Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Status of Claims
Claims 1-20 are subject to examination.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 3, 4, 6, 7, 11, 13, 15, 16, 18, 20, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper et al., 20200104507, IBM in view of Sutherland et al., WO-2020150351-A1 and HENDERSON et al., DE 69920582 T2 2005-09-08.
Referring to claim 1, 11, 16, Kasper-IBM discloses A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by computer processor to perform an operation comprising: A system, comprising: computer processor; and a memory containing a program which when executed by the computer processor performs an operation, the operation comprising: a method comprising: analyzing instructions of a software program to determine where input registers are referenced; determining usage of values stored in the input registers when the software program is executed,
[0023] determining which parameters of an authorized service contain addresses or other data types. Determining how an authorized service interprets parameters can enable testing programs to provide valid or invalid addresses as input in the parameters. Depth testing can be used to discover whether the authorized service uses second, third, or more level parameter lists at addresses, for instance, as pointed to by a parameter list. In order to supply complex and meaningful parameter lists with multiple levels of data and valid pointers, the form and function of the parameter list is determined, or mapped, by a cyber security test tool in embodiments.
[0024] The above-described aspects of the invention address the shortcomings of the prior art by systematically attempting to trigger exceptions when calling an authorized service. By matching an exception address to an input that was supplied, a cyber security test tool can determine, parameter-by-parameter, which parameters contain pointers to other parameter areas and which do not. Further, the cyber security test tool can determine which parameters likely do not contain pointers. The cyber security test tool may also determine which parameters likely contain numeric function codes, bit flags, or expected constants, instead of addresses. By saving this information, a map of a parameter list can be built and used in subsequent targeted testing as a testing profile. In other words, the information supplied during a failure can allow a testing program to map the parameter list and provide increasingly complex valid parameter lists to be used in increasingly complex tests.
wherein the usage comprises (i) comparing against the values stored in the input registers for test or conditional branch logic, (ii) copying the values stored in the input registers, or (iii) referencing storage at a location defined by the values stored in the input registers;
[0040] If the cyber security test tool 205 discovers that the target register 310A (or one of the other target registers 310B-310N) holds a parameter address because a protection exception occurred for the address supplied in target register 310A, then the cyber security test tool 205 can seek to determine parameter characteristics. For example, in 64-bit addressing mode, the cyber security test tool 205 can obtain 200 bytes of storage, enough for 25 parameters of 8 s each. Leaving the values of the other target registers 310B-310N constant at first, or possibly varying them later, the cyber security test tool 205 can set all 25 parameters (e.g., of parameter list 312) to either contain constant values or pointers to valid storage, such as parameter areas 308A, 308B, 308C, . . . , 308N. One-by-one, the cyber security test tool 205 can set one 8-byte parameter at a time to point to a second protected storage location 316 that will cause a protection exception. When a protection exception occurs at an address after calling the authorized service 306 with the parameter list 312, the cyber security test tool 205 can confirm identification of a parameter address in the parameter list 312 pointed to by the target register 310A. Going through all of the parameter list 312, one parameter at a time, the cyber security test tool 205 can build a list or map of which parameters contain addresses. In 32, 31, or 24-bit addressing mode, 4-byte parameters could be used instead, for example.
[0041] Once a list of parameters is found that contains addresses or additional parameters, the cyber security test tool 205 can map constraints of the parameter list 312 and target registers 310 to construct a testing profile 304 of discovered relationships and extend testing of the authorized service 306 to additional level of parameters. If a first parameter 312A pointed to by target register 310A contains a pointer to a parameter area 308A, because a protection exception occurred for an address supplied as the second protected storage location 316, the cyber security test tool 205 can then try to determine characteristics of the parameter area 308A, such as whether it contains a next level parameter list. For example, the cyber security test tool 205 can obtain another 200 bytes of storage, enough for 25 parameters of 8 bytes each as the parameter area 308A. Leaving the values of the target registers 310 and the first level of parameter list 312 constant at first, possibly varying the contents later, the cyber security test tool 205 can set all 25 parameters in a second level parameter list of the parameter area 308A to contain constant values or point to valid storage, such as parameter area 308B. One-by-one, the cyber security test tool 205 can set one 8-byte parameter at a time in the parameter area 308A (e.g., the second level parameter list) to point to a protected storage location 318 that will cause a protect exception. When a protection exception occurs at an address of the protected storage location 318 after calling the authorized service 306, the cyber security test tool 205 can confirm identification of a parameter address in the parameter area 308A pointed to by the first level of parameter list 312 which is pointed to by the first target register 310A. Going through the full list with 25 parameters in the parameter area 308A, one at a time, the cyber security test tool 205 can build a list or map of which parameters contain addresses in the testing profile 304. This process can be repeated for as many levels of parameter areas as desired, such as parameter areas 308C-308N with respect to other protected storage locations 320.
generating array describing values of possible values for parameters based on the usage to provide an input set for security vulnerability testing of the software program.
[0024] The above-described aspects of the invention address the shortcomings of the prior art by systematically attempting to trigger exceptions when calling an authorized service. By matching an exception address to an input that was supplied, a cyber security test tool can determine, parameter-by-parameter, which parameters contain pointers to other parameter areas and which do not. Further, the cyber security test tool can determine which parameters likely do not contain pointers. The cyber security test tool may also determine which parameters likely contain numeric function codes, bit flags, or expected constants, instead of addresses. By saving this information, a map of a parameter list can be built and used in subsequent targeted testing as a testing profile. In other words, the information supplied during a failure can allow a testing program to map the parameter list and provide increasingly complex valid parameter lists to be used in increasingly complex tests.
[0037] For example, some programs 204 may normally be limited to accessing the address space 212A, while the other programs 204 may normally be limited to accessing the address space 212B. Where address space switching is supported, one of the programs 204 of address space 212A may call one of the programs 204 of address space 212B, where access constraints are expected to limit permissions of the program 204 of address space 212A in address space 212B. A cyber security test tool 205 can be executed that tests for security vulnerabilities related to access constraints and other security concerns. Further details regarding the cyber security testing of the cyber security test tool 205 are described with respect to FIGS. 3 and 4
Kasper-IBM do not disclose, which Sutherland discloses disassembling object code ( disassembling object code annotated with metadata labels., 2nd last para, page 10) to identify instructions of a software program (the one or more registers and/or one or more application memory locations used by the instruction comprise one or more input registers and/or one or more input application memory locations, para 7, page 38); analyzing, by a code analyzer, the instructions of the software program to determine where input registers are referenced in the software program (the one or more input registers and/or one or more input application memory locations comprise a first input register or application memory location and a second input register or application memory location; the one or more classification bits comprise one or more first classification bits for the first input register or application memory location; the one or more classification bits further comprise one or more second classification bits for the second input register or application memory location, para 9, para 38, a binary analysis component programmed to take, as input, object code, and perform one or more analyses similar to those performed by e.g., control flow analysis, type analysis, etc.).para 8, page 38 ).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembling the object code of an application. The disassembling would enable analyzing the identified instructions. This would enable knowing of the locations that is referenced by the input register, which would enable classification of the information, para 9, para 38.
Kasper-IBM and Sutherland do not disclose all three usage, which HENDERSON discloses,
(i) comparing against the values stored in the input registers for test or conditional branch logic, (ii) copying the values stored in the input registers, and (iii) referencing storage at a location defined by the values pointers stored in the input registers (
From the ALU 31 Supported operations include addition, subtraction, and load (add to zero) arithmetic operations, logical operations such as AND, OR, exclusive OR, NOT, left shift, right shift, and comparison operations that provide a constant or memory value comparison Values that are in the accumulator register row 36 are not destroyed. 4th para, page 9
a flag data mode, a command only processes the seventeenth bit of the retrieved word. The seventeenth bit is written to the data store on all read accesses 12 always read and then into the MTAG bit of the status register 18 from 3 therefore, provides the tag for either word or byte data. In byte mode, two consecutive bytes are assigned the same tag. Flagged data is used by the FIR, FIRK, COR and CORK commands to emulate a circular buffer. In addition, the MTAG bit of the state register may be tested as a condition for branch / call flags, or it may be combined with other test conditions and other flags to create new conditions. Last para, page 9
(2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP, 4th para, page 12,
To process a multi-word data string, an address is copied from an ACP register to fetch the least significant word in the string. This copied address is then repeatedly incremented to retrieve the remaining words in the string. This will make the in this particular ACP register 49 stored address is left unchanged, the value in this ACP register still pointing to the location of the least significant word of the word string. Consequently, this ACP register is ready for a subsequent operation on this word string.
The processor 10 can store a value in an ACP register 49 pre-change the value +1 or the value -1 before the ACP register in the case of an instruction with respect to an accumulator by the accumulator register row 36 is used, 2nd para, page 10,
Fig 6 shows a data storage addressing unit (DMAU) 14 that takes effect to an address 51 to the data store 12 to deliver. The data storage addressing unit 14 contains an associated ALU 52 performing addition, subtraction and comparison functions, three special address registers 53 (R5 INDEX), 54 (R6 PAGE) and 55 (R7 PGSTK) and five universal registers 56 - 60 (R0 to R4).
The data storage addressing unit 14 can the data store 12 address by means of five addressing modes, ie by means of a direct addressing mode, an indirect addressing mode, a subsequent modification being possible, and three relative addressing modes, 3rd para, page 10
The aspects of construction and arrangement in 5 consider and support chain operations of the type indicated above, consider that (1) the accumulator having the registers AC (0-15) of the accumulator register row 36 is a dual-port read / write construction with a delayed pointer reference to the instruction cycle delay through the ALU 80 Take into account (2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP (3) to successively read the words of a string is a temporary operation that leaves the ACP registers unchanged for future reference to the least significant word of the string in future chain operations, 4th para, page 12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known values stored in the input register. The values would enable implementing operations, comparing, copying and referencing. Such operations would enable testing a software using
conditional / branch instructions, 3rd para, page 10
Referring to claim 3, Kasper-IBM discloses identifying the software program from a set of software programs of interest (para 37)
Referring to claim 4, 13, 18, Kasper-IBM discloses checking a parameter list based on register values (para 6)
Referring to claim 6, 15, 20, Kasper-IBM discloses determining the possible value for the parameters of any reassignments, or local variables where the values stored in the input registers are saved when the software program is executed, para 39
Referring to claim 7, Kasper-IBM discloses determining the possible value for the parameters retrieved from referencing storage at the location defined by the values stored in the input registers when the software program is executed (para 39, 41)
Claim(s) 2, 12, 17, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper-IBM in view of Sutherland, HENDERSON and JAEGER et al., AU 2016396782 B2.
Referring to claim(s) 2, 12, 17, Kasper-IBM, HENDERSON and Sutherland do not disclose, which JAEGER discloses before analyzing the instructions: receiving, by a disassembler (decompilation has found applications in algorithm extraction and analysis, in malware detection, and, to a limited degree, for source code recovery for purposes of modifying or translating object code from one environment to another. A disassembler receives as input an executable program and converts that program into a machine independent assembly code representation. Assembly language typically has a one-to-one correspondence between assembly instructions and underlying machine instructions. A disassembled program can be reassembled by an assembler into an executable program, 2nd para page 2), the object code of the software program (These object code files, in some cases together with additional object files, can be linked and assembled into an executable program, 2nd para, page 2).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembling the object code of an application. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the code is malicious or not using the malware detection, 2nd para, page 2.
Claim(s) 5, 14, 19, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper-IBM in view of Sutherland, HENDERSON and GUO et al., CN 104156311 A.
Referring to claim(s) 5, 14, 19, Kasper-IBM in view of Sutherland and HENDERSON do not disclose, which Guo discloses determining the possible value for the parameters compared against the values stored in the input registers for the test or conditional branch logic when the software program is executed (para 74-76). Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembling the object code of an application. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the test is passed or fail regarding a branch statement, para 75, 87.
Claim(s) 8, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper-IBM in view of Sutherland, HENDERSON and JP 2009129204 A.
Referring to claim(s) 8, Kasper-IBM discloses generating based on the array of the possible value for the parameters, the input set for security vulnerability testing of the software program (para 46). Kasper-IBM, HENDERSON and Sutherland do not disclose, which JP 2009129204 A discloses generating a notification (
The illegal code scrutinizing unit 504 checks whether or not there is an illegal code from the target source code 200 input by the source code input unit 502 and the branch execution information collected by the branch execution status measuring unit 501. The inspection result is notified to the tool operator by the inspection result notification unit 505, 3rd para, page 6
Further, if there is a conditional branch sentence that has not yet been checked among the conditional branch sentences shown in the table shown in FIG. 6, the illegal code review unit 504 performs the processing from S1306 on that conditional branch sentence. Thereafter, the inspection result notification unit 505 notifies the user of the determination result of the unauthorized code review unit 504 (S1312), last para, page 11.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known notification. The processing of the conditional branch sentence would enable information which is collected by the branch execution status measuring and notified to the software. The software would perform further inspection based on the notified information, last para, page 11.
Claim(s) 9, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper-IBM in view of Sutherland, HENDERSON and KAWACHI et al., JP 2009129204 A.
Referring to claim(s) 9, Kasper-IBM discloses generating a parameter list of the values for the parameters (para 46). Kasper-IBM, HENDERSON and Sutherland do not disclose, which KAWACHI discloses based on comparing against the values stored in the input registers for the test or condition branch logic (
The branch execution status measurement unit 501 receives the branch execution information output for the target program 400 being executed, and performs management inside the tool. That is, branch execution information indicating the branch result in each conditional branch statement is input from the function confirmation test system (the test execution compiler 300 or another system). Further, as will be described later, the branch results shown in the input branch execution information are stored for each branch condition statement in the format of the table shown. The branch execution status measurement unit 501 is an example of a branch execution information input unit and a branch result accumulation unit., para 8, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known branch condition with comparison of register values. The processing of the conditional branch sentence would enable information which is collected by the branch execution status measuring and notified to the software. The software would perform further inspection based on the notified information, para 8, page 5.
Claim(s) 10, is/are rejected under 35 U.S.C. 103 as being unpatentable over Kasper-IBM in view of HENDERSON, and JP 2008544340 A.
Referring to claim(s) 10, Kasper-IBM discloses generating a parameter list of the values for the parameters based on copying the values stored in the input registers, para 39. Kasper-IBM, HENDERSON and Sutherland do not disclose, which JP 2008544340 A discloses copying (
the programmable unit 1 has a register memory 3 as a part of the CPU 2. The register memory copy 19 is a complete or partial copy of this register memory 3. In order to perform this duplication, strobe information 34 is output from the PU emulation controller 18. The point at which the contents of the register memory are copied to the register memory copy must be informed to the ED, for example by some kind of encoding of the data type signal 42, 7th para, page 13.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known informing of copying of register information. The processing of the copying would enable information which is collected by the branch execution status measuring and notified to the software. The software would perform further inspection based on the notified information, 7th para, page 13.
Claim(s) 1, 11, 16, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay et al., 20220206958, Intel Corporation in view of Sutherland, HENDERSON and Kasper.
Referring to claim(s) 1, 11, 16, LeMay-Intel discloses A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by a computer processor to perform an operation comprising: A system, comprising: computer processor; and a memory containing a program which when executed by the computer processor performs an operation, the operation comprising: a method comprising: analyzing by a code analyzer the instructions of the software program to determine where input registers are referenced in the software program;
[0154] Since a host is free to directly access data belonging to other hosts once the host has successfully negotiated access to the cryptographic keys for the other hosts, in some embodiments, a current host ID register (such as the register described above in connection with the MAKROUTPTR instruction) of physical machine 500 may be mapped to a set of authorized host IDs for the current host that is being executed, where the current host is allowed to access the cryptographic keys of the hosts corresponding to the authorized host IDs. In some embodiments, a value stored in the current host ID register (e.g., the host ID of the currently executing host) may be mapped to any suitable memory comprising the authorized host IDs. When a client host executes an instruction requesting an object from a server host, the current host ID register may be checked to determine whether the client host is authorized to access data from the server host. If it is not, a fault may be issued and the request may be denied. If the client host is authorized to access the object, the requested object may be provided (or additional checks to determine whether the host is authorized to access the particular requested object may be performed before access to the requested object is granted). In one embodiment, responsive to a determination that the client host is authorized to access data of the server host, the key lookaside buffer 522 may be accessed to obtain a cryptographic key to be used to decrypt the requested object.
determining usage of values stored in the input registers when the
software program is executed,
[0146] In some embodiments, when the data object 514 is received, the physical machine 500 may implement at least a portion of the state of host 506 within itself (as depicted by the dotted lines around host 506 of physical machine 500. This may include, for example, storing the data object 514 in physical memory of the physical machine 500 and creating a page table entry mapping the enhanced cryptographic address to the data object 514 to the physical address at which the data object is stored. This may also include the operating system on the physical machine 500 establishing data structures representing the identity and state of the host 506 specifically as it is instantiated in physical machine 500. For example, this information may include the host address for host 506, the associated memory mappings, and the execution state (e.g., register values) of functions that are running or scheduled to run within the context of host 506.
[
wherein the usage comprises at least one of (1) comparing
against the values stored in the input registers for test or conditional branch logic, (ii)
copying the values stored in the input registers, or (iii) referencing storage at a
location defined by the values stored in the input registers;
[0208] In the embodiment depicted, the flow begins at 802 where a software entity issues a MOVOVERRIDEPTR instruction. At 804, a determination is made as to whether the software entity issuing the instruction is authorized to use the MOVOVERRIDEPTR instruction. Use of the MOVOVERRIDEPTR instruction may be restricted to certain software entities to reduce the security risk associated with the instruction. The processor unit executing the instruction may perform any suitable check to see if the software entity is authorized to execute MOVOVERRIDEPTR instructions. In one embodiment, the processor unit may check a model register (MSR) that stores information indicating whether the software entity is authorized to use the instruction. In some embodiments, privileged software (e.g., an OS or VMM) may have access rights to the MSR in order to specify which processes are able to use the MOVOVERRIDEPTR instruction. In one embodiment, the determination of whether a process is allowed to use the MOVOVERRIDEPTR may be based on a privilege level of the software (e.g., ring 0 software may automatically be allowed to use the MOVOVERRIDEPTR instruction, while other software may be prevented from using the instruction or the system may have to be specially configured, e.g., by privileged software, to be allowed to use the instruction). The check may be done at a per process granularity (e.g., if a process is allowed to use the instruction, then any portion of that process may use the instruction) or at a finer granularity (e.g., on a page by page basis for the code executing the process). In some embodiments, usage of the instruction may be restricted to certain address ranges or with certain keys. For example, a given process may be allowed to use multiple keys, e.g., selectable via a slice of bits within the pointer. In some embodiments, the use of this instruction is only allowed on a subset of those keys. Continuing the example above, the network microkernel process may only be allowed to use this instruction on the keys corresponding to memory shared with other processes, but not its own private memory in order to enhance its resistance to threats against that private memory. The authorization check may be done by any suitable portion of the processor unit. For example, the check may be performed by an instruction decode unit (responsive to recognizing that the MOVOVERRIDEPTR instruction has been issued) or by an execution unit.
[0213] The table 900 may be implemented using any suitable memory, such as a pool of registers. In one embodiment, the registers are MSRs managed by an operating system (or other privileged component). In another embodiment, the registers may be user mode control registers configurable via specialized instructions. Authorization to configure the table may be provided in any suitable manner (e.g., a page table for instruction code may include a bit indicating whether the code is authorized to modify the table). User space or other software may dynamically change the contents of the table 900 or the lookup tag values in supplied linear addresses in order to reference the desired context information.
[0436] If it is determined at 2904 that the privilege level of the entity requesting execution of the instruction is greater than or equal to the minimum required privilege level defined for the instruction, then at 2908 the value stored in processor registers (e.g., 116, 2822) is copied into a microarchitectural register that hardware (e.g., 2842, 2844, 2846) uses for decrypting/encrypting the code, data, or pointer associated with the particular key. In an example, a first 64-bit register containing the most significant 64 bits of the key and a second 64-bit register containing the least significant 64 bits of the key are copied into a 128-bit microarchitectural register.
and
generating array of possible value for parameters based on the usage to provide an input set for security of the software program.
[0124] Host 404 contains objects (data object 406 and code object 408). An object may include any suitable stored information. A data object (e.g., 406) may represent a value (e.g., a Boolean, a string, a constant, an integer, a floating point number), a set of values (e.g., an array, a heap, a linked list, a stack, a queue, a hash table, a tree, or other set of values), or other information (e.g., a structure including various types of values or other data). A code object (e.g., 408) may comprise executable code including one or more instructions.
[0156] In one embodiment, a call instruction for a processor unit is introduced that may accept, as an operand, an enhanced cryptographic address referencing a code object that may be stored locally (e.g., on the same physical machine that is executing the call instruction) or remotely (e.g., on a different physical machine). In various embodiments, the processor unit that is executing the call instruction may determine whether to execute the function (e.g., by performing a local procedure call by using parameters on the stack and executing the code at the address referenced in the call instruction) or to offload execution of the function via a remote procedure call to a different physical machine. In a remote procedure call, the parameters for the call may be sent to the physical machine executing the code object.
[0242] FIG. 12 illustrates a compressed pointer 1204 for an allocation 1210 associated with context information including a magic number 1206 and an allocation length 1208 in accordance with certain embodiments. The magic number 1206 may be any suitable number and may be used to protect integrity of the context information stored in association with the allocation 1210. The magic number 1206 can further strengthen the security for the allocation 1210 by operating like an authentication code. It is used to verify that the plaintext for the stored context information matches an expected format as defined by the expected magic number. If any context information has been corrupted, then it is highly likely that the plaintext magic number will also be corrupted assuming the cryptographic algorithm used has sufficient diffusion. This may facilitate early detection of a corrupted pointer value and may help with debugging or identifying malicious software.
LeMay-Intel do not disclose, which Sutherland discloses disassembling object code ( disassembling object code annotated with metadata labels., 2nd last para, page 10) to identify instructions of a software program (the one or more registers and/or one or more application memory locations used by the instruction comprise one or more input registers and/or one or more input application memory locations, para 7, page 38); analyzing, by a code analyzer, the instructions of the software program to determine where input registers are referenced in the software program (the one or more input registers and/or one or more input application memory locations comprise a first input register or application memory location and a second input register or application memory location; the one or more classification bits comprise one or more first classification bits for the first input register or application memory location; the one or more classification bits further comprise one or more second classification bits for the second input register or application memory location, para 9, para 38, a binary analysis component programmed to take, as input, object code, and perform one or more analyses similar to those performed by e.g., control flow analysis, type analysis, etc.).para 8, page 38 ).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembling the object code of an application. The disassembling would enable analyzing the identified instructions. This would enable knowing of the locations that is referenced by the input register, which would enable classification of the information, para 9, para 38.
LeMay-Intel and Sutherland do not disclose, which Kasper discloses, security vulnerability testing (
[0024] The above-described aspects of the invention address the shortcomings of the prior art by systematically attempting to trigger exceptions when calling an authorized service. By matching an exception address to an input that was supplied, a cyber security test tool can determine, parameter-by-parameter, which parameters contain pointers to other parameter areas and which do not. Further, the cyber security test tool can determine which parameters likely do not contain pointers. The cyber security test tool may also determine which parameters likely contain numeric function codes, bit flags, or expected constants, instead of addresses. By saving this information, a map of a parameter list can be built and used in subsequent targeted testing as a testing profile. In other words, the information supplied during a failure can allow a testing program to map the parameter list and provide increasingly complex valid parameter lists to be used in increasingly complex tests.
[0037] For example, some programs 204 may normally be limited to accessing the address space 212A, while the other programs 204 may normally be limited to accessing the address space 212B. Where address space switching is supported, one of the programs 204 of address space 212A may call one of the programs 204 of address space 212B, where access constraints are expected to limit permissions of the program 204 of address space 212A in address space 212B. A cyber security test tool 205 can be executed that tests for security vulnerabilities related to access constraints and other security concerns. Further details regarding the cyber security testing of the cyber security test tool 205 are described with respect to FIGS. 3 and 4
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known security vulnerability testing for using the generated information. The processing of the generated information would enable determining branch execution status measuring. The software would perform further inspection based on the notified information.
LeMay-Intel, Sutherland, Kasper do not disclose all three usage, which HENDERSON discloses,
(i) comparing against the values stored in the input registers for test or conditional branch logic, (ii) copying the values stored in the input registers, and (iii) referencing storage at a location defined by the values pointers stored in the input registers (
From the ALU 31 Supported operations include addition, subtraction, and load (add to zero) arithmetic operations, logical operations such as AND, OR, exclusive OR, NOT, left shift, right shift, and comparison operations that provide a constant or memory value comparison Values that are in the accumulator register row 36 are not destroyed. 4th para, page 9
a flag data mode, a command only processes the seventeenth bit of the retrieved word. The seventeenth bit is written to the data store on all read accesses 12 always read and then into the MTAG bit of the status register 18 from 3 therefore, provides the tag for either word or byte data. In byte mode, two consecutive bytes are assigned the same tag. Flagged data is used by the FIR, FIRK, COR and CORK commands to emulate a circular buffer. In addition, the MTAG bit of the state register may be tested as a condition for branch / call flags, or it may be combined with other test conditions and other flags to create new conditions. Last para, page 9
(2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP, 4th para, page 12,
To process a multi-word data string, an address is copied from an ACP register to fetch the least significant word in the string. This copied address is then repeatedly incremented to retrieve the remaining words in the string. This will make the in this particular ACP register 49 stored address is left unchanged, the value in this ACP register still pointing to the location of the least significant word of the word string. Consequently, this ACP register is ready for a subsequent operation on this word string.
The processor 10 can store a value in an ACP register 49 pre-change the value +1 or the value -1 before the ACP register in the case of an instruction with respect to an accumulator by the accumulator register row 36 is used, 2nd para, page 10,
Fig 6 shows a data storage addressing unit (DMAU) 14 that takes effect to an address 51 to the data store 12 to deliver. The data storage addressing unit 14 contains an associated ALU 52 performing addition, subtraction and comparison functions, three special address registers 53 (R5 INDEX), 54 (R6 PAGE) and 55 (R7 PGSTK) and five universal registers 56 - 60 (R0 to R4).
The data storage addressing unit 14 can the data store 12 address by means of five addressing modes, ie by means of a direct addressing mode, an indirect addressing mode, a subsequent modification being possible, and three relative addressing modes, 3rd para, page 10
The aspects of construction and arrangement in 5 consider and support chain operations of the type indicated above, consider that (1) the accumulator having the registers AC (0-15) of the accumulator register row 36 is a dual-port read / write construction with a delayed pointer reference to the instruction cycle delay through the ALU 80 Take into account (2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP (3) to successively read the words of a string is a temporary operation that leaves the ACP registers unchanged for future reference to the least significant word of the string in future chain operations, 4th para, page 12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known values stored in the input register. The values would enable implementing operations, comparing, copying and referencing. Such operations would enable testing a software using
conditional / branch instructions, 3rd para, page 10
Claim(s) 2, 12, 17, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, HENDERSON and Kasper and Haber et al., 20040205739.
Referring to claim(s) 2, 12, 17, LeMay-Intel, Sutherland, HENDERSON and Kasper do not disclose, which Haber discloses, before analyzing the instructions, receiving, by a disassembler, the object code of the software program; (
A method for code optimization includes disassembling object code that has been compiled and linked, and identifying a function in the disassembled code, the function including store and restore instructions with respect to a register. The disassembled code is, analyzed to locate a call to the function followed by an instruction to kill the register. The code is modified so as to eliminate the store instruction from the function when the function is invoked by the located call, abstract,
[0037] System 20 typically receives source code that is prepared by a programmer. A compiler 22 compiles the source code to generate object code, and a linker 24 links the compiled code with library code, as is known in the art. The linked object code is fed to an optimizer 26, which analyzes and modifies the code to eliminate redundant store/restore instructions, as described in detail hereinbelow. The optimized code can then be executed by a run-time module 28, as is likewise known in the art. Although all of functions 22 through 28 are shown for simplicity as being performed in system 20, it will be appreciated that these functions may also be separated and carried out on different computers. Thus, optimizer 26, which is the element of concern to the present invention, may receive post-link code from another source, outside system 20, and may pass the optimized code to yet another computer for execution.
[0039] Following the control flow of the program in this manner covers a large percentage of the code. Basic blocks that are not directly discoverable by incremental disassembly are marked as "unclassified code." These blocks typically consist of code reached via a jump by a target register that is resolved only at runtime. It is sometimes possible to classify these blocks using instrumentation of the code and dynamic runtime analysis.
[0040] At the end of the incremental disassembly process, the entire code section of the original program is dissected into basic blocks, which are either classified or unclassified. The classified blocks are marked with flags, which characterize them as either code or data (such as branch table data), and which identify the control flow properties of the code blocks, such as Fallthrough, Continue, Call, Return, Jump, etc. The Call and Return flags, inter alia, are used to identify functions and function calls in the code, at a function identification step 32.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembler for the object code. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the test is passed or fail regarding a branch statement, abstract, para 40.
Claim(s) 3, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, HENDERSON, Kasper, Haber et al., 20040205739 and SCHULTE et al., 20200174765.
Referring to claim(s) 3, LeMay-Intel, Sutherland and Kasper Haber do not disclose, which SCHULTE discloses, identifying the software program from a set of software programs of interest (
[0033] Referring now more particularly to the drawings in which like reference numerals indicate like parts throughout the several views, FIG. 1 is a block diagram schematically showing the application of a disassembler program 102 to an executable 104 to produce assembly code 106 as output, in accordance with certain example embodiments; and FIG. 2 shows an example overall workflow for the FIG. 1 components, in accordance with certain example embodiments. As shown in FIGS. 1-2, the executable program 104 serves as input to the disassembler program 102. This input may be in any suitable executable file format such as, for example, the Linux executable and linkable format (ELF). The assembly code 106 is the output of the disassembler program 102 and corresponds to the original executable program 104., fig., 1, 2.
PNG
media_image1.png
420
422
media_image1.png
Greyscale
PNG
media_image2.png
360
808
media_image2.png
Greyscale
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known multiple programs. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the test is passed or fail regarding a branch statement for executable files that are of different format, para 33.
Claim(s) 4, 13, 18, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, HENDERSON and Kasper and JP 2007529063 A5.
Referring to claim(s) 4, 13, 18, LeMay-Intel, Sutherland, HENDERSON and Kasper do not disclose, which JP 2007529063 A5 discloses, checking a parameter list based on register values (
Native binding mechanism based on unified call stub interface, native binding a plurality of components, i.e., (i) a special IR nodes form to modify all of the target register values, based on (ii) a native calling conventions , aligned in all subject registers a unified context structure, and an object code to call the call stub aligns the particular subject register value (iii) the function parameters, and a native call stub calling native functions, It is divided into, second para, page 8
For example, on the MIPS architecture, function parameters are passed in registers , while on the x86 architecture, parameters are passed on the stack . For MIPSx86 translator call native functions, x86-calling convention requires moving the function parameter from a target register to the stack, 2nd last para, page 6,
For example, in one embodiment, the unified call stub interface is a C function with exactly two parameters (a reference to a unified data structure that includes the call site's target address and all target register values). And return one value (the target address of the next target instruction to be executed by the translator). Unified data structures passed to call stub always contains current (if the no, referred to as target context) values of all target registers, 1st para, page 8
In some cases, further computations ( beyond transformations and calling conventions for data representation) so that the native function interface is substantially different from its target code equivalent and therefore the target data is suitable for use as a native function parameter. There must be run against the target data. In such a case, the call stub 113 may perform further parameter conversion on the target register value. For example , a native function may expect parameters in a unit different from its target code equivalent. In this case, before calling the native function, the call stub 113 performs constant conversion on the appropriate target register value to deal with the difference in unit format for the parameter, last para, page 8.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known parameter list with the register values. The use of associated parameter of the value of the register would enable performing processing according to the parameter. This would enable, for example, implementing a native function with the parameter for the binding mechanism, last para, page 8.
Claim(s) 5, 14, 19, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of JP 2007529063 A5, Sutherland, HENDERSON and Kasper and HE et al., CN 106775913 A.
Referring to claim(s) 5, 14, 19, JP 2007529063 A5 discloses, determining the possible value for the parameters, with the values stored in the input registers, as cited in claim 4. LeMay-Intel, Sutherland, HENDERSON, Kasper and JP 2007529063 A5 do not disclose, which HE discloses, compared against, for the test or conditional branch logic when the software program is executed (
D2. disassembling step, for sequential instruction sequence, performing linear scanning disassembling process; for the destination address jump, directly disassembling the jump to the target address, the target address is indirect address register jump, call target address analyzing the target address analyzing method to obtain the target address after the jump to the corresponding position for disassembling, and constructing the corresponding control flow graph node, 2nd last para, page 2,
the target address analyzing module comprises: a path condition symbol calculation module (equivalent to the symbol executing module): symbolic execution the program. deriving arrival indirect jump instruction analysis is required condition is satisfied, output a condition formula, a SMT solver module selection module to output to the disassembling engine condition formula for resolving, calculating the feasible value variable in the formula to obtain the input parameter; binary simulation module using possible value obtained in the SMT solver module, emulating execution of a corresponding instruction sequence, so as to track the variation of the value of the register command sequence in the running process, and finally determining the indirect jump target address of the instruction, as the address of the next assembler instruction to be reverse, disassembling and use control flow graph generating module to process the instruction, 4th para, page 4,
E3. binary simulation step at E2 in obtaining the variable value as input parameters, the simulation executing corresponding instruction sequence, so as to track the variation of the value of the register command sequence in the running process, and finally determining the indirect jump target address of the instruction, as the address of the next assembler instruction to be reverse using inverse assembly and control flow graph generating method processing instruction again, 4th para, page 5,
B7. using an SMT solver for solving the path condition formula obtained in B6, obtaining input parameters, namely one example; B8. using the binary emulator, emulation instruction sequence of indirect jump instruction, obtains arrival indirect jump instruction, store the value of the indirect jump instruction register, and to jump to the target address, as the address of the next reverse assembler instruction, returning to B3, fourth last para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known implementing the branch condition. The determining for the branch condition while disassembling would enable implementing control flow graph generating module to process the instruction, 4th para, page 4
Claim(s) 6, 15, 20, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of JP 2007529063 A5, Sutherland, HENDERSON and Kasper and Kim et al., 6026362.
Referring to claim(s) 6, 15, 20, JP 2007529063 A5 discloses, determining the possible value of the parameters of any reassignments, or variables where the values stored in the input registers, as cited in claim 4. LeMay-Intel, Sutherland, HENDERSON and Kasper and JP 2007529063 A5 do not disclose, which Kim discloses, local variables are saved when the software program is executed (The additional detailed information can include, but is not limited to, a callmap view, a register palette, a stack palette, a Disassembly view, or a variable's value display window. The additional detailed information can also include other additional detailed information relating to the selected aspect of the process, col., 23, lines 10-20,
PNG
media_image3.png
684
532
media_image3.png
Greyscale
PNG
media_image4.png
696
418
media_image4.png
Greyscale
(3) the debugger of the present invention is preferably designed for use in a client/server computing environment 100. The server computer 102 communicates over a bus or I/O channel 104 with an associated disk storage subsystem 106. The server computer 102 includes a CPU 108 and RAM 110 for storing current state information about program execution. A portion of the RAM 110 is dedicated to storing the register states and local variables associated with each function of the program which is currently executing on the server computer 102. This portion of RAM 110 is typically called a "program stack" or simply "the stack" 202 col., 7, lines 7-12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known local variable. The local variables along with register states associated with each function of the program would be stored to implement the program execution, col., 7, lines 7-12.
Claim(s) 7, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of JP 2007529063 A5, Sutherland, HENDERSON and Kasper and GREINER et al., EP 3571594 B1.
Referring to claim(s) 7, JP 2007529063 A5 discloses, determining the possible value for the parameters retrieved from defined by values stored in the input registers when the software program is executed, as cited in claim 4. LeMay-Intel, Sutherland, HENDERSON and Kasper and JP 2007529063 A5 do not disclose, which GREINER discloses, retrieved from referencing storage at the location (
obtaining (1400) an instruction to perform an action related to one or more guarded storage controls; and executing (1402) the instruction to perform the action, the executing comprising: obtaining, from a location, content associated with the one or more guarded storage controls (1404), the one or more guarded storage controls to control operation of a guarded storage facility used to guard a portion of memory (1406), and wherein the one or more guarded storage controls comprise a designation register used to designate an area of memory to be guarded, a mask register indicating whether one or more sections of the area of memory are to be guarded, and a parameter list address register to designate a location of one or more attributes of a guarded storage event, wherein the guarded storage event is an event that occurs when a program attempts to access an address in a guarded section thereby protecting the addresses within the guarded section; and performing (1408) the action using the content, wherein the action comprises a load or a store, wherein based on the action being the load, the obtaining the content comprises obtaining the content from memory, and the performing the action comprises loading the content obtained from memory into the one or more guarded storage controls, and based on the action being the store, the obtaining the content comprises obtaining the content from the one or more guarded storage controls, and the performing the action comprises storing the content obtained from the one or more guarded storage controls into memory, last para, page 23
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known referencing storage at the location. The parameters/values would be stored at the storage location. And the storing using the reference would enable protecting attempts to access an address in a guarded section which would also protect the addresses within the guarded section, last para, page 23
Claim(s) 8, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Kasper, Sutherland, HENDERSON and JP 2009129204 A.
Referring to claim(s) 8, LeMay-Intel do not disclose, which Kasper-IBM discloses, generating input of the input set for security vulnerability testing of the software program (para 46).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known input for the testing software. The testing software would further implement processing based on the input for to address security vulnerabilities, para 46. LeMay-Intel and Sutherland, HENDERSON and Kasper-IBM do not disclose, which JP 2009129204 A discloses notification (
The illegal code scrutinizing unit 504 checks whether or not there is an illegal code from the target source code 200 input by the source code input unit 502 and the branch execution information collected by the branch execution status measuring unit 501. The inspection result is notified to the tool operator by the inspection result notification unit 505, 3rd para, page 6
Further, if there is a conditional branch sentence that has not yet been checked among the conditional branch sentences shown in the table shown in FIG. 6, the illegal code review unit 504 performs the processing from S1306 on that conditional branch sentence. Thereafter, the inspection result notification unit 505 notifies the user of the determination result of the unauthorized code review unit 504 (S1312), last para, page 11.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known notification. The processing of the conditional branch sentence would enable information which is collected by the branch execution status measuring and notified to the software. The software would perform further inspection based on the notified information, last para, page 11.
Claim(s) 9, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, Kasper, HENDERSON, ROMAN et al., WO 2006068943 A2 and HE et al., CN 106775913 A.
Referring to claim(s) 9, LeMay-Intel, Sutherland, HENDERSON and Kasper do not disclose, which ROMAN discloses, generating a parameter list of the values for the parameters
[00206] The Object Invocation domain contains two micro building blocks to automate server method invocation using the Java language reflection capabilities. As a result of this functionality, developers do not need to build skeletons for their server objects but simply register them, and the system automatically obtains all the information it requires. The Prepare Method Invocation micro building block receives a pointer to an object and the name of the method to invoke. The micro building block uses Java reflection to inspect the method signature, creates an array with the parameter types required to invoke the method, and returns the array as the output parameter. The Invoke Method micro building block receives an array with the parameter values, invokes the object method, and returns an array with the parameters generated by the method.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known generating of a parameter list would enable creating an array with different parameter types that are required to invoke the method. The array with different parameter types would be provided so the inspection of the application would be implemented, para 206.
LeMay-Intel, HENDERSON and ROMAN do not disclose, which HE discloses, based on comparing against the values stored in the input registers for the test or conditional branch logic (
D2. disassembling step, for sequential instruction sequence, performing linear scanning disassembling process; for the destination address jump, directly disassembling the jump to the target address, the target address is indirect address register jump, call target address analyzing the target address analyzing method to obtain the target address after the jump to the corresponding position for disassembling, and constructing the corresponding control flow graph node, 2nd last para, page 2,
the target address analyzing module comprises: a path condition symbol calculation module (equivalent to the symbol executing module): symbolic execution the program. deriving arrival indirect jump instruction analysis is required condition is satisfied, output a condition formula, a SMT solver module selection module to output to the disassembling engine condition formula for resolving, calculating the feasible value variable in the formula to obtain the input parameter; binary simulation module using possible value obtained in the SMT solver module, emulating execution of a corresponding instruction sequence, so as to track the variation of the value of the register command sequence in the running process, and finally determining the indirect jump target address of the instruction, as the address of the next assembler instruction to be reverse, disassembling and use control flow graph generating module to process the instruction, 4th para, page 4,
E3. binary simulation step at E2 in obtaining the variable value as input parameters, the simulation executing corresponding instruction sequence, so as to track the variation of the value of the register command sequence in the running process, and finally determining the indirect jump target address of the instruction, as the address of the next assembler instruction to be reverse using inverse assembly and control flow graph generating method processing instruction again, 4th para, page 5,
B7. using an SMT solver for solving the path condition formula obtained in B6, obtaining input parameters, namely one example; B8. using the binary emulator, emulation instruction sequence of indirect jump instruction, obtains arrival indirect jump instruction, store the value of the indirect jump instruction register, and to jump to the target address, as the address of the next reverse assembler instruction, returning to B3, fourth last para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known implementing the branch condition. The determining for the branch condition while disassembling would enable implementing control flow graph generating module to process the instruction, 4th para, page 4
Claim(s) 10, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, Kasper, HENDERSON, ROMAN et al., WO 2006068943 A2 and HAYWOOD et al., 20200104063.
Referring to claim(s) 10, LeMay-Intel, Sutherland, HENDERSON and Kasper do not disclose, which ROMAN discloses, generating a parameter list of the values / of the one or more possible for the parameters
[00206] The Object Invocation domain contains two micro building blocks to automate server method invocation using the Java language reflection capabilities. As a result of this functionality, developers do not need to build skeletons for their server objects but simply register them, and the system automatically obtains all the information it requires. The Prepare Method Invocation micro building block receives a pointer to an object and the name of the method to invoke. The micro building block uses Java reflection to inspect the method signature, creates an array with the parameter types required to invoke the method, and returns the array as the output parameter. The Invoke Method micro building block receives an array with the parameter values, invokes the object method, and returns an array with the parameters generated by the method.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known generating of a parameter list would enable creating an array with different parameter types that are required to invoke the method. The array with different parameter types would be provided so the inspection of the application would be implemented, para 206.
LeMay-Intel, HENDERSON and ROMAN do not disclose, which HAYWOOD discloses, based on copying the values stored in the input registers. Abstract, claim 2
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known implementing safe copying of the register value. The determining for the copying on whether it is safe or not would prevent improper copying of the register values associated with the vulnerability, abstract, claim 2.
Claim(s) 10, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, Kasper, HENDERSON, ROMAN et al., WO 2006068943 A2 and NAKAMURA JP 2009123051 A
Referring to claim(s) 10, LeMay-Intel, Sutherland, HENDERSON and Kasper do not disclose, which ROMAN discloses, generating a parameter list of the values / of the one or more possible for the parameters
[00206] The Object Invocation domain contains two micro building blocks to automate server method invocation using the Java language reflection capabilities. As a result of this functionality, developers do not need to build skeletons for their server objects but simply register them, and the system automatically obtains all the information it requires. The Prepare Method Invocation micro building block receives a pointer to an object and the name of the method to invoke. The micro building block uses Java reflection to inspect the method signature, creates an array with the parameter types required to invoke the method, and returns the array as the output parameter. The Invoke Method micro building block receives an array with the parameter values, invokes the object method, and returns an array with the parameters generated by the method.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known generating of a parameter list would enable creating an array with different parameter types that are required to invoke the method. The array with different parameter types would be provided so the inspection of the application would be implemented, para 206.
LeMay-Intel, HENDERSON and ROMAN do not disclose, which NAKAMURA discloses, based on copying the values stored in the input registers (
The external accessible register group (RA1-RAn) has a register corresponding to each register of the external access improper register group (RBn). The register value of the external accessible register group is set from the exterior. A copy control unit (CSn) copies the register value set to the external accessible register group according to the copy instruction from the outside to the external access improper register group and performs the copy restriction process during non-copiable period, abstract.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known implementing safe copying of the register value. The determining for the copying on whether it is safe or not would prevent improper copying of the register values associated with the vulnerability, abstract.
Claim(s) 10, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, Kasper, HENDERSON, HENDERSON, ROMAN et al., WO 2006068943 A2 and JP 5874492 B2.
Referring to claim(s) 10, LeMay-Intel, HENDERSON, Sutherland and Kasper do not disclose, which ROMAN discloses, generating a parameter list of the values / of the one or more possible for the parameters
[00206] The Object Invocation domain contains two micro building blocks to automate server method invocation using the Java language reflection capabilities. As a result of this functionality, developers do not need to build skeletons for their server objects but simply register them, and the system automatically obtains all the information it requires. The Prepare Method Invocation micro building block receives a pointer to an object and the name of the method to invoke. The micro building block uses Java reflection to inspect the method signature, creates an array with the parameter types required to invoke the method, and returns the array as the output parameter. The Invoke Method micro building block receives an array with the parameter values, invokes the object method, and returns an array with the parameters generated by the method.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known generating of a parameter list would enable creating an array with different parameter types that are required to invoke the method. The array with different parameter types would be provided so the inspection of the application would be implemented, para 206.
LeMay-Intel, HENDERSON and ROMAN do not disclose, which JP 5874492 B2 discloses, based on copying the values stored in the input registers (
Incidentally, a mismatch value of the internal register, if the error level "low", the resynchronization controller 12 via the external access control unit 113 of the comparison and selection circuit 11, wait for one cycle to all processors along with the outputs an instruction s3, to register the copy control unit 132 of the comparison copy circuit 13, to notify the register copy instruction s5 indicating the emergency treatment. Weight indication s3 is a signal to stop the instruction fetch processing by the processor.
In addition, re-synchronization control unit 12, to notify the register copy instruction s5 in comparison copying circuit 13. In response to the register copy instruction s5, register the copy control unit 132 of the comparison copy circuit 13, to register a mismatch of the processor 2 has occurred, to copy the value of the registers of the processor x1. Subsequently, the resynchronization controller 12, via an external access control unit 113 of the comparison and selection circuit 11, to exit wait instruction s3 of all processors X1 to X3. As a result, the operation of the processor x1~x3 is resumed. Then, re-synchronization control section 12 increments the mismatch counter 122 of the processor x2.
The internal register values X1a x3a, for example, a program counter (hereinafter, PC) with a processor the value of the stack pointer (hereinafter, SP) value of a finite state machine (hereinafter, FSM) in value of the register that holds the is there. PC value then indicates the address value of the target of the instruction processor x1~x3 processes, SP value indicates the address of the memory the information of the temporarily saved by the processor is stored. Then, FSM value is a register of a finite state machine that controls the pipeline stages of the processor X1 to X3, showing the value of the register that holds the processing state of the pipeline stages. Therefore, the value of the internal register x1a~x3a is abnormal, for example, runaway and program runaway pipeline stage control occurs.
Comparative copying circuit 13].
Comparison copying circuit 13, and one by one compares the values x1a~x3a of the internal registers of the three processors x1~x3, If a mismatch occurs in the value of an internal register, based on the majority rule, the value of the internal register to identify the abnormal processor. The comparison copy circuit 13, as an emergency process when the mismatch occurs in the internal register values X1a x3a, instructs writing to internal registers of the abnormal processor values of normal internal registers. This process, by changing the value of the processor of the register, takes about one cycle. For example, as shown in FIG. 1, when the value x2a the internal register of the processor x2 is abnormal (ER 2), comparing the copy circuit 13, for example, the internal register values x1a processor x1, to internal registers x2R processor x2 to instruct the writing
[Detailed configuration of the comparison copy circuit 13].
Comparing the copy circuit 13 has, for example, a comparator majority portion 131, the register copy control section 132. Comparing the majority section 131Compares the value x1a~x3a of the internal register of each processor x1~x3 one by one, the value of the internal register to identify the abnormal processor based on the majority decision when a mismatch occurs. Further, comparing the majority unit 131 notifies the re-synchronization control section 12 a number s1 of the abnormal processor as the error detection information
Register copy control section 132, the resynchronization controller 12 receives the notice of the register copy instruction s5 showing the emergency treatment, the discrepancy arises register, and instructs the copy of the value to congenital processor from a normal processor, last para, page 4.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known implementing safe copying of the register value. The determining for the copying on whether it is safe or not would prevent improper copying of the register values associated with the vulnerability, last para, page 4.
Claim(s) 2, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, HENDERSON and Kasper and FILACHEK 20130117542, IBM.
Referring to claim(s) 2, LeMay-Intel, HENDERSON, Sutherland and Kasper do not disclose, which FILACHEK discloses, receiving, by a disassembler, the object code of the software program (
[0055] For example, FIG. 6 shows another example of the user interface 110 where a user is interacting with the debugger 113 and is being shown a source/disassembled view of application source code. In this example, the user is debugging the source file qdb0xp.cpp and is also performing code coverage collection on the registered module associated with this source file. As the source code is debugged, the debugger 113 references the system program table 202 for the debugged code. The debugger 113 determines if the system program table 202 includes a code coverage data pointer, such as an instruction table pointer, associated with the debugged code. If the system program table 202 does not include this pointer then the debugging process continues as normal. However, if the system program table 202 does include this pointer then the debugger 113 uses the debug information 132 to interpret the content of the instruction table 204, 206. For instance, the following is one example of debug information 132: /ztpf/blddrvklebug/qdb0xp.cpp: [334,-1] 0x5dd4//new statement. "334" is the line number that corresponds to the assembler instructions located at offset 0x5dd4 in the qdb0xp object code. The debugger 113 uses this table to identify which range of instructions in the object code, in terms of offsets, is associated with which lines of source code in the source file.
[0056] For example, the debugger 113 determines which lines of the source code have been executed based on the information in the code coverage data (e.g., instruction table) entry(s) 204, 206 as indicated by the line table in the debug information. The debugger 113 then visually alters the source code displayed in the source/disassembled view of the user interface 110 to identify the executed (and/or non-executed) lines or instructions. For example, FIG. 6 shows that at the time the code coverage collection results were recorded, time T0, the first 3 lines of code in the view have been executed, as indicated by the dashed boxes surrounding these lines of code. It should be noted that other threads can be executing the same code, thereby influencing the results that should be displayed. Therefore, the user can refresh the results displayed in the source/disassembled view to take into account instruction executions resulting from the other threads. Alternatively, the code coverage tool 112 can notify the debugger 113 when additional lines/instructions have been executed and the debugger 113 can automatically update the source/disassembled view.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembler for the object code. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the test is passed or fail regarding a branch statement, abstract, para 56.
Claim(s) 3, is/are rejected under 35 U.S.C. 103 as being unpatentable over LeMay-Intel in view of Sutherland, HENDERSON Kasper, FILACHEK 20130117542, IBM and SCHULTE et al., 20200174765.
Referring to claim(s) 3, LeMay-Intel, Sutherland, HENDERSON, Kasper, FILACHEK do not disclose, which SCHULTE discloses, identifying the software program from a set of software programs of interest (
[0033] Referring now more particularly to the drawings in which like reference numerals indicate like parts throughout the several views, FIG. 1 is a block diagram schematically showing the application of a disassembler program 102 to an executable 104 to produce assembly code 106 as output, in accordance with certain example embodiments; and FIG. 2 shows an example overall workflow for the FIG. 1 components, in accordance with certain example embodiments. As shown in FIGS. 1-2, the executable program 104 serves as input to the disassembler program 102. This input may be in any suitable executable file format such as, for example, the Linux executable and linkable format (ELF). The assembly code 106 is the output of the disassembler program 102 and corresponds to the original executable program 104., fig., 1, 2.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by LeMay-Intel to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known multiple programs. The disassembling would enable analyzing the identified instructions. This would enable knowing of whether the test is passed or fail regarding a branch statement for executable files that are of different format, para 33.
Response to Arguments
Remarks/Arguments filed 12/23/25, pages 7-12 have been fully considered but they are not persuasive. Therefore, rejection of claims 1-20 is maintained.
Regarding the remarks for the amended claims, the rejections are updated accordingly. Please refer to the updated rejections for the amended limitations. Especially please refer to the teachings of addition reference HENDERSON et al., DE 69920582 T2 2005-09-08.
Kasper-IBM discloses A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by computer processor to perform an operation comprising: A system, comprising: computer processor; and a memory containing a program which when executed by the computer processor performs an operation, the operation comprising: a method comprising: analyzing instructions of a software program to determine where input registers are referenced; determining usage of values stored in the input registers when the software program is executed,
[0023] determining which parameters of an authorized service contain addresses or other data types. Determining how an authorized service interprets parameters can enable testing programs to provide valid or invalid addresses as input in the parameters. Depth testing can be used to discover whether the authorized service uses second, third, or more level parameter lists at addresses, for instance, as pointed to by a parameter list. In order to supply complex and meaningful parameter lists with multiple levels of data and valid pointers, the form and function of the parameter list is determined, or mapped, by a cyber security test tool in embodiments.
[0024] The above-described aspects of the invention address the shortcomings of the prior art by systematically attempting to trigger exceptions when calling an authorized service. By matching an exception address to an input that was supplied, a cyber security test tool can determine, parameter-by-parameter, which parameters contain pointers to other parameter areas and which do not. Further, the cyber security test tool can determine which parameters likely do not contain pointers. The cyber security test tool may also determine which parameters likely contain numeric function codes, bit flags, or expected constants, instead of addresses. By saving this information, a map of a parameter list can be built and used in subsequent targeted testing as a testing profile. In other words, the information supplied during a failure can allow a testing program to map the parameter list and provide increasingly complex valid parameter lists to be used in increasingly complex tests.
wherein the usage comprises (i) comparing against the values stored in the input registers for test or conditional branch logic, (ii) copying the values stored in the input registers, or (iii) referencing storage at a location defined by the values stored in the input registers;
[0040] If the cyber security test tool 205 discovers that the target register 310A (or one of the other target registers 310B-310N) holds a parameter address because a protection exception occurred for the address supplied in target register 310A, then the cyber security test tool 205 can seek to determine parameter characteristics. For example, in 64-bit addressing mode, the cyber security test tool 205 can obtain 200 bytes of storage, enough for 25 parameters of 8 s each. Leaving the values of the other target registers 310B-310N constant at first, or possibly varying them later, the cyber security test tool 205 can set all 25 parameters (e.g., of parameter list 312) to either contain constant values or pointers to valid storage, such as parameter areas 308A, 308B, 308C, . . . , 308N. One-by-one, the cyber security test tool 205 can set one 8-byte parameter at a time to point to a second protected storage location 316 that will cause a protection exception. When a protection exception occurs at an address after calling the authorized service 306 with the parameter list 312, the cyber security test tool 205 can confirm identification of a parameter address in the parameter list 312 pointed to by the target register 310A. Going through all of the parameter list 312, one parameter at a time, the cyber security test tool 205 can build a list or map of which parameters contain addresses. In 32, 31, or 24-bit addressing mode, 4-byte parameters could be used instead, for example.
[0041] Once a list of parameters is found that contains addresses or additional parameters, the cyber security test tool 205 can map constraints of the parameter list 312 and target registers 310 to construct a testing profile 304 of discovered relationships and extend testing of the authorized service 306 to additional level of parameters. If a first parameter 312A pointed to by target register 310A contains a pointer to a parameter area 308A, because a protection exception occurred for an address supplied as the second protected storage location 316, the cyber security test tool 205 can then try to determine characteristics of the parameter area 308A, such as whether it contains a next level parameter list. For example, the cyber security test tool 205 can obtain another 200 bytes of storage, enough for 25 parameters of 8 bytes each as the parameter area 308A. Leaving the values of the target registers 310 and the first level of parameter list 312 constant at first, possibly varying the contents later, the cyber security test tool 205 can set all 25 parameters in a second level parameter list of the parameter area 308A to contain constant values or point to valid storage, such as parameter area 308B. One-by-one, the cyber security test tool 205 can set one 8-byte parameter at a time in the parameter area 308A (e.g., the second level parameter list) to point to a protected storage location 318 that will cause a protect exception. When a protection exception occurs at an address of the protected storage location 318 after calling the authorized service 306, the cyber security test tool 205 can confirm identification of a parameter address in the parameter area 308A pointed to by the first level of parameter list 312 which is pointed to by the first target register 310A. Going through the full list with 25 parameters in the parameter area 308A, one at a time, the cyber security test tool 205 can build a list or map of which parameters contain addresses in the testing profile 304. This process can be repeated for as many levels of parameter areas as desired, such as parameter areas 308C-308N with respect to other protected storage locations 320.
generating array describing values of possible values for parameters based on the usage to provide an input set for security vulnerability testing of the software program.
[0024] The above-described aspects of the invention address the shortcomings of the prior art by systematically attempting to trigger exceptions when calling an authorized service. By matching an exception address to an input that was supplied, a cyber security test tool can determine, parameter-by-parameter, which parameters contain pointers to other parameter areas and which do not. Further, the cyber security test tool can determine which parameters likely do not contain pointers. The cyber security test tool may also determine which parameters likely contain numeric function codes, bit flags, or expected constants, instead of addresses. By saving this information, a map of a parameter list can be built and used in subsequent targeted testing as a testing profile. In other words, the information supplied during a failure can allow a testing program to map the parameter list and provide increasingly complex valid parameter lists to be used in increasingly complex tests.
[0037] For example, some programs 204 may normally be limited to accessing the address space 212A, while the other programs 204 may normally be limited to accessing the address space 212B. Where address space switching is supported, one of the programs 204 of address space 212A may call one of the programs 204 of address space 212B, where access constraints are expected to limit permissions of the program 204 of address space 212A in address space 212B. A cyber security test tool 205 can be executed that tests for security vulnerabilities related to access constraints and other security concerns. Further details regarding the cyber security testing of the cyber security test tool 205 are described with respect to FIGS. 3 and 4
Kasper-IBM do not disclose, which Sutherland discloses disassembling object code ( disassembling object code annotated with metadata labels., 2nd last para, page 10) to identify instructions of a software program (the one or more registers and/or one or more application memory locations used by the instruction comprise one or more input registers and/or one or more input application memory locations, para 7, page 38); analyzing, by a code analyzer, the instructions of the software program to determine where input registers are referenced in the software program (the one or more input registers and/or one or more input application memory locations comprise a first input register or application memory location and a second input register or application memory location; the one or more classification bits comprise one or more first classification bits for the first input register or application memory location; the one or more classification bits further comprise one or more second classification bits for the second input register or application memory location, para 9, para 38, a binary analysis component programmed to take, as input, object code, and perform one or more analyses similar to those performed by e.g., control flow analysis, type analysis, etc.).para 8, page 38 ).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known disassembling the object code of an application. The disassembling would enable analyzing the identified instructions. This would enable knowing of the locations that is referenced by the input register, which would enable classification of the information, para 9, para 38.
Kasper-IBM and Sutherland do not disclose all three usage, which HENDERSON discloses,
(i) comparing against the values stored in the input registers for test or conditional branch logic, (ii) copying the values stored in the input registers, and (iii) referencing storage at a location defined by the values pointers stored in the input registers (
From the ALU 31 Supported operations include addition, subtraction, and load (add to zero) arithmetic operations, logical operations such as AND, OR, exclusive OR, NOT, left shift, right shift, and comparison operations that provide a constant or memory value comparison Values that are in the accumulator register row 36 are not destroyed. 4th para, page 9
a flag data mode, a command only processes the seventeenth bit of the retrieved word. The seventeenth bit is written to the data store on all read accesses 12 always read and then into the MTAG bit of the status register 18 from 3 therefore, provides the tag for either word or byte data. In byte mode, two consecutive bytes are assigned the same tag. Flagged data is used by the FIR, FIRK, COR and CORK commands to emulate a circular buffer. In addition, the MTAG bit of the state register may be tested as a condition for branch / call flags, or it may be combined with other test conditions and other flags to create new conditions. Last para, page 9
(2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP, 4th para, page 12,
To process a multi-word data string, an address is copied from an ACP register to fetch the least significant word in the string. This copied address is then repeatedly incremented to retrieve the remaining words in the string. This will make the in this particular ACP register 49 stored address is left unchanged, the value in this ACP register still pointing to the location of the least significant word of the word string. Consequently, this ACP register is ready for a subsequent operation on this word string.
The processor 10 can store a value in an ACP register 49 pre-change the value +1 or the value -1 before the ACP register in the case of an instruction with respect to an accumulator by the accumulator register row 36 is used, 2nd para, page 10,
Fig 6 shows a data storage addressing unit (DMAU) 14 that takes effect to an address 51 to the data store 12 to deliver. The data storage addressing unit 14 contains an associated ALU 52 performing addition, subtraction and comparison functions, three special address registers 53 (R5 INDEX), 54 (R6 PAGE) and 55 (R7 PGSTK) and five universal registers 56 - 60 (R0 to R4).
The data storage addressing unit 14 can the data store 12 address by means of five addressing modes, ie by means of a direct addressing mode, an indirect addressing mode, a subsequent modification being possible, and three relative addressing modes, 3rd para, page 10
The aspects of construction and arrangement in 5 consider and support chain operations of the type indicated above, consider that (1) the accumulator having the registers AC (0-15) of the accumulator register row 36 is a dual-port read / write construction with a delayed pointer reference to the instruction cycle delay through the ALU 80 Take into account (2) the accumulator registers AC (0-15) and their respective offset accumulator registers AC (16-31), the addressing of two operands with a single pointer register ACP ( 0 ) -ACP (3), wherein an accumulator register and its offset register can be used as input registers or as output registers or both as input registers and output registers for the ALU operands; and (3) automatic incrementing of the pointer registers ACP ( 0 ) ACP (3) to successively read the words of a string is a temporary operation that leaves the ACP registers unchanged for future reference to the least significant word of the string in future chain operations, 4th para, page 12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Kasper-IBM to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known values stored in the input register. The values would enable implementing operations, comparing, copying and referencing. Such operations would enable testing a software using
conditional / branch instructions, 3rd para, page 10
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARESH PATEL whose telephone number is (571)272-3973. The examiner can normally be reached on M-F 9-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado, can be reached at (571) 272-7624. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HARESH N PATEL/Primary Examiner, Art Unit 2496
Prosecution Insights