DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statements (IDS) were filed on 3/20/2025 and 7/11/2025. The
submission is incompliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-8 and 10-21 are rejected under 35 USC 101 because the claimed invention is directed to an abstract idea without significantly more.
Claim 1 recites:
A method for performing vulnerability analysis, the method comprising:providing a system model of a vehicular control system;determining a plurality of attack vectors based on the system model;generating an attacker model based on the plurality of attack vectors;determining a number of vulnerabilities in the vehicular control system based on at least the attacker model and the system model;outputting an attackability index based on the number of vulnerabilities.
The claim as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, the claim encompasses a security analyst mentally considering a known system model, reasoning through a set of ways the system could be attacked (attack vectors), forming a mental profile of a hypothetical attacker’s capabilities (attacker model), counting or estimating a number of weaknesses in the system based on that reasoning, and arriving at a relative score or ranking (attackability index) reflecting that count. Each of “determining”, “generating”, and “outputting” as recited is an observation that can be performed in the human mind, or with pen and paper. If a claim, under its broadest reasonable interpretation, covers performance of the limitation in mind, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea.
This judicial exception is not integrated into a practical application. The claim
does not include additional limitations beyond the mental steps. Therefore, the claim is
directed to an abstract idea, and moreover, the claim does not include additional
elements that are sufficient to amount to significantly more than the judicial exception.
Claim 1 is patent ineligible.
Claims 2-4 recite additional characteristics of the mental steps recited in claim 1.
Hence, these claims recite mental steps and they do not recite additional limitations
beyond the abstract idea of claim 1. The reasons set forth for claim 1 are applicable to
claims 2-4. Claims 2-4 are ineligible.
Claim 5 recites the further mental step of recommending a design criteria to protect a measurement based on the attackability index. Recommending a design criteria based on a previously determined index is itself an opinion that can be performed in the human mind. Hence, this claim recites an additional mental step and does not recite additional limitations beyond the abstract idea of claim 1. The reasons set for claim 1 are applicable to claim 5. Claim 5 is ineligible.
Claims 6-8 recite additional characteristics of the mental steps recited in claims 5 and 1.
Hence, these claims recite mental steps and they do not recite additional limitations
beyond the abstract idea of claims 5 and 1. The reasons set forth for claim 5 and 1 are applicable to
claims 6-8. Claims 6-8 are ineligible.
Claim 10 recites evaluating the attackability index using a model-in-loop simulation. Applicant’s specification in para 0075 describes “As used herein, a model-in-loop simulation refers to a simulation using the model based on sample data.” Evaluating a previously determined index using a simulation, without further specificity as to what the simulation comprises, amounts to no more than generally linking the abstract idea to a field of use or applying the abstract idea with a generic computing tool. This additional limitation, considered individually and in combination with the other claim limitations, does not integrate the abstract idea into a practical application, nor does it amount to significantly more than the abstract idea, because the claim does not recite any particular improvement to simulation technology itself. The simulation is merely used as a generic tool to apply the underlying abstract idea on sample data. Claim 10 is ineligible.
Claim 11 recites substantially the same abstract idea as claim 1, with the further mental step of selecting a sensor to protect based on minimizing the attackability index Hence, this claim recites an additional mental step and does not recite additional limitations beyond the abstract idea of claim 1. The reasons set for claim 1 are applicable to claim 11. Claim 11 is ineligible.
Claims 12-14 recite additional characteristics of the mental steps recited in claim 11. Hence, these claims recite mental steps and they do not recite additional limitations beyond the abstract idea of claim 11. The reasons set forth for claim 11 are applicable to claims 12-14. Claims 12-14 are ineligible.
Claims 15-17 recites additional mental steps and do not recite additional limitations beyond the abstract idea of claim 11. The reasons set for claim 11 are applicable to claims 15-17. Claims 15-17 are ineligible.
Claim 18 recites evaluating the attackability index using a model-in-loop simulation. Applicant’s specification in para 0075 describes “As used herein, a model-in-loop simulation refers to a simulation using the model based on sample data.” Evaluating a previously determined index using a simulation, without further specificity as to what the simulation comprises, amounts to no more than generally linking the abstract idea to a field of use or applying the abstract idea with a generic computing tool, and does not recite additional limitations beyond the abstract idea of claim 11. Hence this claim does not recite additional limitations sufficient to integrate the judicial exception into a practical application or to amount to significantly more. Claim 18 is ineligible.
Claims 19-20 recite additional mental steps and they do not recite additional limitations beyond the abstract idea of claim 11. The reasons set forth for claim 11 are applicable to claims 19-20. Claims 19-20 are ineligible.
Claim 21 recites “providing, based on the attackability index, the vehicular control system …” without specifying any context of how the control system is provided. Due to this lack of context, the claim is not limited to a physical rendering of a vehicle control system, and encompasses a mental step, such as marking such a system as being available. Hence, this claim recites an additional mental step and does not recite additional limitations beyond the abstract idea of claim 2. The reasons set for claim 2 are applicable to claim 21. Claim 21 is ineligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1,5, and 8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell (US 8601587 B1, published Dec.3, 2013) in view of Shin (US 20200213351 A1, published Jul.2 ,2020) further in view of Brown (US 20230328094 A1, published Oct.12, 2023).
As per claim 1,
Powell discloses a method for performing vulnerability analysis, the method comprising: providing a system model of a a plurality of attack vectors based on the system model ([Powell, col 3 and 4, lines 62-67 and 1-4], “ Cyber attack vectors generally represent one or more illicit actions that may be performed on network infrastructure 16. In other words, cyber attack vectors may include physical and associated logical paths that may be taken through network infrastructure 16 to reach its target. Illicit actions may include those that exploit external vulnerabilities, internal vulnerabilities, or cascading vulnerabilities of network infrastructure 16. Cyber threat analysis tool 26 generates cyber attack vectors associated with network infrastructure 16 and stores the cyber attack vectors in vulnerability store 34. “); determining a number of vulnerabilities in the ([Powell, col 10, lines 11-13 ], “ simulates the attack vectors on network model 32 to determine one or more resulting ramifications “).
Powell does not disclose, but Shin discloses generating an attacker model based on the plurality of attack vectors [Shin, par 0057, “ adversary model under consideration is discussed. Consider an adversary whose objective is to shut down uncompromised/healthy in-vehicle ECUs in an elusive manner, i.e., only a subtle change in the in-vehicle network behavior while mounting attacks. Such an objective thus precludes any other types of attacks (e.g., jamming, interruption) which, albeit their larger impact, are much less elusive and thus easier to be detected/removed. The elusiveness of such attacks is discussed further below, highlighting the severity of the bus-off attack. Adversaries can either physically or remotely compromise an in-vehicle ECU through numerous attack surfaces and means. Once an in-vehicle ECU is compromised, consider the adversary to be capable of performing at least the following malicious actions. First, since the contents of arbitration, control, and data fields in the CAN frame are managed at user/application level, the adversary can inject any message with forged ID, DLC, and data on the bus. Second, since CAN is a broadcast bus, the adversary can sniff messages on CAN.”]; of a vehicular control system [Shin par 0041, “this disclosure focuses on the vulnerability of the Control Area Network (CAN) protocol for concreteness, which is the de facto standard for in-vehicle networks”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Powell so that a attacker model is generated based on the attack vectors along with a vehicular control system as taught by Shin. One would have been motivated to do so in order to proactively identify potential entry points for vehicular cyber threats and implement countermeasures within the system before a threat occurs.
Powell and Shin do not disclose but Brown discloses outputting an attackability index based on the number of vulnerabilities [Brown, par 0076, “every node in the attack graph is assigned a vulnerability score, which represents the intrinsic risk of the vulnerability to the system.”], [Brown, Fig 3, A table is depicted with score values regarding device vulnerabilities that are widely used in risk management systems.], [Brown, par 0106, “ Calculating vulnerability scores: The algorithm in FIG. 15 describes the process for calculating the vulnerability score. This algorithm includes a final line that adjusts the vulnerability score based on the defense(s) applied to the system. Each node's vulnerability score is calculated using the Exploitability factors (scope, attack_Vector, attack_Complexity, and user_Interaction) described in the table in FIG. 3. The value of each factor is dependent on the node's permission characteristics and its topographic position within the device graph D. The impact factors (confidentiality, integrity, and availability) are set by the system administrator, as is the accessibility score of each entry node. These factors are used to calculate the ISS (Impact Sub-Score). If the system administrator does not want to specify the impact score for every exploit goal, the scores can be auto generated by providing parameters for the distribution of impact scores in the specified system components. This process is similar to the one used to randomly generate IoT/CPS for testing purposes.”]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Powell in view of Shin so that outputting an attackability index is based on the number of vulnerabilities as taught by Brown. One would have been motivated to do so in order to provide a more accurate metric for identifying system risk.
As per claim 5, the rejection of claim 2 is incorporated herein.
Powell does not disclose, but Brown discloses further comprising recommending a design criteria to protect a measurement from the plurality of unprotected measurements based on the attackability index [Brown, par 0041, “The model is flexible enough to analyze practically any IoT/CPS and provide the system administrator with a concrete list of suggested defenses that can reduce system vulnerability at optimal cost.”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Powell to further comprise recommending a design criteria to protect a measurement from the plurality of unprotected measurements is based on the attackability index as taught by Brown. One would have been motivated to do so in order to establish a baseline in identifying systemic vulnerabilities and prioritizing the deployment of protective countermeasures.
As per claim 8, the rejection of claim 1 is incorporated herein.
Powell discloses wherein the vehicular control system comprises an actuator or a communication network ([Powell, col 8, lines 36-37], “network model of network infrastructure “).
Claim(s) 2, 3, and 4 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin and Brown further in view of Showkatbakhsh et al., “Securing State Estimation Under Sensor and Actuator Attacks: Theory and Design” (hereinafter Showkatbakhsh).
As per claim 2, the rejection of claim 1 is incorporated herein.
Powell does not disclose but Showkatbakhsh discloses wherein the plurality of attack vectors comprise a plurality of unprotected measurements [Showkatbakhsh, Abstract, “the malicious agent attacks an input (output) by manipulating its value arbitrarily”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Powell so that the plurality of attack vectors comprise a plurality of unprotected measurements as taught by Showkatbakhsh. One would have been motivated to do so in order to accurately simulate real-world threat vectors against known system vulnerabilities.
As per claim 3, the rejection of claim 2 is incorporated herein.
Powell does not disclose, but Showkatbakhsh discloses wherein at least one of the plurality of unprotected measurements is associated with a sensor [Showkatbakhsh, Abstract, “This paper discusses the problem of estimating the state of a linear time invariant system when some of its sensors and actuators are compromised by an adversarial agent. … the malicious agent attacks an input (output) by manipulating its value arbitrarily”]. Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that at least one of the plurality of unprotected measurements is associated with a sensor as taught by Showkatbakhsh. One would have been motivated to so in order to have a reliable basis for verifying the accuracy of the protected measurements along with the facilitation of detecting sensor anomalies.
As per claim 4, the rejection of claim 2 is incorporated herein.
Powell does not disclose, but Showkatbakhsh discloses wherein at least one of the plurality of unprotected measurements is associated with an actuator [Showkatbakhsh, Abstract, “This paper discusses the problem of estimating the state of a linear time invariant system when some of its sensors and actuators are compromised by an adversarial agent. … the malicious agent attacks an input (output) by manipulating its value arbitrarily”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that at least one of the plurality of unprotected measurements is associated with an actuator as taught by Showkatbakhsh. One would have been motivated to do so in order to identify which specific actuators are vulnerable to corrupted data.
Claim(s) 6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Showkatbakhsh et al., and further in view of Mathur (US 20190253440 A1, published Aug.15, 2019).
As per claim 6, the rejection of claim 5 is incorporated herein.
Powell does not disclose, but Mathur discloses wherein the design criteria comprises a location in the vehicular control system to place a redundant sensor, a redundant actuator, a protected sensor, or a protected actuator [Mathur, par 0057, “ physical data is obtained by the local verification device 184 from the sensors 140 using a secure mechanism, such as by using redundant sensors connected directly to the local verification devices”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the design criteria comprises a location in the vehicular control system to place a redundant sensor, a redundant actuator, a protected sensor, or a protected actuator as taught by Mathur. One would have been motivated to do so in order to improve the fault tolerance and safety of the vehicular control system by ensuring critical components remain operational during failure.
Claim(s) 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin and Brown, and further in view of Bajpai (US 20140052340 A1, published Feb.20, 2014).
As per claim 7, the rejection of claim 1 is incorporated herein.
Powell does not disclose, Bajpai discloses wherein the vehicular control system comprises a Lane Keep Assist System [Bajpai, Fig 3, describes the overall functionality of the Lane Keep Assist System].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the control system comprises a Lane Keep Assist System as taught by Bajpai. One would have been motivated to do in order to extend the vulnerability detection system to cover all vehicular control systems including Lane Keep Assist Systems, to ensure operational safety of the vehicle. Lane Keep Assist Systems are conventional control systems for cars.
Claim(s) 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin and Brown further in view of Larsson (US 20110288841 A1, published Nov.24, 2011).
As per claim 10, the rejection of claim 1 is incorporated herein.
Powell does not disclose, but Larsson discloses further comprising evaluating the attackability index using a model-in-loop simulation [Larsson, par 0041, “SIL testing includes automotive control system simulation”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the attackability index is evaluated using a model-in-loop simulation as taught by Larsson. One would have been motivated to do so in order to achieve a more accurate and dynamic evaluation of the attackability index under realistic operational conditions.
Claim(s) 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin (US 20200213351 A1, published Jul.2 ,2020), in view of Brown (US 20230328094 A1, published Oct.12, 2023) further in view of Jajodia (US 20100058456 A1, published Mar.4, 2010).
As per claim 11
Powell discloses a method ; determining a plurality of attack vectors based on the system model ([Powell, col 3 and 4, lines 62-67 and 1-4], “ Cyber attack vectors generally represent one or more illicit actions that may be performed on network infrastructure 16. In other words, cyber attack vectors may include physical and associated logical paths that may be taken through network infrastructure 16 to reach its target. Illicit actions may include those that exploit external vulnerabilities, internal vulnerabilities, or cascading vulnerabilities of network infrastructure 16. Cyber threat analysis tool 26 generates cyber attack vectors associated with network infrastructure 16 and stores the cyber attack vectors in vulnerability store 34. “); determining a number of vulnerabilities in the ([Powell, col 10, lines 11-13 ], “ simulates the attack vectors on network model 32 to determine one or more resulting ramifications “).
Powell does not disclose but Shin discloses a method of reducing an attackability index of a vehicular control system, the method comprising: providing a system model of the vehicular control system [Shin, par 0041 “ this disclosure focuses on the vulnerability of the Control Area Network (CAN) protocol for concreteness, which is the de facto standard for in-vehicle networks. “]; wherein the system model comprises a plurality of sensors [Shin, par 0042, “CAN bus to provide retrieved sensor data. The transmitted data is received by one or more nodes”], [Shin, par 0091, “ These messages include information such as wheel speeds, steering data, brake pressure, etc.”]; generating an attacker model based on the plurality of attack vectors [Shin, par 0057, “ adversary model under consideration is discussed. Consider an adversary whose objective is to shut down uncompromised/healthy in-vehicle ECUs in an elusive manner, i.e., only a subtle change in the in-vehicle network behavior while mounting attacks. Such an objective thus precludes any other types of attacks (e.g., jamming, interruption) which, albeit their larger impact, are much less elusive and thus easier to be detected/removed. The elusiveness of such attacks is discussed further below, highlighting the severity of the bus-off attack. Adversaries can either physically or remotely compromise an in-vehicle ECU through numerous attack surfaces and means. Once an in-vehicle ECU is compromised, consider the adversary to be capable of performing at least the following malicious actions. First, since the contents of arbitration, control, and data fields in the CAN frame are managed at user/application level, the adversary can inject any message with forged ID, DLC, and data on the bus. Second, since CAN is a broadcast bus, the adversary can sniff messages on CAN.”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that a plurality of sensors is included along with the reduction of an attackability index of a vehicular control system, the method comprising: providing a system model of the vehicular control system as taught by Shin. One would have been motivated to do so in order to provide a standardized framework for simulating potential threat vectors allowing automotive engineers to evaluate the security proactively.
Powell and Shin do not disclose but Brown discloses outputting an attackability index based on the number of vulnerabilities [Brown, par 0076, “every node in the attack graph is assigned a vulnerability score, which represents the intrinsic risk of the vulnerability to the system.”], [Brown, Fig 3, A table is depicted with score values regarding device vulnerabilities that are widely used in risk management systems.], [Brown, par 0106, “ Calculating vulnerability scores: The algorithm in FIG. 15 describes the process for calculating the vulnerability score. This algorithm includes a final line that adjusts the vulnerability score based on the defense(s) applied to the system. Each node's vulnerability score is calculated using the Exploitability factors (scope, attack_Vector, attack_Complexity, and user_Interaction) described in the table in FIG. 3. The value of each factor is dependent on the node's permission characteristics and its topographic position within the device graph D. The impact factors (confidentiality, integrity, and availability) are set by the system administrator, as is the accessibility score of each entry node. These factors are used to calculate the ISS (Impact Sub-Score). If the system administrator does not want to specify the impact score for every exploit goal, the scores can be auto generated by providing parameters for the distribution of impact scores in the specified system components. This process is similar to the one used to randomly generate IoT/CPS for testing purposes.”]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Powell in view of Shin so that outputting an attackability index is based on the number of vulnerabilities as taught by Brown. One would have been motivated to do so in order to provide a more accurate metric for identifying system risk.
Powell, Shin and Brown do not disclose but Jajodia discloses and selecting a sensor from the plurality of sensors to protect to minimize the attackability index [Jajodia, par 0030, “IDS sensors may be placed to cover the attack graph, using a minimal number of sensors”].
It would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell in view of Shin and Brown so that selecting a sensor from the plurality of sensors to protect to minimize the attackability index as taught by Jajodia. One would have been motivated to do so in order to optimize security by having minimal disruption of system operations while reducing various threats to the system.
Claim(s) 12 and 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Jajodia, and further in view of Bajpai (US 20140052340 A1, published Feb.20, 2014).
As per claim 12, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Bajpai discloses wherein the vehicular control system comprises a Lane Keep Assist System [Bajpai, Fig 3, describes the overall functionality of the Lane Keep Assist System].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the control system comprises a Lane Keep Assist System as taught by Bajpai. One would have been motivated to do in order to extend the vulnerability detection system to cover all vehicular control systems including lane keep Assist Systems, to ensure operational safety of the vehicle. Lane Keep Assist Systems are conventional control systems for cars.
As per claim 14, the rejection of claim 11 is incorporated herein.
Powell discloses wherein the vehicular control system further comprises a communication network ([Powell, col 8, lines 36-37], “network model of network infrastructure “).
Claim(s) 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Jajodia further in view of Showkatbatkhsh et. al “Securing State Estimation Under Sensor And Actuator Attacks: Theory and Design” (hereinafter Showkatbakhsh).
As per claim 13, the rejection of claim 11 is incorporated herein.
Powell does not disclose, but Showkatbakhsh discloses wherein the vehicular control system comprises an actuator [Showkatbatkhsh, pg 1, “bounded number of actuators and sensors”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the vehicular control system comprises an actuator as taught by Showkatbatkhsh. One would have been motivated to do in order to improve the responsive of the vehicular control system and reduce wear.
Claim(s) 15,19, and 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Jajodia, and further in view Yao (US 20040267424 A1, published Dec.30, 2004).
As per claim 15, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Yao discloses, further comprising generating a residual based on the system model [Yao, par 0065, “model-based residual signal generator in box 120 to derive a series residual signal“], [Yao, par 0064, “consistency check between the model variables and observed variables”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that generating a residual is based on the system model as taught by Yao. One would have been motivated to do so in order to increase the accuracy of the residual generation and improve the reliability of system fault detection.
As per claim 19, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Yao discloses further comprising identifying a redundant section of the system model and a non-redundant section of the system model [ Yao, par 0004, “Redundancy is needed to detect faults of systems and components. “], [Yao, par 0004, “, a sensor is duplicated or triplicated”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that a redundant section of the system model and a non-redundant section of the system model is identified as taught by Yao. One would have been motivated to do so in order to ensure uniform application of model updates across identical sections while preventing conflicting states within the system model.
As per claim 20, the rejection of claim 19 is incorporated herein.
Powell does discloses further comprising mapping the plurality of attack vectors ([Powell, col 2, lines 50-56, “cyber threat analysis tool 26 generates cyber attack vectors that may be performed on network infrastructure 16, and determines a criticality for the cyber attack vectors according to a relative importance of certain network elements that may be affected by the corresponding cyber attack vectors. “)
Powell does not disclose but Yao discloses to the redundant section of the system model and the non-redundant section of the system model [ Yao, par 0004, “Redundancy is needed to detect faults of systems and components. “], [Yao, par 0004, “, a sensor is duplicated or triplicated”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that a redundant section of the system model and a non-redundant section of the system model is identified as taught by Yao. One would have been motivated to do so in order to ensure uniform application of model updates across identical sections while preventing conflicting states within the system model.
Claim(s) 16 and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Jajodia, and further in view of Mathur ( US 20190253440 A1, published Aug.15,2019).
As per claim 16, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Mathur discloses further comprising determining where in the system model to place a redundant sensor [Mathur, par 0057, “physical data is obtained by the local verification device 184 from the sensors 140 using a secure mechanism, such as by using redundant sensors connected directly to the local verification devices”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the location of the placement of the redundant sensor can be determined as taught by Mathur. One would have been motivated to do so in order to improve fault tolerance, reliability and troubleshooting in case a sensor fails.
As per claim 17, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Mathur disclose further comprising identifying a subset of redundant sensors in the plurality of sensors [Mathur, par 0057, “physical data is obtained by the local verification device 184 from the sensors 140 using a secure mechanism, such as by using redundant sensors connected directly to the local verification devices”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that a subset of redundant sensors in the plurality of sensors is identified as taught by Mathur. One would have been motivated to do so in order to improve fault tolerance, reliability and troubleshooting incase a sensor fails.
Claim(s) 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown, and Jajodia further in view of Larsson (US 20110288841 A1, published Nov.24, 2011).
As per claim 18, the rejection of claim 11 is incorporated herein.
Powell does not disclose but Shin discloses and the attacker model [Shin, par 0057, “ adversary model under consideration is discussed. Consider an adversary whose objective is to shut down uncompromised/healthy in-vehicle ECUs in an elusive manner, i.e., only a subtle change in the in-vehicle network behavior while mounting attacks. Such an objective thus precludes any other types of attacks (e.g., jamming, interruption) which, albeit their larger impact, are much less elusive and thus easier to be detected/removed. The elusiveness of such attacks is discussed further below, highlighting the severity of the bus-off attack. Adversaries can either physically or remotely compromise an in-vehicle ECU through numerous attack surfaces and means. Once an in-vehicle ECU is compromised, consider the adversary to be capable of performing at least the following malicious actions. First, since the contents of arbitration, control, and data fields in the CAN frame are managed at user/application level, the adversary can inject any message with forged ID, DLC, and data on the bus. Second, since CAN is a broadcast bus, the adversary can sniff messages on CAN.”].
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that the attacker model is disclosed as taught by Shin. One would have been motivated to do so in order to streamline the threat verification process using a known attacker framework, yielding the predictable result of a more robust data defenses system.
Powell and Shin does not disclose but Larsson discloses further comprising evaluating the attackability index using a model-in-loop simulation of the system model [Larsson, par 0041, “ SIL testing includes automotive control system simulation “].
It would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell in view of Shin so that the attackability index is evaluated using a model-in-loop simulation of the system model as taught by Larsson. One would have been motivated to do so in order to achieve a more accurate and dynamic evaluation of the attackability index under realistic operational conditions.
Claim(s) 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Powell in view of Shin, Brown and Showkatbakhsh, and further in view of Mathur ( US 20190253440 A1, published Aug.15,2019).
As per claim 21, the rejection of claim 2 is incorporated herein.
Powell does not disclose but Brown discloses further comprising providing, based on the attackability index, the vehicular control system [Brown, par 0082, “ suggest defenses that reduce system vulnerability at the lowest cost, employing a “defense-in-depth” optimization “],
Therefore, it would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell so that measurements protecting the system based on the attackability index as taught by Brown. One would have been motivated to do so in order to improve the overall security posture of the system by proactively identifying and mitigating high-risk vulnerabilities before they can be exploited
Powell and Brown do not disclose but Mathur discloses the vehicular control system, wherein a measurement from the plurality of unprotected measurements is protected in the vehicular control system [Mathur, par 0011, “ actuators controllable by the controller devices or verification devices to remedy the anomalies and regulate the physical process, thereby defending the utilities system against the cyber-physical attacks. “].
It would have been prima facie obvious to one of ordinary skill in the art before the
effective filing date of the claimed invention to modify Powell in view of Brown so that a measurement from the plurality of unprotected measurements is protected in the vehicular control system as taught by Mathur. One would have been motivated to do so in order to enhance data integrity and prevent unauthorized manipulation of critical vehicular control mechanisms.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Saipratap Prem whose telephone number is (571)270-0894. The examiner can normally be reached Monday - Friday 8 a.m. -4 p.m..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at (571) 272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAIPRATAP PREM/Examiner, Art Unit 2494
/JUNG W KIM/Supervisory Patent Examiner, Art Unit 2494
Prosecution Insights