Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination (RCE) under 37 CFR 1.114 was filed in this application on July 6, 2026 after a decision by the Patent Trial and Appeal Board, but before the filing of a Notice of Appeal to the Court of Appeals for the Federal Circuit or the commencement of a civil action. The request, however, lacks the fee required by 37 CFR 1.17(e) and/or the submission required by 37 CFR 1.114. Accordingly, the RCE is improper and any time period running was not tolled by the filing of the improper request.
Response to Arguments
In page 1 of the remarks, Applicant states that claim 1 has been amended to recite “at least two one-time programmable (OTP) indicators […] the at least two OTP indicators comprising a first subset and a second subset”, “the first subset and the second subset being alternatively programed”, and “wherein the at least two one-time programmable indicators are configured to disable the operating state of the boot process upon the first subset being programmed twice in a row or upon the second subset being programmed twice in a row”, with independent claims 11 and 21 being similarly amended, Support is stated to be found in Figs. 5B and 7, as well as paragraphs [0042]-[0043], [0046], and [0049]-[0050]. Claims 2, 7-9, 12, 17-19, 22 and 24 are also amended for consistency with the independent claims that were amended.
In pages 1-2 of the remarks, Applicant states that claims 1-25 were rejected under 112(b) as being allegedly indefinite, as well as 112(a) for failing to comply with written description requirements, with the claims being rephrased for clarity, and requests withdrawal of the rejections.
Examiner states that despite the claim limitations being amended to recite “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset”, and “wherein the at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state upon the first subset and the second subset being alternately programmed […]”, the aforementioned 112(b) and 112(a) rejections for the claims are maintained, despite the Applicant citing Specification paragraphs [0042]-[0043], [0046], and [0049] for examples of claim limitation support in the invention. However, the amended limitations still do not clear up the limitations for the independent claims 1, 11, and 21, as the Applicant does not provide sufficient explanation and description in the Specification.
With regards to the 112(b) rejections, the rejections are maintained, as well as new rejections made in the present Office Action: the term “one-time programmable (OTP) indicators” in claims 1, 11, and 21 is used by the claim to mean “configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state,” while the accepted meaning is “indicators that are programmable only once,”; the limitation “at least twice” renders the claim indefinite because it is unclear how a “one-time programmable” indicator can be “repeatably and alternatively switched at least twice” without contradicting the ordinary meaning of OTP; “repeatably and alternatively switched at least twice” is not defined by the claim, as the Specification does not sufficiently describe how “at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice”, with paragraph [0037] describing that “hardware switches may define the operating state for the remainder of the boot process (e.g. secure state, RMA state, etc.) including ROM instructions”, but which of the hardware switches, if any, correspond to at least “two one-time programmable indicators” to enable the aforementioned boot state. Paragraph [0043] also describes “efuses for the hardware indicators 502 and TMM enable 505 may be secured so that only the manufacturer has the capability or authorization to set or "blow" the indicators and thus change the operating state between SEC and RMA or vice versa”, where the OTP indicators may be programmable only once, despite the limitations describing the indicators as being “configure[able] to enable the operating state of the boot process to be repeatably and alternatively switched at least twice”, which contrasts with the statements that efuses are present in the invention, which are ‘blown’ when an indicator is set one time. The amended limitation of “the at least two OTP indicators comprising a first subset and a second subset” is an indefinite statement, as it could be interpreted in two different ways: Either as “two OTP indicators each comprising a first subset and a second subset” for a total of four OTP indicators, or “two OTP indicators, with a first OTP indicator corresponding to a first subset, and a second OTP indicator corresponding to a second subset”, with paragraph [0010] not providing sufficient explanation as to which of the interpretations is described in the invention.
Next, the claims have been amended to now recite “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset”, and “wherein the at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state upon the first subset and the second subset being alternately programmed […]”, which raise issues that were not previously present. As with the previous Office Action, the amended limitations still do not explain sufficiently how the manufacturer or what hardware is “capable” of programming the OTP indicators “at least twice”, as paragraph [0043] of the Specification states that “efuses for the hardware indicators 502 and TMM enable 505 may be secured so that only the manufacturer has the capability or authorization to set or "blow" the indicators and thus change the operating state between SEC and RMA or vice versa”, where a person of ordinary skill in the art understands it to mean that an indicator, or fuse, can be programmed one time only before being ‘blown’. Furthermore, claim 21 recites the term “means” for several of the claim limitations described, but similarly to the 112(b) rejections made to claims 21-25 above, the disclosure does not provide adequate structure to perform the claimed functions of “reading at least two one-time programmable (OTP) indicators”, “determining an operating state of a boot process […]”, and “executing instructions from a read-only memory, […]” in the apparatus of claim 21, as it is unknown which specific components of the apparatus perform each of the limitations, as well as whether the means of the apparatus are comprised of hardware, software, or a combination of the two.
As a result of this, Examiner maintains the 112(b) rejections for claims 1-25, as well as rejecting the amended limitations under 112(b) and 112(a) for claims 1-25.
In pages 2-4 of the remarks, Applicant states that claims 1-2, 6-10, 11-12, 16-22 and 24 stand rejected under 35 U.S.C. § 102(a)(1) for allegedly being anticipated by Schilder et al. (U.S. Pub. No. 2019/0163909) ("Schilder"). FOA2, pp.14-20. In particular, Schilder implements security measures throughout a semiconductor chip lifecycle. Schilder, [0002]. A lifecycle of chip devices can include manufacturing testing of chip devices in a physical semiconductor wafer, testing the diced chip devices, provisioning, and re-provisioning. Schilder, [0050]. Schilder in FIG. 1 (reproduced) illustrates a semiconductor chip device 100, including ports 101 provide a path to fuses 123 serving as bit storage devices. The fuses 123 include key fuses 125, device state fuses 127, and device ID fuses 129. Key fuses 125 store keys and other secrets, device state fuses 127 store and define the device states, and device ID fuses 129 store a unique device ID of the semiconductor device 100. Schilder, [0054], [0061]. Figure 1 of Schilder is shown, where it is described in page 3 that fuses 123 have an associated fuse controller and device state decoder 121, which reads the bit patterns stored in the device state fuses 127, which can be read directly or via fuse shadow registers (not shown in FIG. 1). Schilder, [0062]. Furthermore, in page 4 of the remarks, Applicant states that Schilder describes nothing equivalent to disclosing the following limitations: “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset”, “wherein the at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state […]”, and “wherein the at least two one-time programmable indicators are configured to disable the operating state of the boot process upon the first subset being programmed twice in a row or upon the second subset being programmed twice in a row” in claim 1. Applicant respectfully requests that the § 102(a)(1) rejections based on Schilder be withdrawn.
Applicant's arguments filed July 6, 2026 have been fully considered but they are not persuasive. Examiner states that the amended limitation of “and wherein the at least two one-time programmable indicators are configured to disable the operating state of the boot process upon the first subset being programmed twice in a row or upon the second subset being programmed twice in a row” is disclosed in Schilder in the paragraph [0078], where a chip cannot transition to test-Mode-Enabled device state from Test-Mode-Disabled test state. A chip can only be personalized once, paragraph [0100] describes “When the device state fuses 127 (FIG. 1) decode to one of the previous states (S513, YES), at s S517 (FIGS. 5), S519, and S521, the chip device may be forced into a Test-Mode-Enabled Device 403 (FIG. 4) state (S503) if fuse bits indicate that the device is currently in Test-Mode-Locked Device 405 state and an unlock request including a password has been received (YES at S517), and the password has been verified (YES at S521).” As a result of the limitations in the independent claims 1, 11, and 21, claims 1-2, 6-10, 11-12, 16-22 and 24 remain rejected under 102(a)(1) as being anticipated by Schilder.
In page 5 of the remarks, Applicant states that the following rejections are to be withdrawn as the independent claims are believed to be allowable over the prior art of Schilder: claims 3, 13 and 23 stand rejected under 35 U.S.C. § 103 for allegedly being unpatentable over Schilder and Findeisen et al. (U.S. Pub. No. 2009/0222653) ("Findeisen"), whose PGPub number has been corrected in this Office Action (“OA”). FOA2, pp.20-22. Claims 4-5 and 14-15 stand rejected under 35 U.S.C. § 103 for allegedly being unpatentable over Schilder, Findeisen and Hershman et al. (U.S. Pub. No. 2021/0407610) ("Hershman "). FOA2, pp.22-24. Applicant states that by virtue of their dependencies to independent claim 1 and 11 as well as “their own merits”, these dependent claims should be allowable over the prior art and have their 103 rejections withdrawn.
Examiner disagrees with the Applicant for reasons that are described in the 102 rejections section above, as the independent claims’ rejections are being maintained. Applicant's arguments fail to comply with 37 CFR 1.111(b) because they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references. As a result of the rejections being maintained, claims 3, 13 and 23 are rejected under 35 U.S.C. 102(a)(1) as anticipated by or, in the alternative, under 35 U.S.C. 103 as obvious over Schilder in view of Findeisen, and claims 4-5 and 14-15 are rejected under 35 U.S.C. 103 as being unpatentable over Schilder in view of Findeisen as applied to claim 2 above, and further in view of Hershman.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
In independent claim 21, the following claim limitations invoke 112(f) for use of the term “means”, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. The claim limitations present in claim 21 are: “means for reading at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset”, “means for determining an operating state of a boot process for a bootstrap controller component based on the at least two one-time programmable indicators”, and “means for executing, by the bootstrap controller component, at least one instruction state of the boot process based on the operating state, the at least one instruction being read from a read only memory”. As each of the claimed limitations does not sufficiently explain what aspects of the invention perform each of the aforementioned limitations in the apparatus of claim 21, the claim invokes 112(f) for use of the term “means”.
Claim Rejections - 35 USC § 112(b)
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-25 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Where applicant acts as his or her own lexicographer to specifically define a term of a claim contrary to its ordinary meaning, the written description must clearly redefine the claim term and set forth the uncommon definition so as to put one reasonably skilled in the art on notice that the applicant intended to so redefine that claim term. Process Control Corp. v. HydReclaim Corp., 190 F.3d 1350, 1357, 52 USPQ2d 1029, 1033 (Fed. Cir. 1999). The term “one-time programmable (OTP) indicators” in claims 1, 11, and 21 is used by the claim to mean “configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state,” while the accepted meaning is “indicators that are programmable only once.” The term is indefinite because the specification does not clearly redefine the term.
Next, the limitation “at least twice” renders the claim indefinite because it is unclear how a “one-time programmable” indicator can be “repeatably and alternatively switched at least twice” without contradicting the ordinary meaning of OTP. The claim does not clearly identify whether the repeated switching refers to the OTP indicators themselves, the operating state, or the boot process, and therefore fails to particularly point out and distinctly claim the subject matter.
The term “repeatably and alternatively switched at least twice” in claims 1, 11, and 21 is a relative term which renders the claim indefinite. The term “repeatably and alternatively switched at least twice” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. The Specification does not sufficiently describe how “at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice”, with paragraph [0037] describing that “hardware switches may define the operating state for the remainder of the boot process (e.g. secure state, RMA state, etc.) including ROM instructions”, but which of the hardware switches, if any, correspond to at least “two one-time programmable indicators” to enable the aforementioned boot state. Also, at paragraph [0043] “The efuses for the hardware indicators 502 and TMM enable 505 may be secured so that only the manufacturer has the capability or authorization to set or "blow" the indicators and thus change the operating state between SEC and RMA or vice versa.” At par. [0048] of the specification: “Once in the secure state 606, a manufacturer or user with the correct authorization certificate and/or hardware may blow or program an RMA indicator of the hardware indicators 502 to increment RMA 607 (i.e., may blow the next-available RMA indicator as described with respect to Figure 5B).” Applicant has not explained how the manufacturer or what hardware is “capable” of performing the desired function of OTP indicators being “switched at least twice”, in conjunction with paragraph [0042] stating that “efuses may alternatively be any one-time programmable indicator”, which does not sufficiently explain how the OTP indicators can be “configured to enable the operating state of the boot process […] switched at least twice […] the first subset and the second subset being alternately programmed”, as recited in the independent claims.
Furthermore, the phrase “the at least two OTP indicators comprising a first subset and a second subset” makes it unclear in the independent claims as to how the two OTP indicators are organized and structured in the invention, as it could either be interpreted as “two OTP indicators each comprising a first subset and a second subset” for a total of four OTP indicators, or “two OTP indicators, with a first OTP indicator corresponding to a first subset, and a second OTP indicator corresponding to a second subset”. While paragraph [0010] describes the programmable indicators as “grouped into at least a first subset and a second subset, the first subset being programmed and the second subset being available for one-time programming”, there is insufficient structure as to how the claim limitation for two OTP indicators comprising a first and second subsets is achieved in the invention.
Furthermore, claims 1, 11, and 21 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential structural cooperative relationships of elements, such omission amounting to a gap between the necessary structural connections. See MPEP § 2172.01. The omitted structural cooperative relationships are: “wherein the at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state upon the first subset and the second subset being alternately programmed, and wherein the at least two one-time programmable indicators are configured to disable the operating state of the boot process upon the first subset being programmed twice in a row or upon the second subset being programmed twice in a row”. The structural relationship between the subsets and the indicators is not sufficiently definite with the two plausible interpretations that cause ambiguity in the claim, as the claimed limitation could be interpreted as “two OTP indicators each comprising a first subset and a second subset” or “two OTP indicators, with a first OTP indicator corresponding to a first subset, and a second OTP indicator corresponding to a second subset”.
Claims 2-10, 12-20, and 22-25 fall together accordingly.
Claim limitations “means for reading at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset”, “means for determining an operating state of a boot process for a bootstrap controller component based on the at least two one-time programmable indicators”, and “means for executing, by the bootstrap controller component, at least one instruction state of the boot process based on the operating state, the at least one instruction being read from a read only memory” in independent claim 21 invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Use of the term “means” to cover the functional limitations for apparatus claim 21 is insufficient, as it is unknown what components, if any, perform the aforementioned limitations. Furthermore, it is unknown whether the means that are recited in claim 21 are hardware or software that perform the functions required by the invention. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claims 22-25 fall together accordingly.
Claim Rejections - 35 USC § 112(a)
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
In claims 1, 11 and 21, in MPEP 2163 (I)(A), while “There is a presumption that an adequate written description of the claimed invention is present when the application is filed”, it also states “issues of adequate written description may arise even for original claims, for example, when an aspect of the claimed invention has not been described with sufficient particularity such that one skilled in the art would recognize that the applicant had possession of the claimed invention at the time of filing.”
In MPEP 2161.01, "computer-implemented functional claim language must still be evaluated for sufficient disclosure under the written description". And MPEP 2161.01(I) "generic claim language in the original disclosure does not satisfy the written description requirement if it fails to support the scope of the genus claimed." For computer-implemented inventions, the determination of the sufficiency of disclosure will require an inquiry into the sufficiency of both the disclosed hardware and the disclosed software due to the interrelationship and interdependence of computer hardware and software. The critical inquiry is whether the disclosure of the application relied upon reasonably conveys to those skilled in the art that the inventor had possession of the claimed subject matter as of the filing date.
Similarly, original claims may lack written description when the claims define the invention in functional language specifying a desired result but the specification does not sufficiently describe how the function is performed or the result is achieved. For software, this can occur when the algorithm or steps/procedure for performing the computer function are not explained at all or are not explained in sufficient detail (simply restating the function recited in the claim is not necessarily sufficient).
In this case, the specification does not provide sufficient details to “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset […] upon the first subset and the second subset being alternately programmed”. No algorithm or steps/procedure for performing the function can be found, explained at all or in sufficient detail.
The portions of the specification relating to “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset […] upon the first subset and the second subset being alternately programmed” are found in par. [0043], [0048] and [0049]. At par. [0043] “The efuses for the hardware indicators 502 and TMM enable 505 may be secured so that only the manufacturer has the capability or authorization to set or "blow" the indicators and thus change the operating state between SEC and RMA or vice versa.” At par. [0048] of the specification: “Once in the secure state 606, a manufacturer or user with the correct authorization certificate and/or hardware may blow or program an RMA indicator of the hardware indicators 502 to increment RMA 607 (i.e., may blow the next-available RMA indicator as described with respect to Figure 5B).” Applicant has not explained how the manufacturer or what hardware is “capable” of performing the desired function.
As in MPEP 2161.01 (I), “a specification cannot always support expansive claim language and satisfy the requirements of 35 U.S.C. 112 "merely by clearly describing one embodiment of the thing claimed." LizardTech v. Earth Resource Mapping, Inc., 424 F.3d 1336, 1346, 76 USPQ2d 1731, 1733 (Fed. Cir. 2005). A person skilled in the art would not understand that the applicant has invented, and been in possession of, the invention as broadly claimed. The description of “at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset […] upon the first subset and the second subset being alternately programmed”, does not entitle the inventor to claim any and all means for achieving the objective(s) as claimed.
Furthermore, As in MPEP 2161.01 (I), "The description requirement of the patent statute requires a description of an invention, not an indication of a result that one might achieve if one made that invention." It is not enough that one skilled in the art could write a program to achieve the claimed function because the specification must explain how the inventor intends to achieve the claimed function to satisfy the written description requirement. See, e.g., Vasudevan Software, Inc. v. MicroStrategy, Inc., 782 F.3d 671, 681-683, 114 USPQ2d 1349, 1356, 1357 (Fed. Cir. 2015).
While programming one-time programmable indicators might be known (i.e. blowing fuses), description as to how the applicant intends to implement “upon the first subset and the second subset being alternately programmed” is not described, more specifically, it is not clear what is doing the programming or the procedure required to perform the programming. The functional language is unclear because the claim does not provide a discernable boundary on what performs the function, since does not clearly follow from the structures recited in the claim i.e. controller, memory, indicators. Therefore, the specification does not provide a disclosure of the computer and algorithm in sufficient detail to demonstrate to one of ordinary skill in the art that the inventor possessed the invention under 35 U.S.C. 112(a).
Claims 2-10, 12-20, and 22-25 fall together accordingly.
Claims 21-25 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. As described above in the “Claim Interpretation” section above, the disclosure does not provide adequate structure to perform the claimed functions of “reading at least two one-time programmable (OTP) indicators”, “determining an operating state of a boot process for a bootstrap controller component based on the at least two one-time programmable indicators”, and “executing instructions from a read-only memory, by the bootstrap controller component, at least one instruction state of the boot process based on the operating state” in the apparatus of claim 21, as it is unknown which specific components of the apparatus perform each of the limitations, as well as whether the means of the apparatus are comprised of hardware, software, or a combination of the two. The specification does not demonstrate that applicant has made an invention that achieves the claimed function because the invention is not described with sufficient detail such that one of ordinary skill in the art can reasonably conclude that the inventor had possession of the claimed invention.
Claims 22-25 fall together accordingly.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 1-2, 6-10, 11-12, 16-22 and 24 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Schilder et al. (US 2019/0163909 A1).
Regarding claim 1, Schilder discloses an apparatus for computer security at power-on, the apparatus comprising:
at least two one-time programmable (OTP) indicators including a first programmed OTP indicator, the at least two OTP indicators comprising a first subset and a second subset; (123/127; [0095] “Once the manufacturing testing has been completed and a chip device passes all test modes (YES, S507), in S511 (FIG. 5) appropriate device state fuses 127 (FIG. 1) for production are blown.” [0086] “As shown in the example device state decoder of FIG. 2, the 27 device state bits 201 may be divided into three 9-bit groups (group-0, group-I, group-2), and each group may be further broken down into three 3-bit sub-groups.”)
a bootstrap controller component (121) that controls at least two boot-time switches (905-919),
the bootstrap controller component calculating an operating state of a boot process based on the at least two one-time programmable indicators; ([0062] “… device states may be derived as a function of a bit pattern stored in the device state fuses 127 using a device state decoder 121.”)
and a read only memory storing at least one instruction (107/161), wherein the bootstrap controller component enables or disables an execution of the at least one instruction of the boot process based on the operating state, the at least one instruction being read from the read only memory, ([0072] “A chip device may have various degrees of lock down/security levels. "Lock down" or "security level" may refer to explicit actions that are taken that affect chip access… the memories may also be disabled.”; Schilder discloses that ports/memories may be disabled in locked states and that boot ROM / boot loader execution is conditionally enabled based on state.)
and wherein the at least two one-time programmable indicators are configured to enable the operating state of the boot process to be repeatably and alternatively switched at least twice between a first operating state and a second operating state upon the first subset and the second subset being alternately programmed. ([0078] “A password maybe required to transition from Test-Mode-Locked Device 405 state to test-Mode-Enabled device state. This is a temporary change, and on chip reset changes the chip back to the fused value. The chip cannot transition to test-Mode-Enabled device state from Test-Mode-Disabled test state. A chip can only be personalized once. If a password is used to go back to temporary test-Mode-Enabled, it may still be considered personalized.”; [0081] “Personalized Device state 409, may be based on creation of a secret Device Initialization Key (DIK), exporting to the DIK to a Key-Management Server (KMS), and saving the DIK in on-chip non-volatile memory such as the key fuses 125. In this way, this state is characterized by the DIK asset within the device 100. A device 100 may be re-personalized, i.e., transitioned into the Personalized Device state 409, as many times as there are physical DIKs within the device (which may be set, for example, to 3 plus a test-DIK).”; [0100] “When the device state fuses 127 (FIG. 1) decode to one of the previous states (S513, YES), at s S517 (FIGS. 5), S519, and S521, the chip device may be forced into a Test-Mode-Enabled Device 403 (FIG. 4) state (S503) if fuse bits indicate that the device is currently in Test-Mode-Locked Device 405 state and an unlock request including a password has been received (YES at S517), and the password has been verified (YES at S521).”; Schilder transition from Test-Mode-Locked to Test-Mode-Enabled, return to fused value on reset, and later re-entry into Test-Mode-Enabled after password verification. Under BRI, show repeated alternating operating-state switching based on programmed fuse patterns/subsets.)
“and wherein the at least two one-time programmable indicators are configured to disable the operating state of the boot process upon the first subset being programmed twice in a row or upon the second subset being programmed twice in a row” ([0078] The chip cannot transition to test-Mode-Enabled device state from Test-Mode-Disabled test state. A chip can only be personalized once. If a password is used to go back to temporary test-Mode-Enabled, it may still be considered personalized.”; [0100] “When the device state fuses 127 (FIG. 1) decode to one of the previous states (S513, YES), at s S517 (FIGS. 5), S519, and S521, the chip device may be forced into a Test-Mode-Enabled Device 403 (FIG. 4) state (S503) if fuse bits indicate that the device is currently in Test-Mode-Locked Device 405 state and an unlock request including a password has been received (YES at S517), and the password has been verified (YES at S521).” [0095] Fig. 5, step S509 programs the fuses to an invalid state, which puts the device into a Disabled Device state.);
One-time programmable indicators may be any electronic one-time programmable or writeonce device such as an efuse or ROM. It is also noted, if the memories are disabled, then execution of any code stored in the ROM is not possible. A completely disabled device is known in the art as being “bricked,” which is what is intended by Schilder, see [0098]. Furthermore, Schilder recites that a device is capable of transitioning from a “personalized” state to a “test mode enabled state”, or alternatively, the fuses may be decoded to a previous state and thus forced into a “test mode enabled state”. If the device is never transitioned into a test mode disabled state, then how many times the device state can be repeatably switched is limited to the number of fuses in the device ID fuses 129.
Regarding claim 2, Schilder discloses the apparatus of claim 1 as set forth above, the first subset is programmed at a completion of manufacturing of the apparatus and the second subset is available for one-time programming subsequent to the manufacturing of the apparatus. ([0095] “Once the manufacturing testing has been completed and a chip device passes all test modes (YES, S507), in S511 (FIG. 5) appropriate device state fuses 127 (FIG. 1) for production are blown. In one embodiment, group-1 device state fuses 127 are written with a correct pattern to “increment” the device state to Test-Mode-Locked Device 405 (FIG. 4) state.”)
If only group-1 is programmed (i.e. efuse blown), groups-2 and 3 would still be available for programming. It is also noted, the scope of the term “subset” includes any number of indicators, including just one.
Regarding claim 6, Schilder discloses the apparatus of claim 1 as set forth above, wherein the bootstrap controller component disables the execution of the at least one instruction based on the operating state. (207, [0063] “…the fifth state may be a disabled state 207 that is reached as a result of failure of reaching any one of the other four states.”; [0072] “…the memories may also be disabled.”) It is noted, if access to the memories, such as the Boot ROM, is disabled then it is not possible to execute any instructions.
Regarding claim 7, Schilder discloses the apparatus of claim 1 as set forth above, wherein the first subset and the second subset are connected to logic gates, the logic gates being arranged such that a first programming of a one-time programmable indicator of the first subset is read by the bootstrap controller component as a first state of the operating state, (205, “RAW”; 401)
a second programming of a one-time programmable indicator of the second subset is read by the bootstrap controller component as a second state of the operating state, (205, “TESTMODE ENABLED”; 403)
and a third programming of another one-time programmable indicator of the first subset is read by the bootstrap controller component as the first state, the third programming being after the second programming. (205, “TESTMODE LOCKED”; 405)
Regarding claim 8, Schilder discloses the apparatus of claim 1 as set forth above, wherein the first subset and the second subset are electronic fuses. (123 “there may fuses 123 which serve as bit-storage devices.”)
Regarding claim 9, Schilder discloses the apparatus of claim 1 as set forth above, further comprising:
an interface to one or more test access ports, (145/147) wherein programming of a onetime programmable indicator the second subset enables or disables the interface to the one or more test access ports. ([0080])
Regarding claim 10, Schilder discloses the apparatus of claim 1 as set forth above, wherein execution of the at least one instruction of the read only memory verifies at least one certificate for authenticating firmware code or provides at least one certificate for authenticating firmware code. (S825, [0141] “…the stage-1 boot loader undergoes verification. To verify the stage-1 flash bootloader, the ROM firmware may generate a hash of the code using a hash function and perform an RSA Verify operation…”)
The methods of claims 11-12 are drawn to the corresponding method of using the apparatus of claims 1-2. Therefore, claims 11-12 correspond to claims 1-2 and are rejected for the same reasons of anticipation as used above for claims 1-2 over Schilder.
The apparatus means of claims 21-22 are drawn to the corresponding apparatus of claims 1-2. Therefore, claims 21-22 correspond to claims 1-2 and are rejected for the same reasons of anticipation as used above for claims 1-2 over Schilder.
The methods of claims 16-20 are drawn to the corresponding method of using the apparatuses of claims 6-10. Therefore, claims 16-20 correspond to claims 6-10 and are rejected for the same reasons of anticipation as used above for claims 6-10 over Schilder.
Regarding claim 24, Schilder discloses The apparatus of claim 1, wherein the first operating state is a returned merchandise authorization (RMA) state, and the second operating state is a security (SEC) state, and wherein the first subset includes a plurality of RMA indicators and the second subset includes a plurality of SEC indicators, the bootstrap controller component being configured to calculate the operating state of the boot process based on the plurality of RMA indicators and on the plurality of SEC indicators. (Schilder, [0095] “In one embodiment, group-1 device state fuses 127 are written with a correct pattern to “increment” the device state to Test-Mode-Locked Device 405 (FIG. 4) state. Alternatively, when a chip device does not pass a test (NO in S507), for example attributable to a manufacturing defect, both group-1 and group-2 fuses may be programmed to a pattern that skips over the Test-Mode-Locked Device 405 state and in S509 jumps straight to Test-Mode-Disabled Device 407 state. Alternatively, S509 may program the fuses to an invalid state, putting the device into a Disabled Device state.”)
It is noted, the claim does not define what a “returned merchandise authorization (RMA)” or “security (SEC)” state is, they are merely labels similar to “first” and “second” that differentiate the two states. However, par. [0043] recites,
“Further efuses may be provided or present to define parameters outside the SEC or RMA state. For example, the SEC state may be defined to include activation of certain debug or JTAG ports until a de-activation efuse is blown and the SEC state is locked down fully… Furthermore, as is readily apparent, this gating mechanism for boot states and switching between RMA states and SEC states may be applied to any chip with debug ports, JTAG ports or connections that need to be selectively disabled in hardware for security.”
The “SEC” and “RMA” states are defined by the enabling and disabling of debug or JTAG ports, though it is still not specified what ports are enabled or disabled based on the state. Applicant merely suggests tying enabling or disabling of ports to both states. The broadest reasonable interpretation is that the “SEC” and “RMA” states are device states which are used to determine the enabling or disabling of debug or JTAG ports of the device. The prior art does not need to explicitly disclose an “RMA” and “SEC” state, the prior art merely needs to suggest device states that are used to enable or disable debug or JTAG ports to read on the limitations of claim 24.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 3, 13 and 23 are rejected under 35 U.S.C. 102(a)(1) as anticipated by or, in the alternative, under 35 U.S.C. 103 as obvious over Schilder in view of Findeisen et al. (US 2009/0222653 A1).
Regarding claim 3, Schilder discloses the apparatus of claim 1, wherein the first programmed OTP indicator is programmed at the completion of manufacturing of the apparatus to enable the bootstrap controller component to initialize at power-on and enter the boot process. (Schilder, [0108] “Because chip devices are initially in a Raw Device state, after initial power-up of the chip device, in S603 (FIG. 6A), a set of device state fuses 127 (FIG. 1) are blown to increment the device state to Test-Mode-Enabled Device 403 (FIG. 4). In an example embodiment, if a fuse pattern does not correspond to a known state, such as the Test-Mode-enabled Device 403 state, the chip device will increment back to the default Raw Device 401 state. This operation ensures that if a fuse sense process is tampered with (which may cause the device state fuses 127 to remain at all zeros or, alternatively, switch to all ones), the chip device would not be capable of being re-opened into any security-sensitive test mode.”)
Alternatively, Findeisen teaches wherein the first programmed OTP indicator is programmed at the completion of manufacturing of the apparatus to enable the bootstrap controller component (100) to initialize at power-on and enter the boot process. (130, “Boot options” and “Security Bits”; [0045] “…in step S102, it may be indicated that secure boot processing is started during the internal self-test. In step S120, the system 150 and in particular the CPU 100 may be initialized, which may, for instance, comprise one or more of the steps S121-S129.”)
Findeisen is directed to a secure boot processing based on non-volatile memory that may not be modified once a pre-boot information is programmed into the non-volatile memory (i.e. one-time programmable memory). Therefore, it would be obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Schilder to incorporate the teachings of Findesein to include wherein the first programmed OTP indicator is programmed to enable the bootstrap controller component to initialize at power-on and enter a boot process. Such modification(s) would be motivated in order to establish a static root of trust. Findeisen [0040].
The method of claim 13 is drawn to the corresponding method of using the apparatus of claim 3. Therefore, claim 13 corresponds to claim 3 and is rejected for the same reasons of anticipation as used above for claim 3 over Schilder, and alternatively in view of Findeisen.
The method of claim 23 is drawn to the corresponding method of using the apparatus of claim 3. Therefore, claim 23 corresponds to claim 3 and is rejected for the same reasons of anticipation as used above for claim 3 over Schilder, and alternatively in view of Findeisen.
Claims 4-5 and 14-15 are rejected under 35 U.S.C. 103 as being unpatentable over Schilder in view of Findeisen as applied to claim 2 above, and further in view of Hershman et al. (US 2021/0407610 A1).
Regarding claim 4, Schilder in view of Findeisen disclose the apparatus of claim 2 as set forth above, wherein the second subset of the at least two one-time programmable indicators include security state indicators (Findeisen, 130 “Security Bits”), but fails to disclose wherein the second subset of the at least two one-time programmable indicators include returned merchandise authorization (RMA) state indicators.
Hershman teaches wherein the second subset of the at least two one-time programmable indicators include returned merchandise authorization (RMA) state indicators (Hershman, [0015] “Non-limiting examples of operational states include… RMA (an IC returned to the manufacturer, e.g., due to failure”).
Hershman is directed to an integrated circuit including a non-volatile memory and secure power-up circuitry, the non-volatile memory includes a one-time programmable memory for storing a device lifecycle state. Therefore, it would be obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Schilder in view of Findeisen to incorporate the teachings of Hershman to include wherein the second subset of the at least two one-time programmable indicators includes returned merchandise authorization (RMA) state indicators. Such modification would be motivated to control access privileges to IC resources during different lifecycle stages of an IC. Hershman [0016].
Regarding claim 5, Schilder in view of Findeisen and Hershman disclose the apparatus of claim 4 as set forth above, wherein the RMA state indicators and the security state indicators control, via first logic gates (Schilder, 203, [0063]), access to debug ports and test access ports (Schilder, 401-407, [00750077]) for a returned merchandise authorization (RMA) process.
The language, “for a returned merchandise authorization (RMA) process” is intended use and non-limiting. The prior art need only disclose “the RMA state indicators and the security state indicators control, via first logic gates, access to debug ports and test access ports.” However, in this case, Schilder discloses the controlling access to debug ports and test access ports based on state indicators. Hershman teaches a lifecycle state indicator tied to an RMA state, similar to that of the RMA state indicators disclosed by Schilder.
The methods of claims 14-15 are drawn to the corresponding methods of using apparatuses of claims 4-5. Therefore, claims 14-15 correspond to claims 4-5 and are rejected for the same reasons of obviousness as used above for claims 4-5 over Schilder in view of Findeisen and Hershman.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Love et al. (US 9436844 B2, "Access Enablement Security Circuit")
Chhodavdia (US 10936771 B1, "Using A Common Fuse Controller Hardware Design For Different Applications ")
O'Loughlin et al. (US 20140108825 A1, "System And Method For Hardware Based Security ")
Feng et al. (US 8046571 B1, "System-on-a-chip (SoC) Security Using One-time Programmable Memories")
Stefan et al. (WO 2021173248 A1, "SELECTIVE BOOT CONTROLLER FOR RESILIENT STORAGE MEMORY")
Constantin (EP 1429224 A1, "Firmware Run-time Authentication")
Ashkenazi et al. (NPL, "Platform Independent Overall Security Architecture in Multi-Processor System-on-Chip ICs for Use in Mobile Phones and Handheld Devices ", 2006)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TOMMY MARTINEZ whose telephone number is (703)756-5651. The examiner can normally be reached at Tommy.Martinez@uspto.gov on Monday thru Friday 8AM-4PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado can be reached at (571) 272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/T.M./ Examiner, Art Unit 2496
/JORGE L ORTIZ CRIADO/Supervisory Patent Examiner, Art Unit 2496
Prosecution Insights