Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1 and 3-6 have been amended.
Claim 2 has been cancelled.
Claims 1 and 3-6 are pending.
Response to Arguments
With respect to arguments regarding 112(f), this argument is persuasive, and the 112(f) interpretation is withdrawn in view of the amendments.
With respect to arguments regarding 112(b), this argument is persuasive, and the 112(b) rejections are withdrawn in view of the amendments.
With respect to the argument that the cited references do not teach “execute code verification of the electronic control device including by verifying whether a program executed by the electronic control device has been subject to tampering,” this argument is moot in view of the new grounds for rejection.
With respect to the argument that the cited references do not teach “determine that the abnormality is caused by an attack from an outside of the vehicle in a case where the electronic control unit determines that communication is present and determines that an abnormality has occurred in the electronic control device after occurrence of the communication”, examiner respectfully disagrees. Paragraph [0028] of Tsurumi describes the identification of a replacement attack because of identifying a second message from outside of the vehicle, and a replacement attack is when a normal message is replaced with an abnormal message. This indicates that messages are the attacks themselves which indicates that the attacks are coming from outside of the vehicle.
With respect to arguments regarding claims 4-6, this argument is not persuasive, as these claims depend on rejected claim 1.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1 and 3 is/are rejected under 35 U.S.C. 103 as being unpatentable over Haga (CN 105637803 A, hereinafter referred to as Haga) in view of Tsurumi (WO 2020137743 A1, hereinafter referred to as Tsurumi) in further view of Traenkenschuh (US 20090125985 A1, hereinafter referred to as Traenkenschuh).
Regarding claim 1, Haga discloses: A state determination device which determines an abnormal state of an electronic control device mounted on a vehicle (Haga: Paragraph [0119] states, "one technical solution disclosed herein relates to an abnormality detection electronic control unit (abnormality detection ECU), which is connected to a bus used in communication by multiple electronic control units that communicate according to the CAN protocol, i.e., the Controller Area Network protocol. The abnormality detection electronic control unit includes: a frame transceiver unit for receiving frames from the bus and sending frames to the bus; and an abnormal MAC detection unit for verifying that a message authentication code (MAC) is appended to the frame received by the frame transceiver unit. If the verification performed by the abnormal MAC detection unit fails, the frame transceiver unit sends a MAC key update request frame, which represents a request to update the MAC key used in the generation of the message authentication code."), but fails to explicitly disclose: the state determination device comprising: an electronic control unit configured to: monitor a presence or an absence of communication between the electronic control device and an outside of the vehicle.
However, in the same field of endeavor, Tsurumi discloses: the state determination device comprising: an electronic control unit configured to: monitor a presence or an absence of communication between the electronic control device and an outside of the vehicle (Tsurumi: Paragraph [0047] states, "The attack detection device 140 comprises an abnormality determination unit 141, an attack determination unit 142, and a transmitting/receiving unit 143." Paragraph [0075] states, "The observation of the diagnostic packet refers to the observation of the diagnostic packet as a diagnostic message while vehicle 1 is in motion. Specifically, the attack determination unit 142 determines whether the third message, which is the diagnostic message mentioned above that is transmitted to the in-vehicle network 100 from outside the vehicle 1 when the vehicle 1 is not moving, is transmitted to the in-vehicle network 100 when the vehicle 1 is moving. The attack determination unit 142 then determines that the cause of the abnormality is an attack if it determines that a third message has been transmitted while the vehicle 1 is moving.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Haga and include the above limitation with the teaching of Tsurumi in order to "more accurately determine events occurring in a network mounted on a mobile object such as a vehicle" (Tsurumi: Paragraph [0006]).
This motivation applies to the remainder of the claim.
Tsurumi fails to explicitly disclose: execute code verification of the electronic control device including by verifying whether a program executed by the electronic control device has been subject to tampering.
However, in the same field of endeavor, Traenkenschuh discloses: execute code verification of the electronic control device including by verifying whether a program executed by the electronic control device has been subject to tampering (Traenkenschuh: Paragraph [0040] states, "code-loading hardware 250 may inspect metadata and/or digital signatures and, in particular, may determine whether ECU code has been revoked, tampered with, corrupted, or whether an operator is authorized to load the ECU code.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Haga as modified by Tsurumi and include the above limitation with the teaching of Traenkenschuh for "securing electronic control unit (ECU) code" (Traenkenschuh: Paragraph [0018]).
Haga further discloses: monitor occurrence or non-occurrence of abnormality of the electronic control device (Haga: Paragraph [0194] states, "The abnormal detection ECU100a is configured to include a frame transceiver unit 160, a frame parsing unit 150, an abnormal frame detection unit 130, a normal ID list holding unit 120, an abnormal detection counter holding unit 110, and a frame generation unit 140. These components are functional components, and each function is achieved through abnormal detection of communication lines in ECU100a, processors or digital circuits that execute control programs stored in memory, etc. In addition, the abnormal detection ECU100b has basically the same structure, but the content of the list information (normal ID list) maintained by the normal ID list holding unit 120 is different for the abnormal detection ECU100a and the abnormal detection ECU100b." Paragraph [0197] states, "The abnormal frame detection unit 130 receives the value of the ID field notified by the frame parsing unit 150 and determines whether the value of the ID field meets the predetermined conditions for indicating an abnormality."), but fails to explicitly disclose: and determine a factor of the abnormality, identify the factor of the abnormality based on a presence or an absence of communication, a result of the code verification, and existence or non-existence of the abnormality, and determine that the abnormality is caused by an attack from an outside of the vehicle in a case where the electronic control unit determines that communication is present and determines that an abnormality has occurred in the electronic control device after occurrence of the communication.
However, Tsurumi further discloses: and determine a factor of the abnormality (Tsurumi: Paragraph [0055] states, "if a message is determined to be abnormal, it is further determined whether the cause of the abnormality in the message is an attack or not, allowing for a more accurate determination of events occurring in the in-vehicle network 100. In other words, it is possible to determine whether the cause of the anomaly is an attack, or a cause other than an attack, such as a malfunction or bug."), identify the factor of the abnormality based on a presence or an absence of communication, [a result of the code verification,] and existence or non-existence of the abnormality (Tsurumi: Paragraph [0058] states, "the additional attack has three characteristics. The first characteristic (hereinafter also referred to as attack characteristic 1) is that the amount of data increases. When normal messages are periodically flowing through the network, abnormal messages are also sent through the network, increasing the amount of data per unit of time. The second characteristic (hereinafter also referred to as attack characteristic 2) is that normal and abnormal messages coexist within the same time period. For example, normal messages and abnormal messages are sent alternately. The third characteristic (hereinafter also referred to as attack characteristic 4) is that anomalies occur simultaneously in multiple types of messages that are related to each other." Paragraph [0060] states, "in cases of causes other than attack, the attack characteristics 1-4 and 3a described above are either not present or are not prominent."), and determine that the abnormality is caused by an attack from an outside of the vehicle in a case where the electronic control unit determines that communication is present and determines that an abnormality has occurred in the electronic control device after occurrence of the communication (Tsurumi: Paragraph [0028] states, "if the determination unit determines that a second message transmitted to the network from outside the mobile body when the mobile body is stopped moving is transmitted to the network when the mobile body is moving, it may identify the type of attack as a replacement attack, in which a normal message is replaced with an abnormal message." Examiner's note: the message is the attack, which means the attack is from outside the vehicle.), but fails to explicitly disclose: the abnormality based on…a result of the code verification.
However, Haga further discloses: the abnormality based on…a result of the code verification (Haga: Paragraph [0312] states, "The predetermined condition indicating an abnormality is the failure of verification in the set verification processing steps (including steps such as MAC generation and MAC comparison), that is, the MAC contained in the data is different from the MAC generated by the MAC generation unit 3170." Paragraph [0007] states, "Message Authentication Code (MAC).").
Regarding claim 3, Haga discloses: The state determination device according to claim 1, wherein the electronic control unit is further configured to execute code verification of the electronic control device after a determination that an abnormality has occurred in the electronic control device (Haga: Paragraph [0007] states, "Message Authentication Code (MAC)." Paragraph [0194] states, "The abnormal detection ECU100a is configured to include a frame transceiver unit 160, a frame parsing unit 150, an abnormal frame detection unit 130, a normal ID list holding unit 120, an abnormal detection counter holding unit 110, and a frame generation unit 140. These components are functional components, and each function is achieved through abnormal detection of communication lines in ECU100a, processors or digital circuits that execute control programs stored in memory, etc. In addition, the abnormal detection ECU100b has basically the same structure, but the content of the list information (normal ID list) maintained by the normal ID list holding unit 120 is different for the abnormal detection ECU100a and the abnormal detection ECU100b." Paragraph [0197] states, "The abnormal frame detection unit 130 receives the value of the ID field notified by the frame parsing unit 150 and determines whether the value of the ID field meets the predetermined conditions for indicating an abnormality." Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure)." Paragraph [0312] states, "if the MAC verification is successful (the values of the two compared MACs are consistent), the abnormal MAC detection unit 4131 notifies the MAC generation unit 3170 so that the counter value corresponding to the message ID held by the counter holding unit 3190 is incremented."), but fails to explicitly disclose: and correct the abnormality as being caused by a failure of the electronic control device in a case where the result of the code verification indicates normal.
However, Tsurumi further discloses: and correct the abnormality as being caused by a failure of the electronic control device [in a case where the result of the code verification indicates normal] (Tsurumi: Paragraph [0055] states, "if a message is determined to be abnormal, it is further determined whether the cause of the abnormality in the message is an attack or not, allowing for a more accurate determination of events occurring in the in-vehicle network 100. In other words, it is possible to determine whether the cause of the anomaly is an attack, or a cause other than an attack, such as a malfunction or bug." Paragraph [0060] states, "in cases of causes other than attack, the attack characteristics 1-4 and 3a described above are either not present or are not prominent.").
The same motivation to modify with Tsurumi, as in claim 1, applies.
Tsurumi fails to explicitly disclose: in a case where the result of the code verification indicates normal.
However, Haga further discloses: in a case where the result of the code verification indicates normal (Haga: Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure)." [0312] states, "The predetermined condition indicating an abnormality is the failure of verification in the set verification processing steps (including steps such as MAC generation and MAC comparison), that is, the MAC contained in the data is different from the MAC generated by the MAC generation unit 3170. The abnormal MAC detection unit 4131 determines whether the MAC is abnormal by comparing the MAC obtained from the MAC generation unit 3170 with the MAC in the data field (i.e., MAC verification).").
Claim(s) 4-6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Haga (CN 105637803 A, hereinafter referred to as Haga) in view of Tsurumi (WO 2020137743 A1, hereinafter referred to as Tsurumi) in further view of Traenkenschuh (US 20090125985 A1, hereinafter referred to as Traenkenschuh) in further view of Nakamura (US 20220166365 A1, hereinafter referred to as Nakamura).
Regarding claim 4, the combination of Haga as modified by Tsurumi discloses: The state determination device according to claim 1 wherein the electronic control unit is further configured to execute code verification of the electronic control device in a case where a determination is made that communication is present (Haga: Paragraph [0007] states, "Message Authentication Code (MAC)." Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure).") but fails to explicitly disclose: and a determination is not made that an abnormality has occurred in the electronic control device after occurrence of the communication.
However, in the same field of endeavor, Nakamura discloses: and a determination is not made that an abnormality has occurred in the electronic control device after occurrence of the communication (Nakamura: Paragraph [0121] states, "when the communication between the microcomputers is normal and the cooperative drive is in progress, the process proceeds to S204 and the cooperative drive is continued, and when the cooperative drive is not in progress, the process proceeds to S203.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Haga as modified by Tsurumi and include the above limitation with the teaching of Nakamura so that "after the abnormality is confirmed, it is possible to appropriately return to the normal control" (Nakamura: Paragraph [0127]).
Nakamura fails to explicitly disclose: and determine that an attack from an outside of the vehicle has been applied to the electronic control device in a case where the result of the code verification indicates abnormal.
However, Tsurumi discloses: and determine that an attack from an outside of the vehicle has been applied to the electronic control device [in a case where the result of the code verification indicates abnormal] (Tsurumi: Paragraph [0055] states, "if a message is determined to be abnormal, it is further determined whether the cause of the abnormality in the message is an attack or not, allowing for a more accurate determination of events occurring in the in-vehicle network 100. In other words, it is possible to determine whether the cause of the anomaly is an attack, or a cause other than an attack, such as a malfunction or bug." Paragraph [0064] states, "For example, the anomaly determination unit 141 determines whether or not the cause of the anomaly is an attack, based on the attack characteristics 1 to 4 shown in Figure 3." Paragraph [0075] states, "The observation of the diagnostic packet refers to the observation of the diagnostic packet as a diagnostic message while vehicle 1 is in motion. Specifically, the attack determination unit 142 determines whether the third message, which is the diagnostic message mentioned above that is transmitted to the in-vehicle network 100 from outside the vehicle 1 when the vehicle 1 is not moving, is transmitted to the in-vehicle network 100 when the vehicle 1 is moving. The attack determination unit 142 then determines that the cause of the abnormality is an attack if it determines that a third message has been transmitted while the vehicle 1 is moving.").
The same motivation to modify with Tsurumi, as in claim 1, applies.
Tsurumi fails to explicitly disclose: in a case where the result of the code verification indicates abnormal.
However, Haga further discloses: in a case where the result of the code verification indicates abnormal (Haga: Paragraph [0007] states, "Message Authentication Code (MAC)." Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure).").
Regarding claim 5, Tsurumi discloses: The state determination device according to claim 1 wherein the electronic control unit is further configured to in a case where [a determination is not made that communication is present,] determine that an abnormality has occurred in the electronic control device, and determine that the abnormality is caused by a failure of the electronic control device (Tsurumi: Paragraph [0055] states, "if a message is determined to be abnormal, it is further determined whether the cause of the abnormality in the message is an attack or not, allowing for a more accurate determination of events occurring in the in-vehicle network 100. In other words, it is possible to determine whether the cause of the anomaly is an attack, or a cause other than an attack, such as a malfunction or bug." Paragraph [0060] states, "in cases of causes other than attack, the attack characteristics 1-4 and 3a described above are either not present or are not prominent.").
The same motivation to modify with Tsurumi, as in claim 1, applies.
Tsurumi fails to explicitly disclose: a determination is not made that communication is present.
However, in the same field of endeavor, Nakamura discloses: a determination is not made that communication is present (Nakamura: Paragraph [0078] states, "it is determined whether the state in which communication is not possible is due to an abnormality in the control unit of the other system or due to an abnormality in communication between microcomputers.").
same motivation to modify with Nakamura, as in claim 4, applies.
Regarding claim 6, Haga discloses: The state determination device according to claim 5 wherein the electronic control unit is further configured to execute code verification of the electronic control device in a case where a determination is made that an abnormality has occurred in the electronic control device (Tsurumi: Paragraph [0007] states, "Message Authentication Code (MAC)." Paragraph [0194] states, "The abnormal detection ECU100a is configured to include a frame transceiver unit 160, a frame parsing unit 150, an abnormal frame detection unit 130, a normal ID list holding unit 120, an abnormal detection counter holding unit 110, and a frame generation unit 140. These components are functional components, and each function is achieved through abnormal detection of communication lines in ECU100a, processors or digital circuits that execute control programs stored in memory, etc. In addition, the abnormal detection ECU100b has basically the same structure, but the content of the list information (normal ID list) maintained by the normal ID list holding unit 120 is different for the abnormal detection ECU100a and the abnormal detection ECU100b." Paragraph [0197] states, "The abnormal frame detection unit 130 receives the value of the ID field notified by the frame parsing unit 150 and determines whether the value of the ID field meets the predetermined conditions for indicating an abnormality." Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure)."), but fails to explicitly disclose: and determine that the abnormality is caused by a failure of the electronic control device or a physical attack from an outside in a case where the result of the code verification indicates abnormal.
However Tsurumi further discloses: and determine that the abnormality is caused by a failure of the electronic control device or a physical attack from an outside [in a case where the result of the code verification indicates abnormal] (Tsurumi: Paragraph [0055] states, "if a message is determined to be abnormal, it is further determined whether the cause of the abnormality in the message is an attack or not, allowing for a more accurate determination of events occurring in the in-vehicle network 100. In other words, it is possible to determine whether the cause of the anomaly is an attack, or a cause other than an attack, such as a malfunction or bug.").
The same motivation to modify with Tsurumi, as in claim 1, applies.
Tsurumi fails to explicitly disclose: in a case where the result of the code verification indicates abnormal.
However, Haga discloses: in a case where the result of the code verification indicates abnormal (Haga: Paragraph [0007] states, "Message Authentication Code (MAC)." Paragraph [0283] states, "the abnormality detection ECU3100a determines whether the content of the ID field in the sent frame meets the predetermined conditions for indicating abnormality (MAC verification failure).").
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHREYAJ RAM BHANDARI whose telephone number is (571)272-0727. The examiner can normally be reached 7:30-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHREYAJ RAM BHANDARI/ Examiner, Art Unit 2434
/NOURA ZOUBAIR/ Primary Examiner, Art Unit 2434
Prosecution Insights