DETAILED ACTION
This first non-final action is in response to applicants’ original filing on 09/20/2024. Claims 1-11 are currently pending and have been considered as follows.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Drawings
The drawings filed on 09/20/2024 are accepted.
Priority
Acknowledgment is made of applicants’ claim for foreign priority under 35 U.S.C. 119(a)-(d). The certified copy has been retrieved on 02/25/2025.
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 09/20/2024 and 06/03/2025 have been placed in the application file, and the information referred therein has been considered as to the merits.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-11 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Asenjo et al. (US 20140337086 A1, IDS submitted 06/03/2025, hereinafter Asenjo).
As to Claim 1:
Asenjo discloses a processing device (e.g. Asenjo “a cloud-based risk assessment system running as a service on a cloud platform can collect and monitor device, asset, and system data from participating industrial facilities and enterprises” [0009]) comprising:
processing circuitry (e.g. Asenjo “a process running on a processor, a processor” [0036]; [0053]) configured to:
collect communication data of an Operational Technology network (e.g. Asenjo “At the device level, the collected data can include device configuration information (e.g., device identifier, firmware version, configurations settings, etc.) as well as real-time status information for the devices (health and diagnostics, faults, alarms, etc.). At the asset and system levels, the collected data can include such information as asset key performance indicators (KPIs), process variables, and characterizations of larger system behavior over time. The risk assessment system can also collect relevant data from supply chain entities connected to the industrial enterprise (e.g., suppliers, warehouses, retail, etc.)” [0009]; plant network [0042]; [0045]; “a Common Industrial Protocol (CIP) network” [0071]);
acquire information presenting a business type and a scale of a business facility in which the Operational Technology network is built (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “System data 412 can also document the particular system configurations in use and industrial operations performed at each industrial system 416. For example, system data 412 can document the arrangement of assets, interconnections between devices, the product being manufactured at a given facility, an industrial process performed by the assets, a category of industry of each industrial system (e.g., automotive, oil and gas, food and drug, marine, textiles, etc.)” [0066]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]);
specify a communication environment of the Operational Technology network based on the communication data (e.g. Asenjo “The system can also track network traffic on the plant network in order to identify potential risks associated with network overload. For example, the risk assessment system may determine that network traffic through a particular network infrastructure device creates a risk of data traffic bottlenecking, which may result in slower response times for critical devices. Accordingly, the system may recommend replacing the network infrastructure device with a higher capacity device, or reconfiguring the network to distribute the identified network traffic more evenly” [0109]);
make an evaluation on the communication environment of the Operational Technology network based on a reference value that is set according to the business type and the scale of the business facility (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]); and
generate a report presenting a result of the evaluation made (e.g. Asenjo “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]).
As to Claim 2:
Asenjo discloses the processing device according to claim 1, wherein the processing circuitry is further configured to:
based on the communication data, specify any one, some, or all of a number of communication devices of the Operational Technology network (e.g. Asenjo “Risk assessment system 202 can organize manufacturing data collected from industrial systems 416 according to various classes. In the illustrated example, manufacturing data is classified according to device data 406, process data 408, asset data 410, and system data 412. FIG. 5 illustrates a hierarchical relationship between these example data classes. A given plant or supply chain 502 can comprise one or more industrial systems 504. Systems 504 represent the production lines or productions areas within a given plant facility or across multiple facilities of a supply chain. Each system 504 is made up of a number of assets 506 representing the machines and equipment that make up the system (e.g., the various stages of a production line). In general, each asset 506 is made up of multiple devices 508, which can include, for example, the programmable controllers, motor drives, human-machine interfaces (HMIs), sensors, meters, etc. comprising the asset 506” [0062]), a type of an Operating System that is used by the communication device (e.g. Asenjo “Returning now to FIG. 4, risk assessment system 202 collects and maintains data from the various devices and assets that make up industrial systems 416 and classifies the data according to the aforementioned classes for the purposes of collective analysis and risk assessment. Device data 406 can comprise device-level information relating to the identity, configuration, and status of the respective devices comprising industrial systems 416, including but not limited to device identifiers, device statuses, current firmware versions, health and diagnostic data, device documentation, identification and relationship of neighboring devices that interact with the device, etc” [0063]), the number of communication devices in which an OS of a version older than a given version is installed, a number of hosts that are deleted and/or added during a specified period, a type and a number of ports that are used in the Operational Technology network, the number of the communication devices having a Dynamic Host Configuration Protocol server function, and the number of the communication devices having performed communication for a given time or less,
make an evaluation on any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo “System data 412 can also document the particular system configurations in use and industrial operations performed at each industrial system 416. For example, system data 412 can document the arrangement of assets, interconnections between devices” [0066]; “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less, and
generate a report associating a result of each evaluation made on any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 3:
Asenjo discloses the processing device according to claim 2, wherein the processing circuitry is further configured to estimate a scale of the business facility based on the number of communication device of the Operational Technology network (e.g. Asenjo “some cloud-aware devices can comprise smart devices capable of determining their own context within the plant or enterprise environment. Such devices can determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels” [0073]; “the cloud-based risk assessment system can maintain a plant model for a given industrial enterprise based on the data collected as described above. To this end, services executing on the cloud platform can facilitate automatic integration of new or existing industrial devices into the plant model. Pursuant to an example, FIG. 9 illustrates automatic integration of a cloud-aware smart device within a larger device hierarchy” [0077]; “Device management component 208 can maintain a plant model 906 that models the industrial enterprise and devices therein. Plant model 906 can represent the industrial enterprise in terms of multiple hierarchical levels, where each level comprises units of the enterprise organized as instances of types and their properties. Exemplary types can include, for example, assets (e.g., pumps, extruders, tanks, fillers, welding cells, utility meters, etc.), structures” [0078]; [0080]; [0081]).
As to Claim 4:
Asenjo discloses the processing device according to claim 2, wherein each reference value is set according to the business type of the business facility and the scale of the business facility with respect to each of any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 5:
Asenjo discloses the processing device according to claim 3, wherein each reference value is set according to the business type of the business facility and the scale of the business facility with respect to each of any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 6:
Asenjo discloses the processing device according to claim 2, wherein the processing circuitry is further configured to generate a report associating, with the result of each evaluation made, content presenting a risk that is assumed with respect to any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo FIG. 12; “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 7:
Asenjo discloses the processing device according to claim 3, wherein the processing circuitry is further configured to generate a report associating, with the result of each evaluation made, content presenting a risk that is assumed with respect to any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo FIG. 12; “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 8:
Asenjo discloses the processing device according to claim 4, wherein the processing circuitry is further configured to generate a report associating, with the result of each evaluation made, content presenting a risk that is assumed with respect to any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo FIG. 12; “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 9:
Asenjo discloses the processing device according to claim 5, wherein the processing circuitry is further configured to generate a report associating, with the result of each evaluation made, content presenting a risk that is assumed with respect to any one, some, or all of the number of communication devices of the Operational Technology network, a type of an OS that is used by the communication device (e.g. Asenjo FIG. 12; “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]), the number of communication devices in which an OS of a version older than a given version is installed, the number of hosts that are deleted and/or added during a specified period, a type and the number of ports that are used in the Operational Technology network, the number of the communication devices having a DHCP server function, and the number of the communication devices having performed communication for a given time or less.
As to Claim 10:
Asenjo discloses a processing method that a processing device executes (e.g. Asenjo “FIG. 16 illustrates an example methodology 1600 for performing a risk assessment for an industrial enterprise using cloud-based service” [0118]), the processing method comprising:
collecting communication data of an Operational Technology network (e.g. Asenjo “At the device level, the collected data can include device configuration information (e.g., device identifier, firmware version, configurations settings, etc.) as well as real-time status information for the devices (health and diagnostics, faults, alarms, etc.). At the asset and system levels, the collected data can include such information as asset key performance indicators (KPIs), process variables, and characterizations of larger system behavior over time. The risk assessment system can also collect relevant data from supply chain entities connected to the industrial enterprise (e.g., suppliers, warehouses, retail, etc.)” [0009]; plant network [0042]; [0045]; “a Common Industrial Protocol (CIP) network” [0071]);
acquiring information presenting a business type and a scale of a business facility in which the Operational Technology network is built (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “System data 412 can also document the particular system configurations in use and industrial operations performed at each industrial system 416. For example, system data 412 can document the arrangement of assets, interconnections between devices, the product being manufactured at a given facility, an industrial process performed by the assets, a category of industry of each industrial system (e.g., automotive, oil and gas, food and drug, marine, textiles, etc.)” [0066]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]);
specifying a communication environment of the Operational Technology network based on the communication data (e.g. Asenjo “The system can also track network traffic on the plant network in order to identify potential risks associated with network overload. For example, the risk assessment system may determine that network traffic through a particular network infrastructure device creates a risk of data traffic bottlenecking, which may result in slower response times for critical devices. Accordingly, the system may recommend replacing the network infrastructure device with a higher capacity device, or reconfiguring the network to distribute the identified network traffic more evenly” [0109]);
making an evaluation on the communication environment of the Operational Technology network based on a reference value that is set according to the business type and the scale of the business facility (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]); and
generating a report presenting a result of the evaluation made at the making an evaluation (e.g. Asenjo “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]).
As to Claim 11:
Asenjo discloses a non-transitory computer-readable recording medium storing therein a processing program (e.g. Asenjo “a computer-readable medium having computer-executable instructions for performing the acts and/or events of the various methods” [0144]) that causes a computer to execute a process comprising:
collecting communication data of an Operational Technology network (e.g. Asenjo “At the device level, the collected data can include device configuration information (e.g., device identifier, firmware version, configurations settings, etc.) as well as real-time status information for the devices (health and diagnostics, faults, alarms, etc.). At the asset and system levels, the collected data can include such information as asset key performance indicators (KPIs), process variables, and characterizations of larger system behavior over time. The risk assessment system can also collect relevant data from supply chain entities connected to the industrial enterprise (e.g., suppliers, warehouses, retail, etc.)” [0009]; plant network [0042]; [0045]; “a Common Industrial Protocol (CIP) network” [0071]);
acquiring information presenting a business type and a scale of a business facility in which the Operational Technology network is built (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “System data 412 can also document the particular system configurations in use and industrial operations performed at each industrial system 416. For example, system data 412 can document the arrangement of assets, interconnections between devices, the product being manufactured at a given facility, an industrial process performed by the assets, a category of industry of each industrial system (e.g., automotive, oil and gas, food and drug, marine, textiles, etc.)” [0066]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]);
specifying a communication environment of the Operational Technology network based on the communication data (e.g. Asenjo “The system can also track network traffic on the plant network in order to identify potential risks associated with network overload. For example, the risk assessment system may determine that network traffic through a particular network infrastructure device creates a risk of data traffic bottlenecking, which may result in slower response times for critical devices. Accordingly, the system may recommend replacing the network infrastructure device with a higher capacity device, or reconfiguring the network to distribute the identified network traffic more evenly” [0109]);
making an evaluation on the communication environment of the Operational Technology network based on a reference value that is set according to the business type and the scale of the business facility (e.g. Asenjo “the risk assessment system can identify risk factors for a given industrial enterprise based in part on comparison of customer data with data collected from similar customers using similar industrial assets and configurations, learned trends based on big data analysis, or other analysis techniques. The system can also identify device- and configuration-specific risk factors based on learned risks associated with particular device combinations and/or configurations in use at multiple industrial facilities” [0010]; “risk assessment component 210 can compare a system configuration for a given industrial facility with the large set of data collected for similar industrial applications in use at other industrial facilities. Based on the comparison, risk assessment component 210 can identify risk factors common to similarly configured industrial systems and determine whether the system configuration under investigation is susceptible to such risk factors” [0051]; “maintain a customer model 404 containing data specific to a given industrial entity or customer. Customer model 404 contains customer-specific information… can include… the customer's industrial concern (e.g., automotive, pharmaceutical, oil and gas, etc.), and other such information. Risk assessment system 202 can marry data collected for each customer with the customer model for identification and event handling purposes” [0068]; “determine their location within a hierarchical plant context or device topology. Data generated by such devices can adhere to a hierarchical plant model that defines multiple hierarchical levels of an industrial enterprise (e.g., a workcell level, a line level, an area level, a site level, an enterprise level, etc.), such that the data is identified in terms of these hierarchical levels… model an enterprise according to such an organizational hierarchy can represent industrial controllers, devices, machines, or processes as data structures (e.g., type instances) within this organizational hierarchy to provide context for data generated” [0073]; “risk assessment component 210 may perform comparative analysis on sets of BDFM data corresponding to a particular industrial application, but collected from different industrial enterprises using different combinations of equipment, devices, or assets. Based on this analysis, risk assessment component 210 may determine that a particular combination of devices for performing the industrial application results in sub-standard performance (e.g., higher frequency of downtime events, lower product throughput, suppression of latent functionality, etc.)” [0101]); and
generating a report presenting a result of the evaluation made at the making an evaluation (e.g. Asenjo “The cloud-based risk assessment system can be configured to generate risk assessment reports on demand. In such embodiments, the reports can organize identified risks according to any suitable classification (e.g., classification according to production area, risk types, risk severity or cost, etc.)” [0012]; [0052]; [0060]; [0093]; [0099]; “Accordingly, if risk assessment component 210 determines that a particular customer is using this sub-standard combination of devices or assets (based on analysis of customer data 1202 in view of the inferred BDFM data), the system may generate risk assessment report 1204 identifying the risk associated with use of the particular asset configuration” [0101]; [0104]; [0106]; [0108]; [0112]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicants’ disclosure.
Dembicki et al. (US 20150057771 A1)
BYRON et al. (US 20150301521 A1)
Erickson et al. (US 20190195742 A1)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kenneth Chang whose telephone number is (571)270-7530. The examiner can normally be reached Monday - Friday 9:30am-5:30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KENNETH W CHANG/Primary Examiner, Art Unit 2438
PNG
media_image1.png
35
280
media_image1.png
Greyscale
12.18.2025