DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 04/16/2025 was filed. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Specification
The disclosure is objected to because of the following informalities:
On Page 10, Line 9, “and an other function” should read “and another function”
On Page 13, Line 15, “and an other function” should read “and another function”
Appropriate correction is required.
Claim Objections
Claim 7 objected to because of the following informalities: In Line 29, “and an other function” should read “and another function”. Appropriate correction is required.
Claim 16 objected to because of the following informalities: In Line 35, “and an other function” should read “and another function”. Appropriate correction is required.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are: “a first determiner that determines reliability of an autonomous movement function of the mobile robot”, “a first information obtainer that obtains information on a safe area at which the mobile robot can stop”, and “a first controller that causes the mobile robot to move to the safe area based on the information on the safe area…” in claim 1, and “a second determiner that determines reliability of an autonomous movement function of the mobile robot”, “a second information obtainer that obtains information on a safe area at which the mobile robot can stop”, and “a second controller that causes the mobile robot to move to the safe area based on the information on the safe area…” in claim 10. These terms do not show what the structure is in their wording.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. “first determiner”, “first information obtainer”, and “first controller” are described in Page 18, Line 4-7 and 13-15. “second determiner” is described in Page 44, Line 22-27. “second information obtainer” is described in Page 44, Line 19-22. “second controller” is described in Page 44, Line 5-8.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-2, 9, and 19 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by O’Brien (US 10477404 B2).
Re Claim 1, O’Brien discloses a mobile robot that is capable of autonomous movement, the mobile robot comprising: (Col. 8, Line 51-54, “In other configurations, the unmanned vehicle can be a driverless car, a delivery robot, a warehouse robot, or any other type of vehicle configured to move without human guidance.”)
a first determiner that determines reliability of an autonomous movement function of the mobile robot; (
Col. 10, Line 40-46, “FIG. 5 illustrates an example method embodiment which can be performed by an autonomous vehicle configured according to the principles disclosed herein. The exemplary method includes determining, at a processor on an autonomous vehicle, that an intrusion attempt on the autonomous vehicle is being made as the autonomous vehicle is traveling, to yield a determination (502).” Examiner is interpreting the processor as the “first determiner”;
Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” O’Brien considers levels of threats and countermeasures to deploy (as shown in quotes above).
It is inherent that O’Brien is making a determination of reliability of autonomous movement in order to determine which counter measures are possible. For example, it may isolate systems (Fig 5) and rely on a secondary navigation system. See Col 3 – Lines 47-64. “With regard to isolating critical systems or data, aspects of the autonomous vehicle which can be isolated include functions, data, mission information, or sub-systems. In one configuration, the mission critical data (i.e., waypoints, cargo, identification information, delivery times, etc.) can be stored in a database which is isolated when threatening communications are being received. Isolating data stored in a database can occur by limiting (at least for a period of time) which systems have access to the database. Similarly, if there are particular functions which are mission critical, those functions may be isolated (meaning, they are no longer executed on the same processor). To isolate functions, there can be a secondary navigation system which only engages upon detecting threatening actions or communications. The secondary navigation system can, for example, lack communication capabilities with the communication system or other aspects of the autonomous vehicle.” One of the countermeasures after isolation of systems includes safe stopping location; Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.”)
a first information obtainer that obtains information on a safe area at which the mobile robot can stop; (Col. 9, Line 31-41, “To identify an alternative stopping zone, the autonomous vehicle can consult a map of the area stored within memory of the autonomous vehicle, where possible stopping/landing zones 304 have been pre-designated. Based on the configuration of the autonomous vehicle, that stored map may be in a secondary navigation system (rather than the primary navigation system). In the example illustrated in FIG. 3, the processor can compare the landing zones 304 nearby with the current location 302 of the autonomous vehicle, then identify, based on captured images, objects 306, 308 which make a planned route 310 near those objects impossible”; Examiner is treating the processer as the first information obtainer.)
and a first controller that causes the mobile robot to move to the safe area based on the information on the safe area when, during autonomous movement of the mobile robot, an anomaly in the mobile robot is detected and the first determiner determines that the autonomous movement function is reliable. (O’ Brien analyzes the anomaly/intrusion and chooses reactions in Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” Col. 9, Line 14-19, “FIG. 3 illustrates an example of an autonomous vehicle navigating to a landing zone (or a stopping zone) in response to an intrusion attempt, where the autonomous vehicle can stop and wait for retrieval. In the case of a ground-based drone, the stopping zone can be a safe place to park, whereas for an aerial drone, a safe landing zone is sought.”; As described above and in Fig. 5, O’Brien inherently checks for reliability of the autonomous movement of the mobile robot in order to determine what actions may occur. In this quote below, the example result after isolation to move the robot to a safe stopping location: Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.” Examiner is treating processer as the first controller, intrusion attempt as the anomaly, stopping zone as safe area.
Re Claim 2, O’Brien discloses when, during autonomous movement of the mobile robot, the anomaly is detected and the first determiner determines that the autonomous movement function is unreliable, the first controller causes the mobile robot to stop at a current location. (Col. 8, Line 38-47, “At tier 3, the problem has escalated, and the threat is likely to result in intrusion or has already caused some loss of control. At this point, it may no longer be possible to continue the original task until the threat is remediated. One or more capabilities may have or will become disabled, and the mission, control, data, and/or package may have (or will be) compromised. Example actions to be taken at this point can include disregarding outside communications for a period of time, seeking sanctuary, landing or stopping immediately…”; Examiner is treating land/stopping immediately as the mobile robot stopping at a current location.)
Re Claim 9, O’Brien discloses an anomaly detector that detects the anomaly. (Col. 8, Line 59-65, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat.”; Examiner is treating feedback loop as anomaly detector.)
Re Claim 19, O’Brien discloses a mobile robot control method for controlling a mobile robot capable of autonomous movement, the mobile robot control method comprising: (Col. 10, Line 40-42, “FIG . 5 illustrates an example method embodiment which can be performed by an autonomous vehicle configured according to the principles disclosed herein”)
causing the mobile robot to move to a safe area based on information on the safe area (Col. 9, Line 31-41, “To identify an alternative stopping zone, the autonomous vehicle can consult a map of the area stored within memory of the autonomous vehicle, where possible stopping/landing zones 304 have been pre-designated. Based on the configuration of the autonomous vehicle, that stored map may be in a secondary navigation system (rather than the primary navigation system). In the example illustrated in FIG. 3, the processor can compare the landing zones 304 nearby with the current location 302 of the autonomous vehicle, then identify, based on captured images, objects 306, 308 which make a planned route 310 near those objects impossible”) when, during autonomous movement of the mobile robot, an anomaly is detected in the mobile robot and an autonomous movement function of the mobile robot is determined to be reliable, the safe area being an area at which the mobile robot can stop. (O’ Brien analyzes the anomaly/intrusion and chooses reactions in Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” Col. 9, Line 14-19, “FIG. 3 illustrates an example of an autonomous vehicle navigating to a landing zone (or a stopping zone) in response to an intrusion attempt, where the autonomous vehicle can stop and wait for retrieval. In the case of a ground-based drone, the stopping zone can be a safe place to park, whereas for an aerial drone, a safe landing zone is sought.”; As described above and in Fig. 5, O’Brien inherently checks for reliability of the autonomous movement of the mobile robot in order to determine what actions may occur. In this quote below, the example result after isolation to move the robot to a safe stopping location: Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.” Examiner is treating intrusion attempt as the anomaly and stopping zone as safe area.)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 3 and 7 is rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Kishikawa (WO2022049894A1 from IDS, translation provided).
Re Claim 3, O’Brien teaches a mobile robot that sends out an alert in response to a threat (Col. 3, Line 10-14, Line 18-19, “As the autonomous vehicle is exposed to various types and degrees of attack, the autonomous vehicles reactions vary based on the type and immediacy of the attack. For example, upon determining a threat exists, the autonomous vehicle may: …send an alert (i.e., call for help), record images, and transmit log data”) but does not explicitly disclose a first user interface (UI) generator that generates a first alert UI when, during autonomous movement of the mobile robot, the anomaly is detected and the first determiner determines that the autonomous movement function is unreliable, the first alert UI being for communicating an alert on a server that communicably connects to the mobile robot.
However, Kishikawa teaches a control mode switching device/method for a robot featuring a server interface for receiving/sending security alerts from/to the robot. (Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security. Provide to the incident response team.”; Page 13, “For example, when an abnormality of the robot 10 is detected on the fleet management server 30, the abnormality detection result may be updated by notifying the robot 10 of a security alert from the fleet management server 30. Similarly, the abnormality detection result may be updated based on the security alert notified from the monitoring server 40.”; Examiner is treating the server notifying the robot 10 of a security alert aa the first alert UI.)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify O’Brien’s mobile robot with Kishikawa’s server interface because it would allow remote operators of the robot to respond to security alerts it experienced without having to be in its near vicinity.
Re Claim 7, O’Brien discloses the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function, and when no attack on the autonomous movement function is detected, the first determiner determines that the autonomous movement function is reliable. (Col. 8, Line 15-18, “Similarly, in some configurations, each tier of the threat level can be associated with types of threats and corresponding reactions. Consider the following examples. If no threat is detected, no response is required.”; Examiner is treating the lack of required response as reliability) but does not explicitly disclose the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function.
However, Kishikawa teaches a control mode switching device/system for a robot that can switch its autonomous control to remote control when an abnormality is detected in order to get the robot to safety, and discloses the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function (Page 19, “In this case, the detection results include, for example, an abnormality of the remote control application (abnormality of the first application), an abnormality of the manual control application (abnormality of the second application), and an abnormality of the autonomous control application (abnormality of the second application) as application abnormalities. 3 Any of the abnormalities of the application) is included. Remote control apps, manual control apps and autonomous control apps are examples of anomalies. Then, the credit score update unit 206 reduces the remote control application score when the remote control application is detected, and reduces the score of the manual control application when an abnormality of the manual control application is detected, and the autonomous control application. When an abnormality is detected, the score of the autonomous control app is reduced.”; Examiner is treating remote control as the other function).
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Kishikawa’s control mode switch because it would allow the remote operators to take direct control of the robot in order to get it to safety in the event that an abnormality had compromised the robot’s autonomous control.
Claims 4-6 are rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Kishikawa (WO2022049894A1 from IDS, translation provided) and Landernäs (WO2020160760A1, translation provided).
Re Claim 4, Modified O’Brien discloses a second UI generator that generates a remote operation UI when, during autonomous movement of the mobile robot, the anomaly is detected and the first determiner determines that the autonomous movement function is unreliable, (Kishikawa, Page 19, “In this case, the detection results include, for example, an abnormality of the remote control application (abnormality of the first application), an abnormality of the manual control application (abnormality of the second application), and an abnormality of the autonomous control application (abnormality of the second application) as application abnormalities. 3 Any of the abnormalities of the application) is included. Remote control apps, manual control apps and autonomous control apps are examples of anomalies. Then, the credit score update unit 206 reduces the remote control application score when the remote control application is detected, and reduces the score of the manual control application when an abnormality of the manual control application is detected, and the autonomous control application. When an abnormality is detected, the score of the autonomous control app is reduced.”; Page 21, “(S602) The response determination unit 204 of the central ECU 200 confirms whether the control of the robot 10a needs to be continued and whether the robot is abnormal (for example, whether the credit score of the robot 10a is not equal to or less than a predetermined threshold value). do. When the control continuation of the robot 10a is not necessary or the robot is abnormal (for example, the credit score of the robot 10a is equal to or less than a predetermined value) (No in S602), the response determination unit 204 executes step S607.”) the remote operation UI being generated on a server that communicably connects to the mobile robot and being used for remote operation of the mobile robot… (Kishikawa, Page 6, “The interface for remotely controlling the robot 10 may be provided by the fleet management server 30. The remote control terminal 50 is an information processing device for remotely operating the robot 10 that operates in the remote control mode. The remote control terminal 50 generates a control signal based on an input from a remote operator (for example, accelerator opening, brake pressure, steering angle, etc.) and transmits the control signal to the robot 10 via the network 20 to cause the robot. Remotely control 10. The remote operator may remotely control the robot 10, for example. The remote operator is an example of a first user. The control mode in which the robot 10 is controlled by a remote operator via the network 20 is an example of the remote control mode.”; Examiner is treating the switch from autonomous control to remote control as the remote operation.) but does not explicitly disclose …wherein the first controller causes the mobile robot to move to the safe area based on input into the remote operation UI on the server.
However, Landernäs teaches a mobile robot featuring a safety mode that has remote operators guide the robot to a safety area in response to an emergency, and discloses …wherein the first controller causes the mobile robot to move to the safe area based on input into the remote operation UI on the server. (Page 6, “Fig. 7 is a control system 200 configured to implement, at least parts of, the proposed method. The control system 200 is e.g. a central control system configured to control one or more mobile robots 1. For example, one control system is configured to control a plurality of mobile robots 1, 3 in an industry area. In its simplest form, the remote system is a simple user device such as a personal computer, which has software configured to remotely control the mobile robots 1, 3 installed thereon.”; Page 5, “When all measures needed to clear the route to the safety area are taken, the moving of the mobile robot 1 to the safety area 2 starts. In other words, the method further comprises controlling S9 the mobile robot 1 to move to one of the safety areas upon determining S6 that the present position of the mobile robot 1 is located outside the one or more safety areas 2. More specifically, the control arrangement 100, 200 controls the transportation mechanism 12 to relocate the mobile robot to a (selected) safety area. If the location information has identified one or more safe routes 4 associated with the safety areas 2 then the controlling S9 comprises controlling the mobile robot to move along one of the obtained safe routes 4 to one of the one or more safety areas 2. When the mobile robot 1 is positioned in a safety area, the mobile robot 1 is stopped, i.e. the transportation mechanism 12 is halted and possibly also braked.”)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Landernäs’ safety mode because it would ensure that the robot’s safe location maneuver would be initialized by Kishikawa’s remote control if something were to go wrong with O’Brien’s autonomous control.
Re Claim 5, Modified O’Brien discloses wherein the remote operation UI includes, in addition to usage for the remote operation, a suspicious activity reporting function that, when suspicious activity is identified regarding movement of the mobile robot, reports the suspicious activity, (Kishikawa, Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security.”) and when, while the mobile robot is being caused to move based on input into the remote operation UI on the server, input of the suspicious activity reporting function of the remote operation UI is recognized, the first controller causes the mobile robot to stop at a current location. (Kishikawa, Page 21, “(S601) The correspondence determination unit 204 of the central ECU 200 determines whether or not the current position of the robot 10a is an area where the control mode can be switched and the control mode can be switched. The area where the control mode can be switched is predetermined, and a place where the robot 10a can be stopped in a safe state is selected as the area where the control mode can be switched.”; Page 21, “(S602) The response determination unit 204 of the central ECU 200 confirms whether the control of the robot 10a needs to be continued and whether the robot is abnormal (for example, whether the credit score of the robot 10a is not equal to or less than a predetermined threshold value). do. When the control continuation of the robot 10a is not necessary or the robot is abnormal (for example, the credit score of the robot 10a is equal to or less than a predetermined value) (No in S602), the response determination unit 204 executes step S607.”; Page 22, “(S607) The response determination unit 204 of the central ECU 200 stops the robot 10a in a safe area and ends. A safe area is selected in a range where there is no problem even if the robot 10a does not operate. Stopping in a safe area is also included in switching control modes.”; Page 24-25, “In the above embodiment, an example of making a monitoring request in response to an abnormality detection of the operating environment is shown, but a request to confirm the operating environment may be made to a remote user during the remote control mode, which is illegal. The remote operator may notify the existence of a nearby third party or an abnormality in the operating environment.”; Examiner is treating control mode switch as previously mentioned autonomous control to remote control.)
Re Claim 6, Modified O’Brien discloses wherein when input of the suspicious activity reporting function of the remote operation UI is recognized, the second UI generator further generates a second alert UI for communicating the suspicious activity. (Kishikawa, Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security.”; Page 8, “When an abnormal behavior is observed, the intrusion detection unit 104 requests the application unit 102 to send a security alert in order to notify the security alert, and notifies the central ECU 200 of the security abnormality.”; Examiner is treating the security alert sent by application unit 102 as the second alert UI.)
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Liu (US 11310269 B2).
Re Claim 8, O’Brien discloses a first storage that stores a destination of the mobile robot, (Col. 9, Line 31-44, “To identify an alternative stopping zone, the autonomous vehicle can consult a map of the area stored within memory of the autonomous vehicle, where possible stopping/landing zones 304 have been pre-designated. Based on the configuration of the autonomous vehicle, that stored map may be in a secondary navigation system (rather than the primary navigation system). In the example illustrated in FIG. 3, the processor can compare the landing zones 304 nearby with the current location 302 of the autonomous vehicle, then identify, based on captured images, objects 306, 308 which make a planned route 310 near those objects impossible. The processor can then plan an alternative route to the stopping zone 304, avoiding those areas which, based on real-time imagery, should be avoided.”; Examiner is treating memory as first storage, and stopping zones in stored map as mobile robot destination) (Col. 10, Line 40-46, “FIG. 5 illustrates an example method embodiment which can be performed by an autonomous vehicle configured according to the principles disclosed herein. The exemplary method includes determining, at a processor on an autonomous vehicle, that an intrusion attempt on the autonomous vehicle is being made as the autonomous vehicle is traveling, to yield a determination (502).” Examiner is interpreting the processor as the “first determiner”. Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” O’Brien considers levels of threats and countermeasures to deploy (as shown in quotes above). It is inherent that O’Brien is making a determination of reliability of autonomous movement in order to determine which counter measures are possible. For example, it may isolate systems (Fig 5) and rely on a secondary navigation system. See Col 3 – Lines 47-64. “With regard to isolating critical systems or data, aspects of the autonomous vehicle which can be isolated include functions, data, mission information, or sub-systems. In one configuration, the mission critical data (i.e., waypoints, cargo, identification information, delivery times, etc.) can be stored in a database which is isolated when threatening communications are being received. Isolating data stored in a database can occur by limiting (at least for a period of time) which systems have access to the database. Similarly, if there are particular functions which are mission critical, those functions may be isolated (meaning, they are no longer executed on the same processor). To isolate functions, there can be a secondary navigation system which only engages upon detecting threatening actions or communications. The secondary navigation system can, for example, lack communication capabilities with the communication system or other aspects of the autonomous vehicle.” One of the countermeasures after isolation of systems includes safe stopping location. Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.”) but does not explicitly disclose …wherein when no tampering of the destination is detected…
However, Liu teaches a system to detect spoofing attacks on automated driving systems, and discloses …wherein when no tampering of the destination is detected… (Col. 10, Line 12-21, “In one embodiment, security module 308 is configured to detect and spoof attacks based on a set of security rules 313. Security module 308 may be implemented as a part of perception module 302 or communicate with perception module 302 or other modules. Security module 308 detects cyber-attack on autonomous vehicle's destination change or abnormal re-routing activities by checking dynamically updated static objects on map along the route together with confirmation from passenger within the autonomous vehicle or service provider.”)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify O’Brien’s mobile robot with Liu’s destination spoof detector because it would further improve the robot’s ability to respond to intentional attacks.
Claims 10-11, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Oda (JP2022125493A translation provided).
Re Claim 10, O’Brien discloses a second determiner that determines reliability of an autonomous movement function of the mobile robot; (Col. 10, Line 40-46, “FIG. 5 illustrates an example method embodiment which can be performed by an autonomous vehicle configured according to the principles disclosed herein. The exemplary method includes determining, at a processor on an autonomous vehicle, that an intrusion attempt on the autonomous vehicle is being made as the autonomous vehicle is traveling, to yield a determination (502).” Examiner is interpreting the processor as the “second determiner”; Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” O’Brien considers levels of threats and countermeasures to deploy (as shown in quotes above). It is inherent that O’Brien is making a determination of reliability of autonomous movement in order to determine which counter measures are possible. For example, it may isolate systems (Fig 5) and rely on a secondary navigation system. See Col 3 – Lines 47-64. “With regard to isolating critical systems or data, aspects of the autonomous vehicle which can be isolated include functions, data, mission information, or sub-systems. In one configuration, the mission critical data (i.e., waypoints, cargo, identification information, delivery times, etc.) can be stored in a database which is isolated when threatening communications are being received. Isolating data stored in a database can occur by limiting (at least for a period of time) which systems have access to the database. Similarly, if there are particular functions which are mission critical, those functions may be isolated (meaning, they are no longer executed on the same processor). To isolate functions, there can be a secondary navigation system which only engages upon detecting threatening actions or communications. The secondary navigation system can, for example, lack communication capabilities with the communication system or other aspects of the autonomous vehicle.” One of the countermeasures after isolation of systems includes safe stopping location; Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.”)
a second information obtainer that obtains information on a safe area at which the mobile robot can stop; (Col. 9, Line 31-41, “To identify an alternative stopping zone, the autonomous vehicle can consult a map of the area stored within memory of the autonomous vehicle, where possible stopping/landing zones 304 have been pre-designated. Based on the configuration of the autonomous vehicle, that stored map may be in a secondary navigation system (rather than the primary navigation system). In the example illustrated in FIG. 3, the processor can compare the landing zones 304 nearby with the current location 302 of the autonomous vehicle, then identify, based on captured images, objects 306, 308 which make a planned route 310 near those objects impossible”; Examiner is treating the processer as the second information obtainer.)
and a second controller that causes the mobile robot to move to the safe area based on the information on the safe area when, during autonomous movement of the mobile robot, an anomaly in the mobile robot is detected and the second determiner determines that the autonomous movement function is reliable. (O’ Brien analyzes the anomaly/intrusion and chooses reactions in Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” Col. 9, Line 14-19, “FIG. 3 illustrates an example of an autonomous vehicle navigating to a landing zone (or a stopping zone) in response to an intrusion attempt, where the autonomous vehicle can stop and wait for retrieval. In the case of a ground-based drone, the stopping zone can be a safe place to park, whereas for an aerial drone, a safe landing zone is sought.”; As described above and in Fig. 5, O’Brien inherently checks for reliability of the autonomous movement of the mobile robot in order to determine what actions may occur. In this quote below, the example result after isolation to move the robot to a safe stopping location: Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.” Examiner is treating processer as the second controller, intrusion attempt as the anomaly, stopping zone as safe area.), but does not explicitly disclose a server that communicably connects to a mobile robot capable of autonomous movement, the server comprising:
However, Oda teaches a server connected to a plurality of mobile robots, and discloses a server that communicably connects to a mobile robot capable of autonomous movement, the server comprising: (Paragraph 0034, “The upper management device 10 is a server (server device) connected to each device and collects data from each device. Moreover, the upper management device 10 is not limited to a single physical device, and may have a plurality of devices that perform distributed processing.”; Paragraph 0037, “The upper management device 10 is a management system that manages a plurality of mobile robots 20, and transmits to each mobile robot 20 an operation command for executing a transport task.”; Paragraph 0027, “The mobile robot 20 autonomously travels to transport objects in medical and welfare facilities such as hospitals, rehabilitation centers, nursing homes, and facilities for the elderly.”)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify O’Brien’s mobile robot with Oda’s robot server system because having the robot’s components in the server as well would reduce the processing stress placed on the robot when running intrusion counter measures.
Re Claim 11, O’Brien discloses when, during autonomous movement of the mobile robot, the anomaly is detected and the second determiner determines that the autonomous movement function is unreliable, the second controller causes the mobile robot to stop at a current location. (Col. 8, Line 38-47, “At tier 3, the problem has escalated, and the threat is likely to result in intrusion or has already caused some loss of control. At this point, it may no longer be possible to continue the original task until the threat is remediated. One or more capabilities may have or will become disabled, and the mission, control, data, and/or package may have (or will be) compromised. Example actions to be taken at this point can include disregarding outside communications for a period of time, seeking sanctuary, landing or stopping immediately…”; Examiner is treating land/stopping immediately as the mobile robot stopping at a current location.)
Re Claim 18, O’Brien discloses an anomaly detector that detects the anomaly. (Col. 8, Line 59-65, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat.”; Examiner is treating feedback loop as anomaly detector.)
Claims 12 and 16 is rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Oda (JP2022125493A translation provided) and Kishikawa (WO2022049894A1 from IDS, translation provided).
Re Claim 12, Modified O’Brien teaches a mobile robot connected to a server that sends out an alert in response to a threat (O’Brien, Col. 3, Line 10-14, Line 18-19, “As the autonomous vehicle is exposed to various types and degrees of attack, the autonomous vehicles reactions vary based on the type and immediacy of the attack. For example, upon determining a threat exists, the autonomous vehicle may: …send an alert (i.e., call for help), record images, and transmit log data”) but does not explicitly disclose a third user interface (UI) generator that generates a third alert UI that communicates an alert when, during autonomous movement of the mobile robot, the anomaly is detected and the second determiner determines that the autonomous movement function is unreliable.
However, Kishikawa teaches a control mode switching device/method for a robot featuring a server interface for receiving/sending security alerts from/to the robot. (Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security. Provide to the incident response team.”; Page 13, “For example, when an abnormality of the robot 10 is detected on the fleet management server 30, the abnormality detection result may be updated by notifying the robot 10 of a security alert from the fleet management server 30. Similarly, the abnormality detection result may be updated based on the security alert notified from the monitoring server 40.”; Examiner is treating the server notifying the robot 10 of a security alert as the third alert UI.)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Kishikawa’s server interface because it would allow remote operators of the robot to respond to security alerts it experienced without having to be in its near vicinity.
Re Claim 16, Modified O’Brien discloses the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function, and when no attack on the autonomous movement function is detected, the second determiner determines that the autonomous movement function is reliable. (O’Brien, Col. 8, Line 15-18, “Similarly, in some configurations, each tier of the threat level can be associated with types of threats and corresponding reactions. Consider the following examples. If no threat is detected, no response is required.”; Examiner is treating the lack of required response as reliability) but does not explicitly disclose the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function.
However, Kishikawa teaches a control mode switching device/system for a robot that can switch its autonomous control to remote control when an abnormality is detected in order to get the robot to safety, and discloses the mobile robot includes the autonomous movement function and an other function that is different from the autonomous movement function (Page 19, “In this case, the detection results include, for example, an abnormality of the remote control application (abnormality of the first application), an abnormality of the manual control application (abnormality of the second application), and an abnormality of the autonomous control application (abnormality of the second application) as application abnormalities. 3 Any of the abnormalities of the application) is included. Remote control apps, manual control apps and autonomous control apps are examples of anomalies. Then, the credit score update unit 206 reduces the remote control application score when the remote control application is detected, and reduces the score of the manual control application when an abnormality of the manual control application is detected, and the autonomous control application. When an abnormality is detected, the score of the autonomous control app is reduced.”; Examiner is treating remote control as the other function).
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Kishikawa’s control mode switch because it would allow the remote operators to take direct control of the robot in order to get it to safety in the event that an abnormality had compromised the robot’s autonomous control.
Claims 13-15 are rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view of Oda (JP2022125493A translation provided), Kishikawa (WO2022049894A1 from IDS, translation provided), and Landernäs (WO2020160760A1, translation provided).
Re Claim 13, Modified O’Brien discloses a fourth UI generator that generates a remote operation UI when, during autonomous movement of the mobile robot, the anomaly is detected and the second determiner determines that the autonomous movement function is unreliable, (Kishikawa, Page 19, “In this case, the detection results include, for example, an abnormality of the remote control application (abnormality of the first application), an abnormality of the manual control application (abnormality of the second application), and an abnormality of the autonomous control application (abnormality of the second application) as application abnormalities. 3 Any of the abnormalities of the application) is included. Remote control apps, manual control apps and autonomous control apps are examples of anomalies. Then, the credit score update unit 206 reduces the remote control application score when the remote control application is detected, and reduces the score of the manual control application when an abnormality of the manual control application is detected, and the autonomous control application. When an abnormality is detected, the score of the autonomous control app is reduced.”; Page 21, “(S602) The response determination unit 204 of the central ECU 200 confirms whether the control of the robot 10a needs to be continued and whether the robot is abnormal (for example, whether the credit score of the robot 10a is not equal to or less than a predetermined threshold value). do. When the control continuation of the robot 10a is not necessary or the robot is abnormal (for example, the credit score of the robot 10a is equal to or less than a predetermined value) (No in S602), the response determination unit 204 executes step S607.”) the remote operation UI being generated on a server that communicably connects to the mobile robot and being used for remote operation of the mobile robot… (Kishikawa, Page 6, “The interface for remotely controlling the robot 10 may be provided by the fleet management server 30. The remote control terminal 50 is an information processing device for remotely operating the robot 10 that operates in the remote control mode. The remote control terminal 50 generates a control signal based on an input from a remote operator (for example, accelerator opening, brake pressure, steering angle, etc.) and transmits the control signal to the robot 10 via the network 20 to cause the robot. Remotely control 10. The remote operator may remotely control the robot 10, for example. The remote operator is an example of a first user. The control mode in which the robot 10 is controlled by a remote operator via the network 20 is an example of the remote control mode.”; Examiner is treating the switch from autonomous control to remote control as the remote operation.) but does not explicitly disclose …wherein the second controller causes the mobile robot to move to the safe area based on input into the remote operation UI on the server.
However, Landernäs teaches a mobile robot featuring a safety mode that has remote operators guide the robot to a safety area in response to an emergency, and discloses …wherein the second controller causes the mobile robot to move to the safe area based on input into the remote operation UI on the server. (Page 6, “Fig. 7 is a control system 200 configured to implement, at least parts of, the proposed method. The control system 200 is e.g. a central control system configured to control one or more mobile robots 1. For example, one control system is configured to control a plurality of mobile robots 1, 3 in an industry area. In its simplest form, the remote system is a simple user device such as a personal computer, which has software configured to remotely control the mobile robots 1, 3 installed thereon.”; Page 5, “When all measures needed to clear the route to the safety area are taken, the moving of the mobile robot 1 to the safety area 2 starts. In other words, the method further comprises controlling S9 the mobile robot 1 to move to one of the safety areas upon determining S6 that the present position of the mobile robot 1 is located outside the one or more safety areas 2. More specifically, the control arrangement 100, 200 controls the transportation mechanism 12 to relocate the mobile robot to a (selected) safety area. If the location information has identified one or more safe routes 4 associated with the safety areas 2 then the controlling S9 comprises controlling the mobile robot to move along one of the obtained safe routes 4 to one of the one or more safety areas 2. When the mobile robot 1 is positioned in a safety area, the mobile robot 1 is stopped, i.e. the transportation mechanism 12 is halted and possibly also braked.”)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Landernäs’ safety mode because it would ensure that the robot’s safe location maneuver would be initialized by Kishikawa’s remote control if something were to go wrong with O’Brien’s autonomous control.
Re Claim 14, Modified O’Brien discloses wherein the remote operation UI includes, in addition to usage for the remote operation, a suspicious activity reporting function that, when suspicious activity is identified regarding movement of the mobile robot, reports the suspicious activity, (Kishikawa, Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security.”) and when, while the mobile robot is being caused to move based on input into the remote operation UI on the server, input of the suspicious activity reporting function of the remote operation UI is recognized, the second controller causes the mobile robot to stop at a current location. (Kishikawa, Page 21, “(S601) The correspondence determination unit 204 of the central ECU 200 determines whether or not the current position of the robot 10a is an area where the control mode can be switched and the control mode can be switched. The area where the control mode can be switched is predetermined, and a place where the robot 10a can be stopped in a safe state is selected as the area where the control mode can be switched.”; Page 21, “(S602) The response determination unit 204 of the central ECU 200 confirms whether the control of the robot 10a needs to be continued and whether the robot is abnormal (for example, whether the credit score of the robot 10a is not equal to or less than a predetermined threshold value). do. When the control continuation of the robot 10a is not necessary or the robot is abnormal (for example, the credit score of the robot 10a is equal to or less than a predetermined value) (No in S602), the response determination unit 204 executes step S607.”; Page 22, “(S607) The response determination unit 204 of the central ECU 200 stops the robot 10a in a safe area and ends. A safe area is selected in a range where there is no problem even if the robot 10a does not operate. Stopping in a safe area is also included in switching control modes.”; Page 24-25, “In the above embodiment, an example of making a monitoring request in response to an abnormality detection of the operating environment is shown, but a request to confirm the operating environment may be made to a remote user during the remote control mode, which is illegal. The remote operator may notify the existence of a nearby third party or an abnormality in the operating environment.”; Examiner is treating control mode switch as previously mentioned autonomous control to remote control.)
Re Claim 15, Modified O’Brien discloses wherein when input of the suspicious activity reporting function of the remote operation UI is recognized, the fourth UI generator further generates a fourth alert UI for communicating the suspicious activity. (Kishikawa, Page 6, “The monitoring server 40 is a server that mainly monitors whether or not a security incident has occurred in the robot 10, and provides an interface for receiving security alerts from the robot 10 and analyzing / responding to the security operation center or security.”; Page 8, “When an abnormal behavior is observed, the intrusion detection unit 104 requests the application unit 102 to send a security alert in order to notify the security alert, and notifies the central ECU 200 of the security abnormality.”; Examiner is treating the security alert sent by application unit 102 as the second alert UI.)
Claims 17 is rejected under 35 U.S.C. 103 as being unpatentable over O’Brien (US10477404B2) in view Oda (JP2022125493A translation provided) and Liu (US11310269B2).
Re Claim 17, Modified O’Brien discloses a second storage that stores a destination of the mobile robot, (O’Brien, Col. 9, Line 31-44, “To identify an alternative stopping zone, the autonomous vehicle can consult a map of the area stored within memory of the autonomous vehicle, where possible stopping/landing zones 304 have been pre-designated. Based on the configuration of the autonomous vehicle, that stored map may be in a secondary navigation system (rather than the primary navigation system). In the example illustrated in FIG. 3, the processor can compare the landing zones 304 nearby with the current location 302 of the autonomous vehicle, then identify, based on captured images, objects 306, 308 which make a planned route 310 near those objects impossible. The processor can then plan an alternative route to the stopping zone 304, avoiding those areas which, based on real-time imagery, should be avoided.”; Examiner is treating memory as second storage, and stopping zones in stored map as mobile robot destination) (O’Brien, Col. 10, Line 40-46, “FIG. 5 illustrates an example method embodiment which can be performed by an autonomous vehicle configured according to the principles disclosed herein. The exemplary method includes determining, at a processor on an autonomous vehicle, that an intrusion attempt on the autonomous vehicle is being made as the autonomous vehicle is traveling, to yield a determination (502).” Examiner is interpreting the processor as the “second determiner”. Col 8 Lines 59-Col 9 Line 13, “FIG. 2 illustrates a feedback loop for deploying, and iteratively improving, autonomous counter-measures. In this example, the detected threat is an intrusion attempt 202, while in other instances the detected threat may be a physical threat, a data theft, an attempt to upload false instructions/directions into the autonomous vehicle, or other types of threat. As the threat is identified 202, the autonomous vehicle can isolate any system 204 or data deemed critical to prevent (or at least attempt preventing) the threat from succeeding. These autonomous reactions 212 can further include the initiation of counter-measures 206, which can further include turtling, shutting down the autonomous vehicle, searching for a nearby stopping zone, etc. The autonomous vehicle (or a central server) then determines the effectiveness of the isolation and counter-measures 208 in diminishing or withstanding the threat. Based on the effectiveness, the code for the autonomous behavior of the autonomous vehicle is modified 210. The modified code allows the autonomous vehicle to behave differently, detect threats differently, and/or adjust differently, in future iterations. Through these mechanisms, the algorithms used to automate the vehicle are modified and improved over time.” O’Brien considers levels of threats and countermeasures to deploy (as shown in quotes above). It is inherent that O’Brien is making a determination of reliability of autonomous movement in order to determine which counter measures are possible. For example, it may isolate systems (Fig 5) and rely on a secondary navigation system. See Col 3 – Lines 47-64. “With regard to isolating critical systems or data, aspects of the autonomous vehicle which can be isolated include functions, data, mission information, or sub-systems. In one configuration, the mission critical data (i.e., waypoints, cargo, identification information, delivery times, etc.) can be stored in a database which is isolated when threatening communications are being received. Isolating data stored in a database can occur by limiting (at least for a period of time) which systems have access to the database. Similarly, if there are particular functions which are mission critical, those functions may be isolated (meaning, they are no longer executed on the same processor). To isolate functions, there can be a secondary navigation system which only engages upon detecting threatening actions or communications. The secondary navigation system can, for example, lack communication capabilities with the communication system or other aspects of the autonomous vehicle.” One of the countermeasures after isolation of systems includes safe stopping location. Col. 10-11, Line 61-5, “In some configurations, the illustrated method can be further augmented with regard to identifying the safe stopping location by: identifying a current location of the autonomous vehicle; identifying a route back to a pre-defined stop zone; determining movement of the autonomous vehicle via the route back to the pre-defined stop zone is not compliant with a current status of the autonomous vehicle; identifying, within a geographic radius of the current location of the autonomous vehicle, features which are not conducive with a stop location; and selecting the safe stopping location based on avoiding the features which are not conducive.”) but does not explicitly disclose …wherein when no tampering of the destination is detected…
However, Liu teaches a system to detect spoofing attacks on automated driving systems, and discloses …wherein when no tampering of the destination is detected… (Col. 10, Line 12-21, “In one embodiment, security module 308 is configured to detect and spoof attacks based on a set of security rules 313. Security module 308 may be implemented as a part of perception module 302 or communicate with perception module 302 or other modules. Security module 308 detects cyber-attack on autonomous vehicle's destination change or abnormal re-routing activities by checking dynamically updated static objects on map along the route together with confirmation from passenger within the autonomous vehicle or service provider.”)
Thus, it would be obvious to a person of ordinary skill in the art at the time of the effective filing of the application to modify Modified O’Brien’s mobile robot with Liu’s destination spoof detector because it would further improve the robot’s ability to respond to intentional attacks.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ANDREW KILLIAN PEPPER whose telephone number is (571)272-6815. The examiner can normally be reached Monday - Friday 10:00-6:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Abby Lin can be reached at (571) 270-3976. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.K.P./Examiner, Art Unit 3657 /ABBY LIN/Supervisory Patent Examiner, Art Unit 3657
Prosecution Insights