CTNF 19/016,703 CTNF 81070 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Claims 1-10 are pending. Claim Rejections - 35 USC § 112 07-30-02 AIA The following is a quotation of 35 U.S.C. 112(b): (b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention. The following is a quotation of 35 U.S.C. 112 (pre-AIA), second paragraph: The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention. 07-34-01 Claims 1-10 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 1 and 10 recite the limitation "keeping the driving function active" in the last line of the claim. There is insufficient antecedent basis for this limitation in the claim. Claims 1 and 10 state: “which are not a driving function of the first vehicle, the countermeasure includes a first countermeasure for disabling the first function while keeping the driving function active”. The initial introduction is negative and indefinite (“a driving function”), meaning there is no specific “driving function” established for the subsequent “the driving function” to refer back to. The examiner suggests the claim should either recite “keeping driving functions active” or affirmatively introduce “at least one driving function” earlier in the claim. Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim s 1-10 are rejected under 35 U.S.C. 103 as being unpatentable over US 11,363,045 to Torisaki et al., above, and further in view of US 12,375,504 to Morita . Regarding claim 1, Torisaki teaches an information provision method executed by an information processing device (Fig. 5: A vehicle anomaly detection server 80) that: obtains attack information through communication with a security monitoring device that determines presence or absence of an attack based on log information obtained from a vehicle (col. 2, lines 6-26: A vehicle anomaly detection server according to an aspect of the present disclosure includes: a communicator that communicates with a vehicle to receive a log of an in-vehicle network included in the vehicle… transmit a log of an in-vehicle network included in the anomaly-related vehicle; and determining whether an anomaly is occurring to the anomaly-related vehicle, based on information indicated by the log transmitted from the anomaly-related vehicle in response to the first request and received by the communicator. Col. 4, lines 32-36: An anomaly due to a cyberattack possibly increases the severity of attack damage while no handling is being performed on this anomaly. For example, this attack may cause serious trouble to the vehicle having this anomaly, or may extend to other vehicles. See Log analyzer 840. Fig. 6: data structure of vehicle log information stored in vehicle log storage DB 870 included in vehicle anomaly detection server 80.); and provides an instruction that causes an attacked vehicle to take a countermeasure appropriate to the attack (col. 15, lines 10-15: log analyzer 840 causes security information generator 850 to transmit the transmission information (such as a warning notice) to this vehicle and other vehicles 1010 under a certain condition), the information provision method comprising: receiving attack information from the security monitoring device, the attack information including a first function of a first vehicle targeted for an attack and vehicle information for identifying the first vehicle (col. 6, lines 19-30: vehicle anomaly detection server may further include a storage that holds a vehicle ID list for each car type, the vehicle ID list including a vehicle ID identifying a vehicle as a candidate for a transmission destination. Fig 9. Col. 13, lines 34-46: Log analyzer 840 is capable of performing, for example, a statistical process on frame information about a plurality of frames collected from the vehicles that is indicated by accumulated logs. On the basis of the frame information about the plurality of frames obtained by communicator 810 and about the frame received on the in-vehicle network of one of vehicles 1010 (vehicle 1010a, for example) obtained by communicator 810 after the obtainment of the plurality of frames, log analyzer 840 functions as a calculator that calculates an anomaly level (severity of anomaly) of this frame received on the in-vehicle network of the one of vehicles 1010.); and transmitting, to the first vehicle identified by the vehicle information, an instruction that causes the first vehicle to take a countermeasure determined according to the first function (col. 15, lines 10-15: log analyzer 840 causes security information generator 850 to transmit the transmission information (such as a warning notice) to this vehicle and other vehicles 1010 under a certain condition. Col. 28, lines 30-35: security information generator 850 is instructed to transmit the transmission information (including the alert and the control information) in the transmission manner corresponding to the determined alert level (Step S203). Col. 8, lines 43-51: When this result indicates the presence of an anomaly, control operations are performed in accordance with this anomaly. The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system.). Torisaki lacks or does not expressly disclose when the first function is a function included in one or more second functions, which are not a driving function of the first vehicle, the countermeasure includes a first countermeasure for disabling the first function while keeping the driving function active. However, Morita discloses wherein when the first function is a function included in one or more second functions, which are not a driving function of the first vehicle, the countermeasure includes a first countermeasure for disabling the first function while keeping the driving function active (col. 9, lines 40-49: the analysis device 1 determines an attack progress status based on an attack scenario prepared in advance when detecting a cyber-security attack, and selects a countermeasure content according to the progress status. As a result, the countermeasure can be taken at an appropriate timing according to the urgency degree of the cyber-security attack, and thus, it is possible to prevent an excessive countermeasure from being taken and a delay in taking the countermeasure, and to maintain safe and comfortable vehicle traveling control. Col. 9, line 64: the countermeasure selection unit 15 that selects, by the CPU, a countermeasure to be prioritized based on the determined urgency degree is provided. Thus, an appropriate countermeasure can be taken at an appropriate timing according to the urgency degree of the cyber-security attack, it is possible to prevent an excessive countermeasure from being taken and the delay in taking a countermeasure, and the safe and comfortable vehicle traveling control can be achieved.). It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Torisaki with Morita to include a first countermeasure for disabling the first function while keeping the driving function active, in order to maintain safe and comfortable vehicle traveling, as taught by Morita, col 9, line 64. Regarding claim 2, Torisaki, as modified above, further discloses the information provision method according to claim 1, wherein the first countermeasure includes forcedly disabling the first function (Col. 8, lines 43-51: When this result indicates the presence of an anomaly, control operations are performed in accordance with this anomaly. The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system). Regarding claim 3, Torisaki, as modified above, further discloses the information provision method according to claim 2, wherein the countermeasure further includes a second countermeasure that causes a presenter included in the first vehicle to present function information that indicates the first function (Col. 8, lines 43-51: When this result indicates the presence of an anomaly, control operations are performed in accordance with this anomaly. The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system). Regarding claim 4, Torisaki, as modified above, further discloses the information provision method according to claim 3, wherein the second countermeasure further includes, after forcedly disabling the first function, causing the presenter to present a first user interface (UI) for receiving, from a user of the first vehicle via an input interface included in the first vehicle, an instruction for resuming the first function (col. 8, lines 42-51: Vehicle 1010 records the result into a recording medium or presents the result to driver D10 via a user interface, for example. When this result indicates the presence of an anomaly, control operations are performed in accordance with this anomaly. The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system.). Regarding claim 5, Torisaki, as modified above, further discloses the information provision method according to claim 1, wherein the first countermeasure includes causing a presenter included in the first vehicle to present a second user interface (UI) for receiving, from a user of the first vehicle via an input interface included in the first vehicle, an instruction for disabling the first function (col. 9, lines 51-58: Each of vehicles 1010 is provided with an in-vehicle network including: various devices, such as a control device, a sensor, an actuator, and a user interface device; and a plurality of ECUs that are information processing devices connected to these various devices and perform frame-related communications via in-vehicle buses (CAN buses). Col. 10, lines 59-63: Bus 70 is connected to ECU 700 connected to diagnostic port 710 that is an interface for communicating with, for example, an external failure diagnostic tool, such as on-board diagnostics 2 (OBD2). Diagnostic port 710 may be connected to bus 70 by bypassing ECU 700. Col. 11, line 66: Vehicle anomaly detection server 80, which handles an anomaly occurring to a frame transmitted and received over the in-vehicle network of vehicle 1010, is implemented by cloud server 1110 or by both cloud server 1110 and server 1210 described above. More specifically, vehicle anomaly detection server 80 is implemented by one or more computers each including a processor, a storage device, and a communication interface. Col. 8, lines 42-51: Vehicle 1010 records the result into a recording medium or presents the result to driver D10 via a user interface, for example. When this result indicates the presence of an anomaly, control operations are performed in accordance with this anomaly. The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system.). Regarding claim 6, Torisaki, as modified above, further discloses the information provision method according to claim 5, wherein the first countermeasure further includes, after disabling the first function, causing the presenter to present a third user interface (UI) for receiving, from the user of the first vehicle via the input interface, an instruction for resuming the first function (col. 9, lines 52-58: Each of vehicles 1010 is provided with an in-vehicle network including: various devices, such as a control device, a sensor, an actuator, and a user interface device; and a plurality of ECUs that are information processing devices connected to these various devices and perform frame-related communications via in-vehicle buses (CAN buses).). Regarding claim 7, Torisaki, as modified above, further discloses the information provision method according to claim 5, wherein the second UI further includes risk information for presenting a risk in a case where the first function is not disabled (FIG. 9 associates a combination of an attack phase and number N of detections of this attack phase (the number of detections) with an alert level on a scale of 1 to 5. The number of detections may be a cumulative number or a number counted in a given unit of time. The alert level indicates a level of importance from a security perspective and is used by log-collection target vehicle selector 855 to select a log-collection target vehicle. Moreover, the alert level is an index used for determining a transmission manner in which vehicle anomaly detection server 80 transmits the transmission information about security to the vehicle.). Regarding claim 8, Torisaki, as modified above, further discloses the information provision method according to claim 1, wherein when the first function is a driving function of the first vehicle, the countermeasure includes a third countermeasure that disables the driving function (col. 8, lines 46-51: The control operations include disabling a system having the anomaly, withdrawing a function affected by the anomaly, and controlling driving to evacuate vehicle 1010. The control operations may be executed by driver D10, or by an automatic control system if vehicle 1010 is provided with such a system.). Regarding claim 9, Torisaki, as modified above, further discloses the information provision method according to claim 1, wherein the one or more second functions are set according to an administrator that manages the first vehicle (col. 8, lines 29-39: A result of this determination is presented to administrative user U10 via server 1210 (as indicated by arrow 1340), for example. Moreover, the result is transmitted to cloud server 1110 (as indicated by arrow 1350) to be stored, and then presented from cloud server 1110 to vehicle 1010 (as indicated by arrow 1360), for example. Administrative user U10 belongs to, for example, service provider 1200. For example, administrative user U10 is in charge of operating this vehicle anomaly detection system and monitoring the status of service provided by the vehicle anomaly detection system.). As per claim 10, this is a device version of the claimed method discussed above in claim 1 wherein all claimed limitations have also been addressed and/or cited as set forth above . Conclusion 07-96 AIA The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. US 11,451,579 to Dyakin et al., teaches a method for protecting electronics systems of a vehicle from cyberattacks includes intercepting messages transmitted on a first communications bus between a plurality of Electronic Control Units (ECUs) of a vehicle. US 2019/0190926 to Choi et al., teaches vehicle cyber-attack detection system (100) has a first tier security module (110) coupled to onboard system (198) of a vehicle to receive system log data (128) generated by the onboard system and extract extracted features from the system log data with natural language processing. Any inquiry concerning this communication or earlier communications from the examiner should be directed to AUBREY H WYSZYNSKI whose telephone number is (571)272-8155. The examiner can normally be reached M-F 9-5. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALI SHAYANFAR can be reached at 571-270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /AUBREY H WYSZYNSKI/Primary Examiner, Art Unit 2434 Application/Control Number: 19/016,703 Page 2 Art Unit: 2434 Application/Control Number: 19/016,703 Page 3 Art Unit: 2434 Application/Control Number: 19/016,703 Page 4 Art Unit: 2434 Application/Control Number: 19/016,703 Page 5 Art Unit: 2434 Application/Control Number: 19/016,703 Page 6 Art Unit: 2434 Application/Control Number: 19/016,703 Page 7 Art Unit: 2434 Application/Control Number: 19/016,703 Page 8 Art Unit: 2434 Application/Control Number: 19/016,703 Page 9 Art Unit: 2434 Application/Control Number: 19/016,703 Page 10 Art Unit: 2434
Prosecution Insights