DETAILED ACTION
In a communication received on 16 October 2025, the applicants amended claim 19, canceled claim 20, and added claim 21.
Claims 1-19 and 21 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 19 and 21 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
With respect to claim 1, the applicants allege, "The cited passages of Sahita does not disclose "underlying hardware that provides a functional hardware instance ... that is completely separate and independent from host circuitry." (page 9) with respect to the claimed limitation(s), "guest circuitry configured to provide a virtual function". The examiner respectfully traverses. The arguments/remarks pertain to whether the cited prior art does not disclose guest circuitry independent from host circuitry. The examiner concludes that the cited prior art clearly discloses virtual machines corresponding to allocated physical hardware resources dedicated to it
Ascertaining the differences between the prior art and the claims at issue requires interpreting the claim language, and considering both the invention and the prior art references as a whole (See 2141.02 "Differences Between Prior art and Claimed Invention).
As best understood by the examiner, the limitation, under broadest reasonable interpretation in light of the specification, pertains to any hardware that provides virtualized functionality in any way. The claim is not interpreted to rely on the guest circuitry that is completely separate and independent from host circuitry because at least the specification only discloses this as an example relying on language such as "generally refer to", "can refer to", and "for example". The feature cannot be properly imported from the specification without being explicitly claimed. Additionally, Sahita, ¶0016, clearly discloses privileging a VM to a subset of resources in the platform such as secure memory; and Sahita, ¶0031, the VMs have their state information stored in protected memory domain such as memory and/or processor registers. These suggest associated hardware elements which correspond to allocated (i.e., independent) for VM functionality and not the host.
In conclusion, the applicants argue(s) that the cited prior art does not disclose guest circuitry independent from host circuitry. The examiner traverses because the cited prior art clearly discloses virtual machines corresponding to allocated physical hardware resources dedicated to it.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-3, 9, and 11-13 is/are rejected under 35 U.S.C. 102(a)(1) as being clearly anticipated by Sahita et al. (US 2011/0061050 A1).
With respect to claim 1, Sahita discloses: a computing device, comprising:
guest circuitry configured to provide a virtual function (i.e., VM manager hardware providing virtual instantiations of a computing entity shared by others on a single computing platform - "virtual instantiations of a single computing platform. Consequently, these virtual machines all correspond to this single computing platform and share its resources" in Sahita, ¶0001, ¶0014);
authorization circuitry (i.e., hardware to determine authorization to execute to read performance counter information of subject VM - "determination may be made by the hardware[,] by checking, for example, a flag set in the VMCS[,] ... as to whether the monitoring VM has been previously authenticated. If so, the process may continue to 440, where a determination may be made as to whether the monitoring VM is authorized to execute the system call" in Sahita, ¶0024)
configured to authorize host circuitry (i.e., platform host and its users may use the monitoring VM for accessing count information of subject VM - "Hardware performance counts may be monitored, for example, in a cloud computing environment, and the monitoring VM may be configured to access the information associated with the subject VM on behalf of cloud computing users and/or a cloud computing platform host, and/or a third party monitoring service provider, assuming proper authorization" in Sahita, ¶0028)
to access an architecture performance counter for the virtual function (i.e., monitoring VM to access performance counter information of a subject VM - "monitoring VM may seek to read state information for the subject VM, by making a system call ... or by sending an instruction to the computing platform. Such state information may include statistics such as a value of a performance counter for the subject VM, where the performance counter may track machine cycles used, mathematical operations performed, input/output operations performed, or resource utilization" in Sahita, ¶0023); and
security circuitry configured to perform a security action based on the authorization. (i.e., upon determining authorization of the monitoring VM, provide the requested count information in Sahita, ¶0029-0030).
With respect to claim 2, Sahita discloses: the computing device of claim 1,
wherein the security action includes providing, to the host circuitry, the architecture performance counter at least partly (i.e., monitoring VM seeking to read performance counter information of a subject VM in Sahita, ¶0023)
in response to a security setting indicating that the host circuitry is authorized to receive the architecture performance counter (i.e., flag indicates that the monitoring VM is trusted to access via system call the counter information - "determination may be made by the hardware[,] by checking, for example, a flag set in the VMCS[,] ... as to whether the monitoring VM has been previously authenticated. If so, the process may continue to 440, where a determination may be made as to whether the monitoring VM is authorized to execute the system call" in Sahita, ¶0024)
With respect to claim 3, Sahita discloses: the computing device of claim 2, wherein the security circuitry is configured to: receive a request for the architecture performance counter from the host circuitry; and provide the architecture performance counter to the host circuitry further in response to the request (i.e., host platform and its users may request performance count information and receive it via monitoring VM via system call based on an authorization in Sahita, ¶0023, ¶0028).
With respect to claim 9, Sahita discloses: the computing device of claim 1, wherein the authorization circuitry is configured to maintain the architecture performance counter (i.e., state information including performance counts may be stored in protected memory domain corresponding to privileges of monitoring VM in Sahita, ¶0024, ¶0028, ¶0035).
With respect to claim 11, the limitation(s) of claim 11 are similar to those of claim(s) 1. Therefore, claim 11 is rejected with the same reasoning as claim(s) 1.
Sahita further discloses: a server system comprising: host circuitry configured to provide a physical function (i.e., computing platform including CPU and hardware components for collecting performance statistics of virtual machines through VM manager in Sahita, ¶0014).
With respect to claim 12, the limitation(s) of claim 12 are similar to those of claim(s) 2. Therefore, claim 12 is rejected with the same reasoning as claim(s) 2.
With respect to claim 13, the limitation(s) of claim 13 are similar to those of claim(s) 3. Therefore, claim 13 is rejected with the same reasoning as claim(s) 3.
Claim(s) 19 and 21 is/are rejected under 35 U.S.C. 102(a)(2) as being clearly anticipated by Kaplan et al. (US 2024/0220603 Al).
With respect to claim 19, Kaplan discloses: a computer-implemented method comprising:
providing, by at least one processor, a virtual function (i.e., initiating or resuming a guest VM with corresponding secure memory area reserved for the guest VM in Kaplan, ¶0025);
in conjunction with providing the virtual function, recording, by the at least one processor, in a circuit of the at least one processor, a security setting indicating permission to access an architecture performance counter for the virtual function (i.e., control fields for indicating for indicating access to the performance monitoring counters in Kaplan, ¶0024); and
authorizing, by the at least one processor, a function to access the architecture performance counter for the virtual function based on the recorded permission of the security setting (i.e., setting the access mode to a performance monitoring counter according to recording a setting in the control field corresponding to permission to access in Kaplan, ¶0024, ¶0026).
With respect to claim 21, Kaplan discloses: the computer-implemented method of claim 19,
wherein the security setting indicates permission to access the architecture performance counter for the virtual function (i.e., a control field for indicating access to the PMC by the guest VM in Kaplan, ¶0024)
and an intended use of the access indicated by the permission (i.e., guest VM can set control field to set intention for exclusive use of the PMC during execution in Kaplan, ¶0024), and
wherein accessing the architecture performance counter is based on the security setting indicating the virtual function and the intended use of the access (i.e., two control fields used to control access and use of the PMCs by the hypervisor and guest VM in Kaplan, ¶0024, ¶0026).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 4-8 and 14-17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Sahita et al. (US 2011/0061050 A1) in view of Meola (US 2011/0173545 A1).
With respect to claim 4, Sahita discloses: the computing device of claim 3, wherein the request includes information (i.e., system call for state information includes instructions to the hardware platform for accessing state information such as performance counter data of other VM in Sahita, ¶0017)
Sahita discloses monitoring VM seeking to read performance counter information of a subject VM (¶0023). Sahita do(es) not explicitly disclose granting by a user access to protected data based on information associated with the request, requestor, and/or intent of the request. Meola, in order to improve decision making for a user to grant access based on information about the request and the requestor (¶0018), discloses: indicating at least one of:
one or more intended uses of the architecture performance counter (i.e., message to a user to grant access to a request includes reasoning for granting access - "a message to the second user regarding why access should be granted and request reconsideration of the decision" in Meola, ¶0031); or
at least one of a particular hypervisor corresponding to a physical function provided by the host circuitry or a particular type of the particular hypervisor corresponding to the physical function (i.e., requesting entity is identified in a request for granting access to protected information - "second user may prefer authorization requests to identify information regarding, for example, the name of the requesting entity, the location of the computing device 201, an indication as to whether a request was sent and/or received from an additional mobile computing device (e.g., the other parent), and a quantity of times the particular request has been made" in Meola, ¶0018).
Based on Sahita in view of Meola, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Meola to improve upon those of Sahita in order to improve decision making for a user to grant access based on information about the request and the requestor.
With respect to claim 5, Sahita discloses: the computing device of claim 4, wherein the security setting includes at least one of: at least one trusted hypervisor security setting authorizing at least one of the particular hypervisor or the particular type of the particular hypervisor to receive the architecture performance counter; or at least one trusted use security setting authorizing the one or more intended uses of the architecture performance counter (i.e., the monitoring VM is authenticated as trusted corresponding to a flag bit and the monitoring VM has permissions to execute particular system calls - "the instruction, VMAUTH_READ, intends to seek access to counter information and corresponds to verification of the privileges of the monitoring vm” in Sahita, ¶0017, “a determination may be made as to whether the monitoring VM is authorized to execute the system call. If so, then the process may continue to 450. Here, the authorized operation, and optionally other operations, may be executed", Sahita ¶0024).
With respect to claim 6, Sahita discloses: the computing device of claim 5, wherein the authorization circuitry is configured to authorize the host circuitry based on at least one of:
the at least one trusted hypervisor security setting (i.e., a flag indicated the authentication of the monitoring VM to submit system calls in Sahita, ¶0024); or
the at least one trusted use security setting (i.e., access privileges corresponding to the monitoring VM and system call used in Sahita, ¶0024, ¶0050)
With respect to claim 7, Sahita discloses monitoring VM seeking to read performance counter information of a subject VM (¶0023). Sahita do(es) not explicitly disclose granting by a user access to protected data based on information associated with the request, requestor, and/or intent of the request. Meola, in order to improve decision making for a user to grant access based on information about the request and the requestor (¶0018), discloses: the computing device of claim 4,
wherein the security circuitry is configured to communicate a prompt, in response to the request, to a user interacting with the virtual function (i.e., prompting a second user to grant access to the request - "upon a request from the entity 110 to access location information of the computing device 201, the second user may be prompted to authorize or deny access to the location information of the computing device 201" in Meola, ¶0018), wherein
the prompt is configured to communicate, to the user, the information indicating at least one of: the at least one of the particular hypervisor or the particular type of the particular hypervisor (i.e., second user receives requests to grant access including the identity of the requestor - "second user may prefer authorization requests to identify information regarding, for example, the name of the requesting entity, the location of the computing device 201, an indication as to whether a request was sent and/or received from an additional mobile computing device (e.g., the other parent), and a quantity of times the particular request has been made" in Meola, ¶0018); or
the one or more intended uses of the architecture performance counter (i.e., request can include reasoning for granting the request - "a message to the second user regarding why access should be granted and request reconsideration of the decision" in Meola, ¶0031).
Based on Sahita in view of Meola, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Meola to improve upon those of Sahita in order to improve decision making for a user to grant access based on information about the request and the requestor.
With respect to claim 8, Sahita discloses monitoring VM seeking to read performance counter information of a subject VM (¶0023). Sahita do(es) not explicitly disclose granting by a user access to protected data based on information associated with the request, requestor, and/or intent of the request. Meola, in order to improve decision making for a user to grant access based on information about the request and the requestor (¶0018), discloses: the computing device of claim 7, wherein:
the security circuitry is configured to receive user input from the user interacting with the virtual function (i.e., user responds with decision to grant or deny access in Meola, ¶0030); and
the authorization circuitry is configured to modify the security setting based on the user input (i.e., updating the access rights to the information in response to the decision to grant access by the user in Meola, ¶0036).
Based on Sahita in view of Meola, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Meola to improve upon those of Sahita in order to improve decision making for a user to grant access based on information about the request and the requestor.
With respect to claim 14, the limitation(s) of claim 14 are similar to those of claim(s) 4. Therefore, claim 14 is rejected with the same reasoning as claim(s) 4.
With respect to claim 15, the limitation(s) of claim 15 are similar to those of claim(s) 5. Therefore, claim 15 is rejected with the same reasoning as claim(s) 5.
With respect to claim 16, the limitation(s) of claim 16 are similar to those of claim(s) 6. Therefore, claim 16 is rejected with the same reasoning as claim(s) 6.
With respect to claim 17, the limitation(s) of claim 17 are similar to those of claim(s) 7. Therefore, claim 17 is rejected with the same reasoning as claim(s) 7.
Claim(s) 10 and 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Sahita et al. (US 2011/0061050 A1) in view of Donovan et al. (US 2004/0230972 A1).
With respect to claim 10, Sahita discloses: the computing device of claim 1, further comprising
additional guest circuitry configured to provide an additional virtual function (i.e., monitoring VM is a peer with respect to subject VM and other non-privileged VMs in Sahita, ¶0034),
wherein: the security circuitry is configured to receive a request for the architecture performance counter from the additional guest circuitry (i.e., monitoring VM to intermediate between platform host and its users to read hardware performance counts associated with the subject VM in Sahita, ¶0028); and
the security circuitry is configured to provide the architecture performance counter to the additional guest circuitry based on the additional authorization (i.e., successfully authenticating and determining authorization leads to the monitoring VM access to the subject VM state information in Sahita, ¶0029-0030).
Sahita discloses monitoring VM to intermediate between platform host and its users to read hardware performance counts associated with the subject VM (¶0028). Sahita do(es) not explicitly disclose more than one other guest virtual machine authorized to access guest virtual machine data. Donovan, in order to improve scalability and control of access of shared data among virtual machines (¶0004), discloses: the authorization circuitry is configured to additionally authorize the additional guest circuitry to access the architecture performance counter (i.e., multiple virtual machines may concurrently be granted access via a lock structure to the data of the server virtual machine in Donovan, ¶0004, ¶0020).
Based on Sahita in view of Donovan, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Donovan to improve upon those of Sahita in order to improve scalability and control of access of shared data among virtual machines.
With respect to claim 18, the limitation(s) of claim 18 are similar to those of claim(s) 10. Therefore, claim 18 is rejected with the same reasoning as claim(s) 10.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHERMAN L LIN whose telephone number is (571)270-7446. The examiner can normally be reached Monday through Friday 9:00 AM - 5:00 PM (Eastern).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached at 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Sherman Lin
2/3/2026
/S. L./Examiner, Art Unit 2447
/JOON H HWANG/Supervisory Patent Examiner, Art Unit 2447