Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Specification Objections
The specification is objected to for the following reasons:
Claims 1 and 16 recite “logic at least one of coupled to or integrated within the receiver” (claim 1) and “logic at least one of coupled to or integrated with the receiver” (claim 16). The alternative phrase is grammatically incomplete (a word such as “that is” is required), and the prepositions differ between the two independent claims without explanation. This formal matter is objected to under 37 C.F.R. § 1.75; appropriate correction is required in any response. In addition:
Paragraphs 0051 and 0085 refer to “FIG. 6C” and “attack pattern 613.” The Brief Description of the Drawings identifies no FIG. 6C - only FIGS. 6A and 6B (paras 0014-0015, 0090-0091). The figure references in paras 0051 and 0085 do not correspond to any drawings.
Paragraph 0086, describing method 403 (FIG. 4C), recites detection “at operation 430” using the computed value “representing the difference between the second sum and the first sum.” Method 403 contains no operations 430 or 470 and computes no sums; its path proceeds by correlation (operations 485-491). The cross-references are erroneous and must be corrected.
Paragraph 0096 refers to “the described operations for USB-C/PD mode-transition architecture described herein.” This subject matter is unrelated to the claimed invention and appears to have been imported from another application. Any correction must not introduce new matter (35 U.S.C. § 132(a)).
Paragraphs 0043 and 0065 state, in defining the frequency metric equation that “S[Wingdings font/0xE0]o is the reference frequency sample.” The variable S is the frequency metric (the difference), not the reference frequency sample, which the specification elsewhere defines as fr (para 0034). The variable definitions are internally inconsistent and must be corrected.
Paragraph 0066 contains a broken sentence: “…the processing logic can omit the computation of the number of ‘zero’ crossings for normalization when computing the frequency metric. an example, the processing logic can compute the frequency metric, S, using an example mathematical equation…”
Appropriate correction is requested.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1 – 20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Rejection 1 - Trademark usage in claims (claims 1-20)
Independent claims 1, 9, and 16 recite “a receiver adapted with Bluetooth® low energy (BLE) capability” (claim 1), “logic of a receiver adapted with Bluetooth® low energy (BLE) capability” (claim 9), and “a receiving device adapted with Bluetooth® low energy (BLE) capability” (claim 16). Where a trademark or trade name is used in a claim as a limitation to identify or describe a particular material or product, the claim does not comply with 35 U.S.C. § 112(b). MPEP § 2173.05(u). A trademark identifies the source of goods; it does not describe the goods themselves. The registered mark “Bluetooth®” is used here as the limitation defining the communication capability of the claimed receiver, but the technical characteristics of Bluetooth Low Energy are defined by the mark owner’s published specifications, which vary across specification versions and change over time without applicant’s control. The scope of the claims therefore depends on a private standard subject to change, and cannot be determined with reasonable certainty. Nautilus, Inc. v. Biosig Instruments, Inc., 572 U.S. 898 (2014). Claims 2-8, 10-15, and 17-20 are rejected on this ground by dependency. In any response, applicant is advised to replace the trademark with the technical characteristics of the capability (e.g., structure or function of the receiver per an identified communication protocol).
Rejection 2 - “a reference frequency sample value” (claims 2, 4, 10, 12, 17, and 19; claims 3, 5, 11, 13, and 18 by dependency)
Claims 2, 10, and 17 recite “compute a second sum of the absolute value of a reference frequency sample value,” and claims 4, 12, and 19 recite “compute a value representing a difference between the frequency samples of bits of the predetermined pattern and a reference frequency sample value.” Each of these claims refers elsewhere in the same claim to “the reference frequency sample” (the quantity recited in parent claims 1, 9, and 16), while introducing the new element “a reference frequency sample value” with an indefinite article. The claim language does not state the relationship between “a reference frequency sample value” and “the reference frequency sample.” Under the broadest reasonable interpretation, “a reference frequency sample value” may be (a) the same quantity as the parent claim’s reference frequency sample, (b) a value derived from it (e.g., the pre-computed sum of absolute values of reference frequency samples described at para 0043), or (c) a separate, distinct reference quantity. The specification does not resolve this ambiguity: it uses “reference frequency sample,” “reference frequency samples,” “reference frequency value” (para 0043), and “reference FM frequency value” (para 0034) without establishing that these terms are coextensive, and paras 0055, 0073 equate the singular and plural forms only for the reference frequency samples themselves.
Because the claims reasonably support more than one interpretation as to the identity of the reference quantity being summed or differenced, claims 2, 4, 10, 12, 17, and 19 are rejected under 35 U.S.C. § 112(b). MPEP §§2173.02(I), 2173.05(e); In re Packard, 751 F.3d 1307 (Fed. Cir. 2014). A suggested amendment is to recite, e.g., “a reference frequency sample value derived from the reference frequency sample.”
Rejection 3 -Direction of the “difference between the second sum and the first sum” (claims 2, 3, 10, 11, 17, and 18)
Claims 2, 10, and 17 recite “compute a value representing a difference between the second sum and the first sum,” and claims 3, 11, and 18 recite “in response to determining that the value representing the difference between the second sum and the first sum meets or exceeds the first threshold value.” The claim language does not specify the direction of the claimed difference: a “difference between Band A” may reasonably be read as B - A, A - B, or | B – A |. The specification computes the disclosed metric in only one direction, S = (∑lfxl - ∑lfrl) (paras 0043-0045, 0065-0067) - the first sum (received) minus the second sum (reference) - while describing the same quantity in the surrounding prose as “a difference between the second sum and the first sum.” The direction of the difference is material to claim scope: it determines whether a value that “meets or exceeds a first threshold value” indicates elevated or reduced high-frequency content relative to the reference, and therefore which branch of claims 3, 11, and 18 labels the intrusion a high pass filter intrusion as opposed to an early commit late detect (ECLD) or early detect late commit (EDLC) intrusion. Under an absolute-value reading, the “less than a second threshold value” branch would additionally capture in-band differences that the specification treats as indicating “no intrusion” (paras 0052, 0070, 0086). At least three reasonable readings of the claimed difference exist, and the claims are therefore indefinite. MPEP §§ 2173.02(I), 2173.03; In re Cohn, 438 F.2d 989 (C.C.P.A. 1972). A suggested amendment is to recite the sign of the difference expressly.
Rejection 4 - “high pass filter intrusion” without any criterion (claims 6 and 14)
Claim 6 recites “wherein the intrusion is a high pass filter intrusion,” and claim 14 recites “wherein the intrusion is (i) a high pass filter intrusion, or (ii) one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.” Unlike claims 3, 11, and 18, which supply the objective test of the first threshold value, claims 6 and 14 recite “a high pass filter intrusion” without any criterion for identifying one. The specification uses the phrase only as a label attached to one output branch of the disclosed decision logic (paras 0052, 0070, 0086) and never identifies what such an intrusion is. A person of ordinary skill in the art could reasonably read the term as (a) an intrusion in which an attacker applies a high-pass filter to the transmitted signal, or (b) any intrusion producing frequency content above a reference. These readings yield different claim scopes, and the specification does not resolve the choice. Claims 6 and 14 are therefore indefinite under 35 U.S.C. § 112(b). MPEP § 2173.02(I); Nautilus, 572 U.S. 898.
Rejection 5 - Lack of antecedent basis: “the receiver” (claims 16 and 20; claims 17-19 by dependency)
[AltContent: ]Claim 16 recites “logic at least one of coupled to or integrated with the receiver,” and claim 20 recites “send, from the receiver, a notification indicating the intrusion associated with the predetermined pattern.” Claim 16 introduces no element named “a receiver”; the only receiving element recited is “a receiving device.” The phrase “the receiver” therefore lacks antecedent basis. The specification compounds the ambiguity by describing a receiver as a component within a receiving device - “a wireless device (e.g., a receiving device) includes receiving logic coupled to or integrated within a receiver of the wireless device” (para 0019; see also paras 0023, 0027) - so that “the receiver” in claims 16 and 20 may refer either to the recited receiving device or to an unrecited sub-component thereof. Claims 16 and 20 are rejected under 35 U.S.C. § 112(b). MPEP § 2173.05(e). A suggested amendment is to replace “the receiver” with “the receiving device” in claims 16 and 20.
Rejection 6 -”in response to determining a difference” (claims 1, 9, and 16)
Claims 1, 9, and 16 recite “in response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern, detecting an intrusion associated with the predetermined pattern” (claims 1 and 16 recite “detect”; claim 9 recites “detecting”). Read literally, this limitation covers the detection of an intrusion upon determining any nonzero difference between the reference frequency sample and the frequency samples. Received frequency samples would be expected to differ from the reference by some nonzero amount in ordinary operation, as the specification itself recognizes that frequency offsets and clocking errors exist between devices and must be estimated and corrected (para 0017). The specification, however, discloses that differences falling within the band between the second threshold value and the first threshold value indicate “no intrusion” (paras 0052, 0070, 0086).
The claims are inconsistent with the disclosed detection condition, and it is unclear what magnitude or character of “a difference” the claims require before an intrusion is detected. Claims 1, 9, and 16 are therefore rejected under 35 U.S.C. § 112(b). MPEP § 2173.03; In re Cohn, 438 F.2d 989.
Claims 2-8, 10-15, and 17-20 are rejected on this ground by dependency.
Rejection 7 - Unclear relationship of “an enclosure having a transmitter and the receiver” (claims 1, 9, and 16)
Claims 1 and 9 recite “wherein the packet is received during a keyless access attempt of an enclosure having a transmitter and the receiver,” and claim 16 recites “during a keyless access attempt of an enclosure having the transmission device and the receiving device.” It is unclear whether “an enclosure having a transmitter and the receiver is a positively recited structural limitation of the claimed wireless device/system or merely an intended environment of use. It is further unclear what relationship “a transmitter” (claims 1, 9) bears to the received packet: the specification describes the packet as transmitted by the keyed peripheral device 150 seeking access to the enclosure on which the wireless device 101 resides (paras 0021-0022), while the claim language places both the transmitter and the receiver on the enclosure. The specification thus describes an arrangement inconsistent with the most natural reading of the claim.
Because the claims reasonably support more than one interpretation as to the arrangement of the claimed devices, claims 1, 9, and 16 are rejected under 35 U.S.C. § 112(b). MPEP § 2173.02(I). Claims 2-8, 10-15, and 17-20 are rejected on this ground by dependency.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1, 8, 9, 15, 16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Arslan (US 2024/0056818 A1) in view of Stitt (US 2020/0120509 A1).
Per claim 1, Arslan (US 2024/0056818 A1) is relied upon to teach a wireless device (reads on “The network device 10 also includes a network interface 30, which may be a wireless interface that connects with an antenna 35”, see Arslan para 0025. Network device 10 communicates through a wireless interface connected to an antenna, which is a wireless device in the same sense as the specification’s wireless device 101 with antenna 110) comprising: a receiver (reads on “The network interface 30 also includes a receive circuit 32 which is used to receive packets”, see Arslan para 0025. Receive circuit 32 is a discrete receive chain (LNA 51 through differentiator 61; see Arslan para 0029-para 0032) used to receive packets, which is a receiver) adapted with Bluetooth® low energy (BLE) capability (reads on “High accuracy distance measuring (HADM) has become a key feature of BLE”, see Arslan para 0002. Arslan’s disclosure is directed to HADM as a feature of BLE, and receive circuit 32 processes received HADM packets (para 0062); a receiver that receives and processes BLE HADM packets is adapted with BLE capability); and logic (reads on “An attack detector circuit 65 operates in conjunction with the receive circuit 32”, see Arslan para 0038. Attack detector circuit 65 (upsample circuit 66, digitized model 67, attack metric calculator 68) is dedicated processing logic that carries out the determining, comparing and detecting functions, the same role as the specification’s attack detector 254A) at least one of coupled to or integrated within the receiver (reads on “The attack detector circuit 65 also receives an input based on the differentiated phase”, see Arslan para 0038. Circuit 65 takes as an input the differentiated phase generated inside receive circuit 32 by differentiator 61, so it is signal-coupled to the receiver, which alone satisfies the alternative), the logic to: determine frequency samples (reads on “Thus, by subtracting the values of two phase values, and optionally dividing the difference by a time duration, a value that is indicative of frequency can be determined”, see Arslan para 0032. Differentiator 61 subtracts successive CORDIC phase values and outputs one frequency-indicative value per sample, and Arslan states in the same paragraph that the derivative of phase is frequency; this is the same phase-difference operation the specification uses to compute fx, so the output samples are frequency samples) of bits of a predetermined pattern (reads on “The Sounding Sequence is a predetermined bit pattern having a predetermined frequency”, see Arslan para 0005. The Sounding Sequence is expressly a predetermined bit pattern, and it is the bit pattern whose differentiated-phase samples Arslan scores near the markers (para 0065); the frequency samples are therefore samples of bits of a predetermined pattern) of a packet (reads on “In response, the receive circuit 32 operates as normal, creating the differentiated phase signal”, see Arslan para 0062. This sentence immediately follows the processing unit’s determination that a HADM packet is being received, so the differentiated-phase samples are generated from the bits of that received packet) during a round-trip timing estimation of the packet (reads on “Round trip delay may be measured using two different standard defined signals; Sounding Sequence and Random Bit Sequence”, see Arslan para 0005. Arslan identifies the Sounding Sequence as one of the two standard signals over which round trip delay is measured, using the initiator/reflector timers of para 0004; samples taken from that sequence are taken during the round-trip timing estimation of the packet, matching the specification’s use of data patterns in RTT estimation); compare (reads on “The attack metric calculator 68 compares the output of the digitized model 67 with the delayed differentiated phase from the fractional delay filter 64”, see Arslan para 0043. Attack metric calculator 68 performs an explicit comparison of two signals, which is the claimed comparing operation), to a reference frequency sample (reads on “In some embodiments, the digitized model emulates the operation of the RF circuit, the CORDIC 60 and the differentiator 61”, see Arslan para 0044. Because digitized model 67 emulates the receive chain through differentiator 61, whose output Arslan identifies as frequency (para 0032), the model output is a computed expected frequency value per sample generated from the known expected data, which is the spec’s expected frequency sample of the pattern bits), the frequency samples of bits of the predetermined pattern (reads on “That expected output is then compared to a delayed version of the differentiated phase and a score is generated”, see Arslan para 0044. The item compared against the expected output is the received differentiated phase, i.e., the received frequency samples mapped above; for the Sounding Sequence the comparison is confined to the pattern bits near the markers (para 0065)); and in response to determining a difference between the reference frequency sample and the frequency samples of bits of the predetermined pattern (reads on “In this embodiment, the attack metric calculator 68 may calculate a difference between each sample from the digitized model 67 and the fractional delay filter 64, square this difference and add this result to an accumulated total”, see Arslan para 0060. Arslan computes, sample by sample, the difference between the digitized-model (reference) sample and the received differentiated-phase (frequency) sample and accumulates it, which is determining a difference between the reference frequency sample and the received frequency samples), detect an intrusion (reads on “The present system compares the actual received packet to an internally generated version of that packet to detect differences that may indicate that a Man in the Middle attack is underway”, see Arslan para 0021. Arslan’s stated purpose is to compare the received packet against an internally generated version and to treat detected differences as indicating a Man in the Middle attack, which is an intrusion detected in response to the difference; and reads on “This value may be a 4 bit signed number, where positive numbers indicate that an attack is likely and negative numbers indicate that an attack is unlikely”, see Arslan para 0061. The NADM output converts the accumulated difference into a signed decision in which positive values indicate an attack is likely, i.e., the detection result that follows from the determined difference) associated with the predetermined pattern (reads on “Thus, to detect an attack, only those regions near the markers are used to calculate the score”, see Arslan para 0065. For the Sounding Sequence the attack score is computed only from regions near the markers embedded in the predetermined pattern, so the detected attack is associated with the predetermined pattern). The prior art of record does not explicitly disclose wherein the packet is received during a keyless access attempt of an enclosure.
Stitt (US 2020/0120509 A1) is relied upon to teach wherein the received (reads on “The packets may be transmitted to take time-of-flight measurements including time to transmit the packets to the portable access device and time to respond and receive corresponding responses from the portable access device”, see Stitt para 0306. Stitt’s vehicle access module receives the time-of-flight response packets from the portable access device as part of its authorization operations, so the packet is received at the vehicle side) during a keyless access attempt (reads on “As an example, the packets may be transmitted to authorize the portable access device and access to the interior of the vehicle may be provided when the portable access device and/or corresponding user is determined to be authorized to access the vehicle”, see Stitt para 0306. These packets are exchanged to authorize the portable access device for access to the interior of the vehicle, i.e., during an attempt to obtain keyless access) of an enclosure (reads on “FIG. 46 shows a vehicle 5200, including a round trip time (RTT) responder 5202 and a RTT initiator 5204, and a portable access device 5206 including a RTT initiator 5208 and a RTT responder 5210”, see Stitt para 0323. Vehicle 5200 is the enclosure; the specification lists a vehicle as an enclosure (spec para 0021), and Stitt places the round-trip-time equipment in that vehicle) having a transmitter and the receiver (reads on “As used herein an “initiator” may refer to a network device including a BLE radio, transmitter and/or receiver and initiates a signal or tone exchange”, see Stitt para 0323. The vehicle’s RTT initiator 5204 is a network device including a BLE radio with a transmitter and receiver, so the enclosure has the transmitting and receiving radio hardware the claim requires; and reads on “The RTT responder 5202 and RTT initiator 5204 may transmit and receive using the antennas”, see Stitt para 0323. The vehicle-side RTT devices both transmit and receive through the vehicle antennas, confirming that the transmitter and the receiver are carried by the enclosure. In the combination Arslan’s network device 10 with transmit circuit 31 and receive circuit 32 serves as that vehicle-side initiator).
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify the BLE high accuracy distance measurement (HADM) network device of Arslan, whose attack detector circuit 65 compares received differentiated-phase (frequency) samples of a round-trip-timing packet with the output of a digitized model to detect a Man in the Middle attack, by integrating the vehicle-resident round-trip-time (RTT) initiator and responder architecture of the passive entry/passive start keyless access system of Stitt (see Stitt para 0323: “FIG. 46 shows a vehicle 5200, including a round trip time (RTT) responder 5202 and a RTT initiator 5204, and a portable access device 5206 including a RTT initiator 5208 and a RTT responder 5210”) to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {A, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have installed Arslan’s network device 10, with its antenna 35, transmit circuit 31, receive circuit 32 and attack detector circuit 65, as the vehicle-side RTT initiator of Stitt’s vehicle 5200, so that the round-trip-timing packets exchanged with a portable access device during a keyless access attempt are transmitted and received by radio hardware carried by the vehicle and are screened by Arslan’s received-versus-reference frequency comparison before access is granted, as recited in the instant claims, by applying the vehicle-resident RTT ranging and relay-attack countermeasure design of Stitt to the existing attack-detecting BLE HADM receiver of Arslan. As Stitt itself states: “If the portable access device is attempting to perform a range extender type relay station attack, the access module performs one or more countermeasures including preventing access to the interior of the vehicle.” (see Stitt para 0306), which addresses the well-recognized problem of relay and man-in-the-middle attacks that spoof round trip-time distance in order to obtain unauthorized keyless entry to a vehicle. One of ordinary skill in the art in BLE secure ranging and keyless vehicle access would have recognized that Arslan names keyless automobile entry as its target application (Arslan para 0002, para 0005) but does not expressly show the transmitter and receiver of its HADM device installed in the vehicle, and that Stitt’s vehicle-mounted RTT initiator with BLE transmit and receive circuitry was a known, predictable solution to exactly that gap, requiring no change to the underlying differentiated-phase comparison, digitized model 67 and NADM scoring of Arslan’s attack detector circuit 65. The combination is further supported by MPEP 2141 Rationale A (combining prior art elements according to known methods to yield predictable results) and Rationale G (some teaching, suggestion, or motivation in the prior art, here Arslan’s own statement that the attack permits entry into the vehicle, that would have led one of ordinary skill to combine the references). The motivation to combine these references applies to all claims under this heading.
Per claim 8, the prior art of record further suggests send, from the receiver (reads on “Further, in certain embodiments, the NADM value is also transmitted to the other network device (either the initiator or reflector) that participated in the distance measurement”, see Arslan para 0062. The device whose receive circuit 32 received the HADM packet and computed the NADM transmits that value to the other device that took part in the ranging exchange, which is sending from the receiver), a notification indicating the intrusion (reads on “In certain embodiments, a value known as the Normalized Attack Detection Metric (NADM) may be used to provide an indication of the likelihood of an attack”, see Arslan para 0061. The transmitted NADM value is defined as an indication of the likelihood of an attack, so the transmitted message is a notification indicating the intrusion; and reads on “The countermeasures may include notifying an owner of the vehicle of the range extender type relay station attack”, see Stitt para 0306. Stitt expressly teaches notifying of the detected relay attack from the vehicle access module, confirming that sending an attack notification from the vehicle-side receiving equipment is a known countermeasure in the same combination) associated with the predetermined pattern (reads on “Based on this score, the processing unit 20 can determine the appropriate NADM for this packet”, see Arslan para 0062. The NADM is determined for the specific received packet from the pattern-based score (para 0065 markers), so the notification is associated with the predetermined pattern).
Claim 9 is analyzed with respect to claim 1.
Claim 15 is analyzed with respect to claim 8.
Claim 16 is analyzed with respect to claim 1. The prior art of record further teaches a system (reads on “The system includes an initiator 1 and a reflector 2”, see Arslan para 0004. Arslan’s HADM arrangement is expressly a system of cooperating initiator and reflector devices) comprising: an antenna (reads on “The network device 10 also includes a network interface 30, which may be a wireless interface that connects with an antenna 35”, see Arslan para 0025. Network device 10 includes antenna 35 connected to its wireless interface, which is the claimed antenna); a transmission device (reads on “The network interface 30 includes a transmit circuit 31 which is used to transmit data from this network device 10 using the antenna 35”, see Arslan para 0025. Transmit circuit 31 (upsampler 71, FIR filter 72, DCO 73, PA 76) is a transmitter that sends data through antenna 35, i.e., a transmission device) that is to transmit a packet (reads on “The initiator 1 transmits a packet to the reflector 2”, see Arslan para 0004. In the HADM round trip the initiator transmits the ranging packet, which is the packet the transmission device is to transmit); a receiving device (reads on “The network interface 30 also includes a receive circuit 32 which is used to receive packets”, see Arslan para 0025. Receive circuit 32 is a dedicated receive chain that receives the round-trip-timing packets, so it is a receiving device in the sense of the specification receiver 104).
Claim 20 is analyzed with respect to claim 8.
Claims 4, 5, 12, 13 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Arslan in view of Stitt and further in view of Baxley (US 2016/0127392 A1).
Per claim 4, the prior art of record further suggests wherein to compare (reads on “The attack metric calculator 68 compares the output of the digitized model 67 with the delayed differentiated phase from the fractional delay filter 64”, see Arslan para 0043. The attack metric calculator of Arslan is the claimed comparing logic: it takes the delayed differentiated-phase samples of the received packet and the model output and compares them, which is the comparison of operation 430 in the specification anchor), to the reference frequency sample (reads on “That expected output is then compared to a delayed version of the differentiated phase and a score is generated”, see Arslan para 0044. The expected output of the digitized model is generated from the data the other device is to transmit, so it is the expected (reference) frequency sample against which the received samples are compared, matching the specification’s reference frequency sample computed at operation 405), the frequency samples of bits of the predetermined pattern (reads on “As is well known, the derivative of phase is frequency”, see Arslan para 0032; and “The Sounding Sequence is a predetermined bit pattern having a predetermined frequency”, see Arslan para 0005. Differentiated phase is frequency, and the Sounding Sequence is a predetermined bit pattern, so the samples Arslan compares are frequency samples of bits of a predetermined pattern, the same operand the specification anchor compares), the logic is to: compute a value representing a difference (reads on “In this embodiment, the attack metric calculator 68 may calculate a difference between each sample from the digitized model 67 and the fractional delay filter 64, square this difference and add this result to an accumulated total”, see Arslan para 0060. Arslan’s attack metric calculator calculates a difference for each sample, which is a value representing a difference, the ∆f of the specification anchor, before any squaring or accumulation) between the frequency samples of bits of the predetermined pattern (reads on “As is well known, the derivative of phase is frequency”, see Arslan para 0032; and “Thus, to detect an attack, only those regions near the markers are used to calculate the score”, see Arslan para 0065. The fractional-delay-filter output is the differentiated phase, i.e., frequency, of the received bits, and for the Sounding Sequence the score is computed over the regions of the predetermined pattern near the markers, so one operand of the difference is the frequency samples of bits of the predetermined pattern) and a reference frequency sample value (reads on “In both embodiments, the attack detector circuit 65 receives, as an input, data that is representative of the data that the other device is to transmit”, see Arslan para 0038. The digitized model is driven by the data the other device is to transmit, so each model sample is an expected (reference) frequency sample value, the other operand of the specification’s ∆f (the claim fixes no subtraction order)). The prior art of record does not explicitly state perform a correlation between the value representing the difference and an attack pattern.
Baxley (US 2016/0127392 A1) is relied upon to teach perform a correlation between the value representing the difference (reads on “In block 1230, the device classification module 370 can match or correlate signatures of signal and link features against signals of known classification as benign or malicious”, see Baxley para 0177; and “This comparison may be done using a correlator, wherein the correlator multiplies both signals sample by sample, sums the products together and determines a score from this information”, see Arslan para 0059. Baxley matches or correlates collected signal signatures against signals of known malicious classification, and the attack metric calculator of Arslan is already a correlator that multiplies two sample sequences and sums the products; in Arslan para 0059 those two sequences are the digitized-model data and the received differentiated-phase data, so Arslan supplies the correlation operation and Baxley the practice of correlating against known-attack signatures) and an attack pattern (reads on “Content of the feature vectors may be compared against templates of known attacks to classify the identified wireless attacks”, see Baxley para 0008; and “The attack templates can provide indicators or signatures for matching red radio behavior to known wireless attacks such as spoofing, Dos, jamming, wormholes, and so forth”, see Baxley para 0183. Baxley compares collected signal content against stored templates of known attacks and states that those templates are signatures of known attacks; a stored template of the waveform difference that a known attack produces (e.g., the phase-inversion corrections of Arslan para 0006) is an attack pattern within the BRI of the claim and of the specification’s attack pattern 613, and correlating the difference values of Arslan with that template is the proposed combination).
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify the BLE round-trip-timing attack detector of the prior art of record (a vehicle-side receiver whose attack metric calculator computes, for each sample of a predetermined bit pattern, the difference between the received differentiated-phase, i.e., frequency, sample and the model-generated expected sample, and which already provides a sample-by-sample multiply-and-sum correlator), by integrating the known-attack template matching of Baxley (see Baxley para 0008: “Content of the feature vectors may be compared against templates of known attacks to classify the identified wireless attacks”) to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {A, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have supplied the per-sample difference values computed by the attack metric calculator of Arslan (Arslan para 0060) to the multiply-and-sum correlator of Arslan (Arslan para 0059) together with a pre-computed attack template held in the memory of the receiving device, the template representing the waveform difference that a known attack (for example, the phase-inversion corrections of the attacker of Arslan para 0006) produces relative to the expected waveform, as recited in the instant claims, by applying the attack-template matching technique of Baxley to the existing received-versus-expected difference computation of Arslan. As Baxley itself states: “The attack templates can provide indicators or signatures for matching red radio behavior to known wireless attacks such as spoofing, DoS, jamming, wormholes, and so forth.” (see Baxley para 0183), which addresses the well-recognized problem of determining not merely that a received signal is anomalous but which known attack produced it. One of ordinary skill in the art of BLE secure ranging and keyless entry would have recognized that the difference values of Arslan are where the attack manifests (see Arslan para 0007: “Thus, it would be beneficial if there were a system that was able to detect a Man in the Middle attack by observing the difference between the expected waveform and the received waveform”), that Arslan reduces those differences to a single score without comparing them to the known shape of an attack’s distortion, and that the matching of Baxley of collected signal signatures against stored templates of known attacks (Baxley para 0177) was a known, predictable solution to exactly that gap, requiring no change to the receive chain or digitized model of Arslan and reusing the correlator of Arslan, which already operates as stated in Arslan para 0059 (“This comparison may be done using a correlator, wherein the correlator multiplies both signals sample by sample, sums the products together and determines a score from this information”). No single reference discloses correlating the received-minus-reference difference values with an attack pattern: the operands of the correlator of Arslan para 0059 are the digitized-model data and the received differentiated-phase data, and Baxley matches its templates against collected signal and link signatures. Supplying the difference values of Arslan para 0060 and a stored known-attack template of Baxley as the two correlator operands is the modification relied on here, and its result is predictable because the correlator still multiplies two sample sequences and sums the products, now yielding a score that rises when the difference values take the shape of a known attack. The combination is further supported by MPEP 2141 Rationale A (combining prior art elements according to known methods to yield predictable results) and Rationale G (the teaching of Baxley that templates of known attacks are used to classify identified wireless attacks supplies the motivation). The motivation to combine these references applies to all claims under this heading.
Per claim 5, the prior art of record further suggests wherein the attack pattern is pre-computed (reads on “Portions of the information within the analysis databases 380 may be preinstalled at the purchase, installation, or configuration of the sensors 120, the signal analysis system 130, and/or other systems supporting the technology presented herein”, see Baxley para 0085; and “In block 1320, the attack classification module 375 can retrieve an attack template library for known and abstract signal types from the attack database 620”, see Baxley para 0183. Baxley’s attack templates are retrieved from an attack database whose content may be preinstalled at purchase, installation, or configuration, i.e., prepared before any received signal is analyzed, which is a pre-computed attack pattern as described in the specification anchor) and stored on the wireless device (reads on “The analysis databases 380 may be stored locally at the signal processing and threat analysis modules of the signal analysis system 130 and the raw signal analysis engines 240, within one or more systems attached via the networks 150, online, in a storage cloud, in any other location, or any combination thereof”, see Baxley para 0125; and “The network device 10 may include a second memory device 40 in which data that is received and transmitted by the network interface 30 is stored”, see Arslan para 0026. Baxley states the databases may be stored locally at the modules that perform the signal and threat analysis, and in the combination that analysis is performed by the attack detector of Arslan’s receiving network device, whose memory stores the data it uses; the template is thus stored on the device comprising the receiver).
Claim 12 is analyzed with respect to claim 4.
Claim 13 is analyzed with respect to claim 5.
Claim 19 is analyzed with respect to claim 12.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Arslan in view of Stitt and further in view of Matos (US 2023/0068613 Al).
Per claim 6, the prior art of record is relied upon to teach the intrusion (reads on “The third BLE signal 4404 may be generated by an attacking device”, see Stitt para 0316. Stitt’s third signal 4404 is produced by an attacking device, so it is an intrusion of the kind the received-versus-reference comparator of Arslan is built to detect) is a high pass filter intrusion (reads on “A third BLE signal 4404 represents the stronger BLE packet signal after leading edge sensing of Gaussian bits and then transmitting with faster edges”, see Stitt para 0316. The attacker senses the leading edges of the Gaussian-shaped bits and retransmits them with faster edges, restoring the high-frequency content that the Gaussian shaping removes, which is the high-frequency signature the specification attributes to the high pass filter intrusion and reads on “As can be seen the edges are sloped and transition quicker that the transitions of the second BLE curve 4402”, see Stitt para 0316. Stitt confirms that the attack signal transitions more quickly than the Gaussian-shaped reference curve, which is the waveform distortion the claimed classification identifies). The prior art of record is silent on explicitly stating wherein the intrusion is a high pass filter intrusion.
Matos (US 2023/0068613 Al) is relied upon to teach a high pass filter intrusion (reads on “The originating device filters each bit of the bit sequence in the target signal 202 via a Gaussian filter to reduce the bandwidth of the target signal 202 and improve coexistence between individual bits of the bit sequence”, see Matos para 0036; and “However, as described above, due to the filtering, transitions (e.g., rise time and/or fall time) between bits of the target signal 202 are increased (e.g., the target signal 202 rises and/or falls over a longer period of time)”, see Matos para 0036. Matos corroborates the Gaussian low-pass baseline of the legitimate BLE bit stream, whose reduced bandwidth lengthens every transition; the faster-edged attack signal of Stitt para 0316 is measured against that baseline and therefore carries frequency content above it, which is the high-frequency signature the specification uses to identify the high pass filter intrusion; and reads on “Yet, the attack device 110 cannot perform effective EDLC attacks with narrowband filtering because only wideband filtering allows the attack device 110 to perform an EDLC attack early enough (e.g., due to the inherent latency of the filtering) to be feasible”, see Matos para 0042. This passage is context only: it explains why an early-acting attacker operates within the lengthened Gaussian transitions; the wideband filtering it names is on the attack device’s detection path and is not relied on as a high pass filter, the class reading being carried by the faster-edged retransmission of Stitt para 0315-para 0316).
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify the keyless vehicle access, attack-detecting BLE HADM system of the prior art of record, in which Arslan’s attack detector circuit 65 compares received differentiated-phase (frequency) samples with the expected output of a digitized model (Arslan para 0043) and Stitt’s attacking device senses the leading edges of the Gaussian-shaped BLE bits and retransmits them with faster edges (Stitt para 0316), by integrating the Gaussian low-pass baseline characterization of the legitimate BLE signal of Matos (see Matos para 0036: “The originating device filters each bit of the bit sequence in the target signal 202 via a Gaussian filter to reduce the bandwidth of the target signal 202 and improve coexistence between individual bits of the bit sequence”) to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {A, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have identified and handled the faster-edge intrusion detected by the Arslan-Stitt received-versus-reference frequency comparison as a high pass filter intrusion, as recited in the instant claims, by applying the teaching of Matos that the legitimate BLE signal is Gaussian (low-pass) filtered to a reduced bandwidth with lengthened transitions to the existing faster-edge attacker model of the Arslan-Stitt combination, so that an attack signal whose edges are faster than that baseline is classified by its high-frequency content. As Matos itself states: “However, as described above, due to the filtering, transitions (e.g., rise time and/or fall time) between bits of the target signal 202 are increased (e.g., the target signal 202 rises and/or falls over a longer period of time).” (see Matos para 0036), which addresses the well-recognized problem that the Gaussian shaping of legitimate BLE bits lengthens their transitions and so gives an early-acting relay attacker time to act (Matos para 0042). One of ordinary skill in the art of BLE secure ranging and keyless entry would have recognized that Stitt describes the faster-edged attack signal (Stitt para 0315-para 0316) without naming its class, and that measuring that signal against the Gaussian low-pass baseline of Matos, relative to which faster edges necessarily carry frequency content above the legitimate band, was a known, predictable solution to exactly that gap, requiring no change to the differentiated-phase comparison and NADM scoring of Arslan or the vehicle-resident RTT architecture of Stitt. The combination is further supported by MPEP 2141 Rationale A (combining prior art elements according to known methods to yield predictable results) and Rationale G (some teaching, suggestion, or motivation in the prior art, here the express identification by Matos of the Gaussian low-pass shaping of legitimate BLE bits and the lengthened transitions that an early-acting attacker exploits, that would have led one of ordinary skill to combine the references). The motivation to combine these references applies to all claims under this heading.
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Arslan in view of Stitt and further in view of Syvertsen (US 2024/0378930 Al).
Per claim 7, the prior art of record teaches the wireless device of claim 1 and the intrusion (reads on “In other words, the attacker 3 must predict the next bit, and begin transmitting that bit, before it is actually received”, see Arslan para 0006. The intrusion Arslan’s detector addresses is an attacker that predicts each next bit and begins transmitting it before it is received, the early-commit half of the specification’s ECLD definition); however, it is silent on explicitly stating the intrusion is one of: an early commit late detect (ECLD) intrusion or an early detect late commit (EDLC) intrusion.
Syvertsen (US 2024/0378930 A1) is relied upon to teach intrusion is one of: an early commit late detect (ECLD) intrusion (reads on “Early commit late detect (ECLD) attacks can occur in wireless communication environments when an attacking device learns symbols of a transmitted signal early during a communication phase between two devices and commits the symbols later in the communication phase to attempt to deceive the receiving device about the arrival time of the transmitted signal, and consequently, the proximity of the transmitting device to the receiving device”, see Syvertsen para 0003. Syvertsen expressly names the attack early commit late detect (ECLD) and defines it as learning symbols early and committing them to deceive the receiver about arrival time, the same round-trip-timing spoof Arslan detects; and reads on “More particularly, in some embodiments, attack devices 120 begins transmitting “relayed” bits before receiving them (based on a prediction), and then make an adjustment (flip the bit) if the prediction was wrong”, see Syvertsen para 0042. Syvertsen’s ECLD attack devices transmit relayed bits before receiving them based on a prediction and flip mispredicted bits, which is word-for-word the mechanism of Arslan para 0006; Syvertsen thus supplies the ECLD label for the intrusion Arslan detects; and reads on “Embodiments of the present disclosure will be described in specific contexts, e.g., an early commit late detect (ECLD) attack prevention for unlocking a vehicle, e.g., using Bluetooth or Bluetooth Low Energy (BLE)’’, see Syvertsen para 0020. Syvertsen places ECLD attacks in BLE vehicle-unlocking, the same keyless-access context as the Arslan-Stitt combination).
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify the keyless vehicle access, attack-detecting BLE HADM system of the prior art of record, in which Arslan’s attack detector circuit 65 detects an attacker that predicts each next bit, transmits it before it is received and corrects mispredicted bits (Arslan para 0006), by integrating the early commit late detect (ECLD) attack characterization of Syvertsen (see Syvertsen para 0003: “Early commit late detect (ECLD) attacks can occur in wireless communication environments when an attacking device learns symbols of a transmitted signal early during a communication phase between two devices and commits the symbols later in the communication phase to attempt to deceive the receiving device about the arrival time of the transmitted signal, and consequently, the proximity of the transmitting device to the receiving device”) to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {A, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have identified and handled the intrusion detected by the Arslan-Stitt received-versus-reference frequency comparison as an early commit late detect (ECLD) intrusion, as recited in the instant claims, by applying the ECLD attack taxonomy of Syvertsen to the existing bit-prediction-and-correction attacker model of the Arslan-Stitt combination. As Syvertsen itself states: “Embodiments of the present disclosure will be described in specific contexts, e.g., an early commit late detect (ECLD) attack prevention for[AltContent: ] unlocking a vehicle, e.g., using Bluetooth or Bluetooth Low Energy (BLE).” (see Syvertsen para 0020), which addresses the well-recognized problem of attackers that commit predicted symbols early to shorten the measured round-trip time and unlock a vehicle. One of ordinary skill in the art in BLE secure ranging would have recognized that Arslan describes the ECLD attacker behavior without attaching the ECLD designation to it, and that Syvertsen’s ECLD characterization of attack devices that transmit relayed bits before receiving them and flip mispredicted bits (Syvertsen para 0042) was a known, predictable solution to exactly that gap, requiring no change to the underlying differentiated-phase comparison and NADM scoring of Arslan or the vehicle-resident RTT architecture of Stitt. The combination is further supported by MPEP 2141 Rationale A (combining prior art elements according to known methods to yield predictable results) and Rationale G (some teaching, suggestion, or motivation in the prior art, here Syvertsen’s express identification of ECLD as the attack against BLE vehicle unlocking, that would have led one of ordinary skill to combine the references). The motivation to combine these references applies to all claims under this heading.
Claim 14 is analyzed with respect to claim 7.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Brian Shaw whose telephone number is (571)270-5191. The examiner can normally be reached on Mon-Thurs from 6:00 AM-3:30 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeff Nickerson can be reached on (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 703-872-9306.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRIAN F SHAW/
Primary Examiner, Art Unit 2432
Prosecution Insights