Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 06/17/2026 has been entered.
Response to Amendments / Arguments
Regarding the rejection(s) of claims under 35 USC 103:
Applicant’s arguments, filed 06/17/2026, have been fully considered and are persuasive. Therefore, the rejection is withdrawn. However the rejection further upheld in view of Conti et al. (US 20070226795 A1, referred to as Conti) in further view of Dardis et al. (US 20190227876 A1, referred to as Dardis)
DETAILED ACTION
This is a reply to the arguments filed on 06/17/2026, in which, claims 1-12 are pending. Claims 1, and 6 are independent. Claim 11 and 12 are newly added.
When making claim amendments, the applicant is encouraged to consider the references in their entireties, including those portions that have not been cited by the examiner and their equivalents as they may most broadly and appropriately apply to any particular anticipated claim amendments.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-12 are rejected under 35 U.S.C. 103 as being unpatentable Conti et al. (US 20070226795 A1, referred to as Conti) in further view of Dardis et al. (US 20190227876 A1, referred to as Dardis)
In reference to claim 1, An electronic device comprising: a storage device configured to store a plurality of firmware (Conti: [0024], [0074] and [0599] Provides for a storage device holding multiple distinct firmwares.)
a central processing unit (CPU) coupled to the storage device and configured to output a security access signal (Conti: [0023]. [0123] and [0164] Provides a CPU (MPU 2610) coupled to storage that outputs a secure-mode signal (NS bit / HPROT / MreqSecure) accompanying each bus access.)
a first circuit block coupled to the CPU (Conti: [0115], [0165], and [0267] Provides for multiple target circuit blocks (memories and peripherals) coupled to the CPU through interconnects, including public or shared hardware.)
a second circuit block coupled to the CPU (Conti:[0116] and [0267] Provides for a second, secure-only set of circuit blocks (secure hardware such as encryption accelerators and RNG, secure RAM/ROM) coupled to the CPU.)
wherein when the security access signal is in a first state, the first circuit block is allowed to be accessed by the CPU and the second circuit block is forbidden to be accessed by the CPU (Conti: [0091]-[0115] and [0325] Provides for public (non-secure) state access being allowed to public blocks and forbidden to secure blocks.)
when the security access signal is in a second state both the first circuit block and the second circuit block are allowed to be accessed by the CPU (Conti: [0214] and [0325] Provides for a hierarchy in which a secure-state access can reach both public targets (N2/N3) and secure targets (N0/N1).)
a security protection circuit coupled between the CPU and the second circuit block (Conti: [0165], [0337], Fig. 8 and Fig. 18 Provides for hardware firewalls and the SSM physically interposed between the CPU and the protected target blocks.)
Conti doesn’t explicitly teach when the electronic device receives a firmware update message through over the air (OTA) and updates the plurality of firmware, a first firmware of the storage device is refreshed, and a second firmware is preserved, after the firmware of the electronic device is updated, the updated first firmware is operated, when the updated first firmware is unable to be operated, the first firmware is switched to the second firmware, and the security protection circuit is activated to enter a security mode, and when the security protection circuit is activated, the security access signal received by the second circuit block is set to the first state. However, Dardis teaches:
when the electronic device receives a firmware update message through over the air (OTA) and updates the plurality of firmware, a first firmware of the storage device is refreshed, and a second firmware is preserved (Dardis: [0016]-[0021], [0057]-[0069] and Fig. 5 Provides for network delivered firmware update message (a push notification) and storing the new firmware while preserving the prior version for rollback.)
after the firmware of the electronic device is updated, the updated first firmware is operated (Dardis: [0047]-[0049] and Fig. 3 Provides for executing the newly applied firmware after the update and checking that it runs, tests components, and boots the OS.)
when the updated first firmware is unable to be operated, the first firmware is switched to the second firmware, and the security protection circuit is activated to enter a security mode (Dardis: [0047]-[0051] and FIg. 4 Provides for detecting that the updated firmware fails to execute, rolling back to the preserved firmware, and having the PFC assume control and apply a restrictive de-feature mask.)
when the security protection circuit is activated, the security access signal received by the second circuit block is set to the first state (Dardis: [0027], [0050]-[0051] and Fig. 4 Provides for the PFC, once it takes over, setting the mask so that the affected features are disabled, which is the first state for the second block.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Conti, which provides an electronic device with a CPU outputting security access signals that control access to first and second circuit blocks through a security protection circuit with distinct secure and non-secure states, with the teachings of Dardis, which introduces over-the-air firmware update management including selective firmware refreshing while preserving backup versions, operating updated firmware after installation, rolling back to preserved firmware when updates fail, and activating security protection to restrict circuit block access upon firmware failure detection. One of ordinary skill in the art would recognize the ability to incorporate Dardis's OTA firmware lifecycle management and failure-triggered security mode activation into Conti's hardware security architecture to create a comprehensive firmware update and protection system. One of ordinary skill in the art would be motivated to make this modification in order to enable remote firmware management capabilities that allow devices to receive and apply updates without physical access while maintaining the ability to recover from failed updates through preserved backup firmware and provide automatic security escalation when firmware failures are detected.)
In reference to claim 2, The electronic device according to claim 1, wherein the security protection circuit comprises: an error detection circuit configured to detect an operation error to determine whether to enter the security mode (Dardis: Conti: [0179]-[0188], [0412]-[0424], Fig. 9B and Fig. 27 Provides for detection circuits inside the security hardware that detect operational errors or unsafe conditions and decide whether to enter a protective response.)
a first logic gate including a first end, a second end and an output end, wherein the first end of the first logic gate receives the security access signal outputted by the CPU, the second end of the first logic gate is coupled to the error detection circuit, and the output end of the first logic gate is coupled to the second circuit block (Conti: [0123], [0167], [0356], [0431] and Fig. 23 Provides for a circuit in MPU2BUS 2665 with three connections. It takes the CPU's security signal (HPROT/NS) as one input and the Public_Stuck signal from the detection handler 2775 as a second input, and it outputs MreqSecure to the interconnect, firewalls, and protected targets.)
wherein when the error detection circuit enters the security mode, the second end of the first logic gate receives a preservation signal outputted by the error detection circuit, and the output end of the first logic gate outputs the security access signal of the first state (Conti: [0412]-[0431] Provides for the detection circuit outputting a dedicated signal (Public_Stuck, and relatedly NS_LOCK) to the gating circuit.)
In reference to claim 3, The electronic device according to claim 2, wherein the first logic gate is an OR gate, and the preservation signal outputted by the error detection circuit is a logic-high voltage (Conti: [0123], [0205], and [0431] Provides for a forcing circuit whose output must be non-secure whenever Public_Stuck is active, regardless of the CPU's NS/HPROT input. Conti: [0147] and [0412] Provides for the error-detection handler 2775 asserting Public_Stuck as active-high ('1') when an invasive test mode is detected.)
In reference to claim 4, The electronic device according to claim 2, wherein the first logic gate is a multiplexer, and the second end and a selection control end of the multiplexer receive the preservation signal outputted by the error detection circuit, and when the preservation signal outputted by the error detection circuit is a logic-high voltage, the output end of the multiplexer outputs a logic-high voltage (Conti: [0336]-[0359] and Fig. 23 Provides for multiplexers (2:1 mux 3932, muxes 3934, 3936, 3946, and demux 3956) with select-line control, used inside the security protection circuitry to route security qualifiers and permissions. Conti: [0360] and [0412]-[0431] Provides for a preservation signal (Public_Stuck) from the detection handler 2775 that controls, or overrides, which security value is output regardless of the CPU input. Conti: [0123]-[0147] Provides for an active-high Public_Stuck forcing the output to the non-secure state, which corresponds to NS/HPROT high.)
In reference to claim 5, The electronic device according to claim 1, wherein the second circuit block is an attack detection circuit, and when the security mode is entered, the CPU is unable to turn off the attack detection circuit (Conti: [0091], [0181]-[0187], [0361], [0412]-[0427], Fig. 9 and Fig. 24 Provides for dedicated attack detection circuitry: the SSM 2460, the Secure Privilege stack firewall 4010, the Security Violation Handler 2760, and the Secure Watchdog and provides for lock fields and Secure-Privilege-only write restrictions on the attack detection enables.)
In reference to claim 6, A firmware switching method for maintaining system security for protecting an electronic device (Conti: [0027], [0099] and [0439] Provides for methods of operating an electronic device to maintain system security.)
Arranging a security protection circuit between a central processing unit and a security circuit block, wherein when a security access signal outputted by the CPU is detected to be in a first state, the security circuit block is forbidden to be accessed, and when the security access signal outputted by the CPU is detected to be in a second state, the security block is allowed to be accessed (Conti: [0115]-[0116], [0165], [0214], [0337], [0599] and FIg. 18 Provides for arranging firewalls and the SSM between the CPU and secure target blocks. The firewalls detect the CPU's security qualifier (NS/MreqSecure), deny access to secure blocks in the public state, and allow it in the secure state.)
Conti doesn’t explicitly teach Updating the electronic device with a first firmware, and preserving a second firmware after receiving a firmware update message through Over the Air (OTA) and the firmware of the electronic device is updated, operating with the updated first firmware, when the first firmware is unable to be operated, switching from the first firmware to the second firmware, and enabling the security protection circuit to enter a security mode; and when the security protection circuit is activated, setting, by the security protection circuit, the security access signal received by the security circuit block to the first state. However, Dardis teaches:
Updating the electronic device with a first firmware, and preserving a second firmware (Dardis: [0047]-[0049] and Fig. 3 Provides for executing the newly applied firmware after the update and checking that it runs, tests components, and boots the OS.)
After receiving a firmware update message through Over the Air (OTA) and the firmware of the electronic device is updated, operating with the updated first firmware (Dardis: [0016]-[0021], [0057]-[0069] and Fig. 5 Provides for network delivered firmware update message (a push notification) and storing the new firmware while preserving the prior version for rollback.)
When the first firmware is unable to be operated, switching from the first firmware to the second firmware, and enabling the security protection circuit to enter a security mode (Dardis: [0047]-[0051] and FIg. 4 Provides for detecting that the updated firmware fails to execute, rolling back to the preserved firmware, and having the PFC assume control and apply a restrictive de-feature mask.)
When the security protection circuit is activated, setting, by the security protection circuit, the security access signal received by the security circuit block to the first state (Dardis: [0027], [0050]-[0051] and Fig. 4 Provides for the PFC, once it takes over, setting the mask so that the affected features are disabled, which is the first state for the second block.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Conti, which provides an electronic device with a CPU outputting security access signals that control access to first and second circuit blocks through a security protection circuit with distinct secure and non-secure states, with the teachings of Dardis, which introduces over-the-air firmware update management including selective firmware refreshing while preserving backup versions, operating updated firmware after installation, rolling back to preserved firmware when updates fail, and activating security protection to restrict circuit block access upon firmware failure detection. One of ordinary skill in the art would recognize the ability to incorporate Dardis's OTA firmware lifecycle management and failure-triggered security mode activation into Conti's hardware security architecture to create a comprehensive firmware update and protection system. One of ordinary skill in the art would be motivated to make this modification in order to enable remote firmware management capabilities that allow devices to receive and apply updates without physical access while maintaining the ability to recover from failed updates through preserved backup firmware and provide automatic security escalation when firmware failures are detected.)
In reference to claim 7, The firmware switching method for maintaining system security according to claim 6, wherein the security protection circuit comprises: an error detection circuit for detecting an operation error, to determine whether to enter the security mode (Dardis: Conti: [0179]-[0188], [0412]-[0424], Fig. 9B and Fig. 27 Provides for detection circuits inside the security hardware that detect operational errors or unsafe conditions and decide whether to enter a protective response.)
a first logic gate including a first end, a second end and an output end, wherein the first end of the first logic gate receives the security access signal outputted by the CPU, the second end of the first logic gate is coupled to the error detection circuit, and the output end of the first logic gate is coupled to the second circuit block (Conti: [0123], [0167], [0356], [0431] and Fig. 23 Provides for a circuit in MPU2BUS 2665 with three connections. It takes the CPU's security signal (HPROT/NS) as one input and the Public_Stuck signal from the detection handler 2775 as a second input, and it outputs MreqSecure to the interconnect, firewalls, and protected targets.)
wherein when the error detection circuit enters the security mode, the second end of the first logic gate receives a preservation signal outputted by the error detection circuit, and the output end of the first logic gate outputs the security access signal of the first state (Conti: [0412]-[0431] Provides for the detection circuit outputting a dedicated signal (Public_Stuck, and relatedly NS_LOCK) to the gating circuit.)
In reference to claim 8, The firmware switching method for maintaining system security according to claim 7, wherein the first logic gate is an OR gate, and the preservation signal outputted by the error detection circuit is a logic-high voltage (Conti: [0123], [0205], and [0431] Provides for a forcing circuit whose output must be non-secure whenever Public_Stuck is active, regardless of the CPU's NS/HPROT input. Conti: [0147] and [0412] Provides for the error-detection handler 2775 asserting Public_Stuck as active-high ('1') when an invasive test mode is detected.)
In reference to claim 9, The firmware switching method for maintaining system security according to claim 7, wherein the first logic gate is a multiplexer; and the second end and the selection control end of the multiplexer receive the preservation signal outputted by the error detection circuit, and when the preservation signal outputted by the error detection circuit is a logic-high voltage, the output end of the multiplexer outputs a logic-high voltage (Conti: [0336]-[0359] and Fig. 23 Provides for multiplexers (2:1 mux 3932, muxes 3934, 3936, 3946, and demux 3956) with select-line control, used inside the security protection circuitry to route security qualifiers and permissions. Conti: [0360] and [0412]-[0431] Provides for a preservation signal (Public_Stuck) from the detection handler 2775 that controls, or overrides, which security value is output regardless of the CPU input. Conti: [0123]-[0147] Provides for an active-high Public_Stuck forcing the output to the non-secure state, which corresponds to NS/HPROT high.)
In reference to claim 10, The firmware switching method for maintaining system security according to claim 6, wherein the security circuit block is an attack detection circuit, and when the security mode is entered, the CPU cannot turn off the attack detection circuit (Conti: [0091], [0181]-[0187], [0361], [0412]-[0427], Fig. 9 and Fig. 24 Provides for dedicated attack detection circuitry: the SSM 2460, the Secure Privilege stack firewall 4010, the Security Violation Handler 2760, and the Secure Watchdog and provides for lock fields and Secure-Privilege-only write restrictions on the attack detection enables.)
In reference to claim 11, The electronic device according to claim 2, wherein the preservation signal outputted by the error detection circuit is a logic-high voltage in the first state and a logic-low voltage in the second state (Conti: [0123]-[0147] and [0412]-[0431] Provides for the detection handler 2775 driving Public_Stuck (and similarly NS_LOCK) to logic '1' when it detects an unsafe condition and provides for Public_Stuck and NS_LOCK going to logic '0' when no unsafe condition is detected.)
In reference to claim 12, The electronic device according to claim 7, wherein the preservation signal outputted by the error detection circuit is a logic-high voltage in the first state and a logic-low voltage in the second state (Conti: [0123]-[0147] and [0412]-[0431] Provides for the detection handler 2775 driving Public_Stuck (and similarly NS_LOCK) to logic '1' when it detects an unsafe condition and provides for Public_Stuck and NS_LOCK going to logic '0' when no unsafe condition is detected.)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AIDAN EDWARD SHAUGHNESSY whose telephone number is (703)756-1423. The examiner can normally be reached on Monday-Friday from 7:30am to 5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson, can be reached at telephone number (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/usptoautomated-interview-request-air-form.
/A.E.S./Examiner, Art Unit 2432
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
