DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This Office action is in response to amendment/reconsideration filed on 12/17/2025, the amendments have been considered. Claims 1, 5, and 6 have been amended. Claims 1-5 are pending for examination, the rejection cited as stated below.
Response to Arguments
Applicant’s arguments, filed 12/17/2025, with respect to the Claim Objections of Claims 1, 2, 5, and 6 have been fully considered and are persuasive. The Claim Objections of Claims 1, 2, 5, and 6 has been withdrawn.
Applicant's arguments with regards to the amendments, “determine a series of packets with consecutive Session IDs following the preceding packet…”, have been fully considered but they are not persuasive. Applicant asserts that the prior arts of record fail to teach or suggest the above-mentioned limitation.
The Examiner respectfully disagrees, as the prior art of Yamamoto discloses detecting abnormalities (Paragraphs 0033-0034). Paragraphs 0120-0122 disclose that based on the information stored in the field of Message ID, information is going to be relayed between the server ECU and the client ECU (e.g., automated driving ECU). After confirmation of the field of Message ID is performed (i.e., there are no abnormalities), then the communications to the client ECUs can be made. This means that the Message ID needs to be inspected before any communications can be performed. Also, the prior art of David discloses in Paragraphs 0035-0036 that malware attempts (i.e., abnormalities) are blocked/stopped based on a variety of information, such as the malware itself, the origin of the malware (i.e., session ID), and information identifying the code segment that provided the malware exploit.
Based on the rationale explained above, the Examiner disagrees with the prior art being silent to the claimed embodiment.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-6 are rejected under 35 U.S.C. 103 as being unpatentable over Yusuke Yamamoto et al (US 20220355750 A1), hereinafter “Yamamoto” in view of Tal Efraim Ben David et al (US 20180316698 A1), hereinafter “David”.
Regarding Claim, Yamamoto discloses monitoring device comprising:
processing circuitry configured to:
use a normal communication model of communication between Engine Control Unit (ECUs) of a vehicle and determine, for each of packets transmitted and received by the ECUs, whether or not the packet is abnormal (Yamamoto, Paragraph 0033, 0141, detecting abnormalities between ECU);
when any one of the packets is determined to be abnormal, determine a series of packets with consecutive Session IDs following the preceding packet determined to be abnormal as abnormal on a basis of a Session ID indicating a communication order included in header information of the packet determined to be abnormal (Yamamoto, Paragraph 0117, transfer management unit confirms whether or not the server ECU has permitted the client ECU to subscribe to the service, on the basis of the information stored in the field of Type in the service subscription propriety frame received from the transfer control unit. Paragraph 0141, on the basis of information stored in the field of time to live (TTL) in Entries Array of a target frame, e.g., a service provision frame, received from the transfer control unit , the transfer management unit detects, as abnormality of the target frame, that a validity period of a service from a server ECU to a client ECU has expired. Paragraph 0142, transfer management unit recognizes that the validity period of the service from the server ECU to the client ECU has expired, on the basis of the TTL in the service provision frame received from the transfer control unit )
However, Yamamoto fails to explicitly disclose and output information of a packet determined to be abnormal and information of a packet determined to be abnormal by the second determination unit.
David, from the same or similar field of endeavor, discloses and output information of a packet determined to be abnormal and information of a packet determined to be abnormal by the second determination unit (David, Paragraph 0036, controller logs information about its operation, including blocked malware attempts as well as information on secure operation of the controller over time. Paragraph 0037, management computer system receives reports from the controller as well as from multiple other controllers and devices, and can aggregate the reports into a central database system).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify Yamamoto in view of David in order to further modify the method of detecting abnormalities in an in-vehicle communication from the teachings of Yamamoto with the method of centralized controller management and anomaly detection from the teachings of David.
One of ordinary skill in the art would have been motivated because by using security policies in the electronic control units the system will be able to maintain a secure operation and prevent attacks to controller area network (David – Paragraphs 0003-0006).
Regarding Claim 2, the combination of Yamamoto and David disclose the monitoring device according to claim 1 above, wherein Yamamoto further discloses wherein the communication between the ECUs is a Publish/Subscribe type communication (Yamamoto, Paragraphs 0081-0083, 0117, ECUs are subscribed to services),
and in a case where it is determined that a number of simultaneous subscription clients in the Publish/Subscribe type communication exceeds a normal range, when determining that a packet of any one of subscription Sessions is abnormal, the processing circuitry is further configured to determine that a packet of a subscription client in the subscription Session determined to be abnormal is abnormal (Yamamoto, Paragraph 0116-0118, determining if ECU is subscribed or not to a service. Paragraph 0141, on the basis of information stored in the field of TTL in Entries Array of a target frame, e.g., a service provision frame, received from the transfer control unit, the transfer management unit 20 detects, as abnormality of the target frame, that a validity period of a service from a server ECU to a client ECU has expired).
Regarding Claim 3, the combination of Yamamoto and David disclose the monitoring device according to claim 2 above, where Yamamoto further discloses wherein in a case where it is determined that the number of simultaneous subscription clients in the Publish/Subscribe type communication exceeds the normal range, when determining that no packet of any one of the subscription Sessions is abnormal until all the subscription Sessions are terminated, the processing circuitry is further configured to specify a subscription Session in which a feature amount of a communication interval of each of the packets is most deviated from a normal communication model, and determine that a packet of a subscription client in the specified subscription Session is determined to be abnormal (Yamamoto, Paragraph 0116-0118, determining if ECU is subscribed to a service. Paragraph 0141, on the basis of information stored in the field of TTL in Entries Array of a target frame, e.g., a service provision frame, received from the transfer control unit, the transfer management unit 20 detects, as abnormality of the target frame, that a validity period of a service from a server ECU to a client ECU has expired).
Regarding Claim 4, the combination of Yamamoto and David disclose the monitoring device according to claim 2 above, wherein Yamamoto further discloses wherein the packet is a packet of SOME/IP protocol or SOME/IP-SD protocol (Yamamoto, Paragraphs 0070-0072, communication according to SOME/IP communication protocol).
Claim 5 carries similar limitations as discussed with regards to Claim 1 above and therefore is rejected for the same reason.
Claim 6 carries similar limitations as discussed with regards to Claim 1 and Claim 5 above and therefore is rejected for the same reason.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAVIER O GUZMAN whose telephone number is (571)270-0588. The examiner can normally be reached Monday - Friday 8 am to 4 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Brian J Gillis can be reached at 571-272-7952. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAVIER O GUZMAN/Primary Examiner, Art Unit 2446