Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
The instant application 18/816,887 claims foreign priority to foreign application CN 202410196576.3 which claims the foreign priority filing date of 02/22/2024.
Oath/Declaration
Applicant’s oath/declaration filed on 08/27/2024 has been reviewed by the examiner and is found to conform to the requirements prescribed in 37 C.F.R. 1.63.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 08/27/2024 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Drawings
The drawings submitted on 08/27/2024 with the instant application are acceptable for examination purposes.
Specification
The specification submitted on 08/27/2024 with the instant application are acceptable for examination purposes.
Claim Objections
Claims 1, 4, 6, 8, 10-11, 13, 15, and 17-19 are objected to because of the following informalities:
In Claim 1, the limitation “data sent from the substation monitoring terminal to the Internet of Things” could be re-written as: “data sent from the substation monitoring terminal to an Internet of Things network” or the like, for clarity and to establish antecedent basis for the internet of things in the claims
In Claim 1, the limitation “and the data at least comprises electricity consumption data” should read: “and the sent data at least comprises electricity consumption data” for clarity and consistency with the antecedent basis of the sent data
In Claim 1, the limitation “the plurality of trapezoid fuzzy sets are obtained by sequencing according to the magnitude of the data quality parameters” could be re-written as: “the plurality of trapezoid fuzzy sets are obtained by sequencing according to a magnitude of the data quality parameters” or the like, because there is no antecedent basis for the magnitude of the data quality parameters
In Claim 1, the limitation “and in response to in the substation monitoring terminal having the security risk” should read: “and in response to the substation monitoring terminal having the security risk”
In Claim 1, the limitation “controlling the traffic of the substation monitoring terminal to access the Internet of Things to be reduced” could be re-written as: “controlling traffic of the substation monitoring terminal to reduce access to the Internet of Things”, or the like, for clarity
Claims 18 and 19 recite similar limitations to those of Claim 1, and are objected to for at least the same reasons as Claim 1
In Claim 4, the limitation “According to a formula kP = NFD / NTD + NFD, calculating the falsity degree KF” should read: “According to a formula kF = NFD / NTD + NFD, calculating the falsity degree KF” for clarity
In Claim 6, the limitation “wherein the trust degree is used for representing the risk extent of the substation monitoring terminal …” should read: “wherein the trust degree is used for representing a risk extent of the substation monitoring terminal …” because there is no antecedent basis for the risk extent
In Claim 8, the limitation “wherein the attack counts refer to the counts of malicious attacks on a data system or a network” should read: “wherein the attack counts refer to counts of malicious attacks on a data system or a network” because there is no antecedent basis for the counts of malicious attacks
In Claim 10, the limitation “wherein the error rates refer to a frequency at which errors occurs during data transmission or processing” should read: “wherein the error rates refer to a frequency at which errors occur during data transmission or processing”
In Claim 11, the limitation “wherein the error rates are used for measuring the reliability of the data transmission or processing” should read: “wherein the error rates are used for measuring a reliability of the data transmission or processing” because there is no antecedent basis for the reliability
In Claim 13, the limitation “wherein the repetition rates are used for measuring the accuracy of the data transmission or processing” should read: “wherein the repetition rates are used for measuring an accuracy of the data transmission or processing” because there is no antecedent basis for the accuracy
In Claim 15, the limitation “wherein the miss rates are used for measuring the integrity of the data transmission or processing” should read: “wherein the miss rates are used for measuring an integrity of the data transmission or processing” because there is no antecedent basis for the integrity
In Claim 17, the limitation “wherein the channel blocking rates are used for measuring the load and efficiency of the data transmission” should read: “wherein the channel blocking rates are used for measuring a load and efficiency of the data transmission” because there is no antecedent basis for the load and efficiency
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
In Claim 1, the limitation “the plurality of trapezoid fuzzy sets are obtained by sequencing according to the magnitude of the data quality parameters” is unclear because it does not clearly convey the means of obtaining the trapezoid fuzzy sets. That is, sequencing according to the magnitude of the data quality parameters is ambiguous because it is not clear if, e.g., the sets are sequenced by the magnitude of their parameters, the membership functions are ordered, the parameters are sequenced before or after fuzzification, etc. Further, the magnitude of the data quality parameters is not clear. Thus, the fuzzy set obtaining step is unclear and the scope of the claim is unclear. For examination purposes, the limitation will be interpreted to represent obtaining trapezoid fuzzy set representations for each data quality parameter by associating the parameter values with corresponding fuzzy membership values/ranges.
Corresponding independent Claims 18 and 19 include similar limitations to those of Claim 1 and are rejected for the same reasons as Claim 1.
In Claim 4, the limitation reciting the formula for calculating a falsity data amount NFD is not clear because the formula includes at least the variables “NRP” and “x” and the function “E[ … ]” which are not defined in the claim. Therefore, the scope of the claim is unclear. The scope of the claim can be clarified by defining the variables within the context of the claims.
In Claim 7, the limitation reciting the formula for calculating a data gain value RRP is not clear because the formula includes at least the variables “kDi”, “vDvi”, “kDSi”, “SDi”, “kMi”, “MG”, operators “⋁” and “⊗”, and the function “E[ … ]”, which are not defined in the claim. Further, the same variable “x” is described as representing both “fuzzy uncertainty rates” and “fuzzy uncertainty scales” within the same formula. Therefore, the scope of the claim is unclear. The scope of the claim can be clarified by defining the variables and operators within the context of claims.
In Claim 7, the limitation reciting the formula for calculating a data loss value LD is not clear because the formula includes at least the variable “NRP” and the function “E[ … ]” which are not defined in the claim. The formula also includes the variable “x”, which is not clearly described to be the same x representing fuzzy uncertainty rates/scales from the data gain value formula or some different value(s). Therefore, the scope of the claim is unclear. The scope of the claim can be clarified by defining the variables within the context of the claims.
Claims 2-17 are also rejected at least due to their dependence on Claim 1
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 8, 10-14, 16, and 18-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hao et al. (Hao, W., Yang, Q., Li, Z., Hu, S., Liu, B., & Ruan, W. (2023). Multi-scale Traffic Aware Cybersecurity Situational Awareness Online model for Intelligent Power Substation Communication Network. IEEE Internet of Things Journal, 10(2), 1666–1681. https://doi.org/10.1109/jiot.2022.3210946), hereinafter Hao, in view of Gu et al. (Gu, J.-C., Liu, C.-H., Chou, K.-Y., & Yang, M.-T. (2019). Research on CBM of the Intelligent Substation Scada System. Energies, 12(20). https://doi.org/10.3390/en12203892), hereinafter Gu, Zhi et al. (CN 116347550 A), hereinafter Zhi, and O’Connell et al. (US 20230053883 A1), hereinafter O’Connell.
Regarding Claim 1:
Hao teaches A method for controlling a substation monitoring terminal, comprising (Hao – P. 1667, Left Col.: The communication resource allocations will advance SCN early warning using the mathematical modeling of data traffic and communication network topology [4]. The accurate modeling of the communication pattern will help improve the SCN performance and characterize the unique traits of the SCN traffic under normal operating conditions [5], [6]. The timely situational awareness of SCN conditions is essential to prevent unexpected delays in the communication network that can deteriorate substation network performance in cyber attacks. Also, the detailed risk evaluation and equipment failure localization of included devices in SCN is essential to make a more comprehensive and pertinent situational awareness of cyberspace in an intelligent substation. Consequently, the online assessment of SCN anomaly detection and multiple scenarios’ vulnerability within an acceptable computational complexity is critical to enhancing the operation and maintenance of intelligent substations [6]. To this end, this article investigated an online and quantitative cyberspace situational awareness model for the SCN based on multiscale traffic characterization and quantitative risk analysis): acquiring sent data of the substation monitoring terminal, wherein the sent data is data sent from the substation monitoring terminal to the Internet of Things (Hao – P. 1673, Right Col. And P. 1674, Left Col.: The SCN data traffic measurements are collected from the mirror port of the Ethernet switch (Reason S20 series) at the station level using the Wireshark software in a real operating 110-kVelectricpower substation. The monitored devices in SCN include the SCADA servo server (IBMX3650), a workstation (IntelXeonprocessorE5-2600v3family), a GPS/Time server (Syncbox), the substation controller, and the Gateway (SGW1050). The architecture of the studied 110-kVsubstation adopted the standard IEC61850 protocol, as shown in Fig. 4. Also, the SCN traffic data collecting details and the corresponding included devices are shown in Fig. 4. The network traffic at the station level contains various useful information from the included IIoT devices (e.g., intelligent gateway and substation controllers) and also the networked installations (e.g., SCADA server, workstations, and Ethernet switch). For example, the network traffics from the SCADA system to the controllers can be extracted based on certain types of protocols or IP addresses; and P. 1667, Left Col. And Right Col.: A dynamic fractional autoregressive integration moving average (FARIMA)-based traffic threshold model is proposed to characterize the multiscale SCN data traffic patterns for holistic network traffic, separated network traffics of included devices (especially IIoTs) and separated network traffic of certain protocol types with low computational complexity and high forecasting accuracy.), and the data at least comprises electricity consumption data of an electricity consumption device monitored by the substation monitoring terminal (Hao – P. 1673, Right Col.: The SCN data traffic measurements are collected from the mirror port of the Ethernet switch (Reason S20 series) at the station level using the Wireshark software in a real operating 110-kV electric power substation; and P. 1666, Right Col. And P. 1667, Left Col.: It is also acknowledged that the intelligent electrical substation is an assembled system that contains various Industrial Internet of Things (IIoT) devices as components (often regarded as smart sensors and actuators) to enhance manufacturing and industrial processes … The IIoT devices, e.g., intelligent electronic devices (IEDs), programmable
logic controllers (PLCs), advanced measurement infrastructure (AMI), and remote terminal units (RTUs), facilitate the advanced management functionalities of a power substation. The SCN is expected to provide real-time, highspeed, and reliable data communication channels for advanced metering and control commands and further conduct the fault diagnosis and anomaly alarming for the unexpected events with the alliance of IIoT techniques; Examiner’s Comment: Hao’s teaching of at least the AMI devices included in the SCN and the performance of advanced metering indicates that the data transmitted to and from the SCN includes at least power consumption data of connected devices); process the sent data within a pre-determined time period (Hao – P. 1674, Left Col.: The traffic measurements are collected for more than 24 h with a sampling rate of 1 ms based on the probing mechanism [41]. The impact of such a data traffic collection process on the traffic pattern is considered negligible [42]. The collected data traffic includes the substation measurements and control messages (e.g., protection command, CB trips, and HMI control command) in the PCAP format [43]. In this work, the collected data traffic is further aggregated in the timescales of 1 s, 30 s, and 1 min, respectively, and used as the input for the proposed FARIMA(p, d, q) model for traffic characterization. The network traffic of a certain device in SCN can be obtained through the assigned IP or MAC address presented in Wireshark); the data quality parameters at least comprise: attack counts (Hao – P. 1670, Right Col.: Table III: listing of types of attacks and their respective observed frequencies among observed data traffic); determining whether the substation monitoring terminal has a security risk (Hao – P. 1679, Left Col.: The most affected protocol Prisk = MMS calculated by the separated SCN traffic indicates that the traffic bytes proportion of the MMS traffic has been altered to a great extent. The most likely attack surface is through penetrating the peer to-peer application layer protocol (i.e., MMS) in the SCN to disrupt the normal operations. Thus, the corresponding countermeasures (e.g., network traffic interpretation, application layer protocol standardization, and abnormal packet filtering) are engaged to verify the integrity and compliance of the MMS traffic. Besides, the forged and incorrect packets in the MMS protocol should be further distinguished to mitigate the security risks … The threat perception model of the included devices (i.e., SCADA, workstation, GPS, sensor cluster, substation con troller, and Gateway as shown in Fig. 4) is proposed using the separated SCN traffic. The equipment failures can be localized by calculating the risk indicators of the considered devices (including IIoTs) in SCN, as given in Table IX (seven SCN assets are exemplified). The SCADA sever has a higher risk indicator value (Rm = 0.273) than other included devices in SCN, and the corresponding countermeasures (e.g., deploying the end point detection, network detection response, and updating the software) should be adopted in the SCADA server. It should be noted that the proposed method can be used as the prealarms of the perceived threats before the security information event management (SIEM) executes the DPI for the suspicious packets).
Hao does not expressly teaches adopting a fuzzy inference method to process the sent data … to obtain a plurality of trapezoid fuzzy sets, wherein the plurality of trapezoid fuzzy sets are used for representing uncertainty of data quality parameters of the substation monitoring terminal, the plurality of trapezoid fuzzy sets are obtained by sequencing according to the magnitude of the data quality parameters; determining whether the substation monitoring terminal has a [security] risk according to the plurality of trapezoid fuzzy sets.
However, Gu teaches adopting a fuzzy inference method to process the sent data … to obtain a plurality of trapezoid fuzzy sets, wherein the plurality of trapezoid fuzzy sets are used for representing uncertainty of data quality parameters of the substation monitoring terminal (Gu – P. 6: The equipment influencing factors of the intelligent substation SCADA system are evaluated by trapezoidal and triangular membership functions to determine their degrees of membership in the evaluation comment set V, as shown in Figure 3. The membership functions of the linguistic variables “Excellent”, “Good”, “Average”, “Poor”, and “Worst” are defined in Equations (3)–(7), with the parameters defined and evenly distributed as α=0.1, β=0.3, γ=0.5, δ=0.7, and ε=0.9, respectively; and P. 5: An intelligent substation SCADA system consists of a lot of equipment, and each performance index of individual equipment reflects the performance status of individual equipment and the system as a whole. Server (u1), SCADA HMI software (u2), Switch (u3), IED (u4), and MU (u5) are analyzed in this study. Equipment availability (u11), communication port failure rate (u12), CPU usage rate (u13), memory usage rate (u14), and transmission load rate (u15) are included in the server reliability evaluation model [17,18]. Software availability (u21), data receiving rate (u22), data access time (u23), and failure repair time (u24) are included in the SCADA HMI software reliability evaluation model [19]. Equipment availability (u31), communication port failure rate (u32), packet lost rate (u33), transmission load rate (u34), and CPU usage rate (u35) are included in the switch reliability evaluation model [16]. Equipment availability (u41), operation failure rate (u42), communication failure rate (u43), operating environment (u44), and CPU usage rate (u45) are included in the IED reliability evaluation model [20]. Equipment availability (u51), SV packet lost rate (u52), SV code error rate (u53), transmission time (u54), time synchronization accuracy (u55), and CPU usage rate (u56) are included in the MU reliability evaluation model [20]), the plurality of trapezoid fuzzy sets are obtained by sequencing according to the magnitude of the data quality parameters (Gu – P. 6: The equipment influencing factors of the intelligent substation SCADA system are evaluated by trapezoidal and triangular membership functions to determine their degrees of membership in the evaluation comment set V, as shown in Figure 3. The membership functions of the linguistic variables “Excellent”, “Good”, “Average”, “Poor”, and “Worst” are defined in Equations (3)–(7), with the parameters defined and evenly distributed as α=0.1, β=0.3, γ=0.5, δ=0.7, and ε=0.9, respectively; and P. 6: Figure 3 and equations (1)-(8) describing the evaluation of factors for relative deterioration of SCADA system equipment based at least on trapezoidal fuzzy sets), the data quality parameters at least comprise: … error rates … miss rates … (Gu – P. 5: An intelligent substation SCADA system consists of a lot of equipment, and each performance index of individual equipment reflects the performance status of individual equipment and the system as a whole. Server (u1), SCADA HMI software (u2), Switch (u3), IED (u4), and MU (u5) are analyzed in this study. Equipment availability (u11), communication port failure rate (u12), CPU usage rate (u13), memory usage rate (u14), and transmission load rate (u15) are included in the server reliability evaluation model [17,18]. Software availability (u21), data receiving rate (u22), data access time (u23), and failure repair time (u24) are included in the SCADA HMI software reliability evaluation model [19]. Equipment availability (u31), communication port failure rate (u32), packet lost rate (u33), transmission load rate (u34), and CPU usage rate (u35) are included in the switch reliability evaluation model [16]. Equipment availability (u41), operation failure rate (u42), communication failure rate (u43), operating environment (u44), and CPU usage rate (u45) are included in the IED reliability evaluation model [20]. Equipment availability (u51), SV packet lost rate (u52), SV code error rate (u53), transmission time (u54), time synchronization accuracy (u55), and CPU usage rate (u56) are included in the MU reliability evaluation model [20]); determining whether the substation monitoring terminal has a [security] risk according to the plurality of trapezoid fuzzy sets (Gu – P. 20: The result shows that the equipment status maintenance and management platform developed in this study can diagnose the equipment operating status in real time. The inspection and maintenance personnel can analyze the overall equipment condition by knowing which one of the four status ratings, i.e., "in Good Condition", "Attention Required", "in Critical Condition", and "Immediate Inspection and Maintenance Required", the equipment status has, and can determine the priority for equipment maintenance. The evaluation result can serve as a valuable reference to utility companies when making maintenance plans).
Gu additionally teaches and the data at least comprises electricity consumption data of an electricity consumption device monitored by the substation monitoring terminal (Gu – P. 4: Figure 2: Example configuration of the proposed substation SCADA system; and P. 5: IEDs are core protection and control devices in a power system. Parameters are set and protection logics are programmed differently depending on the needs and operating conditions of different systems. IEDs receive various electrical data from potential transformers (PTs), current transformers (CTs), MUs, and other equipment. IEDs send dispatch control commands and transmit power operating data to the SCADA system at the station level, or other related equipment through network communication, thus effectively reducing power outages and harm caused by power system abnormal operation).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, further incorporating Gu to arrive at the claimed invention. Gu establishes known practices for evaluating operating statuses of substation devices based on IoT communication characteristics of the devices by applying a fuzzy comprehensive evaluation to the characteristics. The evaluations are used to identify performance deficiencies or anomalies of substation equipment toward prioritizing system maintenance plans. Hao provides known techniques for detecting potential security risks in electric substation operations by observing abnormal behavior/traffic in data communications throughout an IIoT network. Thus, applying the fuzzy evaluations provided by Gu to the communication security determinations established by Hao would have been a predictable combination of known techniques with similar data elements in similar substation environments. The combination would provide the obvious benefit of identification of abnormal and potentially malicious activity based on fuzzy evaluations of IoT communication traffic, and therefore would have been obvious to a skilled artisan.
The combination of Hao and Gu does not expressly teach the data quality parameters at least comprise: … repetition rates … and channel blocking rates.
However, Zhi teaches the data quality parameters at least comprise: … repetition rates … and channel blocking rates (Zhi – P. 2: the terminal device can judge the WiFi network quality in a plurality of dimensions, so as to determine the quality condition of the current WiFi network, improves the accuracy … WiFi network parameter does not satisfy the first preset condition comprises at least one of the following: the channel busy rate of the WiFi network is greater than the second preset value … the uplink and downlink retransmission rate is greater than the seventh preset value and/or the uplink and downlink confirmation character repetition rate is greater than the eighth preset value. In this way, the terminal device can accurately judge the quality condition of the WiFi network according to the parameter).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao and Gu, further incorporating Zhi to arrive at the claimed invention. Zhi provides known data transmission quality characteristics for monitoring WiFi network quality. Zhi notes that these characteristics are observable/actionable in IoT systems, further including smart grid terminals. Thus, applying Zhi’s network traffic characteristics in observing network data communication quality to the substation communication traffic observations and responses provided by Hao and Gu represents a predictable combination of related elements. Specifically, at least Zhi’s channel busy rate and retransmission/repetition rates would be beneficial for detecting abnormal activity in systems such as those taught by Hao and Gu. Therefore, the combination would have been obvious to a skilled artisan.
The combination of Hao, Gu, and Zhi does not expressly teach and in response to in the substation monitoring terminal having the security risk, controlling the traffic of the substation monitoring terminal to access the Internet of Things to be reduced.
However, O’Connell teaches and in response to in the [substation monitoring] terminal having the security risk, controlling the traffic of the [substation monitoring] terminal to access the Internet of Things to be reduced (O’Connell – Paragraph [0046]: PCF 114 may further include instructions 130 to change a status of device 102 where it is determined from instructions 128 that the packet data is anomalous. Changing the status of IoT device 102 may include, for example, blocking device 102, i.e, prohibiting a device from initiating a new session. In another example, changing the status of IoT device 102 may include, for example, throttling IoT device 102 (e.g., in the case of a suspected Denial of Service (DoS) attack), including limiting the bandwidth of IoT device 102. In some examples, changing the status of IoT device 102 may include offloading traffic transmitted on a network slice of IoT device 102 to a different network slice, or otherwise rerouting traffic of the device).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, and Zhi, further incorporating O’Connell to arrive at the claimed invention. O’Connell demonstrates a known convention in IoT systems for throttling device network access upon detecting anomalous traffic coming from the device. O’Connell’s defensive countermeasure against detected data traffic anomalies combines naturally with the system taught by Hao, Gu, and Zhi. O’Connell observes network traffic against expected behavior patterns to detect abnormal device activity in a manner that is analogous to at least the combined teachings of Hao and Gu. O’Connell adds a responsive remediation action by limiting network access of devices exhibiting anomalous activity. O’Connell’s teachings predictably enhance Hao, Gu, and Zhi’s system with a protective operation against detected anomalies. Thus, the combination would have been obvious to one of ordinary skill in the art.
Regarding Claim 8:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Hao further teaches wherein the attack counts refer to the counts of malicious attacks on a data system or a network (Hao – P. 1670, Right Col.: Table III: listing of types of attacks and their respective observed frequencies among observed data traffic).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 10:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Gu further teaches wherein the error rates refer to a frequency at which errors occurs during data transmission or processing (Gu – P. 5: Equipment availability (u51), SV packet lost rate (u52), SV code error rate (u53), transmission time (u54), time synchronization accuracy (u55), and CPU usage rate (u56) are included in the MU reliability evaluation model [20]).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 11:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 10.
Gu further teaches wherein the error rates are used for measuring the reliability of the data transmission or processing (Gu – P. 5: Equipment availability (u51), SV packet lost rate (u52), SV code error rate (u53), transmission time (u54), time synchronization accuracy (u55), and CPU usage rate (u56) are included in the MU reliability evaluation model [20]).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 12:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Zhi further teaches wherein the repetition rates refer to a frequency at which repeated data occurs during data transmission or processing (Zhi – P. 2: the terminal device can judge the WiFi network quality in a plurality of dimensions, so as to determine the quality condition of the current WiFi network, improves the accuracy … WiFi network parameter does not satisfy the first preset condition comprises at least one of the following: the channel busy rate of the WiFi network is greater than the second preset value … the uplink and downlink retransmission rate is greater than the seventh preset value and/or the uplink and downlink confirmation character repetition rate is greater than the eighth preset value. In this way, the terminal device can accurately judge the quality condition of the WiFi network according to the parameter).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 13:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 10.
Zhi further teaches wherein the repetition rates are used for measuring the accuracy of the data transmission or processing (Zhi – P. 2: the terminal device can judge the WiFi network quality in a plurality of dimensions, so as to determine the quality condition of the current WiFi network, improves the accuracy … WiFi network parameter does not satisfy the first preset condition comprises at least one of the following: the channel busy rate of the WiFi network is greater than the second preset value … the uplink and downlink retransmission rate is greater than the seventh preset value and/or the uplink and downlink confirmation character repetition rate is greater than the eighth preset value. In this way, the terminal device can accurately judge the quality condition of the WiFi network according to the parameter).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 14:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Gu further teaches wherein the miss rates refer to a frequency at which data is lost during data transmission or processing. (Gu – P. 5: An intelligent substation SCADA system consists of a lot of equipment, and each performance index of individual equipment reflects the performance status of individual equipment and the system as a whole. Server (u1), SCADA HMI software (u2), Switch (u3), IED (u4), and MU (u5) are analyzed in this study. Equipment availability (u11), communication port failure rate (u12), CPU usage rate (u13), memory usage rate (u14), and transmission load rate (u15) are included in the server reliability evaluation model [17,18]. Software availability (u21), data receiving rate (u22), data access time (u23), and failure repair time (u24) are included in the SCADA HMI software reliability evaluation model [19]. Equipment availability (u31), communication port failure rate (u32), packet lost rate (u33), transmission load rate (u34), and CPU usage rate (u35) are included in the switch reliability evaluation model [16]. Equipment availability (u41), operation failure rate (u42), communication failure rate (u43), operating environment (u44), and CPU usage rate (u45) are included in the IED reliability evaluation model [20]. Equipment availability (u51), SV packet lost rate (u52), SV code error rate (u53), transmission time (u54), time synchronization accuracy (u55), and CPU usage rate (u56) are included in the MU reliability evaluation model [20]).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 16:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 10.
Zhi further teaches wherein the channel blocking rates refer to a rate at which data cannot be transmitted due to channel blocking during data transmission (Zhi – P. 2: the terminal device can judge the WiFi network quality in a plurality of dimensions, so as to determine the quality condition of the current WiFi network, improves the accuracy … WiFi network parameter does not satisfy the first preset condition comprises at least one of the following: the channel busy rate of the WiFi network is greater than the second preset value).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 18:
Claim 18 is a non-transitory storage medium claim with limitations corresponding to those of method Claim 1. Therefore, Claim 18 is rejected with the same combination and rationale as Claim 1.
At least Zhi further teaches the additional elements A non-transitory storage medium, wherein the non-transitory storage medium comprises a program, wherein when the program runs, a device where the non-transitory storage medium is located is controlled to execute (Zhi – P. 24: The embodiment of the application claims a terminal device, the terminal device comprises: Including: a processor and a memory; the memory stores the computer execution instruction; the processor executes the computer execution instruction stored by the memory, so that the terminal device executes the method … The embodiment of the application further claims a computer-readable storage medium. The computer readable storage medium stores a computer program. When the computer program is executed by the processor, the method is realized).
Regarding Claim 19:
Claim 18 is an electronic apparatus claim non-transitory storage medium claim with limitations corresponding to those of method Claim 1 and non-transitory storage medium Claim 18. Therefore, Claim 19 is rejected with the same combination and rationale as Claim 1 and 18.
At least Zhi further teaches the additional elements An electronic apparatus, comprising a memory and a processor, wherein the memory is arranged for storing a computer program, and the processor is arranged for executing, according to the computer program (Zhi – P. 24: The embodiment of the application claims a terminal device, the terminal device comprises: Including: a processor and a memory; the memory stores the computer execution instruction; the processor executes the computer execution instruction stored by the memory, so that the terminal device executes the method … The embodiment of the application further claims a computer readable storage medium. The computer readable storage medium stores a computer program. When the computer program is executed by the processor, the method is realized).
Claim(s) 3, 5, 6, and 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hao in view of Gu, Zhi, O’Connell, and Liang et al. (CN 112866283 A), hereinafter Liang.
Regarding Claim 3:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Gu further teaches the trapezoid fuzzy sets (Gu – P. 6: The equipment influencing factors of the intelligent substation SCADA system are evaluated by trapezoidal and triangular membership functions to determine their degrees of membership in the evaluation comment set V, as shown in Figure 3. The membership functions of the linguistic variables “Excellent”, “Good”, “Average”, “Poor”, and “Worst” are defined in Equations (3)–(7), with the parameters defined and evenly distributed as α=0.1, β=0.3, γ=0.5, δ=0.7, and ε=0.9, respectively).
The combination of Hao, Gu, Zhi, and O’Connell does not expressly teach wherein determining whether the substation monitoring terminal has the security risk according to the plurality of trapezoid fuzzy sets comprises: according to the plurality of trapezoid fuzzy sets, calculating a falsity degree of the substation monitoring terminal and a security degree of the substation monitoring terminal, wherein the falsity degree is used for representing a falsity extent of the sent data, and the security degree is used for representing a security extent of the sent data; in response to the falsity degree being greater than a first threshold value, determining that the substation monitoring terminal has a security risk of falsity data; and in response to the security degree being greater than a second threshold value, determining that the substation monitoring terminal has a security risk of a data attack.
However, Liang teaches wherein determining whether the substation monitoring terminal has the security risk according to the plurality of [trapezoid] fuzzy sets comprises: according to the plurality of [trapezoid] fuzzy sets, calculating a falsity degree of the substation monitoring terminal and a security degree of the substation monitoring terminal, wherein the falsity degree is used for representing a falsity extent of the sent data (Liang – P. 8: S1, through different behaviours of the network node, defining 7 kinds of confidence factors F1, F2,F3, F4, F5, F6, F7 … when the data packet of one node is sent to the next node, source node will monitor whether the data packet is falsified in a certain time, ensuring the integrity F2 of the data of the node has important function for the transmission safety the node; wherein F2 represents a data integrity factor; IPi, j (t) represents the number of data packets that have not been tampered and successfully transmitted; FPi, j (t) represents the number of data packets required to be transmitted), and the security degree is used for representing a security extent of the sent data (Liang – P. 8: S1, through different behaviours of the network node, defining 7 kinds of confidence factors F1, F2,F3, F4, F5, F6, F7 … the node energy in the Internet of Things is extremely limited, for ensuring the correct transmission of the data to relay when intercepting and transmitting data, analyzing and judging whether the node is attacked by analyzing the data success rate F1 of the node; wherein F1 represents the data transmission rate factor, ACKi, j (t) represents the number of datapacket successfully forwarded between adjacent nodes, TPi, j (t) is the number of data packetrequired to be forwarded by the node); in response to the falsity degree being greater than a first threshold value, determining that the substation monitoring terminal has a security risk of falsity data (Liang – P. 10: S63, according to the confidence factor on each trust fuzzy set membership size to divide the information of the node, using non-trust: 0 ≤μ T1 <25, generally trust: 25 < μ T2 < 50, very trust: 50 < μT3 < 75, full trust: 75 ≤μ T4 <100 represents the trust level); and in response to the security degree being greater than a second threshold value, determining that the substation monitoring terminal has a security risk of a data attack (Liang – P. 10: S63, according to the confidence factor on each trust fuzzy set membership size to divide the information of the node, using non-trust: 0 ≤μ T1 <25, generally trust: 25 < μ T2 < 50, very trust: 50 < μT3 < 75, full trust: 75 ≤μ T4 <100 represents the trust level).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, Zhi, and O’Connell, further incorporating Liang to arrive at the claimed invention. One would be motivated to incorporate Liang’s teaching to generate fuzzy sets corresponding to confidence factors to perform threshold-based trust determinations of an observed IoT node into Hao, Gu, Zhi, and O’Connell’s method for determining security risks in an electric substation. Liang’s added techniques provide pre-determined decision points for detecting communication/device abnormalities.
Regarding Claim 5:
The combination of Hao, Gu, Zhi, O’Connell, and Liang teaches the method as claimed in claim 3.
Liang further teaches wherein calculating the security degree of the substation monitoring terminal according to the plurality of trapezoid fuzzy sets comprises: acquiring a real data amount of the sent data and a security data amount of the sent data, and according to a formula: kA = NAD / NTD+NAD, calculating the security degree kA, wherein NAD is the security data amount of the sent data, and NTD is the real data amount of the sent data (Liang – P. 8: Formula (3); and P. 8: wherein F3 represents a data availability factor, RACKi, j (t) represents the number of data packets to be responded, NRACKi, j (t) represents the number of data packets not responded).
While the particular confidence factor being evaluated based on Liang’s Equation (3) is a data availability factor, one of ordinary skill in the art would have found it obvious to implement the similar formula to determine a security degree of sent data by dividing the amount of security data of the sent data by the total amount of the sent data (security + real data).
Regarding Claim 6:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 1.
Gu further teaches the trapezoid fuzzy sets (Gu – P. 6: The equipment influencing factors of the intelligent substation SCADA system are evaluated by trapezoidal and triangular membership functions to determine their degrees of membership in the evaluation comment set V, as shown in Figure 3. The membership functions of the linguistic variables “Excellent”, “Good”, “Average”, “Poor”, and “Worst” are defined in Equations (3)–(7), with the parameters defined and evenly distributed as α=0.1, β=0.3, γ=0.5, δ=0.7, and ε=0.9, respectively).
The combination of Hao, Gu, Zhi, and O’Connell does not expressly teach wherein determining whether the substation monitoring terminal has the security risk according to the plurality of trapezoid fuzzy sets comprises: according to the plurality of trapezoid fuzzy sets, calculating a trust degree of the substation monitoring terminal, wherein the trust degree is used for representing the risk extent of the substation monitoring terminal to access the Internet of Things; and in response to the trust degree being less than a third threshold value, determining that there is a security risk for the substation monitoring terminal accesses the Internet of Things.
However, Liang teaches wherein determining whether the substation monitoring terminal has the security risk according to the plurality of [trapezoid] fuzzy sets comprises: according to the plurality of [trapezoid] fuzzy sets, calculating a trust degree of the substation monitoring terminal, wherein the trust degree is used for representing the risk extent of the substation monitoring terminal to access the Internet of Things (Liang – P. 3: The purpose of the invention is to provide Internet of Things for evaluating the node based on fuzzy evidence theory, by using fuzzy theory and D-S evidence theory fusion method, evaluating the complete confidence of the node, realizing accurate and effective discovery of malicious nodes in the network, improving the security of the network in the Internet of Things; and P. 8: kind of based on fuzzy evidence theory of the Internet of Things node evaluation method, specifically comprising the following steps: S1, through different behaviours of the network node, defining 7 kinds of confidence factors F1, F2,F3, F4, F5, F6, F7; the confidence factor respectively step S1 is the data success rate of the node in the network, data integrity, data availability, data receiving packet rate, data forwarding rate, time factor and safety level … (1) the node energy in the Internet of Things is extremely limited, for ensuring the correct transmission of the data to relay when intercepting and transmitting data, analyzing and judging whether the node is attacked by analyzing the data success rate F1 of the node; wherein F1 represents the data transmission rate factor, ACKi, j (t) represents the number of data packet successfully forwarded between adjacent nodes, TPi, j (t) is the number of data packet required to be forwarded by the node; (2) when the data packet of one node is sent to the next node, source node will monitor whether the data packet is falsified in a certain time, ensuring the integrity F2 of the data of the node has important function for the transmission safety the node; wherein F2 represents a data integrity factor; IPi, j (t) represents the number of data packets that have not been tampered and successfully transmitted; FPi, j (t) represents the number of data packets required to be transmitted); and in response to the trust degree being less than a third threshold value, determining that there is a security risk for the substation monitoring terminal accesses the Internet of Things (Liang – P. 10: S63, according to the confidence factor on each trust fuzzy set membership size to divide the information of the node, using non-trust: 0 ≤μ T1 <25, generally trust: 25 < μ T2 < 50, very trust: 50 < μT3 < 75, full trust: 75 ≤μ T4 <100 represents the trust level; and P. 8: (1) the node energy in the Internet of Things is extremely limited, for ensuring the correct transmission of the data to relay when intercepting and transmitting data, analyzing and judging whether the node is attacked by analyzing the data success rate F1 of the node; wherein F1 represents the data transmission rate factor, ACKi, j (t) represents the number of data packet successfully forwarded between adjacent nodes, TPi, j (t) is the number of data packet required to be forwarded by the node).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, Zhi, and O’Connell, further incorporating Liang to arrive at the claimed invention. One would be motivated to incorporate Liang’s teaching to generate fuzzy sets corresponding to confidence factors to perform threshold-based trust determinations of an observed IoT node into Hao, Gu, Zhi, and O’Connell’s method for determining security risks in an electric substation. Liang’s added techniques provide pre-determined decision points for detecting communication/device abnormalities.
Regarding Claim 15:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 14.
The combination of Hao, Gu, Zhi, and O’Connell does not expressly teach wherein the miss rates are used for measuring the integrity of the data transmission or processing.
However, Liang teaches wherein the miss rates are used for measuring the integrity of the data transmission or processing (Liang – P. 8: (2) when the data packet of one node is sent to the next node, source node will monitor whether the data packet is falsified in a certain time, ensuring the integrity F2 of the data of the node has important function for the transmission safety the node; wherein F2 represents a data integrity factor; IPi, j (t) represents the number of data packets that have not been tampered and successfully transmitted; FPi, j (t) represents the number of data packets required to be transmitted).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, Zhi, and O’Connell, further incorporating Liang to arrive at the claimed invention. One would be motivated to incorporate Liang’s association of data integrity with a determination of a number of successfully transmitted packets relative to an expected number of transmitted packets into Hao, Gu, Zhi, and O’Connell’s method for determining security risks in an electric substation. Such a data integrity measure enhances the method with another characteristic for detecting anomalous network activity.
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hao in view of Gu, Zhi, O’Connell, and Mohammad et al. (US 20210329023 A1), hereinafter Mohammad.
Regarding Claim 9:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 8.
The combination of Hao, Gu, Zhi, and O’Connell does not expressly teach wherein the attack counts are used for evaluating the security and robustness of the data system or the network.
However, Mohammad teaches wherein the attack counts are used for evaluating the security and robustness of the data system or the network (Mohammad – Paragraph [0131]: Some implementations provide a critical review of existing security modeling frameworks for Smart Grids. Some implementations propose, implement, and analyze a Probabilistic Model Checking (PMC) solution for modeling a Smart Grid security attack process. Some implementations study the effect of various system parameters (e.g., the attack location, the attack probability, the attack consequences) on the robustness of a security risk analysis system (the attack success rate, the attack costs, and the number of attack attempts)).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, Zhi, and O’Connell, further incorporating Mohammad to arrive at the claimed invention. One would be motivated to incorporate Mohammad’s security system robustness determination based at least on a number of attacks into Hao, Gu, Zhi, and O’Connell’s method for determining security risks in an electric substation. The additional functionality establishes a practical relationship between the observed data and its effect on the system.
Claim(s) 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hao in view of Gu, Zhi, O’Connell, and Wu et al. (US 20210144707 A1), hereinafter Wu.
Regarding Claim 17:
The combination of Hao, Gu, Zhi, and O’Connell teaches the method as claimed in claim 16.
The combination of Hao, Gu, Zhi, and O’Connell does not expressly teach wherein the channel blocking rates are used for measuring the load and efficiency of the data transmission.
However, Wu teaches wherein the channel blocking rates are used for measuring the load and efficiency of the data transmission (Wu – Paragraph [061]: As an example, base station 110 may determine a measurement associated with a CBR, a channel occupancy ratio, an RSSI, and RSRP, an RSRQ, and/or the like. In some aspects, base station 110 may determine a smaller spectral efficiency range, a spectral efficiency range associated with lower spectral efficiencies, and/or the like, when the measurement indicates a higher load level (e.g., a load level satisfying a threshold value) and/or a higher interference level (e.g., an interference level satisfying a threshold value) for the set of resources, and may determine a higher spectral efficiency range, a spectral efficiency range associated with higher spectral efficiencies, and/or the like, when the measurement indicates a lower load level or a lower interference level for the set of resources).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Hao, Gu, Zhi, and O’Connell, further incorporating Wu to arrive at the claimed invention. One would be motivated to incorporate Wu’s teaching to use channel blocking rates to determine measurements indicating data transmission load and efficiency into Hao, Gu, Zhi, and O’Connell’s method for determining security risks in an electric substation. This combination further enhances the method by deriving additional details for evaluating network traffic based on observed data characteristics.
Allowable Subject Matter
Claims 2, 4, and 7 would be allowable if rewritten to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph, set forth in this Office action and to include all of the limitations of the base claim and any intervening claims.
Specifically, none of the cited prior-art references by Hao, Gu, Zhi, O’Connell, and Wu, whether singularly or in combination, teach or suggest the feature limitations of claims 2, 4 and 7. In addition, the searches conducted do not yield any references that reasonably teach or suggest every feature limitations of claims 2, 4 and 7.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Zeng et al. (CN 112417442 A) teaches a layered protection system for a power internet of things network including fuzzy evaluation of the system’s protection capability
Wangyang et al. (CN 111614615 A) teaches a substation power monitoring network security system including fuzzy comprehensive evaluations to detect security threats
Yin et al. (CN 112396292 A) teaches a system for detecting abnormal or malfunctioning devices in a power grid network toward enhancing their functionality/security
Zhang et al. (Zhang, M., Fang, J., Mo, W., Wang, H., Ma, J., Luo, L., & Hao, F. (2020). Development of the monitoring system in the Smart Distribution Substation in Guangzhou, China. 2020 International Conference on Wireless Communications and Smart Grid (ICWCSG), 159–162. https://doi.org/10.1109/icwcsg50807.2020.00042) demonstrates a system providing a foundation for enhancing automated cyber and physical security of electrical power substations
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICHOLAS JOSEPH DILUZIO whose telephone number is (703)756-1229. The examiner can normally be reached Mon - Fri -- 7:30 AM - 5 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached at 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NICHOLAS JOSEPH DILUZIO/Examiner, Art Unit 2498
/YIN CHEN SHAW/Supervisory Patent Examiner, Art Unit 2498
