discloses: wherein the asset is a function type asset configured to be implemented on the hardware type item (0016, lines 8-13) . As to claim 19, Agerstam discloses: determining a configuration of the asset, wherein the configuration is resistant to the cyber-attack (0029, lines 1-6; 0024, lines 10-12) ; modifying the asset in accordance with the determined configuration (0024, lines 13-15) ; implementing the modified asset on the item to mitigate an impact of the cyber-attack (0024, lines 13-15) . As to claim 20, Agerstam discloses: wherein modification of the asset comprises recoding a software application, reconfiguring an electronic control unit, or reconfiguring a network architecture (0024, lines 10-15) . Claim Rejections - 35 USC § 103 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-20-02-aia AIA This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention. 07-22-aia AIA Claim (s) 2, 6-11, and 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Agerstam as applied to claim s 1, 12, and 17 above, and further in view of Sorani et al. (US 2022/0394053 A2 and Sorani hereinafter) . As to claim 2, Agerstam fails to specifically disclose: wherein the change in operating condition of the asset from a first operating condition to a second operating condition represents a change in operating condition of the asset in response to a simulation of the cyber-attack on the asset. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses a system and method for assessing risk in networked vehicle components, the system and method having: wherein the change in operating condition of the asset from a first operating condition to a second operating condition represents a change in operating condition of the asset in response to a simulation of the cyber-attack on the asset (0071, lines 28-42) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by simulating a cyberattack. Sorani recites motivation by disclosing that using a simulation of a cyber attack to detect an operating condition change allows for the prediction of an impact and recommendation for improving safety (0071, lines 28-42). It is obvious that the teachings of Sorani would have improved the teachings of Agerstam by simulating a cyberattack in order to predict impact and recommendation for improving safety. As to claim 6, Agerstam fails to specifically disclose: wherein the asset is a software function implemented on the ECU . Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: wherein the asset is a software function implemented on the ECU (0044). Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by using an asset with an ECU. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 7, Agerstam fails to specifically disclose: wherein the TARA tool is further configured to: determine a first damage impact level for the first damage scenario, wherein the first damage impact level indicates a first magnitude of damage resulting from the second operating condition of the asset implemented on the item. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: determine a first damage impact level (i.e. first risk level value) for the first damage scenario, wherein the first damage impact level indicates a first magnitude of damage resulting from the second operating condition of the asset implemented on the item (0043, lines 16-18) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by determining a first damage impact level. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 8, Agerstam fails to specifically disclose: determine whether a magnitude of the first damage impact level is acceptable; and in response to a determination that the magnitude of the first damage impact level is unacceptable, implement a third operating condition at the asset. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: determine whether a magnitude of the first damage impact level is acceptable (0071, lines 10-28) ; in response to a determination that the magnitude of the first damage impact level is unacceptable, implement a third operating condition at the asset (0071, lines 28-35) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by implementing a third operation condition. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 9, Agerstam fails to specifically disclose: determine a second magnitude of a second damage impact level resulting from the third operating condition; in response to a determination that second damage impact level is acceptable, implementing the third operating condition on the item to mitigate an effect of the cyber-attack. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: determine a second magnitude of a second damage impact level resulting from the third operating condition (0071, lines 35-36) ; in response to a determination that second damage impact level is acceptable, implementing the third operating condition on the item to mitigate an effect of the cyber-attack (0071, lines 35-42) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by implementing a third operation condition. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 10, Agerstam fails to specifically disclose: wherein the system is a centralized system, and is further configured to receive information from at least one of a product design database, an entity, a development team, or an organizational metamodel, and the information relates to the asset implemented a design of a computer system located on a vehicle. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: wherein the system is a centralized system, and is further configured to receive information from at least one of a product design database, an entity, a development team, or an organizational metamodel, and the information relates to the asset implemented a design of a computer system located on a vehicle (0058, lines 5-18) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by receiving information from a database. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 11, Agerstam fails to specifically disclose: a damage injured party attribute identifying an entity affected by the first damage scenario; a damage category attribute identifying a negative effect of the first damage scenario; or a damage condition attribute identifying a state when the first damage scenario occurred. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: a damage injured party attribute identifying an entity affected by the first damage scenario (0071, lines 1-50) ; a damage category attribute identifying a negative effect of the first damage scenario; or a damage condition attribute identifying a state when the first damage scenario occurred. Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by identifying an affected entity. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. As to claim 16, Agerstam fails to specifically disclose: wherein the device is located at a centralized system, and at least one of the asset or the item are retrieved from a product design database communicatively coupled to the centralized system. Nonetheless, this feature is well known in the art and would have been an obvious modification of the teachings disclosed by Agerstam, as taught by Sorani. Sorani discloses: wherein the device is located at a centralized system, and at least one of the asset or the item are retrieved from a product design database communicatively coupled to the centralized system (0058, lines 5-18) . Given the teaching of Sorani, a person having ordinary skill in the art before the effective filing date of the claimed invention would have readily recognized the desirability and advantages of modifying the teachings of Agerstam with the teachings of Sorani by retrieving the item from a database. Please refer to the motivation recited above with respect to claim 2 as to why it is obvious to apply the teachings of Sorani to the teachings of Agerstam. Prior Art Made of Record 07-96 AIA The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Almurayh (US 2016/0205123 A1) discloses a system and method for detecting home anomalies. Crabtree et al. (WO 2021/216163 A2) discloses a system and method for AI-driven defensive cybersecurity strategy analysis and recommendation. Dawson et al. (WO 2008/036569 A1) discloses a system and method for centralized security management. Hamdi (US 2018/0124095 A1) discloses a system and method for multi-tier cache visual. Hirano et al. (WO 2021/144859 A1) discloses a system and method for intrusion path analysis. Hu et al. (CN 120200791 A) discloses a system and method for intelligent attack system based on AI. Huang et al. (CN 119449496 A) discloses a system and method for safe state intelligent monitoring of sensitive information based on AI. Judge (US 2003/0172292 A1) discloses a system and method for message threat management. Li et al. (CN 115242502 A) discloses a system and method for power system network security risk evaluation. Li et al. (CN 119484065 A) discloses a system and method for network security situation sensing based on deep neural network. Marett et al. (US 2023/0421588 A1) discloses a system and method for data inspection. McFarlane et al. (US 2007/0067846 A1) discloses a system and method for associating security vulnerabilities and assets. Mitani et al. (US 2025/0119443 A1) discloses a system and method for anomaly cause estimation. Sand et al. (US 2024/0187439 A1) discloses a system and method for proactively monitoring the inherent cyber-tech risk of software and hardware components. Sethi et al. (US 2025/0023918 A1) discloses a system and method for smart recommendation and dynamic grouping of devices for better device management. Viswambharan et al. (WO 2020/227266 A1) discloses a system and method for protecting a service mesh from external attacks on exposed software vulnerabilities. Waplington et al. (US Patent 11,349,877 B2) discloses a system and method for solution management for addressing cybersecurity vulnerabilities. Wei et al. (CN 119484163 A) discloses a system and method for attack path intelligent recommendation based on improved MulVAL. Xia et al. (CN 116886399 A) discloses a system and method for AI intelligent DDoS attack protection processing platform of network security . Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to SARAH SU whose telephone number is (571)270-3835. The examiner can normally be reached 6:30 AM - 3:00 PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /SARAH SU/Primary Examiner, Art Unit 2431 Application/Control Number: 18/647,977 Page 2 Art Unit: 2431 Application/Control Number: 18/647,977 Page 3 Art Unit: 2431 Application/Control Number: 18/647,977 Page 4 Art Unit: 2431 Application/Control Number: 18/647,977 Page 5 Art Unit: 2431 Application/Control Number: 18/647,977 Page 6 Art Unit: 2431 Application/Control Number: 18/647,977 Page 7 Art Unit: 2431 Application/Control Number: 18/647,977 Page 8 Art Unit: 2431 Application/Control Number: 18/647,977 Page 9 Art Unit: 2431 Application/Control Number: 18/647,977 Page 10 Art Unit: 2431 Application/Control Number: 18/647,977 Page 11 Art Unit: 2431 Application/Control Number: 18/647,977 Page 12 Art Unit: 2431 Application/Control Number: 18/647,977 Page 13 Art Unit: 2431 Application/Control Number: 18/647,977 Page 14 Art Unit: 2431 Application/Control Number: 18/647,977 Page 15 Art Unit: 2431 Application/Control Number: 18/647,977 Page 16 Art Unit: 2431 Application/Control Number: 18/647,977 Page 17 Art Unit: 2431
Prosecution Insights