CTNF 19/088,590 CTNF 88750 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. 07-30-03-h AIA Claim Interpretation 07-30-03 AIA The following is a quotation of 35 U.S.C. 112(f): (f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph: An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “a log acquisition unit acquiring…”; “a log analysis unit determining ….“; “a verification instruction unit instructing …”; “an intrusion determination unit determining…..”; and “an attack estimation unit performing …” in claim 1 and claim 12. A review of the specification shows that the following appears to be the corresponding structure described in the specification for the 35 U.S.C. 112, sixth paragraph limitation: specification discloses text , fig .3-4, para 0040-0049. Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. Claim Rejections - 35 USC § 103 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim (s) 1, 5-6, 9-13 are rejected under 35 U.S.C. 103 as being unpatentable over HAGA et al(EP 3 621 246 81) in view of KONG et al(US 20190149324 A1) . With regards to claim 1, 10-11, HAGA discloses, An information processing device (FIG 2 80 and associated text; ) comprising: a log acquisition unit acquiring a security log indicating an anomaly occurred in a vehicle (FIG 4 830 and associated text;[0066] The log collection processing unit 830 stores various data (such as information about frames received on an on-board network), which is the content of the log information collected from each vehicle, in the vehicle log storage DB 870. When storing the various data in the vehicle log storage DB 870, the log collection processing unit 830 may also perform processing such as a predetermined normalization of the various data. The data (vehicle log information) stored in the vehicle log storage DB 870 will be described later using Fig. 5. [0114] The anomaly detection server 80 performs a statistical anomaly detection process on the basis of log information (log information including information about frames received on the on-board network of each vehicle) transmitted from each vehicle (step S201).); a log analysis unit determining whether to instruct a verification unit of the vehicle to execute an integrity verification based on the security log acquired by the log acquisition unit ([0061] The ECUs 100 and 101 connected to the bus 10, the ECUs 200 and 201 connected to the bus 20, and the ECUs 300, 301, and 302 connected to the bus 30 are MAC-supporting ECUs, and include functions (MAC generation function, MAC verification function) for processing a message authentication code (MAC). FIG 4 840 and associated text; ); a verification instruction unit instructing the verification unit to execute the integrity verification in response to the log analysis unit determining to instruct the verification unit to execute the integrity verification for the in-vehicle unit ([0139];The anomaly detection server 80 performs a verification test regarding whether or not a problem has occurred in using the generated new rule or algorithm for detecting the attack frame in the vehicle, and only in the case in which the verification test is successful (step S305), the anomaly detection server 80 delivers transmission information including fraud detection information indicating the rule or algorithm to vehicles in the vehicle family A that includes the vehicle 1010a (step S306). Note that the verification test is performed in an environment that simulates a vehicle, for example. Also, in the case in which the verification test is not successful, the new rule or algorithm may be adjusted or the like to make the verification test successful, and then fraud detection information indicating the adjusted rule or algorithm may be delivered.); an intrusion determination unit determining whether the in-vehicle unit is intruded based on a result of the integrity verification executed by the verification unit ([0067] The log analysis processing unit 840 includes a function of analyzing the log information collected from each vehicle and stored (accumulated) in the vehicle log storage DB 870, and thereby assessing the anomaly level, which is an index associated with whether or not a frame received on the on-board network of a certain vehicle is anomalous (whether or not an attack frame has been sent out on the on-board network by an attacker).); and an attack estimation unit performing an estimation of an attack, which is a cause of intrusion, based on the security log and a result of intrusion determination obtained from the intrusion determination unit ([0141]; In the on-board network management system according to Embodiment 2, in the case of determining that a frame received on the on-board network of a certain vehicle is anomalous (an attack frame) according to an anomaly level assessed for the frame by the anomaly detection server 80, under a fixed condition, fraud detection information indicating a rule or algorithm for detecting the anomaly (the attack frame) on the vehicle side is delivered to vehicles in the same vehicle family as the vehicle.). HAGA does not exclusively but KONG teaches, execute an integrity verification for verifying an integrity of an in-vehicle unit (FIG 3 and associated text; [0029]; There is a need to identify the vehicle that reflects changes in the components that make up the vehicle. In this manner, validation of the vehicle identity ensures the integrity of all of the components that make up the vehicle as well as information generated by any of the components that make up the vehicle. By generating hashes for each vehicle component a cryptology tree, similar to a Merkle Tree, may be used to verify vehicle integrity. Although exemplary embodiments are discussed in the context of a vehicle, planes, trains, motorcycles, and other transportation devices may also employ the disclosed integrity verification.). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify HAGA’s device with teaching of KONG in order to for generating a vehicle identification hash value and verifying the integrity of the vehicle (KONG Abstract). With regards to claim 5, HAGA in view of KONG teaches, wherein, in response to the log analysis unit determining, based on the security log, to instruct the verification unit to execute the integrity verification, the verification instruction unit instructs the verification unit to execute the integrity verification for: all of the in-vehicle units mounted on the vehicle (KONG FIG 3 and associated text;); or the in-vehicle unit for which the security log indicates the anomaly; or an in-vehicle unit other than the in-vehicle unit for which the security log indicates the anomaly; or the in-vehicle unit for which the security log indicates the anomaly and another in-vehicle unit physically or logically related to the in-vehicle unit for which the security log indicates the anomaly. With regards to claim 6, HAGA in view of KONG teaches,, wherein, in response to the log analysis unit determining, based on the security log, to instruct the verification unit to execute the integrity verification, the verification instruction unit instructs the verification unit to verify, as the integrity verification (HAGA [0139];The anomaly detection server 80 performs a verification test regarding whether or not a problem has occurred in using the generated new rule or algorithm for detecting the attack frame in the vehicle, and only in the case in which the verification test is successful (step S305), the anomaly detection server 80 delivers transmission information including fraud detection information indicating the rule or algorithm to vehicles in the vehicle family A that includes the vehicle 1010a (step S306). Note that the verification test is performed in an environment that simulates a vehicle, for example. Also, in the case in which the verification test is not successful, the new rule or algorithm may be adjusted or the like to make the verification test successful, and then fraud detection information indicating the adjusted rule or algorithm may be delivered.,) at least one of program code, data, hardware configuration, or software configuration ([0133] The anomaly detection server 80 assesses the anomaly level of a frame received on the on-board network of a certain vehicle, on the basis of information about the frame.). Motivation would be same as stated in claim 1. With regards to claim 9, HAGA in view of KONG teaches, wherein the intrusion determination unit determines that the in-vehicle unit is intruded when the integrity of the in-vehicle unit is impaired (KONG FIG 3 350 with “NO” and associated text )., the intrusion determination unit determines that the in-vehicle unit is not intruded when the integrity of the in-vehicle unit is maintained (KONG FIG 3 350 with “YES” and associated text), and the intrusion determination unit determines that it is unable to determine whether the in-vehicle unit is intruded or not when the integrity of the in-vehicle unit cannot be verified (HAGA [0126] For this reason, anomalies that go undetected by fraud detection techniques based on existing rules such as a blacklist (for example, attack frames related to a sign of attack, a hitherto unknown attack ). Motivation would be same as stated in claim 1. With regards to claim 12, HAGA discloses, An information processing system (FIG 1A and associated text; )comprising: an in-vehicle information processing device mounted on a vehicle (FIG 3 90 and associated text; [0062]); and an external information processing device located outside the vehicle and communicating with the in-vehicle information processing device (FIG 2 80), wherein the in-vehicle information processing device includes : a monitoring unit generating a security log indicative of an anomaly occurred in the vehicle ([0043] First, each of the multiple vehicles 1010 (first vehicle, second vehicle, and so on) of the group 1000 transmits log information, which is information successively acquired in each vehicle, to the cloud server 1110 of the data center operating company 1100.); and and the external information processing device includes (FIG 2 80): a log acquisition unit acquiring the security log from the in-vehicle information processing device (FIG 4 830 and associated text; ); a log analysis unit determining whether to instruct the verification unit to execute the integrity verification for the in-vehicle unit based on the security log acquired by the log acquisition unit (FIG 4 840 and associated text; ); a verification instruction unit instructing the verification unit to execute the integrity verification in response to the log analysis unit determining to instruct the verification unit to execute the integrity verification ([0139];The anomaly detection server 80 performs a verification test regarding whether or not a problem has occurred in using the generated new rule or algorithm for detecting the attack frame in the vehicle, and only in the case in which the verification test is successful (step S305), the anomaly detection server 80 delivers transmission information including fraud detection information indicating the rule or algorithm to vehicles in the vehicle family A that includes the vehicle 1010a (step S306). Note that the verification test is performed in an environment that simulates a vehicle, for example. Also, in the case in which the verification test is not successful, the new rule or algorithm may be adjusted or the like to make the verification test successful, and then fraud detection information indicating the adjusted rule or algorithm may be delivered.); an intrusion determination unit determining whether the in-vehicle unit is intruded based on a result of the integrity verification executed by the verification unit ([0067] The log analysis processing unit 840 includes a function of analyzing the log information collected from each vehicle and stored (accumulated) in the vehicle log storage DB 870, and thereby assessing the anomaly level, which is an index associated with whether or not a frame received on the on-board network of a certain vehicle is anomalous (whether or not an attack frame has been sent out on the on-board network by an attacker).); and an attack estimation unit performing an estimation of an attack, which is a cause of intrusion, based on the security log and a result of intrusion determination obtained from the intrusion determination unit ([0141]; In the on-board network management system according to Embodiment 2, in the case of determining that a frame received on the on-board network of a certain vehicle is anomalous (an attack frame) according to an anomaly level assessed for the frame by the anomaly detection server 80, under a fixed condition, fraud d=3A) information indicating a rule or algorithm for detecting the anomaly (the attack frame) on the vehicle side is delivered to vehicles in the same vehicle family as the vehicle). HAGA does not exclusively but ZHANG teaches, a verification unit executing an integrity verification for an in-vehicle unit mounted on the vehicle (FIG 3 and associated text; [0029]; There is a need to identify the vehicle that reflects changes in the components that make up the vehicle. In this manner, validation of the vehicle identity ensures the integrity of all of the components that make up the vehicle as well as information generated by any of the components that make up the vehicle. By generating hashes for each vehicle component a cryptology tree, similar to a Merkle Tree, may be used to verify vehicle integrity. Although exemplary embodiments are discussed in the context of a vehicle, planes, trains, motorcycles, and other transportation devices may also employ the disclosed integrity verification.). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify HAGA’s device with teaching of KONG in order to for generating a vehicle identification hash value and verifying the integrity of the vehicle (KONG Abstract). Claim 13 is method claim corresponding system claim 12, also rejected accordingly . Allowable Subject Matter 12-151-08 AIA 07-43 12-51-08 Claim 2-4, 7-8 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Conclusion 07-96 AIA The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. CN 112585930 A, CN 111277668 A Any inquiry concerning this communication or earlier communications from the examiner should be directed to MOHAMMED WALIULLAH whose telephone number is (571)270-7987. The examiner can normally be reached 8.30 to 430 PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached at 1-571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /MOHAMMED WALIULLAH/Primary Examiner, Art Unit 2498 Application/Control Number: 19/088,590 Page 2 Art Unit: 2498 Application/Control Number: 19/088,590 Page 3 Art Unit: 2498 Application/Control Number: 19/088,590 Page 5 Art Unit: 2498 Application/Control Number: 19/088,590 Page 6 Art Unit: 2498 Application/Control Number: 19/088,590 Page 7 Art Unit: 2498 Application/Control Number: 19/088,590 Page 8 Art Unit: 2498 Application/Control Number: 19/088,590 Page 9 Art Unit: 2498 Application/Control Number: 19/088,590 Page 10 Art Unit: 2498 Application/Control Number: 19/088,590 Page 11 Art Unit: 2498 Application/Control Number: 19/088,590 Page 12 Art Unit: 2498
Prosecution Insights