DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to amendment filed on 02/27/2026.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 02/27/2026 has been entered.
Response to Amendment
By this amendment, claims 1-2, 5-6, 8-9, 12-15, and 18-19 are amended. Claims 3-4, 10-11, and 16-17 are canceled. Claims 21-26 are newly added claims. Therefore, claims 1-2, 5-9, 12-15, and 18-26 are pending. Any objections and rejections not repeated below is withdrawn due to Applicant's amendment.
Response to Arguments
Applicant's arguments filed 02/27/2026 have been fully considered but they are not persuasive. Applicant argues in substance:
Applicant submits that the cited references, either alone or in combination, fail to teach, show, or suggest the claimed embodiments. The Action cites Dow to teach, inter alia, the limitations "wherein the primary virtual machine (VM) supports a first processor architecture and the enclave VM supports a second processor architecture," and "determining that the primary VM is not configured to execute the process." Action, pp. 6-7 and 9-10. Specifically, the Action cites Dow's "specialty processor" and "blade processor," which are used interchangeably to refer to a hardware processor that is configured to process a specific type of workload, to teach the disclosed enclave VM. Id The Action further cites Dow's mainframe processor to teach the disclosed primary VM. Id. The Action also cites Dow's offloading in response to detecting a maxed-out mainframe processing to teach determining that the primary VM is not configured to execute the process. Id. at pp. 6-7. However, Dow fails to teach that the mainframe processor (which the Action equates to the primary VM) does not support the second processor architecture, nor determining that the primary VM is not configured to execute the process, as recited in amended claims 1, 8, and 14…
In view of the above, the Examiner's contentions and the cited art do
not support an obviousness rejection of amended independent claims 1, 8, and 14. Remaining claims 2, 5-7, 9, 12, 13, 15, and 18-20 depend, either directly or indirectly, from claims 1, 8, and 14. Accordingly, the Examiner's contentions and the cited art also do not support an obviousness rejection of claims 2, 5-7, 9, 12, 13, 15, and 18-20, and withdrawal of the rejection is respectfully requested.
New claims 21-26 are added by this reply. The new claims depend on independent claims 1, 8, or 14. Applicant asserts that the new claims are patentable over the cited art for at least the same reasons as the are the aforementioned independent claims. Accordingly, favorable consideration of the new claims is respectfully requested.
With regard to point (a), due to claim amendments, Li et al. Pub. No. US 2019/0324790 Al (hereafter Li 1) has been utilized to cure the stated deficiencies of independent claims 1, 8, and 14 as stated above. Therefore, independent claims 1, 8, and 14 and their respective dependent claims are still rejected for the reasons in this Office Action’s 103 rejection below. Argument has not been found to be persuasive.
Claim Objections
Claims 6, 13, and 19 are objected to because of the following informalities:
In Claims 6, 13, and 19, “writing the process request to the memory address range” should read “writing the process request to a memory address range”.
Any claim not specifically mentioned above, is objected due to its dependency on an objected claim.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 5-9, 12-15, and 18-26 are rejected under 35 U.S.C. 103 as being unpatentable over Li et al. Pub. No. US 2019/0324790 Al (hereafter Li 1) in view of Li et al. Pub. No. US 2020/0134171 Al (hereafter Li 2), and further in view of RAVAL et al. Pub. No. US 2022/0206942 Al (hereafter RAVAL).
Regarding claim 1, Li 1 teaches a method for executing a process in an enclave virtual machine, the method comprising: receiving, by a primary virtual machine, a process request specifying the process ([0021] “In some embodiments, an auxiliary processor can access and execute an auxiliary processor virtual machine manager 126 stored in the storage device 118. The auxiliary processor virtual machine manager 126 can initialize a virtual machine and detect an instruction from a main processor to be executed by the auxiliary processor. The auxiliary processor virtual machine manager 126 can also execute the instruction on the auxiliary processor with the auxiliary instruction set architecture and transmit context data corresponding to the execution of the instruction to the main processor.”, Note: The detected instruction is interpreted as the process); wherein: executing the process requires support of a second processor architecture, and the primary virtual machine supports a first processor architecture and does not support the second processor architecture ([0025] “…In some examples, the auxiliary processor is based on an auxiliary instruction set architecture that is different from the main instruction set architecture of the main processor. For example, the main processor and the auxiliary processor can use different instruction set architectures, such as x86, ARM, and Open-RISC, among others, to execute instructions.”, [0026] “…In some embodiments, the auxiliary processor manager 122 determines that an instruction can be executed more efficiently by an auxiliary processor if the main processor indicator is above a threshold indicating the main processor is executing instructions for other applications and the auxiliary utilization indicator is below a threshold indicating that the auxiliary processor is available…”): looking up specifications associated with the process; comparing the specifications associated with the process with specifications allocated to the primary virtual machine, wherein the comparing comprises determining that the primary virtual machine is not configured to execute the process, wherein determining that the primary virtual machine is not configured to execute the process comprises determining that the primary virtual machine does not support the second processor architecture ([0015] “…A main processor or a main processing core can execute instructions for the central processing unit. For example, the main processor or the main processing core can execute instructions for an operating system and any other suitable software. An auxiliary processor or an auxiliary processing core can execute instructions for peripheral devices, input devices, and the like. For example, auxiliary processors or auxiliary processing cores can execute instructions for sensors, sensor hubs, keyboards, mice, and the like…”, [0025] “…In some examples, the auxiliary processor is based on an auxiliary instruction set architecture that is different from the main instruction set architecture of the main processor. For example, the main processor and the auxiliary processor can use different instruction set architectures, such as x86, ARM, and Open-RISC, among others, to execute instructions.”, [0019] “…The first threshold can indicate if the main processor is underutilized and whether the main processor can execute the instruction. The second threshold can indicate if the auxiliary processor is underutilized and whether the auxiliary processor can execute the instruction.”, [0026] “…In some embodiments, the auxiliary processor manager 122 determines that an instruction can be executed more efficiently by an auxiliary processor if the main processor indicator is above a threshold indicating the main processor is executing instructions for other applications and the auxiliary utilization indicator is below a threshold indicating that the auxiliary processor is available…”)…
Li 1 fails to teach … and based on determining that the primary virtual
machine is not configured to execute the process: sending the process request from the primary virtual machine to an enclave memory of the enclave virtual machine via a memory channel coupling the primary virtual machine and the enclave memory … and executing the process on the enclave virtual machine using a processor of the enclave virtual machine, wherein the processor of the enclave virtual machine supports the second processor architecture.
In analogous art Li 2 teaches and based on determining that the primary
virtual machine is not configured to execute the process: sending the process request from the primary virtual machine to an enclave memory of the enclave virtual machine via a memory channel coupling the primary virtual machine and the enclave memory ([0016] “…one or more software processes may be running on the guest OSs 120 of the VMs as guest applications 122…”, [0028] “Next, at step 214, one or more tasks are executed by the enclave VM as needed … Some examples of these tasks include (1) communicating with the requesting software process 201 and/or other software processes, which may reside in the computer system 100 or in other computer systems…”, [0033] “…The transmission of the identity of the enclave VM 302B from the enclave VMs 302B to the enclave VM 302A may be through any communication channel, even a communication channel that is not considered to be secure.”, Note: A task is a process request communicated from a software process of a VM (primary virtual machine) to an enclave virtual machine) … and executing the process on the enclave virtual machine using a processor of the enclave virtual machine, wherein the processor of the enclave virtual machine supports the second processor architecture ([0028] “Next, at step 214, one or more tasks are executed by the enclave VM as needed…”).
It would have been obvious to a person having ordinary skill in the art prior to the
effective filing date of the claimed invention to have modified Li 1 to incorporate the teachings of Li 2 to provide a secure environment in a VM to store any codes and/or data that need to be protected (Li 2 [0018] “An enclave VM provides a secure environment to store any codes and/or data that need to be protected…”).
Li 1 and Li 2 fail to teach wherein the memory channel is configured to utilize smart data accelerator interface (SDXI) protocol.
In analogous art RAVAL teaches wherein the memory channel is configured to utilize smart data accelerator interface (SDXI) protocol ([0002] “…Smart Data Accelerator Interface (SDXI) engines are distributed across multiple sockets, and the SDXI engines are peripheral component endpoints, such as a peripheral component interconnect express (PCie) endpoint, with interfaces into multiple root complexes and capable of performing multi-address space DMA operations.”, [0037] “…Each SDXI engine has a physical function (PF), and multiple VFs, however, each VM will only need to attach to one VF and be able to utilize all SDXI engine instances to facilitate data transfer between any other SDXI engine PF/VFs, regardless of how many SDXI engine instances are present on a system…”, Note: VMs utilize VFs and SDXI engines to perform DMA operations and transfer data to each other).
It would have been obvious to a person having ordinary skill in the art prior to the
effective filing date of the claimed invention to have modified Li 1 and Li 2 to incorporate the teachings of RAVAL to facilitate low latency and high bandwidth transfer of data (RAVAL [0036] “In embodiments of the present disclosure, an SDXI engine 104, which is a particular peripheral component endpoint, is a software and hardware solution that facilitates low latency and high bandwidth transfer of data between at least two distinct address domains on a host system…”).
Regarding claim 2, Li 1, Li 2, and RAVAL teach the method of claim 1, and Li 2 further teaches wherein prior to sending the process request to the enclave virtual machine, the method further comprises: sending a creation request, to a virtual machine manager, to create the enclave virtual machine ([0026] “…a deployment of a new enclave VM for the software process is initiated by the enclave manager…”, Note: The enclave manager is the virtual machine manager) with support for the second processor architecture; and creating, using the virtual machine manager, the enclave virtual machine, comprising: allocating, as the enclave memory, a memory address range based on the specifications associated with the process ([0021] “The enclave manager 124 operates to configure and deploy enclave VMs in response to requests from software processes, which may be part of applications 122 or other executing software programs …The virtual CPU and memory for the enclave VMs can vary depending on the actual enclave demands from the software processes during the creation of the enclave VMs…”, [0027] “Next, at step 212, the content for the secure execution environment provided by the enclave VM is loaded into the enclave VM by the enclave manager. In an embodiment, the content is extracted from the enclave composition/construction log and loaded into the virtual volatile memory of the enclave VM using the virtual address mapping from the enclave composition/construction log…”), allocating, to the enclave virtual machine, the processor that supports the second processor architecture, and providing the memory address range to the primary virtual machine ([0021] “The enclave manager 124 operates to configure and deploy enclave VMs in response to requests from software processes, which may be part of applications 122 or other executing software program…”, [0027] “Next, at step 212, the content for the secure execution environment provided by the enclave VM is loaded into the enclave VM by the enclave manager. In an embodiment, the content is extracted from the enclave composition/construction log and loaded into the virtual volatile memory of the enclave VM using the virtual address mapping from the enclave composition/construction log…”, [0023] “…an enclave measurement is information that can be used to unique identify an enclave or secure execution environment represented by an enclave composition/construction log, which includes (1) content to be stored in the secure execution environment or enclave, e.g., pages of both data and code to be stored, (2) the virtual address mapping of the enclave, and (3) any other security information from user configuration (e.g., page permissions)…”, Note: The software process executing in a virtual machine sends content to the enclave manager to be loaded into the memory address of the enclave virtual machine).
Regarding claim 5, Li 1, Li 2, and RAVAL teach the method of claim 2, and Li 1 further teaches wherein the creation request specifies the second processor architecture for the enclave virtual machine ([0021] “In some embodiments, an auxiliary processor can access and execute an auxiliary processor virtual machine manager 126 stored in the storage device 118. The auxiliary processor virtual machine manager 126 can initialize a virtual machine and detect an instruction from a main processor to be executed by the auxiliary processor. The auxiliary processor virtual machine manager 126 can also execute the instruction on the auxiliary processor with the auxiliary instruction set architecture and transmit context data corresponding to the execution of the instruction to the main processor.”).
Regarding claim 6, Li 1, Li 2, and RAVAL teach the method of claim 1, and Li 2 further teaches wherein sending the process request to the enclave virtual machine comprises: writing the process request to the memory address range, wherein the enclave virtual machine comprises the enclave memory ([0027] “Next, at step 212, the content for the secure execution environment provided by the enclave VM is loaded into the enclave VM by the enclave manager. In an embodiment, the content is extracted from the enclave composition/construction log and loaded into the virtual volatile memory of the enclave VM using the virtual address mapping from the enclave composition/construction log…”, Note: Content is the process request that is loaded into the enclave VM).
Regarding claim 7, Li 1, Li 2, and RAVAL teach the method of claim 1, and Li 2 further teaches wherein after executing the process on the enclave virtual machine, the method further comprises: obtaining result data of the process ([0028] “Next, at step 214, one or more tasks are executed by the enclave VM as needed. The type of tasks executed by the enclave VM may vary depending on the application of the enclave VM. Some examples of these tasks include (1) communicating with the requesting software process 201 and/or other software processes, which may reside in the computer system 100 or in other computer systems, (2) executing the code originally loaded into the enclave VM using the data originally loaded into the enclave VM or using data from external sources…”, Note: The result data from executing the code originally loaded into the enclave VM using the data originally loaded into the enclave VM is communicated to a software process to return it).
Regarding claim 8, Li 1 further teaches a non-transitory computer readable medium comprising instructions which, when executed by a processor, enables the processor to perform a method for executing a process in an enclave virtual machine, the method comprising ([0047] “FIG. 5 is an example block diagram of a non-transitory computer readable media for executing an instruction for a main processor with an auxiliary processor. The tangible, non-transitory, computer-readable medium 500 may be accessed by a processor 502 over a computer interconnect 504. Furthermore, the tangible, non-transitory, computer-readable medium 500 may include code to direct the processor 502 to perform the operations of the current method.”). The other limitations are substantially the same as those of claim 1. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 9, it is an article of manufacture claim whose limitations are substantially the same as those of claim 2. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 12, it is an article of manufacture claim whose limitations are substantially the same as those of claim 5. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 13, it is an article of manufacture claim whose limitations are substantially the same as those of claim 6. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 14, Li 1 further teaches a computing device, comprising: a processor; and memory storing instructions which, when executed by the processor, enables the processor to perform a method for executing a process in an enclave virtual machine, the method comprising ([0047] “FIG. 5 is an example block diagram of a non-transitory computer readable media for executing an instruction for a main processor with an auxiliary processor. The tangible, non-transitory, computer-readable medium 500 may be accessed by a processor 502 over a computer interconnect 504. Furthermore, the tangible, non-transitory, computer-readable medium 500 may include code to direct the processor 502 to perform the operations of the current method.”). The other limitations are substantially the same as those of claim 1. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 15, it is a machine claim whose limitations are substantially the same as those of claim 2. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 18, it is a machine claim whose limitations are substantially the same as those of claim 5. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 19, it is a machine claim whose limitations are substantially the same as those of claim 6. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 20, it is a machine claim whose limitations are substantially the same as those of claim 7. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 21, Li 1, Li 2, and RAVAL teach the method of claim 2, and Li 2 further teaches further comprising: based on receiving, by the primary virtual machine, the memory address range: writing program data, process parameters, and input data to the enclave memory and within the memory address range ([0021] “The enclave manager 124 operates to configure and deploy enclave VMs in response to requests from software processes, which may be part of applications 122 or other executing software programs …The virtual CPU and memory for the enclave VMs can vary depending on the actual enclave demands from the software processes during the creation of the enclave VMs…”, [0027] “Next, at step 212, the content for the secure execution environment provided by the enclave VM is loaded into the enclave VM by the enclave manager. In an embodiment, the content is extracted from the enclave composition/construction log and loaded into the virtual volatile memory of the enclave VM using the virtual address mapping from the enclave composition/construction log…”, [0023] “…an enclave measurement is information that can be used to unique identify an enclave or secure execution environment represented by an enclave composition/construction log, which includes (1) content to be stored in the secure execution environment or enclave, e.g., pages of both data and code to be stored, (2) the virtual address mapping of the enclave, and (3) any other security information from user configuration (e.g., page permissions)…”).
Regarding claim 22, Li 1, Li 2, and RAVAL teach the method of claim 21, and Li 2 further teaches wherein the execution of the process is initiated by writing initiation data to the enclave memory ([0041] “…In an embodiment, the enclave manager may initiate the deployment of the enclave virtual computing instance, which is executed by the hypervisor. At block 406, the content is loaded into the deployed enclave virtual computing instance. At block 408, execution of at least one task is facilitated using the content in the enclave virtual computing instance to ensure confidentiality of the content.”, Note: Once content is loaded into the enclave virtual machine, task(s) are executed using the content).
Regarding claim 23, it is an article of manufacture claim whose limitations are substantially the same as those of claim 21. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 24, it is an article of manufacture claim whose limitations are substantially the same as those of claim 22. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 25, it is a machine claim whose limitations are substantially the same as those of claim 21. Accordingly, it is rejected for substantially the same reasons.
Regarding claim 26, it is a machine claim whose limitations are substantially the same as those of claim 22. Accordingly, it is rejected for substantially the same reasons.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. In particular, US 20090089794 A1 is cited because it discloses offloading tasks from one data processor to another data processor of a potentially different architecture.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JUSTIN CHE-CHUN TONG whose telephone number is (703)756-1737. The examiner can normally be reached Monday-Thursday: 7:30 AM to 6:00 PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, April Y Blair can be reached on (571)270-1014. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.C.T./Examiner, Art Unit 2196
/APRIL Y BLAIR/Supervisory Patent Examiner, Art Unit 2196
