DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined
under the first inventor to file provisions of the AIA .
Under 35 USC § 101
Claims 1, 9, and 18 are directed to patent-eligible subject matter under 35
U.S.C. § 101.
The claims are directed to technological systems and methods for detecting anomalous processor behavior based on physical electromagnetic emanations produced by a processor. In particular, the claims require probing electromagnetic emanations from the processor using an electromagnetic probe, generating or amplifying a signal resulting from the probing, sampling the electromagnetic signal using sampling circuitry, and determining processor behavior based on the resulting samples. Claims 1 and 9 further require obtaining the samples at a sampling rate greater than a clock frequency of the processor. These operations cannot practically be performed in the human mind and therefore do not merely recite a mental process. Moreover, even assuming that the determination of whether the processor exhibits a behavior anomaly could be characterized as an abstract evaluation, the claims integrate such evaluation into practical technological application by requiring physical acquisition and processing of electromagnetic emanations from an operating processor using the recited electromagnetic probe, sampling circuitry, and in claims 1 and 9, a sampling rate having a specified relationship to the processor clock frequency. Accordingly, considered as a whole, claims 1, 9 and 18 are directed to a judicial and therefore, claims 1-20 are eligible under 35 U.S.C. § 101.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 5, 9, and 13 are rejected under 35 U.S.C. 103 as being unpatentable
over Keller et at el. (Pub. No. US 2016/0098561) (hereinafter Keller) in view of Prvulovic et al. (Pub. No. US 2016/0127124) (hereinafter Prvulovic).
As per claims 1 and 9, Keller teaches a system for detecting anomalous or malicious behavior of an electronic device based upon unintended electromagnetic emissions generated during operation of the device (see ¶¶ [0135] and [0141]). Keller teaches an antenna/probe configured to receive unintended electromagnetic emissions from an electrically excited electronic device and explicitly teaches that antenna 34 may operate as a near-field probe positioned sufficiently close to the surface of a chip or die to be within the near-field of the frequencies being examined (see ¶ [0171]). Keller further teaches an electromagnetic sensor 820 including a low-noise amplifier (LNA) 834, RF tuner 836, and analog-to-digital converter (ADC) 838, and teaches time-domain and frequency-domain processing modules including one or more processors or programmable logic devices such as an FPGA (see ¶¶ [0137]-[0139]). Keller additionally teaches that the RF receiver employs a sensitive LNA to amplify the emission signal and that the received RF emissions are digitized by ADC 838 see ¶¶ [0225]-[0226]).
Keller further teaches processing the captured unintended electromagnetic energy by measuring a feature value in a spectral-frequency region, calculating a difference between the measured feature value and a baseline feature value, and determining, based upon the calculated difference, whether malicious, anomalous, or modified software, firmware, or circuitry is present in the monitored electrical device (see ¶ [0141]). Keller further teaches that the baseline feature value may be obtained from captured unintended emissions generated by a baseline electrical device (see ¶ [0253]). Thus, Keller teaches the claimed electromagnetic probe, amplifier, sampling/digitizing circuitry, and control circuitry configured to determine anomalous behavior from the processor/device electromagnetic emanations.
Keller, however, fails to explicitly teach obtaining the samples at a sampling rate greater than a clock frequency of the processor.
Prvulovic, however, teaches measuring physical side-channel signals generated by processor instruction execution, including electromagnetic emanations, and explains that individual instruction events may produce signals lasting only a fraction of a nanosecond. Prvulovic teaches that accurate assessment of such signals requires collecting many samples, including at least ten samples and preferably more, during the short instruction event, thereby requiring an extremely high real-time sampling rate (see ¶ [0066]). Prvulovic further teaches real-time oscilloscope or A/D converters capable of digitizing signals at approximately 50 Gsamples/s and discusses even higher rates, such as approximately 100 Gsamples/s (see ¶ [0066]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to employ Prvulovic’s high-rate sampling technique when digitalizing the electromagnetic emanation signal acquired by Keller because Prvulovic teaches that instruction level signals may persist for only a fraction of a nanosecond and that accurate assessment of differences between such signals requires obtaining many samples during that short interval, thereby providing Keller’s processing circuitry with sufficiently sampled electromagnetic signal data for more accurately assessing differences in processor generated electromagnetic emanations.
As per claim 2, the combination of Keller and Prvulovic teaches the system as stated above. Keller explicitly teaches sensor 820 including analog-to-digital converter 838 for digitizing the received electromagnetic signal and processing modules containing processors or programmable logic devices for processing the digitized signal (see ¶¶ [0137]-[0139] and [0167]) and that the received RF emissions are digitized by ADC 838 (see ¶ [0226]). Prvulovic likewise teaches A/D converters for sampling processor side-channel signals at extremely high sampling rate (see ¶ [0066]). It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to employ Keller’s ADC as the claimed sampling circuitry because an ADC converts the acquired analog electromagnetic signal into digital samples suitable for subsequent signal processing, thereby enabling Keller’s processing circuitry to perform feature extraction, baseline comparison, and anomaly determination on sampled electromagnetic data.
As per claims 5 and 13, the combination of Keller and Prvulovic teaches the system as stated above. Prvulovic further teaches filtering a processor side-channel signal to reject other frequencies, including external noise, electromagnetic noise generated by the measured system, and other side-channel signals (see ¶ [0067]).
Claims 3, 11 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over
Keller in view of Prvulovic and further in view of Yang (Pub. No. US 2014/0002153).
As per claims 3, 11 and 12, the combination of Keller and Prvulovic teaches the system as stated above except that the sampling circuitry is configured to sample the amplified emanations signal at a rate that is at least eight times greater than a clock frequency of a processor clock of the processor or sixteen times the clock frequency.
Yang, however, teaches oversampling using a clock having a frequency that is a multiple of a processor clock frequency. Yang teaches that a clock generator may receive a processor clock signal and generate an input clock signal as a multiple of the processor clock signal, explicitly identifying 6 times or 12 times the processor clock signal as examples (see ¶ [0022]). Yang further teaches providing the input clock signal to an oversampling pulse generator to generate an oversampled clock signal and using the resulting oversampled clock signal for sampling received signals (see ¶ [0023]). Accordingly, Yang teaches sampling using clock rates based on processor clock multiples of 6 times and 12 times, each of which falls within the claimed range substantially two times to sixteen times the processor clock frequency.
It would have been obvious to one having ordinary skill in the art to configure the sampling circuitry of Killer as modified by Prvulovic according to Yang’s processor clock relative oversampling technique because Prvulovic teaches that accurate assessment of short-duration processor instruction level side-channel signals requires obtaining numerous samples during those short intervals, and Yang teaches generating a sampling-related clock at predetermined multiples of a processor clock, including 6 times and 12 times, thereby providing a predictable implementation for obtaining multiple samples at a rate substantially greater than the processor clock frequency.
Claim 17 is rejected under 35 U.S.C. 103 as being unpatentable over Keller in
view of Prvulovic and further in view of Prvulovic et al. (Pub. No. US 2018/0012020) (hereinafter Prvulovic ‘020).
As per claim 17, the combination of Keller and Prvulovic teaches the system as stated above except that probing the EM emanations from the processor controlling at least a portion of the control system comprises probing the EM emanations from the processor controlling at least a portion of an industrial control system (ICS).
Prvulovic ‘020, however, teaches runtime side-channel anomaly monitoring of a control system and specifically teaches an embodiment in which the monitored system is a nuclear power plant controller, wherein detection of an anomaly can cause a safe shutdown of the nuclear reactor (see ¶ [0079]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to apply the electromagnetic processor monitoring technique of Keller as modified by Prvulovic to monitor a processor of an industrial control system as taught by Prvulovic ‘202 because Prvulovic ‘020 teaches applying side-channel based runtime monitoring to a controller of an industrial system, thereby extending the processor monitoring technique of Keller and Prvulovic to detect deviations in processor execution in an industrial environment.
Claims 4 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over
Keller in view of Prvulovic and further in view of Kune et al. (Pub. No. US 2018/0007074) (hereinafter Kune).
As per claims 4 and 10, the combination of Keller and Prvulovic teaches the system as stated above.
While Keller teaches measuring a feature value of captured unintended electromagnetic energy, calculating a difference between the measured feature and a baseline feature value, and determining from that difference whether anomalous or malicious software, firmware, or circuitry is present (see ¶ [0141]). Keller additionally teaches obtaining the baseline feature value from captured unintended emissions generated by a baseline electrical device (see ¶ [0253]). The combination of Keller and Prvulovic fails to explicitly teach that the control circuitry includes a controller configured to determine whether the processor is exhibiting the behavior anomaly by determining that a distance score of the amplified emanations signal relative to one or more pre-established normal emanation signals is within a range defined by one or more pre-determined threshold values.
Kune, however, teaches training a side-channel anomaly detection system using normal behavior according to distance/threshold criterion (see ¶ [0034]). It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to employ Kune’s quantitative distance from normal criterion in Keller’s baseline comparison because both the combination Keller and Prvulovic and Kune identify anomalous device behavior by determining deviation of measured side-channel characteristics from characteristics representative of expected or normal operation, thereby providing an objective quantitative criterion for distinguishing normal processor operation from anomalous processor operation.
Claims 18 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over
Keller in view of Prvulovic ‘020.
As per claim 18, Keller teaches an electromagnetic monitoring system including a near-field antenna/probe (see ¶¶ [0147] and [0171]), an electromagnetic sensor having ADC 838 and processing circuitry (see ¶ [0137]), and circuitry for determining anomalous operation from captured electromagnetic emissions by comparison with baseline characteristics (see ¶ [0141]).
However, Keller fails to explicitly teach an industrial control system including a processor configured to control at least a portion of the industrial control system.
Prvulovic ‘020, however, teaches applying side-channel anomaly monitoring to a control system, explicitly including a nuclear power plant controller (see ¶ [0079]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to employ Keller’s electromagnetic probe, sampling circuitry, and anomaly determination circuitry to monitor the processor of the industrial controller taught by Prvulovic ‘020 because Prvulovic ‘020 teaches applying side-channel based runtime monitoring to a controller of an industrial system, thereby extending the processor monitoring technique of Keller to detect deviations in processor execution in an industrial environment.
As per claim 19, the combination of Keller and Prvulovic ‘020 teaches the system as stated above. Keller further teaches comparing measured electromagnetic characteristics with baseline electromagnetic characteristics and explicitly teaches that the baseline feature value may be obtained from captured unintended emissions generated by a baseline electrical device (see ¶ [0253]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to store such normal/baseline electromagnetic information for subsequent comparison because retaining previously obtained normal electromagnetic measurements provides a persistent representation of expected operation, thereby permitting subsequent acquired processor measurements to be compared with known normal processor behavior.
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Keller in
view of Prvulovic ‘020 and further in view of Kune.
As per claim 20, the combination of Keller and Prvulovic ‘020 teaches the system as stated above.
While Keller teaches measuring a feature value of captured unintended electromagnetic energy, calculating a difference between the measured feature and a baseline feature value, and determining from that difference whether anomalous or malicious software, firmware, or circuitry is present (see ¶ [0141]). Keller additionally teaches obtaining the baseline feature value from captured unintended emissions generated by a baseline electrical device (see ¶ [0253]). the combination of Keller and Prvulovic ‘020 fails to explicitly teach that the control circuitry includes a controller configured to determine whether the processor is exhibiting the behavior anomaly by determining that a distance score of the amplified emanations signal relative to one or more pre-established normal emanation signals is within a range defined by one or more pre-determined threshold values.
Kune, however, teaches training a side-channel anomaly detection system using normal behavior according to distance/threshold criterion (see ¶ [0034]). It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to employ Kune’s quantitative distance from normal criterion in Keller’s baseline comparison because both the combination Keller and Prvulovic ‘020 and Kune identify anomalous device behavior by determining deviation of measured side-channel characteristics from characteristics representative of expected or normal operation, thereby providing an objective quantitative criterion for distinguishing normal processor operation from anomalous processor operation.
Claims 6, 7, 14 and 15 are rejected under 35 U.S.C. 103 as being unpatentable
over Keller in view of Prvulovic ‘020 and further in view of Hoya et al. (Pub. No. US 2004/0054528) (hereinafter Hoya).
As per claims 6 and 14, the combination of Keller and Prvulovic teaches the system as stated above except that the filter comprises a singular value decomposition based denoising filter.
Hoya, however, teaches a noise-removal technique based on singular value decomposition (see Abstract and ¶ [0012]). Hoya further teaches applying the singular value decomposition to a matrix formed from samples of the input signals (see ¶¶ [0048]-[0050]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to configure the filter of Keller as modified by Prvulovic, to employ the noise removal technique of Hoya because Hoya teaches separating sampled observed signal data into signal and noise subspaces using singular value decomposition and projecting the noisy observed data onto the signal subspace, thereby reducing noise in the acquired signal while retaining signal components for subsequent analysis (see ¶ [0012]). The modification would have constituted the predictable use of a known signal denoising technique to improve the quality of sampled signal supplied to Keller’s processor behavior analysis.
As per claims 7 and 15, the combination of Keller and Prvulovic teaches the system as stated above except that the filter comprises a Wiener filter.
Hoya, however, teaches implementing Wiener filtering (see ¶ [0010]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to configure the filter of Keller, as modified by Prvulovic, as a Wiener filter because it would produce denoised estimate from noisy signal data (see ¶ [0005]), thereby reducing noise in the sampled signals before subsequent analysis.
Claims 8 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over
Keller in view of Prvulovic ‘020 and further in view of Al Faruque et al. (Pub. No. US 2019/0230113) (hereinafter Al Faruque).
As per claims 8 and 16, the combination of Keller and Prvulovic teaches the system as stated above except that the filter comprises a k-nearest neighbors (k-NN) regressor.
Al Faruque, however, teaches processing emissions acquired from a physical system for purposes of determining system behavior and detecting anomalous operation (see ¶ [0007]). Al Faruque further teaches that an analog-emissions signal may be reprocessed to remove noise (see ¶ [0015]).
Al Faruque further teaches using k-nearest-neighbor regression in processing the analog emission derived data. Al Faruque teaches that an estimation function may be generated using a supervised learning approach and explicitly identifies “k-Nearest Neighbor Regression” as one of the regression approaches (see ¶¶ [0016]-[0017]).
It would have been obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to configure the filtering and signal-processing operations of Keller, as modified by Prvulovic, to employ the k-nearest-neighbor regression technique taught by Al Faruque, because Al Faruque teaches preprocessing analog-emission signals to remove noise and thereafter applying regression algorithms, explicitly including k-nearest-neighbor regression, to features derived from the analog-emission signals, thereby providing a known data driven technique for obtaining estimated signal related values from the processed analog emission data for subsequent detection of anomalous system behavior.
Prior art
The prior art made record and not relied upon is considered pertinent to
applicant’s disclosure:
Alain et al. [‘499] discloses a method and an apparatus for de-noising an image, and in particular, de-noising an image using video epitome based on a source video image. An embodiment of the present principles provides a method of processing an image in a video, comprising: decoding an encoded version of the image to generate a decoded version of the image; and generating a de-noised version of the image using the decoded version of the image and a video image epitome which is a texture epitome associated with the image, wherein the video image epitome was extracted from a source version of the image, wherein the generating comprises: de-noising a current patch using corresponding patches located in the video image epitome that correspond to at least one of a plurality of nearest neighbor patches.
Roux [‘438] discloses a method including: generating a reference trace for a noise source; generating a primary trace for the seismic source; generating a first estimated convolutional operator between the reference trace and the primary trace; convolving the operator with the reference trace for a time frame to generate an estimated noise for the time frame; and subtracting the estimated noise from the primary trace to generate an output signal.
Contact information
Any inquiry concerning this communication or earlier communications from the
examiner should be directed to MOHAMED CHARIOUI whose telephone number is (571)272-2213. The examiner can normally be reached Monday through Friday, from 9 am to 6 pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Andrew Schechter can be reached on (571) 272-2302. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Mohamed Charioui
/MOHAMED CHARIOUI/Primary Examiner, Art Unit 2857
Prosecution Insights