DETAILED ACTION
This action is in response to the claims filed 9/20/2024. Claims 1-20 are pending. Independent claims 1 and 13, and corresponding dependent claims are directed towards a system and method for defending against Wi-Fi spoofing attacks.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Drawings
Color photographs and color drawings are not accepted in utility applications unless a petition filed under 37 CFR 1.84(a)(2) is granted. Any such petition must be accompanied by the appropriate fee set forth in 37 CFR 1.17(h), one set of color drawings or color photographs, as appropriate, if submitted via the USPTO patent electronic filing system or three sets of color drawings or color photographs, as appropriate, if not submitted via the via USPTO patent electronic filing system, and, unless already present, an amendment to include the following language as the first paragraph of the brief description of the drawings section of the specification: “The patent or application file contains at least one drawing executed in color. Copies of this patent or patent application publication with color drawing(s) will be provided by the Office upon request and payment of the necessary fee.” Color photographs will be accepted if the conditions for accepting color drawings and black and white photographs have been satisfied. See 37 CFR 1.84(b)(2).
The drawings are objected to because: Figs. 5-6 and 7A-7C are unacceptable due to the clarity that has been lost converting color drawing to black and white (see 37 C.F.R. 1.84 (a)(2) “The color drawings must be of sufficient quality such that all details in the drawings are reproducible in black and white in the printed patent”); and Fig. 4 item 410 is not described in the specification. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The disclosure is objected to because of the following informalities: the first recitation of the following acronyms is not expanded: [0003] GPS; [0027] IEEE; [0028] NFC, 3G, 4G, 5G, CDMA, GSM, LTE and NR; [0035] MAC; [0042] OS; [0068] API; [0087] OFDM and [0093] LTT. Appropriate correction is required.
Claim Objections
Claims 1, 3, 6, 8, 10 and 13-15 are objected to because of the following informalities, shown with suggested amendments: Claim 1 l. 10 “when a determination is made that the group” for proper antecedent basis; Claim 1 ll. 12-13 “an analysis of physical layer attributes of the signals broadcasted by each AP of the group of first APs” for proper antecedent basis; Claim 3 l. 2 “contains at least one falsified signal, and” for proper grammar; Claim 6 l. 3 “product” should be “produce”; Claim 8 l. 2 “Aps” should be “APs”; Claim 10 l. 2 “[[the]]a transceiver” as this is the first recitation; Claim 13 ll. 12-13 “an analysis of physical layer attributes of the signals broadcasted by each AP of the group of first APs” for proper antecedent basis; Claim 14 l. 3 “contains at least one falsified signal” for grammar; Claim 15 l. 2 “determining [[the]]a group of reference APs” as this is the first recitation; and Claim 15 l. 6 “product” should be “produce”. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1 and 13 contains the trademark/trade name “Wi-Fi”. Where a trademark or trade name is used in a claim as a limitation to identify or describe a particular material or product, the claim does not comply with the requirements of 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph. See Ex parte Simpson, 218 USPQ 1020 (Bd. App. 1982). The claim scope is uncertain since the trademark or trade name cannot be used properly to identify any particular material or product. A trademark or trade name is used to identify a source of goods, and not the goods themselves. Thus, a trademark or trade name does not identify or describe the goods associated with the trademark or trade name. In the present case, the trademark/trade name is used to identify/describe “signals” and, accordingly, the identification/description is indefinite. Examiner recommends use of the term “wireless” instead of “Wi-Fi”.
Claim 1 l. 7 recites “detect a group of nearby access points (APs) broadcasting Wi-Fi signals” of which “nearby” is a relative term that renders the claim indefinite. The term “nearby” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “group of nearby access points” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “detect a group of first access points (APs) broadcasting Wi-Fi signals”.
Claim 13 l. 2 recites “detecting a group of nearby access points (APs) broadcasting Wi-Fi signals” of which “nearby” is a relative term that renders the claim indefinite. The term “nearby” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “group of nearby access points” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “detecting a group of first access points (APs) broadcasting Wi-Fi signals”.
Claim 6 ll. 2-4 recite the limitation “when processed by the localization service in combination with corresponding attribute of nearby, will product an expected result if there are no falsified nearby and an unexpected result if there are falsified nearby” which is vague and indefinite due to missing language (e.g. the “attribute of nearby (entity missing)” and “there are no falsified (entity missing) nearby”). It is unclear if the missing object should be a “falsified signal” or a “falsified AP”. For purposes of applying prior art the limitation has been construed as “when processed by the localization service in combination with corresponding attributes of the group of first APse an expected result if there are no falsified APsAPs
Claim 7 ll. 1-2 recite the limitation “wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false” which lacks proper antecedent basis as Claim 1 has only one “identifying” step. For purposes of applying prior art the limitation has been construed as “wherein identifying which APs of the group of first APs is falsified is a different process than making a determination whether the group of first APs contains at least one falsified signal”.
Claim 15 ll. 5-7 recite the limitation “when processed by the localization service in combination with corresponding attribute of nearby, will product an expected result if there are no falsified nearby and an unexpected result if there are falsified nearby” which is vague and indefinite due to missing language (e.g. the “attribute of nearby (entity missing)” and “there are no falsified (entity missing) nearby”). It is unclear if the missing object should be a “falsified signal” or a “falsified AP”. For purposes of applying prior art the limitation has been construed as “when processed by the localization service in combination with corresponding attributes of the group of first APse an expected result if there are no falsified APsAPs”.
Claim 16 ll. 1-2 recite the limitation “wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false” which lacks proper antecedent basis as Claim 1 has only one “identifying” step. For purposes of applying prior art the limitation has been construed as “wherein identifying which APs of the group of first APs is falsified is a different process than determining whether the group of first APs contains at least one falsified signal”.
Claims 2-12 and 14-20 incorporate the deficiencies of claims 1 and 13, respectively, through dependency, and are therefore also rejected.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-2, 7, 10, 13, 16 and 18 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Le et al. “Rogue Access Point Detection and Localization”, published Nov. 29, 2012.
As to claim 1, Le discloses a system for detecting falsified Wi-Fi signals (Le Figure 1 showing system architecture having server, APs and monitors), comprising: a network interface, including a transceiver configured to communicate via packetized information via a Wi-Fi protocol (Le §II¶2-3 laptops using wireless network card and WiFi API); a processor (Le§II¶2-3 laptops and server – require processors); and a memory having stored thereon a set of instructions which (Le§II¶2-3 laptops and server – require memory and OS), when executed by the processor cause the system to: detect a group of nearby access points (APs) broadcasting Wi-Fi signals (Le §II¶1 measure AP data transmission and signal characteristics; Figure 1 showing set of APs and monitors); make a determination whether the group of nearby APs contains at least one falsified Wi-Fi signal (Le §IV(B)¶1 monitors measure WLAN transmissions and detect unmatched or duplicated AP addresses or IDs as potential threats); whenever it is determined that the group of nearby APs does contain at least one falsified Wi-Fi signal, perform an analysis of each AP of the group of nearby APs using at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs); identify which APs of the group of nearby APs is falsified (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs); and initiate a mitigating action relative to the falsified APs that are identified (Le §I¶3 find rogue AP and eliminate the threat).
As to claim 2, Le discloses the invention as claimed as described in claim 1, including wherein the instructions further cause the system to make a request to a localization service in relation to the group of nearby APs (Le §IV(B)¶1 monitors send measured RSSI to server to running localization algorithms to identify and locate the rogue APs).
As to claim 7, Le discloses the invention as claimed as described in claim 1, including wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs – detection of potential rogue AP and identification of rogue AP are different processes).
As to claim 10, Le discloses the invention as claimed as described in claim 7, wherein the instructions further cause the system to perform an analysis on one or more physical layer attributes (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs – localization algorithms using received signal strength indicator (RSSI)).
As to claim 13, Le discloses a method for detecting falsified Wi-Fi signals, the method comprising detecting a group of nearby access point (APs) broadcasting Wi-Fi signals (Le §II¶1 measure AP data transmission and signal characteristics; Figure 1 showing set of APs and monitors); determining whether the group of nearby APs contains at least one falsified Wi-Fi signal (Le §IV(B)¶1 monitors measure WLAN transmissions and detect unmatched or duplicated AP addresses or IDs as potential threats); upon determining that the group of nearby APs does contain at least one falsified Wi-Fi signal, performing an analysis of each AP of the group of nearby APs using at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs); identifying which APs of the group of nearby APs is falsified (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs); and initiating a mitigating action relative to the falsified APs that are identified (Le §I¶3 find rogue AP and eliminate the threat).
As to claim 16, Le discloses the invention as claimed as described in claim 13, including wherein identifying the false nearby APs is a different process than identifying whether at least one nearby AP is false (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs – detection of potential rogue AP and identification of rogue AP are different processes).
As to claim 18, Le discloses the invention as claimed as described in claim 16, including further comprising: performing an analysis on one or more physical layer attributes (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs – localization algorithms using received signal strength indicator (RSSI)).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Le et al. “Rogue Access Point Detection and Localization”, published Nov. 29, 2012, in view of Borovikov et al. (US 2015/0341358 A1), published Nov. 26, 2015.
As to claim 8, Le substantially discloses the invention as claimed as described in claim 7, including identifying the false nearby AP (Le §IV(B)¶1 “once potential rogue APs are detected, all the monitors will measure the RSSI from the suspects” sent to server to run localization algorithms to identify and locate the rogue APs). Le fails to explicitly disclose performing a pair-wise comparison of locations corresponding to the group of nearby APs. Borovikov describes determining trusted wireless access points. With this in mind, Borovikov discloses performing a pair-wise comparison corresponding to the group of nearby APs (Borovikov [0059] pairwise comparing of characteristics obtained from identified wireless access points to determine trusted access point). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the pairwise comparing of AP characteristics with the AP evaluation of Le, such that a pairwise comparison is made of the RSSI values, as it would advantageously allow for a user to trust a connection to a verified AP (Borovikov [0007]).
Claims 11 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Le et al. “Rogue Access Point Detection and Localization”, published Nov. 29, 2012, in view of Drew (US 2015/0088272 A1), published Mar. 26, 2015.
As to claim 11, Le substantially discloses the invention as claimed as described in claim 10, failing, however, to explicitly disclose where the instructions further cause the system to identify a Doppler shift in said Wi-Fi signals. Drew describes automating control of energy consuming devices using analysis of wireless signal patterns inside a structure to detect motion. With this in mind, Drew discloses identifying a Doppler shift in Wi-Fi signals (drew [0020] RF patterns are analyzed to detect motion using Doppler shift of Wi-Fi radio frequencies). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the motion detection of Drew with the rogue access point detection of Le, such that a wireless AP signal is analyzed using Doppler shift to detect motion, as it would advantageously assist in detecting a falsified AP may be in motion.
As to claim 19, Le substantially discloses the invention as claimed as described in claim 18, failing, however, to explicitly disclose further comprising: identifying a Doppler shift in said Wi-Fi signals. Drew discloses identifying a Doppler shift in Wi-Fi signals (drew [0020] RF patterns are analyzed to detect motion using Doppler shift of Wi-Fi radio frequencies). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the motion detection of Drew with the rogue access point detection of Le, such that a wireless AP signal is analyzed using Doppler shift to detect motion, as it would advantageously assist in detecting a falsified AP may be in motion.
Claims 12 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Le et al. “Rogue Access Point Detection and Localization”, published Nov. 29, 2012, in view of Harmon (US 9,882,931 B1), issued Jan. 30, 2018.
As to claim 12, Le substantially discloses the invention as claimed as described in claim 1, including a mitigation action (Le §I¶3 find rogue AP and eliminate the threat). Le fails to explicitly disclose wherein the mitigation action comprises at least one of: disconnect the transceiver from falsified APs or save information associated with falsified APs. Harmon describes detecting potentially illegitimate wireless access points. With this in mind, Harmon discloses wherein the mitigation action comprises disconnecting the transceiver from falsified APs (Harmon col. 12 ll. 53-63 security action to mitigate potential threat from access point is to discontinue connection with wireless access point). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the mitigation of Harmon with the rogue access point detection of Le, such that upon determination of a falsified AP a security action such as disconnection from the AP is taken, as it would advantageously reduce the threat from the AP (Harmon col. 12 ll. 53-63).
As to claim 20, Le substantially discloses the invention as claimed as described in claim 13, including a mitigation action (Le §I¶3 find rogue AP and eliminate the threat). Le fails to explicitly disclose wherein the mitigation action comprises at least one of: disconnecting a transceiver from falsified APs or saving information associated with falsified APs. Harmon discloses wherein the mitigation action comprises disconnecting the transceiver from falsified APs (Harmon col. 12 ll. 53-63 security action to mitigate potential threat from access point is to discontinue connection with wireless access point). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the mitigation of Harmon with the rogue access point detection of Le, such that upon determination of a falsified AP a security action such as disconnection from the AP is taken, as it would advantageously reduce the threat from the AP (Harmon col. 12 ll. 53-63).
Allowable Subject Matter
Claims 3-6, 9, 14-15 and 17 would be allowable if rewritten to overcome the rejection(s) under 35 U.S.C. 112(b), set forth in this Office action and to include all of the limitations of the base claim and any intervening claims.
The following is a statement of reasons for the indication of allowable subject matter:
Regarding claim 3 and its dependent claims, the prior art of record fails to disclose or fairly suggest, in combination, a system for detecting falsified Wi-Fi signals that makes an initial detection of APs, determines if any APs are broadcasting falsified signals, performs an analysis of each AP using either a pair-wise comparison of AP locations or analysis of physical layer attributes of the signals to determine a falsified AP which is then mitigated, as described in claim 1, further including making a request to a localization service in relation to the group of APs, as described in claim 2, and further including where the request includes a group of reference APs located at a known location different from the location of the group of APs, in the specific manner and combination as recited in claim 3.
The use of a localization service (i.e. a wireless localization service) to determine a falsified access signal is novel as the submission of a group of reference APs with the detected group of APs to determine an estimated location that should indicate with the returned result (i.e. expected/unexpected) if one of the APs of the detected group is being falsified.
Claim 14, has similar subject matter as found in claims 2 and 3, and has the same reasoning as presented for claim 3.
Regarding claim 9, the prior art of record fails to disclose or fairly suggest, in combination, a system for detecting falsified Wi-Fi signals that makes an initial detection of APs, determines if any APs are broadcasting falsified signals, performs an analysis of each AP using either a pair-wise comparison of AP locations or analysis of physical layer attributes of the signals to determine a falsified AP which is then mitigated, as described in claim 1, further including the determining a false signal and identifying a false AP being different processes, as described in claim 7, further including a pairwise comparison of the location of each AP of the group, as described in claim 8, and further including sending a plurality of pairs of APs to a geolocation server in a set of requests to identify and isolate any deviations from expected location and ascribe the deviations to a specific AP, in the specific manner and combination as recited in claim 9.
The use of a geolocation server to service a request having a pair of APs will return an estimated location based on the pair of APs. The expected result should be an estimated location close to the user, but an unexpected location would indicate one of the two APs is falsified.
Claim 17, has similar subject matter as found in claim 9, and has the same reasoning as presented for claim 9.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Tian et al. “Wasserstein Metric-Based Location Spoofing Attack Detection in WiFi Positioning Systems” is related to determination of false APs prior to submission of a positioning request to a Wi-Fi positioning system.
Gum et al. (US 2021/0333411 A1) is related to determining correct location in the presence of GNSS spoofing.
Pan et al. (US 9,578,458 B2) is related to detection of rogue access points with a location different from a registered location.
Hassan et al. (US 11,751,070 B2) is related to detection of anomalous access points.
Kumar et al. (US 11,041,933 B2) is related to localization based on network of wireless nodes.
Aggarwal et al. (US 2010/0172259 A1) is related to detection of falsified wireless access points.
Morgan et al. (US 2006/0240840 A1) is related to optimizing data in Wi-Fi positioning systems.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ERIC W SHEPPERD whose telephone number is (571)270-5654. The examiner can normally be reached on Monday - Thursday, Alt. Friday, 7:30AM - 5:00PM, EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal Dharia can be reached on (571)272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Eric W Shepperd/Primary Examiner, Art Unit 2492