Office Action 1: Non-Final Rejection (2022-05-06)
Rejection types: 102 - Lack of Novelty, 103 - Obviousness, Double Patenting

CLAIMS:
WHAT IS CLAIMED IS:

1\. A system comprising:
memory;
a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:
define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation;
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks.

2\. The system of claim 1, wherein the countermeasure includes outputting a message or a notification.

3\. The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller, a powers supply, an internal regulator, or an intermediate voltage.

4\. The system of claim 1, wherein the ADC includes an encryption unit.

5\. The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller to measure drain power voltage.

6\. The system of claim 1, wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel, wherein the channel is utilized for the baseline measurement.

7\. The system of claim 1, wherein the ADC is connected via a least one data bus to the separate processor, wherein the ADC includes at least one channel connected via a secure bus that requires encryption or authentication or both.

8\. The system of claim 7, wherein the secure bus is controlled by a secure element or in response to a secure state of the microcontroller.

9\. The system of claim 1, wherein a channel of the side-channel includes a higher sampling rate than other channels of the side-channel of the ADC, wherein the channel is utilized for the baseline measurement.

10\. The system of claim 1, wherein the ADC is unconnected and configured to measure parasitic noise on the ADC.

11\. A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side- channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes received from an analog-to-digital converter (ADC) of a microcontroller;
receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime;
comparing the runtime measurement of the physical attribute to the fingerprint; and
in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or
one or more fault-attacks.

12\. The computer-implemented method of claim 1 1, wherein the physical attribute includes a voltage.

13\. A system comprising:
memory;
a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:
define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring voltage prior to runtime operation;
receive a runtime measurement from the ADC that includes voltage of at least a separate microcontroller during runtime;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks.

14\. The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a voltage supply of the microcontroller.

15\. The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller.

16\. The system of claim 13, wherein the runtime measurement is retrieved from no connection with an input supply pin of the ADC, wherein the runtime measurement includes parasitic noise of the ADC.

17\. The system of claim 13, wherein the countermeasure operation includes reprogramming the software to original code.

18\. The system of claim 13, wherein the countermeasure operation includes reprogramming the software.

19\. The system of claim 13, wherein the side-channel is associated with a separate microcontroller.

20\. The system of claim 13, wherein runtime measurement is sent to an intrusion detection system segregated from the separate processor and MCU, wherein the intrusion detection system is configured to compare the runtime measurement to the baseline measurement utilizing a neural network. 15 16 17 18

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 have been examined.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 09/25/2020 is in compliance with the provisions of 37 CFR 1.97.  Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA  as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of copending Application No. 16/723861 in view of US 10157278 to Gonzalez et al (hereinafter Gonzalez).
Instant application
Copending Application No. 16/723861
11. A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side- channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes received from an analog-to-digital converter (ADC) of a microcontroller; receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime; comparing the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks.
11. A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement of one or more physical attributes of at least a separate processor during an enrollment period of the system;
receiving a runtime measurement from a sensor regarding the one or more physical attributes of at least the separate processor during runtime;
comparing the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
Copending Application No. 16/723861 does not teach: physical attributes received from an analog-to-digital converter (ADC) of a microcontroller. However, Gonzalez teaches:
physical attributes received from an analog-to-digital converter (ADC) of a microcontroller (Gonzalez: column 4, lines 61-67: The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez in the invention of copending Application No. 16/723861 to include the above limitations. The motivation to do so would be to determine an anomaly of the target device (Gonzalez: column 1, lines 55-60).
This is a provisional nonstatutory double patenting rejection.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-3, 7-9, 11-14 and 17-19 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by applicant provided prior art US 10157278 to Aguayo Gonzalez et al (hereinafter Gonzalez).
As per claim 1, Gonzalez teaches:
A system comprising: memory; a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:
define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 7, lines 9-24: The reference data can be securely stored in the PFP references database 207 to be used in the assessment process. These reference data are normally extracted during a characterization process. Column 9, line 65-column 10, line 10: The reference extraction module 218 generates reference data that drive the integrity assessment performance (the PFP reference extraction process is also referred to as Characterization process). Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage);
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime (Gonzalez: column 3, line 63-column 4, line 6: As shown in FIG. 1, side-channel probes 101 can capture side-channel information (e.g., power consumption or electromagnetic emissions and other physical signals, etc.) Fig. 2A, column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 6, lines 1-5 and 22-25: The digitized signals from the digitizer 203 can be passed, e.g., via a link or network connection 204, to the discrete-time signal processor (DSP) 205. The PFP analytics 206 can process data received from the DSP 205. Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage);
compare the runtime measurement to the fingerprint (Gonzalez: column 4, lines 6-16: The fingerprinting system 100 can collect new side-channel collected information at 102 and then compare the newly-collected side-channel information with previously-stored reference data (e.g., historical reference power consumption records, etc.) at 103. Also, column 7, lines 24-30); and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, etc.).
As per claim 2, Gonzalez teaches:
The system of claim 1, wherein the countermeasure includes outputting a message or a notification (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106).
As per claim 3, Gonzalez teaches:
The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller, a powers supply, an internal regulator, or an intermediate voltage (Gonzalez: column 2, lines 51-60: The apparatus comprises a circuit anomaly detection component configured to monitor a change of state in a pin on a target circuit chip that indicates that a reprogrammable component on the target circuit chip is reprogrammed. Column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage, current, power, signal delay, radiation, audio and/or temperature, i.e., an input pin of the ADC is connected, directly or indirectly, to a pin on the target chip).
As per claim 7, Gonzalez teaches:
The system of claim 1, wherein the ADC is connected via a least one data bus to the separate processor, wherein the ADC includes at least one channel connected via a secure bus that requires encryption or authentication or both (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor. Column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 6, lines 1-21: After the signals are digitized, however, they can be stored for later processing or transferred to another location to be processed. Thus, the link or network 204 between the digitizer 203 and the DSP 205 can be a direct connection, a storage element for later processing, or a network connection for sending the digitized signals to a remote location. For added security, the network 204 may be physically or logically separated from the other network that carries traffic for the device being monitored. In some cases, encryption of the link (secure bus) or network 204 for added security may be desirable).
As per claim 8, Gonzalez teaches:
The system of claim 7, wherein the secure bus is controlled by a secure element or in response to a secure state of the microcontroller (Gonzalez: Column 6, lines 1-21: After the signals are digitized, however, they can be stored for later processing or transferred to another location to be processed. Thus, the link or network 204 between the digitizer 203 and the DSP 205 can be a direct connection, a storage element for later processing, or a network connection for sending the digitized signals to a remote location. For added security, the network 204 may be physically or logically separated from the other network that carries traffic for the device being monitored. In some cases, encryption of the link or network 204 for added security may be desirable).
As per claim 9, Gonzalez teaches:
The system of claim 1, wherein a channel of the side-channel includes a higher sampling rate than other channels of the side-channel of the ADC, wherein the channel is utilized for the baseline measurement (Gonzalez: Column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. Column 5, lines 54-67: Alternatively the sample rate control and filtering control may be coordinated to sample the most desirable parts of the signal (e.g., feature-rich portions of the signal that can be used to better detect anomalies). One example for controlling the sample rate is to search an over-sampling rate using the structure in FIG. 2A to find distinct features for subsequent anomaly detection).
As per claim 11, Gonzalez teaches:
A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side- channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes received from an analog-to-digital converter (ADC) of a microcontroller (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 7, lines 9-24: The reference data can be securely stored in the PFP references database 207 to be used in the assessment process. These reference data are normally extracted during a characterization process. Column 9, line 65-column 10, line 10: The reference extraction module 218 generates reference data that drive the integrity assessment performance (the PFP reference extraction process is also referred to as Characterization process));
receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime (Gonzalez: column 3, line 63-column 4, line 6: As shown in FIG. 1, side-channel probes 101 can capture side-channel information (e.g., power consumption or electromagnetic emissions and other physical signals, etc.) Fig. 2A, column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 6, lines 1-5 and 22-25: The digitized signals from the digitizer 203 can be passed, e.g., via a link or network connection 204, to the discrete-time signal processor (DSP) 205. The PFP analytics 206 can process data received from the DSP 205);
comparing the runtime measurement of the physical attribute to the fingerprint (Gonzalez: column 4, lines 6-16: The fingerprinting system 100 can collect new side-channel collected information at 102 and then compare the newly-collected side-channel information with previously-stored reference data (e.g., historical reference power consumption records, etc.) at 103. Also, column 7, lines 24-30); and
in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, etc.).
As per claim 12, Gonzalez teaches:
The computer-implemented method of claim 11, wherein the physical attribute includes a voltage (Gonzalez: Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage).
As per claim 13, Gonzalez teaches:
A system comprising: memory; a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to: define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring voltage prior to runtime operation (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 7, lines 9-24: The reference data can be securely stored in the PFP references database 207 to be used in the assessment process. These reference data are normally extracted during a characterization process. Column 9, line 65-column 10, line 10: The reference extraction module 218 generates reference data that drive the integrity assessment performance (the PFP reference extraction process is also referred to as Characterization process). Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage);
receive a runtime measurement from the ADC that includes voltage of at least a separate microcontroller during runtime (Gonzalez: column 3, line 63-column 4, line 6: As shown in FIG. 1, side-channel probes 101 can capture side-channel information (e.g., power consumption or electromagnetic emissions and other physical signals, etc.) Fig. 2A, column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 6, lines 1-5 and 22-25: The digitized signals from the digitizer 203 can be passed, e.g., via a link or network connection 204, to the discrete-time signal processor (DSP) 205. The PFP analytics 206 can process data received from the DSP 205. Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage);
compare the runtime measurement to the fingerprint (Gonzalez: column 4, lines 6-16: The fingerprinting system 100 can collect new side-channel collected information at 102 and then compare the newly-collected side-channel information with previously-stored reference data (e.g., historical reference power consumption records, etc.) at 103. Also, column 7, lines 24-30); and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, etc.).
As per claim 14, Gonzalez teaches:
The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a voltage supply of the microcontroller (Gonzalez: Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage).
As per claim 17, Gonzalez teaches:
The system of claim 13, wherein the countermeasure operation includes reprogramming the software to original code (Gonzalez: column 7, lines 43-54: Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, triggering the target device for reboot and reinitiating virtualization. Column 8, lines 3-9: In the case of that a virtual machine is running at the target device and anomalous behavior is found in one of the side channels, the virtual machine can be restarted or migrated).
As per claim 18, Gonzalez teaches:
The system of claim 13, wherein the countermeasure operation includes reprogramming the software (Gonzalez: column 7, lines 43-54: Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, triggering the target device for reboot and reinitiating virtualization. Column 8, lines 3-9: In the case of that a virtual machine is running at the target device and anomalous behavior is found in one of the side channels, the virtual machine can be restarted or migrated).
As per claim 19, Gonzalez teaches:
The system of claim 13, wherein the side-channel is associated with a separate microcontroller (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary.  Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez and An Encryption-Authentication Unified A/D Conversion Scheme for IoT Sensor Nodes by Gadde et al (hereinafter Gadde).
As per claim 4, Gonzalez does not teach: wherein the ADC includes an encryption unit. However, Gadde teaches:
wherein the ADC includes an encryption unit (Gadde: Abstract: We have proposed an Analog-to-Digital Conversion scheme, based on slope A/D conversion, involving two randomized slopes, to realize resistance to side channel attacks and perform data encryption-authentication during the A/D conversion process. We have designed and fabricated the proposed encryption-authentication unified ADC in 0.18pm CMOS process).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gadde in the invention of Gonzalez to include the above limitations. The motivation to do so would be to realize resistance to side channel attacks (Gadde: Abstract).
Claims 5, 6, 15 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez and US 20150317475 to Aguayo Gonzalez et al (hereinafter Gonzalez’475).
As per claim 5, Gonzalez teaches:
The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller to measure drain power voltage (Gonzalez: Column 4, lines 30-67: As shown in FIG. 2A, the PFP system can include analog side-channels probes 201 that transmit collected side-channel information to the analog processing unit 202 for an electronic device under test. The analog processing unit 202 can then send the received side-channel information to a digitizer 203 to convert the analog data to digital signals. Column 5, lines 16-22: The digitizer 203 can convert the analog signals into the digital domain to be processed with computers and/or digital circuits. The digitizer 203 can be implemented using an analog-to-digital Converter (ADC). Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage, i.e., an input pin of the ADC is connected, directly or indirectly, to a pin on the target chip).
Gonzalez teaches measuring voltage but does not teach drain power voltage. However, Gozalez’475 teaches:
measure drain power voltage (Gonzalez’475: [0074] The physical location of the sensor is a critical element for the success of this approach. The ideal location 210 is shown in FIG. 2 at the VDD signal of the processor 205).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005]).
As per claim 6, Gonzalez teaches:
The system of claim 1, wherein the channel is utilized for the baseline measurement (Gonzalez: column 3, lines 47-54: In some instances, a physical side-channel can be used to assess the execution status in a target processor system (e.g., digital circuit or computer system) using an external monitor. Column 9, line 65-column 10, line 10: The reference extraction module 218 generates reference data that drive the integrity assessment performance (the PFP reference extraction process is also referred to as Characterization process)).
Gonzalez does not explicitly teach: wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel. However, Gonzalez’475 teaches:
wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel (Gonzalez’475: [0073] The general PFP method begins by collecting fine-grained measurements from the power consumption during the execution of trusted code. The sensor 110 can be implemented by means of …, a high-bandwidth current mirror. [0353] One example approach to reduce the variance of the estimates, and thus the probabilities of making a classification error, is to increase the time-bandwidth product of the observation).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005]).
As per claim 15, Gonzalez does not teach the limitations of claim 15. However, Gonzalez’475 teaches:
wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller (Gonzalez’475: Fig. 2, [0074] The physical location of the sensor is a critical element for the success of this approach. The ideal location 210 is shown in FIG. 2 at the VDD signal of the processor 205. If this location is not feasible, or introduces excessive power supply noise, then the second best location 220 is also shown. [0298]: The analog output of the processor 3810 is monitored by sensor 3820 and converted by an analog-to-digital converter 3830, i.e., the sensor that obtains the runtime measurement is placed between the ground as seen in fig. 2 and the analog-to-digital converter).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005]).
As per claim 20, Gonzalez teaches:
The system of claim 13, wherein runtime measurement is sent to an intrusion detection system segregated from the separate processor and MCU (Gonzalez: column 7, lines 24-35: Upon performing comparison and analytics, the PFP analytics 206 can forward comparison data to a decision module 206b to determine whether an intrusion or anomaly exists. In other instances, the PFP analytics 206 can send the analytics data to other intrusion detectors 223).
Gonzalez does not teach: wherein the intrusion detection system is configured to compare the runtime measurement to the baseline measurement utilizing a neural network. However, Gonzalez’475 teaches:
wherein the intrusion detection system is configured to compare the runtime measurement to the baseline measurement utilizing a neural network (Gonzalez’475: [0091]: Other techniques for detector design and machine training include: Neural Networks. [0343] In one embodiment, the PFP system may enable intrusion detection based on a supervised learning approach, preventing attackers from training the intrusion detection system (IDS) after deployment to accept their malicious actions, traffic packets or other activities. In supervised learning, the specific features and patterns used as a baseline reference (power fingerprint) to determine when anomalies exist are determined during a pre-characterization stage and are not changed until the system gets updated. [0347] The PFP system can observe and characterize the fine-grained patterns in the power consumption of digital systems.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005]).
Claims 10 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez and Measurements of spurious emission with a time-domain EMI measurement system using multi-sampling techniques by Braun et al (hereinafter Braun).
As per claim 10, Gonzalez does not teach: wherein the ADC is unconnected and configured to measure parasitic noise on the ADC. However, Braun teaches:
wherein the ADC is unconnected and configured to measure parasitic noise on the ADC (Braun: Page 793: Left column: A. Nonlinearity of ADCs: Analog-to-Digital Converter show deviations from the ideal quantization steps that are described by the differential nonlinearity (DNL) and integral nonlinearity (INL). Right column: B. Methods to determine INL and DNL of ADCs: A sinusoidal signal is applied to the ADC. The sinusoidal signal x(t) = sin (ωt) is digitized by an ADC with K quantization steps. For a full scale sinusoidal signal we obtain a digitized signal x[k] of an ideal ADC according to: x[k] = round(
K
2
sin (ωt). The probability density function (PDF) PDF[k] is calculated according to: PDF[k] =
∑
n
=
1
N
δ
(
x
[
n
]
-
k
)
(4) where δ(x[n] − k) is the Kronnecker Symbol and returns 1 if x[n] = k. From the relation between the PDF of an ideal ADC and the measured PDF the DNL of the ADC is determined. By performing a numeric integration of the DNL the INL is calculated. Page 794: 1) Stationary spurious signals: Stationary spurious signals are independent of the input signals and are mainly caused by internal ADC clocking signals. Their frequencies are a fraction of the sampling frequency. The frequency of the spurious signals can be described by (6) fspur =
m
f
s
l
l,m = 1, 2, 3, ... (6)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Braun in the invention of Gonzalez to include the above limitations. The motivation to do so would be to enhance the spurious free dynamic range of the Time-domain EMI Measurement System (Braun: Abstract).
As per claim 16, Gonzalez does not teach the limitations of claim 16. However, Braun teaches:
wherein the runtime measurement is retrieved from no connection with an input supply pin of the ADC, wherein the runtime measurement includes parasitic noise of the ADC (Braun: Page 793: Left column: A. Nonlinearity of ADCs: Analog-to-Digital Converter show deviations from the ideal quantization steps that are described by the differential nonlinearity (DNL) and integral nonlinearity (INL). Right column: B. Methods to determine INL and DNL of ADCs: A sinusoidal signal is applied to the ADC. The sinusoidal signal x(t) = sin (ωt) is digitized by an ADC with K quantization steps. For a full scale sinusoidal signal we obtain a digitized signal x[k] of an ideal ADC according to: x[k] = round(
K
2
sin (ωt). The probability density function (PDF) PDF[k] is calculated according to: PDF[k] =
∑
n
=
1
N
δ
(
x
[
n
]
-
k
)
(4) where δ(x[n] − k) is the Kronnecker Symbol and returns 1 if x[n] = k. From the relation between the PDF of an ideal ADC and the measured PDF the DNL of the ADC is determined. By performing a numeric integration of the DNL the INL is calculated. Page 794: 1) Stationary spurious signals: Stationary spurious signals are independent of the input signals and are mainly caused by internal ADC clocking signals. Their frequencies are a fraction of the sampling frequency. The frequency of the spurious signals can be described by (6) fspur =
m
f
s
l
l,m = 1, 2, 3, ... (6)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Braun in the invention of Gonzalez to include the above limitations. The motivation to do so would be to enhance the spurious free dynamic range of the Time-domain EMI Measurement System (Braun: Abstract).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices by Clark et al: Medical devices based on embedded systems are ubiquitous in clinical settings. Increasingly, they connect to networks and run off-the-shelf operating systems vulnerable to malware. But strict validation requirements make it prohibitively difficult or costly to use anti-virus software or automated operating system updates on these systems. Our add-on monitoring system, WattsUpDoc, uses a traditionally undesirable side channel of power consumption to enable run-time malware detection. In our experiments, WattsUpDoc detected previously known malware with at least 94% accuracy and previously unknown malware with at least 85% accuracy on several embedded devices—detection rates similar to those of conventional malware-detection systems on PCs. WattsUpDoc detects malware without requiring hardware or software modifications or network communication.

APPLICANT REBUTTAL: Remarks
Reconsideration of the above-identified application in view of the present Amendment is respectfully requested
Claims 1-20 are currently rejected. Claims 1, 11, and 13 are currently amended. No new matter has been added by these amendments.
Double Patentin
-
Claims 1-20 are provisionally rejected on the grounds of nonstatutory double patenting as being unpatentable over claims 1-20 of Application No. 16/723,861 in view of U.S. Patent No. 10,157,278 to Gonzalez et al., hereinafter Gonzalez. While the Applicant traverses the Rejection, the claims are now amended and the rejection is therefore moot. Notably, Gonzalez relies on a sensor, which is distinct from the claims in the instant application.
Rej
ection Un
d
er 35 U
.S.C.
.
Claims 1-3, 7-9, 11-14, and 17-19 are rejected under 35 U.S.C. § 102(a)(1) as being anticipated by Gonzalez. While the Applicant traverses the Rejection, the claims are now amended to facilitate prosecution. Specifically, the claims require, among other things "wherein the runtime measurement is retrieved directly from a power supply pin of the ADC." This is distinct from Gonzalez and does not utilize sensors such as those in Gonzalez. Non-limiting examples of this is shown in FIG 2 (note power supply pin 217) and FIG. 3A (note power supply pin 307):
FIG. 2
FtG. 3A
In contrast, Gonazalez utilizes side-channel information measured by side-channel probes. ("FIG. 1 is a combined system structure and work flow diagram illustrating aspects of a fingerprinting system 100 for anomaly detection based on side-channel information measured by side-channel probes. See Gonzalez at 2: 64-67.) Gonzales is directed to reprogrammable devices (e.g. FPGA), where you can observe certain pins to see if they are being reprogrammed. At best, Gonzalez discloses "[a]n EM sensor or a direct circuit connection is used for monitoring a change of state in the pin on the chip 1001a that enables flash memory to be reprogrammed or for enabling the FPGA or the BIOS to be reprogrammed." (Gonzalez at 19; 41-45.) In contrast, the power supply pin has nothing directly to do with a device being reprogrammed. It's simply a power supply pin. Thus, Gonzalez fails to disclose the limitations as claimed.
Specifically, with respect to claim 14, the claim requires "wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller." Gonzalez again utilizes an on-chip sensor. The on-chip sensor of Gonzalez is an internal sensor, and thus, does not need to be connected to anything, nor is it "retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller." The cited portion simply states "The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage, current, power, signal delay, radiation, audio and/or temperature." The cited portion never states that the measurement is "retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller." For at least this reason, the claim is in condition for allowance.
Rej
ection Under 35 U.S.
C.
.
Claim 4 is rejected under 35 U.S.C. § 103 as being unpatentable over Gonzalez and Non- Patent Literature "An Encryption-Authentication Unified A/D Conversion Scheme for loT Sensor Nodes" to Gadde et al., hereinafter Gadde. Claim 4 is allowable based on its dependency to claim 1.
Claims 5, 6, 15, and 20 are rejected under 35 U.S.C. § 103 as being unpatentable over Gonzalez and U.S. Publication No. 2015/0317475 to Gonzalez et al., hereinafter '475 Gonzalez. These claims are allowable based on their dependency to their corresponding independent claim.
Claims 10 and 16 are rejected under 35 U.S.C. § 103 as being unpatentable over Gonzalez and Non-Patent Literature "Measurements of spurious emission with a time-domain EMI measurement system using multi-sampling techniques" to Braun et al., hereinafter Braun. These claims are allowable based on their dependency to their corresponding independent claim.
Sum
marv
Applicant has made a genuine effort to respond to the rejections and advance prosecution of this application. Applicant respectfully submits that all formal and substantive requirements for patentability have been met and that this case is in condition for allowance, which action is respectfully requested.
The Examiner is requested to telephone the undersigned to discuss resolution of any remaining issues.
No additional fee is believed be due as a result of filing this paper. However, please charge any fees or credit any overpayments as a result of the filing of this paper to Deposit Account No. 04-1061.
Respectfully submitted,Dickinson Wright PLLC

NEXT OFFICE ACTION: DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The following is a Final Office action in response to communications received on 07/27/2022.
Response to Amendment
Claims 1, 11 and 13 have been amended.
Claims 1-20 have been examined.
Applicant’s arguments with respect to claim(s) 1, 11 and 13 regarding the new limitations: “wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation via a power supply pin of the ADC” and “wherein the runtime measurement is retrieved directly from the power supply pin” have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA  as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of copending Application No. 16/723861 in view of US 20040268159 to Aasheim et al (hereinafter Aasheim) and Behavior Profiling of Power Distribution Networks for Runtime Hardware Trojan Detection by Khalid et al (hereinafter Khalid).
Instant application
Copending Application No. 16/723861
1. (Currently Amended) A system comprising: memory; a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory and configured to:
define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring a voltage of the separate processor prior to runtime operation via a power supply pin of the ADC;
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from the power supply pin;
compare the runtime measurement to the fingerprint; and
in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks.
1. (Currently Amended) A system comprising: memory; a processor in communication with the memory and programmed to:
during an enrollment period, define a fingerprint that includes a baseline measurement of a physical attribute of at least a separate processor during an enrollment period of the system, wherein the enrollment period includes measuring the physical attribute of the separate processor prior to runtime operation;
receive a runtime measurement-from a sensor, the physical attribute of at least the separate processor during runtime;
compare the runtime measurement of the physical attribute to the fingerprint; and in response to the measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
2. (Original) The system of claim 1, wherein the physical attribute includes a power consumption.
Copending Application No. 16/723861 does not teach: an analog-to-digital converter (ADC) and in communication with the memory; measuring a voltage of the separate processor via a power supply pin of the ADC; and wherein the runtime measurement is retrieved directly from the power supply pin. However, Aasheim teaches:
an analog-to-digital converter (ADC) and in communication with the memory; measuring a voltage of the separate processor via a power supply pin of the ADC (Aasheim: [0027] Power measurement circuit 106 typically includes an analog to digital converter (ADC) 208, a communications interface 210 and a memory 212. [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption. ADC 208 generally converts a continuously variable (i.e., analog) power consumption signal from device 102 into a digital (discrete) form).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Aasheim in the invention of Co-pending application 16/723861 to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
Co-pending application 16/723861 in view of Aasheim does not teach: wherein the runtime measurement is retrieved directly from the power supply pin. However, Khalid teaches:
wherein the runtime measurement is retrieved directly from the power supply pin (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. These values are then converted into the respective digital values through an analog to digital converter and then stored into memory. Fig. 1 shows the current from power ports of modules PP1, PP2, PPn being directly measured by the ADC).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Khalid in the invention of Co-pending application 16/723861 to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
Similarly, the rest of the independent and dependent claims of the instant application are analogous to the rest of the independent and dependent claims of Co-pending application 16/723861.
This is a provisional nonstatutory double patenting rejection.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 1-3, 7-9, 11-15 and 17-19 are rejected under 35 U.S.C. 103 as being unpatentable over Behavior Profiling of Power Distribution Networks for Runtime Hardware Trojan Detection by Khalid et al (hereinafter Khalid), US 20040268159 to Aasheim et al (hereinafter Aasheim) and prior art of record US 10157278 to Gonzalez et al (hereinafter Gonzalez).
As per claim 1, Khalid teaches:
A system comprising:
memory; a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory (Khalid: page 1317: Fig. 1 shows an ADC in communication with a memory) and configured to: define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel of a separate processor retrieved from the (Khalid: Page 1317: Fig. 1, Left column, 2nd paragraph: The first step is to obtain the signature power behavior of the given integrated circuit that consists of sequentially connected modules at the pre-market test stage. A. Pre-Market Stage Power Behavior Extraction: The first phase of proposed methodology is to obtain the power behavior of different modules that are sequentially connected by utilizing the following steps: 1) In the first, we measure the power of each sequentially connected modules to extract the modular power behavior. Right column: In the proposed methodology, we utilized rate power consumption in different sequentially connected blocks of IP modules to develop a two stage classification criteria. In order to establish this criteria, the first step is to identify the normal behavior zone, which is the range between the maximum and minimum values of δP. Similarly, its normal behavior zone is the range between the maximum and minimum values of ΔP. Page 1318: left column: III Case Study: A. Signature obtained for the Power Behavior of AES: The first step is to obtain the signature power behavior of the AES, which is obtained by implementing AES modules without intrusion and with some of the benchmarks intrusions [18] in Verilog. The extraction of signature behavior of AES module is completed in two stages: In the first stage, the AES module is implemented in Verilog and its power rating is extracted using the Xillinx power (Xpower) analyzer for Virtex-5 (xc5vlx330) and Virtex-6 (Xc6vlx760). The highlighted columns of Table I show the dynamic power behavior signature of the AES in Xpower analyzer.);
receive a runtime measurement from the ADC regarding the voltage of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from the power supply pin (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. These values are then converted into the respective digital values through an analog to digital converter and then stored into memory. Fig. 1 shows the current from power ports of modules PP1, PP2, PPn being directly measured by the ADC);
compare the runtime measurement to the fingerprint (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: In the second step, the extracted power behavior is used to calculate the changes in current with respect to the sequentially connected modules (first and second derivatives of power behavior) and then compared to the upper and lower bounds of the changes in current from the signature power profile); and
in response to the measurement exceeding a threshold, (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: If it lies outside the bounds then the integrated circuit is considered as intruded).
Khalid teaches obtaining power behavior signature at pre-market test stage using a Xillinx power (Xpower) analyzer but does not teach: via a power supply pin of the ADC. Also, Khalid does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Aasheim teaches:
a baseline measurement of side-channel traces of a side-channel … via a power supply pin of the ADC (Aasheim: [0027] Power measurement circuit 106 typically includes an analog to digital converter (ADC) 208, a communications interface 210 and a memory 212. [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption. ADC 208 generally converts a continuously variable (i.e., analog) power consumption signal from device 102 into a digital (discrete) form. [0029]. Memory 218 includes a power profiler 220 module that is configured to execute on processor 216 to track and identify software instructions 206 executing on embedded device 102. [0033] Power profiler 220 is also configured to correlate the power consumption data 214 received from power measurement circuit 106 with the software instructions 206 executing on processor 200 of embedded device 102. Power profiler 220 generates a power profile 224 that quantifies the power consumed for the precise software instruction executing on processor 200 of embedded device 102.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Aasheim in the invention of Khalid to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
Khalid in view of Aasheim does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Gonzalez teaches:
executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, etc.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez in the invention of Khalid in view of Aasheim to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
As per claim 2, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein the countermeasure includes outputting a message or a notification (Gonzalez: Column 7, lines 43-54: Some of the actions/responses 221 can include, but not limited to …, notifying user of the target device).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 1 above.
As per claim 3, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller, a powers supply, an internal regulator, or an intermediate voltage (Khalid: page 1317: Fig. 1, Right column: B. Runtime Power Analysis: In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. Fig. 1 shows the ADC connected to the power ports of the modules. Aasheim: Fig. 3 and [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption).
The examiner provides the same rationale to combine prior arts Khalid and Aasheim as in claim 1 above.
As per claim 7, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein the ADC is connected via a least one data bus to the separate processor, wherein the ADC includes at least one channel connected via a secure bus that requires encryption or authentication or both (Aasheim: [0021]: In the exemplary environment 100, the host computer 104 and the power measurement circuit 106 are also coupled via bus 108. [0027] Power measurement circuit 106 typically includes an analog to digital converter (ADC) 208. Gonzalez: Column 6, lines 1-21: After the signals are digitized, however, they can be stored for later processing or transferred to another location to be processed. Thus, the link or network 204 between the digitizer 203 and the DSP 205 can be a direct connection, a storage element for later processing, or a network connection for sending the digitized signals to a remote location. For added security, the network 204 may be physically or logically separated from the other network that carries traffic for the device being monitored. In some cases, encryption of the link (secure bus) or network 204 for added security may be desirable).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 1 above.
As per claim 8, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 7, wherein the secure bus is controlled by a secure element or in response to a secure state of the microcontroller (Gonzalez: Column 6, lines 1-21: After the signals are digitized, however, they can be stored for later processing or transferred to another location to be processed. Thus, the link or network 204 between the digitizer 203 and the DSP 205 can be a direct connection, a storage element for later processing, or a network connection for sending the digitized signals to a remote location. For added security, the network 204 may be physically or logically separated from the other network that carries traffic for the device being monitored. In some cases, encryption of the link or network 204 for added security may be desirable).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 1 above.
As per claim 9, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein a channel of the side-channel includes a higher sampling rate than other channels of the side-channel of the ADC, wherein the channel is utilized for the baseline measurement (Aasheim: [0028]: The analog power consumption signal from device 102 is sampled at a rate that is typically greater than the rate at which instructions 206 are being executed by processor 200 on embedded device 102).
The examiner provides the same rationale to combine prior arts Khalid and Aasheim as in claim 1 above.
As per claim 11, Khalid teaches:
A computer-implement method, comprising:
defining a fingerprint that includes a baseline measurement retrieved from a side-channel of at least a separate processor during an enrollment period, wherein the baseline measurement includes one or more physical attributes (Khalid: Page 1317: Fig. 1, Left column, 2nd paragraph: The first step is to obtain the signature power behavior of the given integrated circuit that consists of sequentially connected modules at the pre-market test stage. A. Pre-Market Stage Power Behavior Extraction: The first phase of proposed methodology is to obtain the power behavior of different modules that are sequentially connected by utilizing the following steps: 1) In the first, we measure the power of each sequentially connected modules to extract the modular power behavior. Right column: In the proposed methodology, we utilized rate power consumption in different sequentially connected blocks of IP modules to develop a two stage classification criteria. In order to establish this criteria, the first step is to identify the normal behavior zone, which is the range between the maximum and minimum values of δP. Similarly, its normal behavior zone is the range between the maximum and minimum values of ΔP. Page 1318: left column: III Case Study: A. Signature obtained for the Power Behavior of AES: The first step is to obtain the signature power behavior of the AES, which is obtained by implementing AES modules without intrusion and with some of the benchmarks intrusions [18] in Verilog. The extraction of signature behavior of AES module is completed in two stages: In the first stage, the AES module is implemented in Verilog and its power rating is extracted using the Xillinx power (Xpower) analyzer for Virtex-5 (xc5vlx330) and Virtex-6 (Xc6vlx760). The highlighted columns of Table I show the dynamic power behavior signature of the AES in Xpower analyzer.);
receiving a runtime measurement from the ADC, wherein the runtime measurement includes the one or more physical attributes of at least the separate processor during runtime, wherein the runtime measurement is retrieved directly from a power supply pin of the ADC (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. These values are then converted into the respective digital values through an analog to digital converter and then stored into memory. Fig. 1 shows the current from power ports of modules PP1, PP2, PPn being directly measured by the ADC);
comparing the runtime measurement of the physical attribute to the fingerprint (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: In the second step, the extracted power behavior is used to calculate the changes in current with respect to the sequentially connected modules (first and second derivatives of power behavior) and then compared to the upper and lower bounds of the changes in current from the signature power profile); and
in response to the runtime measurement exceeding a threshold  (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: If it lies outside the bounds then the integrated circuit is considered as intruded).
Khalid teaches obtaining power behavior signature at pre-market test stage using a Xillinx power (Xpower) analyzer but does not teach: physical attributes received from an analog-to-digital converter (ADC) of a microcontroller. Also, Khalid does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Aasheim teaches:
physical attributes received from an analog-to-digital converter (ADC) of a microcontroller (Aasheim: [0027] Power measurement circuit 106 typically includes an analog to digital converter (ADC) 208, a communications interface 210 and a memory 212. [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption. ADC 208 generally converts a continuously variable (i.e., analog) power consumption signal from device 102 into a digital (discrete) form. [0029]. Memory 218 includes a power profiler 220 module that is configured to execute on processor 216 to track and identify software instructions 206 executing on embedded device 102. [0033] Power profiler 220 is also configured to correlate the power consumption data 214 received from power measurement circuit 106 with the software instructions 206 executing on processor 200 of embedded device 102. Power profiler 220 generates a power profile 224 that quantifies the power consumed for the precise software instruction executing on processor 200 of embedded device 102).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Aasheim in the invention of Khalid to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
Khalid in view of Aasheim does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Gonzalez teaches:
executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, etc.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez in the invention of Khalid in view of Aasheim to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
As per claim 12, Khalid in view of Aasheim and Gonzalez teaches:
The computer-implemented method of claim 11, wherein the physical attribute includes a voltage (Aasheim: [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption. Gonzalez: Column 11, lines 57-60: The on-chip sensor may be located in a processor, support chip, or in the power management chip, and may detect voltage).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 11 above.
As per claim 13, Khalid teaches:
A system comprising:
memory; a microcontroller including an analog-to-digital converter (ADC) and in communication with the memory (Khalid: page 1317: Fig. 1 shows an ADC in communication with a memory) and configured to: define a fingerprint that includes a baseline measurement of side-channel traces of a side-channel retrieved from the ADC, during an enrollment period of the system, wherein the enrollment period includes measuring voltage prior to runtime operation (Khalid: Page 1317: Fig. 1, Left column, 2nd paragraph: The first step is to obtain the signature power behavior of the given integrated circuit that consists of sequentially connected modules at the pre-market test stage. A. Pre-Market Stage Power Behavior Extraction: The first phase of proposed methodology is to obtain the power behavior of different modules that are sequentially connected by utilizing the following steps: 1) In the first, we measure the power of each sequentially connected modules to extract the modular power behavior. Right column: In the proposed methodology, we utilized rate power consumption in different sequentially connected blocks of IP modules to develop a two stage classification criteria. In order to establish this criteria, the first step is to identify the normal behavior zone, which is the range between the maximum and minimum values of δP. Similarly, its normal behavior zone is the range between the maximum and minimum values of ΔP. Page 1318: left column: III Case Study: A. Signature obtained for the Power Behavior of AES: The first step is to obtain the signature power behavior of the AES, which is obtained by implementing AES modules without intrusion and with some of the benchmarks intrusions [18] in Verilog. The extraction of signature behavior of AES module is completed in two stages: In the first stage, the AES module is implemented in Verilog and its power rating is extracted using the Xillinx power (Xpower) analyzer for Virtex-5 (xc5vlx330) and Virtex-6 (Xc6vlx760). The highlighted columns of Table I show the dynamic power behavior signature of the AES in Xpower analyzer);
receive a runtime measurement from the ADC that includes voltage of at least a separate microcontroller during runtime, wherein the runtime measurement is retrieved from a power supply pin of the ADC (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. These values are then converted into the respective digital values through an analog to digital converter and then stored into memory. Fig. 1 shows the current from power ports of modules PP1, PP2, PPn being directly measured by the ADC);
compare the runtime measurement to the fingerprint (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: In the second step, the extracted power behavior is used to calculate the changes in current with respect to the sequentially connected modules (first and second derivatives of power behavior) and then compared to the upper and lower bounds of the changes in current from the signature power profile); and
in response to the measurement exceeding a threshold (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: If it lies outside the bounds then the integrated circuit is considered as intruded).
Khalid teaches obtaining power behavior signature at pre-market test stage using a Xillinx power (Xpower) analyzer but does not teach: a baseline measurement retrieved from the ADC. Also, Khalid does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Aasheim teaches:
a baseline measurement retrieved from the ADC (Aasheim: [0027] Power measurement circuit 106 typically includes an analog to digital converter (ADC) 208, a communications interface 210 and a memory 212. [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption. ADC 208 generally converts a continuously variable (i.e., analog) power consumption signal from device 102 into a digital (discrete) form. [0029]. Memory 218 includes a power profiler 220 module that is configured to execute on processor 216 to track and identify software instructions 206 executing on embedded device 102. [0033] Power profiler 220 is also configured to correlate the power consumption data 214 received from power measurement circuit 106 with the software instructions 206 executing on processor 200 of embedded device 102. Power profiler 220 generates a power profile 224 that quantifies the power consumed for the precise software instruction executing on processor 200 of embedded device 102.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Aasheim in the invention of Khalid to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
Khalid in view of Aasheim does not teach: executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks. However, Gonzalez teaches:
executing a countermeasure operation against software ran by the separate processor, a hardware modification, or one or more fault-attacks (Gonzalez: column 4, lines 10-16: Based on the comparison, the fingerprinting system 100 can determine whether there is an anomaly of the measured target device/system at 104. If yes, the fingerprinting system can alert a user at 106. Column 7, lines 43-54: The response module 210 triggers automatic actions that affect the target device in response to integrity violations. Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, etc.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez in the invention of Khalid in view of Aasheim to include the above limitations. The claim would have been obvious because a particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (see KSR Int’l Co. v. Teleflex Inc. 550 U.S. ___, 82 USPQ2d 1385 (Supreme Court 2007) (KSR)).
As per claim 14, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a voltage supply of the microcontroller (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. Aasheim: Fig. 3 show a input supply pin of the ADC Vin connected to the voltage supply).
The examiner provides the same rationale to combine prior arts Khalid and Aasheim as in claim 13 above.
As per claim 15, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein the runtime measurement is retrieved from a connection between an input supply pin of the ADC and a ground of the microcontroller (Khalid: Page 1317, Fig. 1 and right column: B. Runtime Power Analysis: Fig. 1 shows the proposed off-chip runtime power monitors, which operates in two steps. In the first step, it obtains runtime power profile by measuring the current from the power ports of each module (PP1, PP2, ..., PPn) of integrated circuits. Aasheim: Fig. 3 show a input supply pin of the ADC and the ground).
The examiner provides the same rationale to combine prior arts Khalid and Aasheim as in claim 13 above.
As per claim 17, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein the countermeasure operation includes reprogramming the software to original code (Gonzalez: column 7, lines 43-54: Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, triggering the target device for reboot and reinitiating virtualization. Column 8, lines 3-9: In the case of that a virtual machine is running at the target device and anomalous behavior is found in one of the side channels, the virtual machine can be restarted or migrated).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 13 above.
As per claim 18, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein the countermeasure operation includes reprogramming the software (Gonzalez: column 7, lines 43-54: Some of the actions/responses 221 can include, but not limited to activating another device, disabling control ports of the target device, notifying user of the target device, triggering the target device for reboot and reinitiating virtualization. Column 8, lines 3-9: In the case of that a virtual machine is running at the target device and anomalous behavior is found in one of the side channels, the virtual machine can be restarted or migrated).
The examiner provides the same rationale to combine prior arts Khalid in view of Aasheim and Gonzalez as in claim 13 above.
As per claim 19, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein the side-channel is associated with a separate microcontroller (Khalid: page 1317: Fig. 1 and left column, 2nd paragraph: The first step is to obtain the signature power behavior of the given integrated circuit).
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Khalid in view of Aasheim and Gonzalez as applied to claim 1 above, and further in view of prior art of record An Encryption-Authentication Unified A/D Conversion Scheme for loT Sensor Nodes by Gadde et al (hereinafter Gadde).
As per claim 4, Khalid in view of Aasheim and Gonzalez does not teach: wherein the ADC includes an encryption unit. However, Gadde teaches:
wherein the ADC includes an encryption unit (Gadde: Abstract: We have proposed an Analog-to-Digital Conversion scheme, based on slope A/D conversion, involving two randomized slopes, to realize resistance to side channel attacks and perform data encryption-authentication during the A/D conversion process. We have designed and fabricated the proposed encryption- authentication unified ADC in 0.18pm CMOS process).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gadde in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to realize resistance to side channel attacks (Gadde: Abstract).
Claims 5, 6 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Khalid in view of Aasheim and Gonzalez as applied to claims 1 and 13 above, and further in view of prior art of record US 20150317475 to Aguayo Gonzalez et al (hereinafter Gonzalez’475).
As per claim 5, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein the ADC includes an ADC input pin connected to an internal voltage pin of the microcontroller (Aasheim: [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption).
Khalid in view of Aasheim and Gonzalez does not teach: to measure drain power voltage. However, Gozalez’475 teaches:
measure drain power voltage (Gonzalez’475: [0074] The physical location of the sensor is a critical element for the success of this approach. The ideal location 210 is shown in FIG. 2 at the VDD signal of the processor 205).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005)).
As per claim 6, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 1, wherein the channel is utilized for the baseline measurement (Aasheim: [0028] FIG. 3 illustrates an example of how a typical ADC 208 on circuit 106 might be coupled to an embedded device 102 to measure power consumption).
Khalid in view of Aasheim and Gonzalez does not teach: wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel. However, Gonzalez’475 teaches:
wherein a channel of the side-channel includes a higher bandwidth than other channels of the side-channel (Gonzalez’475: [0073] The general PFP method begins by collecting fine-grained measurements from the power consumption during the execution of trusted code. The sensor 110 can be implemented by means of ..., a high-bandwidth current mirror. [0353] One example approach to reduce the variance of the estimates, and thus the probabilities of making a classification error, is to increase the time-bandwidth product of the observation).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005)).
As per claim 20, Khalid in view of Aasheim and Gonzalez teaches:
The system of claim 13, wherein runtime measurement is sent to an intrusion detection system segregated from the separate processor and MCU (Gonzalez: column 7, lines 24-35: Upon performing comparison and analytics, the PFP analytics 206 can forward comparison data to a decision module 206b to determine whether an intrusion or anomaly exists. In other instances, the PFP analytics 206 can send the analytics data to other intrusion detectors 223).
Khalid in view of Aasheim and Gonzalez does not teach: wherein the intrusion detection system is configured to compare the runtime measurement to the baseline measurement utilizing a neural network. However, Gonzalez’475 teaches:
wherein the intrusion detection system is configured to compare the runtime measurement to the baseline measurement utilizing a neural network (Gonzalez’475: [0091]: Other techniques for detector design and machine training include: Neural Networks. [0343] In one embodiment, the PFP system may enable intrusion detection based on a supervised learning approach, preventing attackers from training the intrusion detection system (IDS) after deployment to accept their malicious actions, traffic packets or other activities. In supervised learning, the specific features and patterns used as a baseline reference (power fingerprint) to determine when anomalies exist are determined during a pre-characterization stage and are not changed until the system gets updated. [0347] The PFP system can observe and characterize the fine-grained patterns in the power consumption of digital systems).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Gonzalez’475 in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to provide an integrity assessment and intrusion detection solution for critical cyber systems (Gonzalez’475: [0005)).
Claims 10 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Khalid in view of Aasheim and Gonzalez as applied to claims 1 and 13 above, and further in view of prior art of record Measurements of spurious emission with a time-domain EMI measurement system using multi-sampling techniques by Braun et al (hereinafter Braun).
As per claim 10, Khalid in view of Aasheim and Gonzalez does not teach the limitations of claim 10. However, Braun teaches:
wherein the ADC is unconnected and configured to measure parasitic noise on the ADC (Braun: Page 793: Left column: A Nonlinearity of ADCs: Analog-to- Digital Converter show deviations from the ideal quantization steps that are described by the differential nonlinearity (DNL) and integral nonlinearity (INL). Right column: B. Methods to determine INL and DNL of ADCs: A sinusoidal signal is applied to the ADC. The sinusoidal signal x(t) = sin (ωt) is digitized by an ADC with K quantization steps. For a full scale sinusoidal signal we obtain a digitized signal x[k] of an ideal ADC according to: x[k] = round(
K
2
sin (ωt). The probability density function (PDF) PDF[k] is calculated according to: PDF[k] =
∑
n
=
1
N
δ
(
x
n
-
k
)
(4) where
δ
(
x
n
-
k
)
is the Kronnecker Symbol and returns 1 if x[n] = k. From the relation between the PDF of an ideal ADC and the measured PDF the DNL of the ADC is determined. By performing a numeric integration of the DNL the INL is calculated. Page 794: 1) Stationary spurious signals: Stationary spurious signals are independent of the input signals and are mainly caused by internal ADC clocking signals. Their frequencies are a fraction of the sampling frequency. The frequency of the spurious signals can be described by (6) fspur =
m
f
s
l
I,m = 1, 2, 3, ... (6)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Braun in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to enhance the spurious free dynamic range of the Time-domain EMI Measurement System (Braun: Abstract).
As per claim 16, Khalid in view of Aasheim and Gonzalez does not teach the limitations of claim 16. However, Braun teaches:
wherein the runtime measurement is retrieved from no connection with an input supply pin of the ADC, wherein the runtime measurement includes parasitic noise of the ADC (Braun: Page 793: Left column: A Nonlinearity of ADCs: Analog-to- Digital Converter show deviations from the ideal quantization steps that are described by the differential nonlinearity (DNL) and integral nonlinearity (INL). Right column: B. Methods to determine INL and DNL of ADCs: A sinusoidal signal is applied to the ADC. The sinusoidal signal x(t) = sin (ωt) is digitized by an ADC with K quantization steps. For a full scale sinusoidal signal we obtain a digitized signal x[k] of an ideal ADC according to: x[k] = round(
K
2
sin (ωt). The probability density function (PDF) PDF[k] is calculated according to: PDF[k] =
∑
n
=
1
N
δ
(
x
n
-
k
)
(4) where
δ
(
x
n
-
k
)
is the Kronnecker Symbol and returns 1 if x[n] = k. From the relation between the PDF of an ideal ADC and the measured PDF the DNL of the ADC is determined. By performing a numeric integration of the DNL the INL is calculated. Page 794: 1) Stationary spurious signals: Stationary spurious signals are independent of the input signals and are mainly caused by internal ADC clocking signals. Their frequencies are a fraction of the sampling frequency. The frequency of the spurious signals can be described by (6) fspur =
m
f
s
l
I,m = 1, 2, 3, ... (6)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Braun in the invention of Khalid in view of Aasheim and Gonzalez to include the above limitations. The motivation to do so would be to enhance the spurious free dynamic range of the Time-domain EMI Measurement System (Braun: Abstract).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action.  Accordingly, THIS ACTION IS MADE FINAL.  See MPEP § 706.07(a).  Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action.  In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action.  In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.

CITED REFERENCE SUMMARIES: Ref US20150317475A1: [content unavailable]
Ref US20150317475: Claims:
1. A method, comprising:
receiving, at a first module, side-channel information of a first target component of a system, the first module being collocated with the first target component, the side-channel information of the first target component being associated with the plurality of authorized execution statuses of the first target component and an execution status of the first target component; obtaining a power fingerprint for the first target component based on the side-channel information for the first target component, the power fingerprint for the first target component representing a plurality of authorized execution statuses of the first target component; receiving, at a second module, side-channel information of a second target component of the system, the second module being collocated with the second target component, the side-channel information of the second target component being associated with the plurality of authorized execution statuses of the second target component and an execution status of the second target component; obtaining a power fingerprint for the second target component based on the side-channel information for the second target component, the power fingerprint for the second target component representing a plurality of execution statuses of the second target component; and sending, from a processor module, a reporting signal based on at least one of (1) the power fingerprint for the first target component and an execution status of the first target component, or (2) the power fingerprint for the second target component and an execution status of the second target component, the reporting signal associated with at least one of the execution status of the first target component or the execution status of the second target component.
2. The method of claim 1, wherein the processor module is physically separate from the first target component and the second target component.
3. The method of claim 1, wherein:
the power fingerprint for the first target component is obtained by the first module; the power fingerprint for the second target component is obtained by the second module; the method further comprising: receiving, at the processor module from the first module, a signal representing the power fingerprint for the first target component; and receiving, at the processor module from the second module, a signal representing the power fingerprint for the second target component.
4. The method of claim 1, further comprising:
receiving, at the processor module from the first module, a signal representing the side-channel information of the first target component; and receiving, at the processor module from the second module, a signal representing the side-channel information of the second target component, the power fingerprint for the first target component is obtained by the processor module, the power fingerprint for the second target component is obtained by the processor module.
5. The method of claim 1, wherein the reporting signal represents at least one of an integrity assessment, a malicious intrusion detection, an unauthorized modification detection or a tampering detection, for at least one of the first target component or the second target component.
6. The method of claim 1, wherein the first target component and the second target component are included within at least one of (1) an Industrial Control System (ICS), (2) a Supervisory, Control and Data Acquisition (SCADA) system, or (3) an embedded compute platform.
7. The method of claim 1, wherein the processor module are operatively coupled to the first module and the second module through at least one network.
8. The method of claim 1, wherein the obtaining the power fingerprint for the first target component, the obtaining the power fingerprint for the second target component, and the sending the reporting signal are repeated substantially continuously.
9. A method, comprising:
sending a predefined input to an untrusted electronic device, the predefined input being defined based on a functionality of the untrusted electronic device; receiving side-channel information of the untrusted electronic device in response to the predefined input; obtaining a power fingerprint for the untrusted electronic device based on the side-channel information; and assessing an integrity of the untrusted electronic device based on the power fingerprint.
10. The method of claim 9, wherein the sending the predefined input includes sending the predefined input to the untrusted electronic device such that the untrusted electronic device is put into a specific state sequence or software of the untrusted electronic device is executed, in response to the predefined input.
11. The method of claim 9, wherein the sending the predefined input includes sending the predefined input to the untrusted electronic device such that a first execution path of the untrusted electronic device is operational in response to the predefined input and a second execution path of the untrusted electronic device is not operational in response to the predefined input.
12. The method of claim 9, wherein the untrusted electronic device is a first untrusted electronic device, the method further comprising:
repeating the sending, the receiving, the obtaining and the assessing for each untrusted electronic device from a plurality of electronic devices.
13. The method of claim 9, wherein the untrusted electronic device is a first untrusted electronic device, the method further comprising:
repeating the sending, the receiving, the obtaining and the assessing for each untrusted electronic device from a plurality of electronic devices, the assessing including identifying an unauthorized modification of the untrusted electronic device based on statistical analysis of at least a portion of the plural of electronic devices.
14. The method of claim 9, wherein the untrusted electronic device is a first untrusted electronic device, the method further comprising:
for each untrusted electronic device from a plurality of electronic devices, performing the following: sending a predefined input to that untrusted electronic device; receiving side-channel information of that untrusted electronic device in response to the predefined input; dynamically modifying the side-channel information of that untrusted electronic device such that manufacturing variability is reduced to produce a modified side-channel information; obtaining a power fingerprint for that untrusted electronic device based on the modified side-channel information; and assessing an integrity of that untrusted electronic device based on the power fingerprint.
15. The method of claim 9, wherein the assessing includes identifying an unauthorized modification of the untrusted electronic device when the untrusted electronic device has been subjected to unauthorized modification.
16. An apparatus, comprising:
a power fingerprint monitor module configured to receive a signal representing an unauthorized access of a device; and a response analysis module operatively coupled to the power fingerprint monitor module, the response analysis module configured to select a response module from a plurality of response modules in response to detection of the unauthorized access, a first response module from the plurality of response modules configured to collect information associated with the device during the unauthorized access, a second response module from the plurality of response modules configured to prevent access to the device in response to the unauthorized access, a third response module from the plurality of response modules configured to disable at least a portion of the device subjected to the unauthorized access.
17. The apparatus of claim 16, wherein the first response module is configured to send a report signal based on information associated with the device during the unauthorized access.
18. The apparatus of claim 16, wherein the plurality of response modules includes a fourth module configured to collect information associated with at least one of the unauthorized access or a device that triggered the unauthorized access.
19. The apparatus of claim 16, wherein the third response module is configured to temporarily disable the portion of the device including at least one powering down the device, resetting the device or preventing operation of the portion of the device.
20. The apparatus of claim 16, wherein the third response module is configured to permanently disable the portion of the device including at least one of (1) physically damaging the portion of the device, (2) destroying the portion of the device, (3) setting the portion of the device into an irrecoverable logic state, or (4) permanently erasing a memory of the device.
Ref US10157278T: [content unavailable]
Ref APP-16_723861: Claims:
A system comprising: memory; a processor in communication with the memory and programmed to: during an enrollment period, define a fingerprint that includes a baseline measurement of a physical attribute of at least a separate processor during the enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements, wherein the enrollment period includes measuring the physical attribute of the separate processor prior to runtime operation; receive, from a sensor, a runtime measurement of the physical attribute of at least the separate processor during runtime; compare the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
a processor in communication with the memory and programmed to: during an enrollment period, define a fingerprint that includes a baseline measurement of a physical attribute of at least a separate processor during the enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements, wherein the enrollment period includes measuring the physical attribute of the separate processor prior to runtime operation; receive, from a sensor, a runtime measurement of the physical attribute of at least the separate processor during runtime; compare the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
during an enrollment period, define a fingerprint that includes a baseline measurement of a physical attribute of at least a separate processor during the enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements, wherein the enrollment period includes measuring the physical attribute of the separate processor prior to runtime operation;
receive, from a sensor, a runtime measurement of the physical attribute of at least the separate processor during runtime;
compare the runtime measurement of the physical attribute to the fingerprint; and
in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
The system of claim 1, wherein the physical attribute includes a power consumption.
The system of claim 1, wherein the physical attribute includes a time interval between message communications of the separate processor.
The system of claim 1, wherein the physical attribute includes a sound emitted from the separate processor.
The system of claim 1, wherein the physical attribute includes a temperature.
The system of claim 1, wherein the physical attribute includes a vibration.
The system of claim 1, wherein the memory is configured to store the fingerprint.
The system of claim 1, wherein the processor is further programmed to, in response to the measurement exceeding a threshold, log the measurement and store the log in the memory.
The system of claim 1, wherein the sensor is a shunt resistor.
The system of claim 1, wherein the fingerprint includes two or more physical attributes of at least the separate processor during the enrollment period of the system.
A computer-implement method, comprising: defining a fingerprint that includes a baseline measurement of one or more physical attributes of at least a separate processor during an enrollment period of a system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements, wherein the fingerprint includes code utilized to identify normal operation of the system utilizing one or more measurements of the one or more physical attributes; receiving a runtime measurement from a sensor regarding the one or more physical attributes of at least the separate processor during runtime; comparing the runtime measurement of the physical attribute to the fingerprint; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
defining a fingerprint that includes a baseline measurement of one or more physical attributes of at least a separate processor during an enrollment period of a system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements, wherein the fingerprint includes code utilized to identify normal operation of the system utilizing one or more measurements of the one or more physical attributes;
receiving a runtime measurement from a sensor regarding the one or more physical attributes of at least the separate processor during runtime;
comparing the runtime measurement of the physical attribute to the fingerprint; and
The computer-implemented method of claim 11, wherein the threshold is updated in response to the comparing the runtime measurement of the physical attribute to the fingerprint.
A system comprising: memory; a processor in communication with the memory and programmed to: receive a runtime measurement from a sensor regarding the physical attribute of at least the separate processor during runtime; compare the runtime measurement of the physical attribute to a fingerprint, wherein the fingerprint includes a baseline measurement of a physical attribute of at least a separate processor, wherein the baseline measurement is determined during an enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
a processor in communication with the memory and programmed to: receive a runtime measurement from a sensor regarding the physical attribute of at least the separate processor during runtime; compare the runtime measurement of the physical attribute to a fingerprint, wherein the fingerprint includes a baseline measurement of a physical attribute of at least a separate processor, wherein the baseline measurement is determined during an enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements; and in response to the runtime measurement exceeding a threshold, executing a countermeasure operation against software ran by the separate processor.
receive a runtime measurement from a sensor regarding the physical attribute of at least the separate processor during runtime;
compare the runtime measurement of the physical attribute to a fingerprint, wherein the fingerprint includes a baseline measurement of a physical attribute of at least a separate processor, wherein the baseline measurement is determined during an enrollment period of the system in a secured environment using Original Equipment Manufacturer (OEM) components to establish normalized measurements; and
The system of claim 13, wherein the processor is further programmed to, in response to the measurement exceeding a threshold, log the measurement and store the log in the memory.
The system of claim 13, wherein the countermeasure operation includes killing the software ran by the separate processor.
The system of claim 13, wherein the countermeasure operation includes rebooting the system.
The system of claim 13, wherein the countermeasure operation includes reprogramming the software ran by the separate processor to original code.
The system of claim 13, wherein the countermeasure operation includes reprogramming the software ran by the separate processor.
The system of claim 13, wherein the physical attribute includes a temperature.
The system of claim 13, wherein the physical attribute includes a vibration.