DETAILED ACTION
This communication is in response to application number 18/363,633 filed on 12/22/2025. Claims 1-30 are pending examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to arguments
Claim Rejections - 35 U.S.C.§ 112(b)
Applicants’ amendments with respect to claims 5, 15 and 25 have been considered and are persuasive. Hence, the rejection of claims 5, 15 and 25 are withdrawn.
Claim Rejections under 35 U.S.C.§101
Applicants’ arguments with respect to claims 1,11 and 21 have been fully considered but are not persuasive. The steps of receiving indications, determining actions, monitoring signals and performing a process based on the results, can be performed by a generic processor using conventional data gathering and analysis. The hardware components of memory and processor system are more like generic tools to implement the abstract monitoring and decision-making process. Hence, the rejection is maintained.
Claim Rejections under 35 U.S.C.§103
Applicants’ arguments regarding independent claims 1,11 and 21 have been fully considered and are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Conti monitors processor bus signals during operation and does so to determine whether execution is allowable under a given security mode, which involves detecting unauthorized or unexpected hardware activity when the processor is logically restricted and thus teaches monitoring hardware-level instruction, data, status and control signals for indications of activity inconsistent with an intended secure or restricted state.
A new reference, Edwards et al (US 20190258830 A1), has been introduced to teach monitoring of disabled sensors for indications that the sensors are active. Edwards discloses disabling hardware components such as sensors as part of a secure process and continuing to monitor their signal connections for unexpected electrical activity, signal transitions or other perturbations, where any detected activity on a disabled interface is treated as an indication that the hardware component is active, and where such signals arise from hardware behavior rather than software-controlled signaling which is analogous to the claimed monitoring of signal connections for perturbation signals from disabled hardware that indicate active hardware behavior.
the secure shut down the hardware component"
210
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or
composition of matter, or any new and useful improvement thereof, may obtain a patent
therefore, subject to the conditions and requirements of this title.
Claims 1-30 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
Independent claim
Step 1:
Claims 1, 11 and 21 are drawn to a method, therefore falls under one of four categories of statutory subject matter (process/method, machines/products/apparatus, manufactures, and compositions of matter).
Step 2A, Prong 1:
Nonetheless, claims 1,11 and 21 are directed to a judicially recognized exception of an abstract idea without significantly more. Claim 1,11 and 21 recites a method of "receive an indication to perform a secure process", "determine, based on the indication to perform the secure process, to disable the hardware component", "transmit, to the hardware component, an indication to disable", enumerates a mental concept. A human can determine whether an action needs to be taken depending on a secure process being performed. These are steps that are carried out using basic observation and logical reasoning. As such, the steps receiving, transmitting signals based on a determination is nothing more than an abstract mental concept (MPEP 2106.04(a)(2)(III)).
Step 2A, Prong 2:
Claims 1,11 and 21 recites additional step of "monitor the signal connection for perturbation signals, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise hardware signals" and "perform the secure process based on the monitored signal connection" that fails to integrate the abstract idea into a practical application. Monitoring a signal connection for changes and conditionally executing an action based on the result is not an improvement to the system. This additional step, to monitor signals and perform a remedial action based on the signal, is a form of insignificant extra solution activity where determination of a change in signal is necessary for all uses of the judicial exception. The cited elements, hardware component, memory and processor system are more like generic tools and do not add any weight and fails to integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea (MPEP 2106.05(g)) (MPEP 2106.05(g)).
Step 2B:
The additional step that is a form of insignificant extra-solution activity, does not amount to significantly more than an abstract idea because the courts have recognized that this additional step to be well-understood, routine, and conventional when claimed in a merely generic manner for receiving and retrieving data (See MPEP 2106.05(d)(II)(i)). As such claims 1,11 and 21 is not patent eligible.
Dependent claims
Dependent claims 2-10, 12-20, 22-30 are ineligible for the same reasons given with respect to claims 1, 11, 21.
Step 1:
Claims 2, 4-9, 12, 14-19, 22, 23-29 are drawn to a method, therefore falls under one of four categories of statutory subject matter (process/method, machines/products/apparatus, manufactures, and compositions of matter).
Step 2A-2B:
Dependent claims 2, 4-9, 12, 14-19, 22, 23-29 recites additional steps of "detect the perturbation signals", "stop performance of the secure process based on the detected perturbation signal" and others that fails to integrate the abstract idea into a practical application. These steps involve observation, evaluation, judgment and opinion of a process that can be performed in a human mind. Observing signals on a connection and evaluating those signals by comparing them to expected values or prior states to judge whether a condition has occurred and make a decision to continue, resume or stop a secure process based on that judgement are human cognitive functions such as noticing changes, interpreting those changes based on context, making decisions based on that interpretation and taking necessary actions. These additional steps that is a form of insignificant extra-solution activity, does not amount to significantly more than an abstract idea because the courts have recognized that this additional step to be well-understood, routine, and conventional when claimed in a merely generic manner for receiving and retrieving data (See MPEP 2106.05(d)(II)(i)). As such dependent claims 2, 4-9, 12, 14-19, 22, 23-29 are not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-30 are rejected under 35 U.S.C. 103 as being unpatentable over Kelly et al. (US 20140215613 A1), hereinafter referred to as Kelly, in view of Conti et al. (US 20060021035 A1), hereinafter referred to as Conti in further view of Edwards et al. (US 20190258830 A1), hereinafter referred to as Edwards.
As per claim 1, Kelly discloses an apparatus for secure processing, comprising:
a hardware component; (An intrusion detection hardware set, Kelley, para [0006])
a memory system comprising instructions; and (Volatile memory, Kelley, para [0006])
a processor system coupled to the memory system and coupled to the hardware component through a signal connection, wherein the processor system is configured to:
receive an indication to perform a secure process; (The second processor set is structured, connected, located and/or programmed to receive the set of first signal(s), Kelley, para [0006]).
receive, from the hardware component, an indication that the hardware component has been disabled (The intrusion response hardware set is structured, located, connected and/or programmed to receive the set of response signal(s), Kelley, para [0006]).
perform the secure process based on the monitored signal connection. (Responsive to the set of response signal(s), make at least one responsive action to protect the volatile memory hardware set from any unauthorized access related to the determined physical access condition, Kelley, para [0006]).
However, Kelly does not disclose:
determine, based on the indication to perform the secure process, to disable
transmit, to the hardware component, an indication to disable
monitor the signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Conti discloses:
transmit, to the hardware component, an indication to disable (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting ad managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
Kelly in view of Conti does not explicitly disclose:
determine, based on the indication to perform the secure process, to disable
monitor the signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Edwards discloses:
determine, based on the indication to perform the secure process, to disable (Firmware or software running on an embedded system may be configured to only allow execution of a minimal set of operations in this reduced or protected state and the system disables the coupling to the DUT/bus i.e., processing circuitry disables the switch, Edwards, para [0021] and [0039]).
monitor the signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active (This can exaggerate any signal perturbations and can allow metrics to be measured. Statistical perturbations to the waveform may indicate that an intruder is present. Processing circuitry disables the switch and while disables/disconnected, signals are still sampled/monitored i.e., ADC may sample output V1 and V2 while discharge. Normally an intruder actively using a device will source or sink energy results in a square wave decoded as a binary 1 or 0, Edwards, para [0018], [0025], [0031]. The binary 1 or 0 is a mechanism for active behavior on the monitored connection (energy sourcing/sinking on the bus/node), which is what causes detectable wave form changes/perturbations).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018])
As per claim 2, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein the perturbation signals comprise hardware signals, and wherein the processor system is further configured to
Furthermore, Kelly discloses:
detect the perturbation signals based on a change in the hardware signals received via the signal connection (Indications of an attack are changes such as: (i) attack sub-mod 320 receives data from housing-mounted portion of detection hardware set 201a to determine whether housing 200 is being opened in an unauthorized manner; (ii) cooling sub-mod 322 receives data from thermal sensor portion of detection hardware set 201c to determine whether it is being attempted to cool the volatile memory (that is, RAM 205, 207) down to a cryogenic temperature for a cryogenic attack; and (iii) switch interface sub-mod 324 receives data from optical microswitch portion of detection hardware set 201b in order to determine whether RAM board assembly 208 is being moved, or removed, relative to the other hardware in system 102, Kelley, para [0035])
As per claim 3, Kelly, Conti and Edwards disclose the apparatus of claim 2, wherein
Furthermore, Kelly discloses:
the signal connection comprises a physical connection dedicated to carrying the hardware signals (The data from detection hardware set 201a-c is transferred through a connection designed for monitoring hardware conditions, Kelley, para [0035]).
As per claim 4, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein the processor system is further configured to:
detect a perturbation signal on the signal connection; and (Responsive to a determination that a physical access condition exists, actions are taken to halt any ongoing secure operations, Kelly, para [0006]).
Furthermore, Conti discloses:
stop performance of the secure process based on the detected perturbation signal (The core security controller may assert interrupts that cause the processor to halt or abort processes in response to detected security events, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 5, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein
Furthermore, Edwards discloses:
software does not control sending the perturbation signal (In the disconnected state the capacitors will discharge with a natural exponential decay response, Edwards, para [0033]. The discharge response is a natural physical response when disconnected, not something software is sending)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018]).
As per claim 6, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein the processor system is configured to:
Furthermore, Conti discloses:
determine an expected signal for the monitored signal connection; and (By monitoring such signals on the primary bus 180 the core security controller 258 can determine the actual instruction and data presented to the processor 170 for execution, the security mode of the MPU 104, and whether or not the instruction and/or the data is allowable given the current security mode, Conti, para [0027]).
determine a perturbation signal has been received based on a comparison of a signal on the monitored signal connection to the expected signal (An attempt by a program executing on the processor 170 to access a secure address range of memory while the processor 170 is operating in a non-secure mode will be identified by the core security controller 258 as a security violation, Conti, para [0027]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 7, Kelly, Conti and Edwards disclose the apparatus of claim 6, wherein
Furthermore, Kelly discloses:
the expected signal on the monitored signal connection comprises an initial signal on the monitored signal connection (The intrusion detection hardware set is structured, located, connected and/or programmed to send out a set of first signal(s), Kelley, para [0006]. These initial signals are used as baselines to compare against real- time hardware signals)
As per claim 8, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein the processor system is further configured to:
transmit an indication to start to the hardware component; and (Upon detecting that the system has not been destroyed at S650, the system moves to S610 and restarts its initialization process, Kelley, para [0032], Fig 3).
Furthermore, Conti discloses:
complete performance of the secure process; (FIG. 3 illustrates a method for responding to a security violation, Conti, para [0041])
output a result of the secure process (Once the interrupt service routine of block 310 has completed execution, the violation may be marked as cleared (e.g., by asserting a clear violation signal to the core security controller that originally detected the security violation), Conti, para [0042]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 9, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein
Furthermore, Kelly discloses:
the hardware component comprises at least one of a sensor interface, a radio interface, an input/output interface, or a power interface (I/O (input/output) interface module(s) 206, Kelley, para [0020]).
As per claim 10, Kelly, Conti and Edwards disclose the apparatus of claim 1, wherein
Furthermore, Conti discloses:
the signal connection is coupled to an interface of the hardware component (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]. The signal connections between the core security controller and hardware interfaces enable communication for security monitoring and interrupt signaling).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 11, Kelly discloses a method for secure processing, comprising:
receiving an indication to perform a secure process; (The second processor set is structured, connected, located and/or programmed to receive the set of first signal(s), Kelley, para [0006]).
determining, based on the indication to perform the secure process, to disable (The intrusion response hardware set is structured, located, connected and/or programmed to receive the set of response signal(s), Kelley, para [0006]).
performing the secure process based on the monitored signal connection (Responsive to the set of response signal(s), make at least one responsive action to protect the volatile memory hardware set from any unauthorized access related to the determined physical access condition, Kelley, para [0006]).
However, Kelly does not explicitly disclose the limitations:
transmitting, to the hardware component, an indication to disable
receiving, from the hardware component, an indication that the hardware component has been disabled
monitoring a signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Conti discloses:
transmitting, to the hardware component, an indication to disable (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
Kelly in view of Conti does not explicitly disclose the limitations:
receiving, from the hardware component, an indication that the hardware component has been disabled
monitoring a signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Edwards discloses:
receiving, from the hardware component, an indication that the hardware component has been disabled (Firmware or software running on an embedded system may be configured to only allow execution of a minimal set of operations in this reduced or protected state and the system disables the coupling to the DUT/bus i.e., processing circuitry disables the switch, Edwards, para [0021] and [0039]).
monitoring a signal connection for perturbation signals from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active(This can exaggerate any signal perturbations and can allow metrics to be measured. Statistical perturbations to the waveform may indicate that an intruder is present. Processing circuitry disables the switch and while disables/disconnected, signals are still sampled/monitored i.e., ADC may sample output V1 and V2 while discharge. Normally an intruder actively using a device will source or sink energy results in a square wave decoded as a binary 1 or 0, Edwards, para [0018], [0025], [0031]. The binary 1 or 0 is a mechanism for active behavior on the monitored connection (energy sourcing/sinking on the bus/node), which is what causes detectable wave form changes/perturbations).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018]).
As per claim 12, Kelly, Conti and Edwards disclose the method of claim 11, wherein the perturbation signals comprise hardware signals, and further comprising
Furthermore, Kelly discloses:
detecting the perturbation signals based on a change in [[the]] hardware signals received via the signal connection (Indications of an attack are changes such as: (i) attack sub-mod 320 receives data from housing-mounted portion of detection hardware set 201a to determine whether housing 200 is being opened in an unauthorized manner; (ii) cooling sub-mod 322 receives data from thermal sensor portion of detection hardware set 201c to determine whether it is being attempted to cool the volatile memory (that is, RAM 205, 207) down to a cryogenic temperature for a cryogenic attack; and (iii) switch interface sub-mod 324 receives data from optical microswitch portion of detection hardware set 201b in order to determine whether RAM board assembly 208 is being moved, or removed, relative to the other hardware in system 102, Kelley, para [0035]).
As per claim 13, Kelly, Conti and Edwards disclose the method of claim 12, wherein
Furthermore, Kelly discloses:
the signal connection comprises a physical connection dedicated to carrying the hardware signals (The data from detection hardware set 201a-c is transferred through a connection designed for monitoring hardware conditions, Kelley, para [0035]).
As per claim 14, Kelly, Conti and Edwards disclose the method of claim 11, further comprising:
detecting a perturbation signal on the signal connection; and (Responsive to a determination that a physical access condition exists, actions are taken to halt any ongoing secure operations, Kelly, para [0006]).
Furthermore, Conti discloses:
stopping performance of the secure process based on the detected perturbation signal (The core security controller may assert interrupts that cause the processor to halt or abort processes in response to detected security events, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 15, Kelly, Conti and Edwards disclose the method of claim 11, wherein
Furthermore, Edwards discloses:
software does not control sending the perturbation signal the hardware signals comprise signals from the hardware component that are not under software control (In the disconnected state the capacitors will discharge with a natural exponential decay response, Edwards, para [0033]. The discharge response is a natural physical response when disconnected, not something software is sending)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018])
As per claim 16, Kelly, Conti and Edwards disclose the method of claim 11, further comprising:
Furthermore, Conti discloses:
determining an expected signal for the monitored signal connection; and (By monitoring such signals on the primary bus 180 the core security controller 258 can determine the actual instruction and data presented to the processor 170 for execution, the security mode of the MPU 104, and whether or not the instruction and/or the data is allowable given the current security mode, Conti, para [0027]).
determining a perturbation signal has been received based on a comparison of a signal on the monitored signal connection to the expected signal (An attempt by a program executing on the processor 170 to access a secure address range of memory while the processor 170 is operating in a non-secure mode will be identified by the core security controller 258 as a security violation, Conti, para [0027]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 17, Kelly, Conti and Edwards disclose the method of claim 16, wherein
Furthermore, Kelly discloses:
the expected signal on the monitored signal connection comprises an initial signal on the monitored signal connection (The intrusion detection hardware set is structured, located, connected and/or programmed to send out a set of first signal(s), Kelley, para [0006]. These initial signals are used as baselines to compare against real- time hardware signals).
As per claim 18, Kelly, Conti and Edwards disclose the method of claim 11, further comprising:
completing performance of the secure process; (Upon detecting that the system has not been destroyed at S650, the system moves to S610 and restarts its initialization process, Kelley, para [0032], Fig 3).
Furthermore, Conti discloses:
transmitting an indication to start to the hardware component; and (FIG. 3 illustrates a method for responding to a security violation, Conti, para [0041]).
outputting a result of the secure process (Once the interrupt service routine of block 310 has completed execution, the violation may be marked as cleared (e.g., by asserting a clear violation signal to the core security controller that originally detected the security violation), Conti, para [0042]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 19, Kelly, Conti and Edwards disclose the method of claim 11, wherein
Furthermore, Kelly discloses:
the hardware component comprises at least one of a sensor interface, a radio interface, an input/output interface, or a power interface (I/O (input/output) interface module(s) 206, Kelley, para [0020]).
As per claim 20, Kelly, Conti and Edwards disclose the method of claim 11, wherein
Furthermore, Conti discloses:
the signal connection is coupled to an interface of the hardware component (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]. The signal connections between the core security controller and hardware interfaces enable communication for security monitoring and interrupt signaling).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 21, Kelly discloses a non-transitory computer-readable medium having stored thereon instructions that, when executed by a processor system, cause the processor system to:
receive an indication to perform a secure process; (The second processor set is structured, connected, located and/or programmed to receive the set of first signal(s), Kelley, para [0006]).
receive, from the hardware component, an indication that the hardware component has been disabled (The intrusion response hardware set is structured, located, connected and/or programmed to receive the set of response signal(s), Kelley, para [0006]).
perform the secure process based on the monitored signal connection (Responsive to the set of response signal(s), make at least one responsive action to protect the volatile memory hardware set from any unauthorized access related to the determined physical access condition, Kelley, para [0006]).
However, Kelly does not explicitly disclose:
determine, based on the indication to perform the secure process, to disable
transmit, to the hardware component, an indication to disable
monitor a from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Conti discloses:
transmit, to the hardware component, an indication to disable (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
Kelly in view of Conti does not explicitly disclose:
determine, based on the indication to perform the secure process, to disable
monitor a from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active
Edwards discloses:
determine, based on the indication to perform the secure process, to disable (Firmware or software running on an embedded system may be configured to only allow execution of a minimal set of operations in this reduced or protected state and the system disables the coupling to the DUT/bus i.e., processing circuitry disables the switch, Edwards, para [0021] and [0039]).
monitor a from the hardware component that has been disabled, wherein the signal connection carries the perturbation signals, and wherein the perturbation signals comprise an indication that the hardware component is active(This can exaggerate any signal perturbations and can allow metrics to be measured. Statistical perturbations to the waveform may indicate that an intruder is present. Processing circuitry disables the switch and while disables/disconnected, signals are still sampled/monitored i.e., ADC may sample output V1 and V2 while discharge. Normally an intruder actively using a device will source or sink energy results in a square wave decoded as a binary 1 or 0, Edwards, para [0018], [0025], [0031]. The binary 1 or 0 is a mechanism for active behavior on the monitored connection (energy sourcing/sinking on the bus/node), which is what causes detectable wave form changes/perturbations).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018])
As per claim 22, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein the perturbation signals comprise hardware signals, and wherein the instructions further cause the processor system to
Furthermore, Kelly discloses:
detect the perturbation signals based on a change in the hardware signals received via the signal connection (Indications of an attack are changes such as: (i) attack sub-mod 320 receives data from housing-mounted portion of detection hardware set 201a to determine whether housing 200 is being opened in an unauthorized manner; (ii) cooling sub-mod 322 receives data from thermal sensor portion of detection hardware set 201c to determine whether it is being attempted to cool the volatile memory (that is, RAM 205, 207) down to a cryogenic temperature for a cryogenic attack; and (iii) switch interface sub-mod 324 receives data from optical microswitch portion of detection hardware set 201b in order to determine whether RAM board assembly 208 is being moved, or removed, relative to the other hardware in system 102, Kelley, para [0035])
As per claim 23, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 22, wherein
Furthermore, Kelly discloses:
the signal connection comprises a physical connection dedicated to carrying the hardware signals (The data from detection hardware set 201a-c is transferred through a connection designed for monitoring hardware conditions, Kelley, para [0035]).
As per claim 24, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein the instructions further cause the processor system:
detect a perturbation signal on the signal connection; and (Responsive to a determination that a physical access condition exists, actions are taken to halt any ongoing secure operations, Kelly, para [0006]).
Furthermore, Conti discloses:
stop performance of the secure process based on the detected perturbation signal (The core security controller may assert interrupts that cause the processor to halt or abort processes in response to detected security events, Conti, para [0033]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 25, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein
Furthermore, Edwards discloses:
software does not control sending the perturbation signal (In the disconnected state the capacitors will discharge with a natural exponential decay response, Edwards, para [0033]. The discharge response is a natural physical response when disconnected, not something software is sending).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly and Conti with Edwards by detecting and managing intrusion (Kelly) and identification and prevention of security violations within a computing system (Conti) with hardware intrusion detection system (Edwards). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly and Conti with Edwards in order to monitor the disabled state by using the monitored waveform to detect active behavior (See Edwards, para [0018])
As per claim 26, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein the instructions further cause the processor system:
Furthermore, Conti discloses:
determine an expected signal for the monitored signal connection; and (By monitoring such signals on the primary bus 180 the core security controller 258 can determine the actual instruction and data presented to the processor 170 for execution, the security mode of the MPU 104, and whether or not the instruction and/or the data is allowable given the current security mode, Conti, para [0027]).
determine a perturbation signal has been received based on a comparison of a signal on the monitored signal connection to the expected signal (An attempt by a program executing on the processor 170 to access a secure address range of memory while the processor 170 is operating in a non-secure mode will be identified by the core security controller 258 as a security violation, Conti, para [0027]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 27, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 26, wherein
Furthermore, Kelly discloses:
the expected signal on the monitored signal connection comprises an initial signal on the monitored signal connection (The intrusion detection hardware set is structured, located, connected and/or programmed to send out a set of first signal(s), Kelley, para [0006]. These initial signals are used as baselines to compare against real- time hardware signals).
As per claim 28, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein the instructions further cause the processor system:
complete performance of the secure process; (Upon detecting that the system has not been destroyed at S650, the system moves to S610 and restarts its initialization process, Kelley, para [0032], Fig 3).
Furthermore, Conti discloses:
transmit an indication to start to the hardware component; and (FIG. 3 illustrates a method for responding to a security violation, Conti, para [0041])
output a result of the secure process (Once the interrupt service routine of block 310 has completed execution, the violation may be marked as cleared (e.g., by asserting a clear violation signal to the core security controller that originally detected the security violation), Conti, para [0042]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting and managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
As per claim 29, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein
Furthermore, Kelly discloses:
the hardware component comprises at least one of a sensor interface, a radio interface, an input/output interface, or a power interface (I/O (input/output) interface module(s) 206, Kelley, para [0020]).
As per claim 30, Kelly, Conti and Edwards disclose the non-transitory computer-readable medium of claim 21, wherein
Furthermore, Conti discloses:
the signal connection is coupled to an interface of the hardware component (The core security controller may assert the security abort interrupt signal 284, which is monitored by the interrupt controller 174. In response to the assertion of the security abort interrupt the interrupt controller may assert the interrupt request (IRQ) signal 281, which in turn may initiate an interrupt request to the processor 170, Conti, para [0033]. The signal connections between the core security controller and hardware interfaces enable communication for security monitoring and interrupt signaling).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Kelly with Conti by detecting ad managing intrusion (Kelly) with identification and prevention of security violations within a computing system (Conti). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Kelly with Conti in order to identify an activity on the core bus as a security violation and prevent execution of an instruction (See Conti, para [0027]).
Conclusion
Applicants’ amendments necessitated new grounds of rejection.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RAGHAVENDER CHOLLETI whose telephone number is (703) 756-1065. The examiner can normally be reached M-F 9am-5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, RUPAL DHARIA can be reached on (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Respectfully submitted,
/RAGHAVENDER NMN CHOLLETI/Examiner, Art Unit 2492
/RUPAL DHARIA/Supervisory Patent Examiner, Art Unit 2492
Prosecution Insights