Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
2. This action is in response to the application filed April 25, 2025.
3. Claims 1-16 have examined and are pending with this action.
4. The Information Disclosure Statement filed April 25, 2025 has been considered.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
5. Claims 1-14 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1, 13, and 14 recites the limitation "the ego log management device”. There is insufficient antecedent basis for this limitation in the claim. Appropriate correction is required.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
6. Claims 1, 5, 7, 9, 11, and 13-16 are rejected under 35 U.S.C. 102(a)(1) and 102(a)(2) as being anticipated by Gutti et al. (US 9,104,745 B1).
INDEPENDENT:
As per claim 1, Gutti teaches a log management device, which is one of a plurality of log management devices equipped to a mobile object, each of the plurality of log management devices acquiring logs from an electronic control unit (see Gutti, FIG. 1A), the log management device comprising:
a log acquisition unit acquiring the logs from the electronic control unit (see Gutti, FIG. 2B; and Abstract: “In some embodiments, a received query to generate a log report is forwarded to each of a plurality of log collector clusters, and responses to the query received from each of at least a subset of the plurality of log collector clusters are aggregated to generate the log report.”);
a storage unit in which main device information is stored, the main device information indicating a main log management device designated from the plurality of log management devices including the ego log management device, the main log management device transmitting the acquired logs to a device located outside of the mobile object (see Gutti, FIG. 2B; and col.4, lines 1-13: “At step 214, the received event log data is stored at one or more log collectors (or with respect to one or more virtual log collectors thereof) of an associated cluster. That is, step 214 comprises writing the log data to one or more (virtual) loggers of the cluster. The event log may or may not be stored at step 214 at the inbound logger, i.e., the log collector that receives the event log at step 212. In various embodiments, the event log may be stored by itself or as part of a segment or block of data that, for example, includes data from a plurality of event logs. In some cases, for instance, a plurality of logs from one or more devices are aggregated to form a block of data that is then stored at one or more (virtual) loggers at step 214”);
a determination unit determining whether the ego log management device is the main log management device based on the main device information (see Gutti, col.4, lines 60-65: “At step 304, the received query is forwarded to one or more appropriate log collector clusters. In some cases, the central management system selects a particular log collector of a cluster as a coordinator for responding to a query forwarded by the central management system”); and
a transmission unit transmitting the logs to the device located outside of the mobile object (see Gutti, col.5, lines 1-11: “… At step 316, the coordinator of the cluster receives aggregated results from one or more collectors to which the query was forwarded at step 314 and aggregates the results for the cluster. At step 318, the aggregated results of the cluster are returned by the coordinator to the central management system.”),
wherein, when the determination unit determines that the ego log management device is the main log management device, the transmission unit transmits the logs to the device located outside of the mobile object, and when the determination unit determines that the ego log management device is not the main log management device, the transmission unit does not transmit the logs to the device located outside of the mobile object (see Gutti, col.4, lines 62-65: “the central management system selects a particular log collector of a cluster as a coordinator for responding to a query forwarded by the central management system”. NOTE: only the designated coordinator can transmit the cluster’s log files. If it is not eh selected coordinator, it does not perform the external transmission).
As per claim 13, Gutti teaches a log management method executed by a log management device, wherein the log management device is one of a plurality of log management devices equipped to a mobile object, the log management device includes a storage unit in which main device information is stored, and the main device information indicates a main log management device which is designated from the plurality of log management devices, the log management method comprising:
acquiring logs from an electronic control unit (see Claim 1 rejection above);
determining whether the ego log management device is the main log management device based on the main device information stored in the storage unit of the ego log management device (see Claim 1 rejection above);
in response to determining that the ego log management device is the main log management device, transmitting the acquired logs to a device located outside of the mobile object (see Claim 1 rejection above); and
in response to determining that the ego log management device is not the main log management device, not transmitting the acquired logs to the device located outside of the mobile object (see Claim 1 rejection above).
As per claim 14, Gutti teaches a computer-readable non-transitory storage medium storing a log management program, the log management program comprising instructions to be executed by at least one processor of a log management device, wherein the log management device is one of a plurality of log management devices equipped to a mobile object, the log management device includes a storage unit in which main device information is stored, and the main device information indicates a main log management device which is designated from the plurality of log management devices, the instructions of the log management program comprising:
acquiring logs from an electronic control unit (see Claim 1 rejection above);
determining whether the ego log management device is the main log management device based on the main device information stored in the storage unit of the ego log management device (see Claim 1 rejection above);
in response to determining that the ego log management device is the main log management device, transmitting the acquired logs to a device located outside of the mobile object (see Claim 1 rejection above); and
in response to determining that the ego log management device is not the main log management device, not transmitting the acquired logs to the device located outside of the mobile object (see Claim 1 rejection above).
As per claim 15, Gutti teaches a log management system equipped to a mobile object, the log management system comprising:
a first log management device acquiring logs from an electronic control unit (see Claim 1 rejection above); and
a second log management device acquiring the logs from the electronic control unit (see Gutti, FIG. 1A, #106), wherein the first log management device includes: a first log acquisition unit acquiring the logs from the electronic control unit (see Claim 1 rejection above);
a first storage unit in which main device information is stored, the main device information indicating a main log management device which is designated from the first and second log management devices included in the log management system, the main log management device transmitting the acquired logs to a device located outside of the mobile object (see Claim 1 rejection above); and
a first determination unit determining that the first log management device is not the main log management device based on the main device information (see Claim 1 rejection above),
and the second log management device (see Gutti, FIG. 1A, #106) includes:
a second log acquisition unit acquiring the logs from the electronic control unit (see Claim 1 rejection above);
a second storage unit in which the main device information indicating the main log management device is stored (see Claim 1 rejection above);
a second determination unit determining that the second log management device is the main log management device based on the main device information (see Claim 1 rejection above); and
a transmission unit transmitting the logs to the device located outside of the mobile object (see Claim 1 rejection above).
As per claim 16, Gutti teaches a log management method executed by a log management system equipped to a mobile object, wherein the log management system includes a first log management device and a second log management device each acquiring logs from an electronic control unit, each of the first and second log management devices includes a storage unit in which main device information is stored, the main device information indicating a main log management device which is designated from the first and second log management devices included in the log management system, the log management method comprising:
acquiring, by the first log management device, the logs from the electronic control unit (see Claim 1 rejection above);
determining, in the first log management device, that the first log management device is not the main log management device based on the main device information stored in the storage unit of the first log management device (see Claim 15 rejection above);
acquiring, by the second log management device, the logs from the electronic control unit (see Claim 1 rejection above);
determining, in the second log management device, that the second log management device is the main log management device based on the main device information stored in the storge unit of the second log management device (see Claim 15 rejection above); and
transmitting, by the second log management device, the acquired logs to a device located outside of the mobile object (see Claim 15 rejection above).
DEPENDENT:
As per claim 5, which depends on claim 2 Gutti, teaches further comprising a detection result output unit outputting the detection result information to the main log management device indicated by the main device information in response to the determination unit determining that the ego log management device is not the main log management device (see Gutti, col.5, lines 1-11: “… At step 316, the coordinator of the cluster receives aggregated results from one or more collectors to which the query was forwarded at step 314 and aggregates the results for the cluster. At step 318, the aggregated results of the cluster are returned by the coordinator to the central management system.”).
As per claim 7, which depends on claim 1, Gutti teaches further comprising a receiving unit receiving the main device information, wherein the storage unit stores the main device information received by the receiving unit (see Gutti, FIG. 2B, #214).
As per claim 9, which depends on claim 1, Gutti teaches further comprising a load information acquisition unit acquiring load information indicating a load of a different log management device from the different log management device, wherein the different log management device is one of the plurality of log management devices, the main device information indicates the main log management device designated in a case where a load of one of the plurality of log management devices is equal to or greater than a predetermined threshold, and when the load indicated by the acquired load information is equal to or greater than the predetermined threshold, the determination unit determines whether the ego log management device is the main log management device based on the main device information (see Gutti, col.2, line 53-57: “A log collector 106 registration with central management system 102 includes a specification of logger capacity (e.g., storage, CPU, RAM, etc.) so that central management system 102 can appropriately distribute load across a plurality of log collectors 106”; and col.4, lines 39-44: “Step 214 may include any one or more appropriate load balancing or distribution techniques, such as consistent hashing, to store data across one or more (virtual) log collectors of an associated cluster. Moreover, step 214 may include replication of data to facilitate increased availability of data in the cluster”).
As per claim 11, which depends on claim 1, Gutti further teaches wherein the transmission unit transmits the logs via a communication device that communicates with the device located outside of the mobile object, the log management device is provided in a secure area, and the communication device is located in a non-secure area (see Gutti, col.2, line 4-8: “Security appliances, such as firewalls, generate a large number of event logs. The event logs contain valuable information that, for example, may provide insights into activities and/or trends of an associated network and may be employed for forensic purposes.”; and col.5, line 60-64: “Although the disclosed architecture has been described with respect to firewall generated log records, the techniques disclosed herein may be similarly adapted to non-security appliances for efficient storage and reporting of data.”).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
7. Claims 2-4, 6, and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Gutti et al. (US 9,104,745 B1) in view of Kawata et al. (US 12,056,000 B1).
As per claim 2, which depends on claim 1, Gutti does not explicitly teach further comprising an anomaly detection unit detecting an anomaly occurred in the electronic control unit based on the logs and generating detection result information, wherein the transmission unit transmits the logs related to the detected anomaly.
Kawata teaches an anomaly detection unit detecting an anomaly occurred in the electronic control unit based on the logs and generating detection result information, wherein the transmission unit transmits the logs related to the detected anomaly (see Kawata, Abstract: “The device may process the sequence of log templates to identify an anomaly associated with the sequence of log templates.”; and col.3, lines 56-59: “As shown in FIG. 1A, and by reference number 105, the monitoring device may obtain one or more log files. For example, the one or more network devices may respectively send log files to the monitoring device”).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the system of Gutti in view of Kawata by implementing an anomaly detection unit detecting an anomaly occurred in the electronic control unit based on the logs and generating detection result information, wherein the transmission unit transmits the logs related to the detected anomaly. One would be motivated to do so because Gutti teaches in column 5, lines 17-22, “During query processing, the central management system itself functions as a coordinator across multiple clusters. In various embodiments, aggregating results at a collector, a coordinator of a cluster, and/or the central management system may include analyzing, organizing, or otherwise processing or formatting the results”.
As per claim 6, which depends on claim 5, Gutti and Kawata teach further comprising a detection result acquisition unit acquiring, in response to the determination unit determining that the ego log management device is the main log management device (see Claim 1 rejection above), the detection result information generated by a different log management device as first detection result information from the different log management device, the different log management device being one of the plurality of log management devices (see Gutti, col.4, lines 62-65: “In some cases, the central management system selects a particular log collector of a cluster as a coordinator for responding to a query forwarded by the central management system.”); and
a comparison unit comparing the acquired first detection result information with second detection result information, the second detection result information being the detection result information generated by the anomaly detection unit of the ego log management device (see Claim 2 rejection above), wherein, when the first detection result information is different from the second detection result information as a comparison result determined by the comparison unit, the transmission unit transmits comparison result information indicating the comparison result determined by the comparison unit to the device located outside of the mobile object (see Kawata, col.6, lines 51-59: “the monitoring device may train a machine learning model based on historical data (e.g., historical sequences of log templates) and/or additional information, such as information identifying a “good” sequence of log templates (e.g., without anomalies associated with the sequence of log templates) and/or information identifying a “bad” sequence of log templates (e.g., that identifies anomalies associated with the sequences of log templates”).
As per claim 8, which depends on claim 1, Gutti further teaches wherein the mobile object is equipped with an electronic control system, the electronic control system includes multiple electronic control units that are distributed into multiple zones according to functions or locations of the multiple electronic control units, each of the multiple zones includes one or more of the plurality of log management devices (see Gutti, col.3, line 14-25: “In some cases, data associated with a cluster 108 is restricted to that cluster although it may be moved, replicated, or otherwise distributed within the cluster. In some embodiments, clusters 108 may reflect administrative or other boundaries across which data is not shared. Similar to the clustering described with respect to FIG. 1B, in some embodiments, a log collector device may be segmented into one or more virtual systems, and the one or more virtual systems may be assigned to one or more clusters. Such a technique allows multiple virtual systems of a single device to belong to multiple clusters, thus segmenting the data from their initial source”), the log acquisition unit periodically acquires a liveness monitoring log from one of the multiple electronic control units, when one of the multiple electronic control units included in a first zone among the multiple zones is not in an operating state, the log management device included in a second zone different from the first zone is designated as the main log management device by the main device information , and when the log acquisition unit fails to acquire the liveness monitoring log from one of the multiple electronic control units, the determination unit determines whether the ego log management device is the main log management device based on the main device information (see Gutti, col.2, line 20-31: “A highly available and scalable event storage system, which, for example, may be deployed in an enterprise network, is disclosed. As further described herein, such an event storage system provides various features, such as, for example, supporting storage of a large number of event logs per second; retrieval of specific and/or aggregate information from among a large number of stored events; scalability to meet the demands of an associated network, e.g., by incrementally adding capacity as needed to preserve read and write rates as event generation rates increase; and redundancy so that partial hardware and/or software failures or network partitioning do not disable the entire system”; and col.5, lines 51-60: “A configurable data replication factor provides a way to tune fault tolerance and provide read availability. Even when a collector is offline (e.g., due to network connectivity issues or software, hardware, or other failures), other collectors that have the same data can serve read operations. Any writes destined for an unavailable collector may be temporarily stored on other collectors and transferred to the intended collector upon reconnection. Thus, (temporary) failures of collectors do not result in non-availability of the overall system”).
Allowable Subject Matter
8. Claims 3, 4, 10, and 12 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is an examiner' s statement of reasons for allowance:
The prior art of record does not disclose, teach, or suggest neither singly nor in combination the claimed limitation of “wherein the storage unit stores the main device information in association with master anomaly information indicating an anomaly predicted to occur in the electronic control unit, and the determination unit determines whether the ego log management device is the main log management device based on the main device information associated with the master anomaly information corresponding to the anomaly indicated by the detection result information” as recited in dependent claim 3.
The prior art of record does not disclose, teach, or suggest neither singly nor in combination the claimed limitation of “further comprising a load measuring unit measuring a load of the ego log management device, wherein, when the load of the ego log management device measured by the load measuring unit is equal to or greater than the predetermined threshold, the determination unit determines that the ego log management device is not the main log management device regardless of the main device information” as recited in dependent claim 10.
Claim 4 depends on claims 3 and claims 12 depends on claim 4. Therefore, claims 4 and 12 are also allowable if claim 3 and 2 are incorporated into the independent claim 1.
Conclusion
9. For the reasons above, claims 1-2, 5-9, 11, and 13-16 have been rejected, claim 3, 4, 10, and 12 have been objected to and claims 1-16 remain pending.
10. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL Y WON whose telephone number is (571)272-3993. The examiner can normally be reached on Wk.1: M-F: 8-5 PST & Wk.2: M-Th: 8-7 PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas R Taylor can be reached on 571-272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Won/Primary Examiner, Art Unit 2443
Prosecution Insights