DETAILED ACTION
This action is in response to the application filed on 11/17/2023. Claims 1-20 are pending and have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on February 16th, 2024, April 23rd, 2024, and December 7th, 2024. The submissions are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1, 3, and 8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. (Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning) (hereafter referred to as Zhang) in view of Intel et al. (Input Types and Boundary Checking in Enclave-Definition Language (EDL) Files) (hereafter referred to as Intel).
Regarding claim 1, Zhang teaches
by a host process, acquiring training data, and dividing the training data for a training node cluster employing a master-workers architecture to obtain multiple pieces of sub-training data (Zhang, Section 3.3, “Before the training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host” and “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” (Zhang, Abstract). Examiner notes that data model being uploaded to the host is mapped to acquiring data and the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the training node cluster comprises a master node and multiple worker nodes, which are used for performing model training in a collaborative manner (Zhang, Abstract, “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner”. Examiner notes that the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the host process runs in a non-trusted execution environment, and the training node cluster runs in a trusted execution environment (Zhang, Section 2.2, “Training is performed on a third-party cloud trusted by neither data owners nor the model owner. The cloud instances, including privileged software like OS and hypervisor, are untrusted” and “Trusted hardware like Intel SGX(Software Guarded Extensions) offers a viable solution to create a trusted execution environment (TEE) even if the underlying platform is untrusted” (Zhang, Section 3.2)).
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Zhang, Section 3.3, “Before training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host, which does not have the key”).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Zhang, Section 3.3, “Once the attestation is successful, each secret owner uploads its encryption key to the enclave over a TLS protected channel, with which the enclave can retrieve the encrypted data and model from the storage and decrypt them. The training starts once the data, model, and ML code are all loaded into the enclave”).
controlling the master node and each of the worker nodes to train a preset model by using corresponding respective decrypted sub-training data, respectively, to obtain a trained model (Zhang, Section 4, “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates… After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
wherein during the training process, the master node is used for transmitting a training task to each of the worker nodes and for gathering sub-training results transmitted by the worker nodes (Zhang, Section 4, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
Zhang does not teach, but Intel does teach
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Intel, page 5, “A pointer argument can also be used with the user_check attribute. If the pointer argument is passed with the user_check attribute, then the trusted edge routine will not verify the point … The buffer pointed by the pointer is not copied; rather the address is passed … An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data”. Examiner notes that the buffer is mapped to the address of the shared memory).
wherein the shared memory of the host process is used for being shared by the host process and the training node cluster (Intel, page 3, “When an application makes an ECALL with the in attribute and with a pointer or array argument the trusted edge routine copies the memory content into a trusted memory area and pass the copy of the trusted environment … When an application makes an ECALL with the out attribute and with an array or pointer argument, the trusted edge routine allocates a buffer in trusted memory area, zeroes it and passes it to the trusted environment”).
by the host process, recording a data storage address of each piece of the encrypted sub-training data in the shared memory, and transmitting respective data storage addresses to corresponding master node and worker nodes, respectively wherein each data storage address corresponds to one training node (Intel, page 5, “An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data … these sorts of bulk reads and writes benefit from allowing the enclave to process larger data collections in smaller chunks”. Examiner notes that the user_check attribute is the address of the encrypted collection of data, which maps to the data storage address).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Intel, page 5, “The buffer pointed by the pointer is not copied; rather the address is passed”).
Zhang and Intel are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang to use the Intel Software Guard Extensions (Intel SGX) from Intel. Intel teaches that “proper data handling/marshalling at the edge between the trusted/untrusted code parts plays a vital role in contributing to enclave’s security” (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 3, Zhang and Intel teach the method of claim 1, Zhang further teaches
controlling the master node to assign a corresponding training task to each of the worker nodes based on the decrypted sub-training data corresponding to each of the worker nodes, and controlling the master node to transmit each training task to a corresponding worker node (Zhang, Abstract, “Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” and “In Citadel, each data owner has a dedicated training enclave, which needs to be attested by both the corresponding data owner(s) and the model owner to gain their trust. It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates. As the code has direct access to the training data, it must be shared to and agreed by the data owner ... After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation” (Zhang, Section 4.1)).
controlling each of the worker nodes to train the preset model in accordance with a corresponding training task and corresponding decrypted sub-training data to obtain a corresponding sub-training result (Zhang, Section 1, “Citadel proposes a privacy preserving mechanism to divide SGX-based ML training into training and aggregating parts, making it possible to spin up a distributed cluster to accommodate voluminous multi-sourced data” and “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates” (Zhang, Section 4.1)).
controlling each of the worker nodes to transmit the corresponding sub-training result to the master node (Zhang, Section 4.1, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
controlling the master node to gather the sub-training result of the master node and the sub-training results of the worker nodes to obtain a total training result (Zhang, Section 3.3, “The training starts once the data, model, and ML code are all loaded into the enclave. When the training completes, the model owner downloads the model, and the enclave is destroyed along with the contained data”).
repeating the above steps until the total training result meets a preset condition (Zhang, Section 4.2.2, “As described in Algorithm 1, after processing a batch, each training enclave holds its own gradients and follows a tree-structured hierarchical aggregation scheme to accumulate gradients”
PNG
media_image1.png
368
491
media_image1.png
Greyscale
Examiner notes that the algorithm shows that training function iterates through batches).
Regarding claim 8, Zhang and Intel teach the method of claim 1, Zhang further teaches
the process of encrypting each piece of the sub-training data by the host process shares one symmetric key with the process of decrypting the encrypted sub-training data by each of the training nodes (Zhang, Section 3.3, “Before the training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host … each secret owner uploads its encryption key to the enclave over a TLS-protected channel, with which the enclave can retrieve the encrypted data and model from the storage and decrypt them”).
Claim(s) 2, 11-13, 16-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Zhang in view of Intel and Kim et al (US 20210081122 A1) (hereafter referred to as Kim).
Regarding claim 2, Zhang and Intel teach the method of claim 1, Zhang and Intel do not teach, but Kim does teach
by the host process, activating the master node and each of the worker nodes, and controlling the master node and each of the worker nodes to generate, in accordance with a size of data volume of corresponding sub-training data, a trusted memory matched with the data volume, wherein the trusted memory is used for storing the sub-training data (Kim, paragraph 0004, “Tailoring the at least one ML program includes allocating a shared memory for computing a plurality of layers of a neural network, the shared memory reducing total memory usage during the computation of the plurality of layers, loading model parameter data for each of the plurality of layers onto the shared memory on-demand”).
Zhang, Intel, and Kim are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to apply the allocation of shared memory from Kim. One of the ordinary skill in the art would have known to apply the known technique of determining the memory size for resource allocation. Therefore, applying Kim’s technique would yield the predictable result of allocating the right amount of memory in order to optimize performance. (See MPEP 2141 (III)(D) Applying a known technique to a known device ready for improvement to yield predicable results).
Regarding claim 11, Zhang teaches
by a host process, acquiring training data, and dividing the training data for a training node cluster employing a master-workers architecture to obtain multiple pieces of sub-training data (Zhang, Section 3.3, “Before the training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host” and “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” (Zhang, Abstract). Examiner notes that data model being uploaded to the host is mapped to acquiring data and the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the training node cluster comprises a master node and multiple worker nodes, which are used for performing model training in a collaborative manner (Zhang, Abstract, “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner”. Examiner notes that the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the host process runs in a non-trusted execution environment, and the training node cluster runs in a trusted execution environment (Zhang, Section 2.2, “Training is performed on a third-party cloud trusted by neither data owners nor the model owner. The cloud instances, including privileged software like OS and hypervisor, are untrusted” and “Trusted hardware like Intel SGX(Software Guarded Extensions) offers a viable solution to create a trusted execution environment (TEE) even if the underlying platform is untrusted” (Zhang, Section 3.2)).
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Zhang, Section 3.3, “Before training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host, which does not have the key”).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Zhang, Section 3.3, “Once the attestation is successful, each secret owner uploads its encryption key to the enclave over a TLS protected channel, with which the enclave can retrieve the encrypted data and model from the storage and decrypt them. The training starts once the data, model, and ML code are all loaded into the enclave”).
controlling the master node and each of the worker nodes to train a preset model by using corresponding respective decrypted sub-training data, respectively, to obtain a trained model (Zhang, Section 4, “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates… After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
wherein during the training process, the master node is used for transmitting a training task to each of the worker nodes and for gathering sub-training results transmitted by the worker nodes (Zhang, Section 4, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
Zhang does not teach, but Intel does teach
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Intel, page 5, “A pointer argument can also be used with the user_check attribute. If the pointer argument is passed with the user_check attribute, then the trusted edge routine will not verify the point … The buffer pointed by the pointer is not copied; rather the address is passed … An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data”. Examiner notes that the buffer is mapped to the address of the shared memory).
wherein the shared memory of the host process is used for being shared by the host process and the training node cluster (Intel, page 3, “When an application makes an ECALL with the in attribute and with a pointer or array argument the trusted edge routine copies the memory content into a trusted memory area and pass the copy of the trusted environment … When an application makes an ECALL with the out attribute and with an array or pointer argument, the trusted edge routine allocates a buffer in trusted memory area, zeroes it and passes it to the trusted environment”).
by the host process, recording a data storage address of each piece of the encrypted sub-training data in the shared memory, and transmitting respective data storage addresses to corresponding master node and worker nodes, respectively wherein each data storage address corresponds to one training node (Intel, page 5, “An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data … these sorts of bulk reads and writes benefit from allowing the enclave to process larger data collections in smaller chunks”. Examiner notes that the user_check attribute is the address of the encrypted collection of data, which maps to the data storage address).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Intel, page 5, “The buffer pointed by the pointer is not copied; rather the address is passed”).
Zhang and Intel are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang to use the Intel Software Guard Extensions (Intel SGX) from Intel. Intel teaches that “proper data handling/marshalling at the edge between the trusted/untrusted code parts plays a vital role in contributing to enclave’s security” (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Zhang and Intel do not teach, but Kim does teach
An electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, the processor and the memory communicate via the bus when the electronic device runs, and the machine-readable instructions, when executed by the processor, perform the following operations for model training (Kim, paragraph 0096, “Referring now to FIG. 12, an exemplary computer system 1200 is shown which may represent a server or a network device, in accordance with an embodiment of the present invention. The computer system 1200 includes at least one processor (CPU) 1205 operatively coupled to other components via a system bus”).
Zhang, Intel, and Kim are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to have their methods run on the computer system from Kim. One of the ordinary skill in the art would have known to apply the known technique of using a computer machine to perform instructions. Therefore, applying Kim’s technique would yield the predictable result of running instructions on computers. (See MPEP 2141 (III)(D) Applying a known technique to a known device ready for improvement to yield predicable results).
Regarding claim 12, Zhang and Intel teach the system of claim 11, Zhang and Intel do not teach, but Kim does teach
by the host process, activating the master node and each of the worker nodes, and controlling the master node and each of the worker nodes to generate, in accordance with a size of data volume of corresponding sub-training data, a trusted memory matched with the data volume, wherein the trusted memory is used for storing the sub-training data (Kim, paragraph 0004, “Tailoring the at least one ML program includes allocating a shared memory for computing a plurality of layers of a neural network, the shared memory reducing total memory usage during the computation of the plurality of layers, loading model parameter data for each of the plurality of layers onto the shared memory on-demand”).
Zhang, Intel, and Kim are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to apply the allocation of shared memory from Kim. One of the ordinary skill in the art would have known to apply the known technique of determining the memory size for resource allocation. Therefore, applying Kim’s technique would yield the predictable result of allocating the right amount of memory in order to optimize performance. (See MPEP 2141 (III)(D) Applying a known technique to a known device ready for improvement to yield predicable results).
Regarding claim 13, Zhang, Intel and Kim teach the system of claim 11, Zhang further teaches
controlling the master node to assign a corresponding training task to each of the worker nodes based on the decrypted sub-training data corresponding to each of the worker nodes, and controlling the master node to transmit each training task to a corresponding worker node (Zhang, Abstract, “Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” and “In Citadel, each data owner has a dedicated training enclave, which needs to be attested by both the corresponding data owner(s) and the model owner to gain their trust. It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates. As the code has direct access to the training data, it must be shared to and agreed by the data owner ... After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation” (Zhang, Section 4.1)).
controlling each of the worker nodes to train the preset model in accordance with a corresponding training task and corresponding decrypted sub-training data to obtain a corresponding sub-training result (Zhang, Section 1, “Citadel proposes a privacy preserving mechanism to divide SGX-based ML training into training and aggregating parts, making it possible to spin up a distributed cluster to accommodate voluminous multi-sourced data” and “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates” (Zhang, Section 4.1)).
controlling each of the worker nodes to transmit the corresponding sub-training result to the master node (Zhang, Section 4.1, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
controlling the master node to gather the sub-training result of the master node and the sub-training results of the worker nodes to obtain a total training result (Zhang, Section 3.3, “The training starts once the data, model, and ML code are all loaded into the enclave. When the training completes, the model owner downloads the model, and the enclave is destroyed along with the contained data”).
repeating the above steps until the total training result meets a preset condition (Zhang, Section 4.2.2, “As described in Algorithm 1, after processing a batch, each training enclave holds its own gradients and follows a tree-structured hierarchical aggregation scheme to accumulate gradients”
PNG
media_image1.png
368
491
media_image1.png
Greyscale
Examiner notes that the algorithm shows that training function iterates through batches).
Regarding claim 16, Zhang teaches
by a host process, acquiring training data, and dividing the training data for a training node cluster employing a master-workers architecture to obtain multiple pieces of sub-training data (Zhang, Section 3.3, “Before the training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host” and “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” (Zhang, Abstract). Examiner notes that data model being uploaded to the host is mapped to acquiring data and the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the training node cluster comprises a master node and multiple worker nodes, which are used for performing model training in a collaborative manner (Zhang, Abstract, “We present Citadel, a scalable collaborative ML system that protects both data and model privacy in untrusted in frastructures equipped with Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner”. Examiner notes that the training enclaves and aggregator enclave maps to the master and worker architecture).
wherein the host process runs in a non-trusted execution environment, and the training node cluster runs in a trusted execution environment (Zhang, Section 2.2, “Training is performed on a third-party cloud trusted by neither data owners nor the model owner. The cloud instances, including privileged software like OS and hypervisor, are untrusted” and “Trusted hardware like Intel SGX(Software Guarded Extensions) offers a viable solution to create a trusted execution environment (TEE) even if the underlying platform is untrusted” (Zhang, Section 3.2)).
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Zhang, Section 3.3, “Before training begins, a data (or model) owner generates a private symmetric key and uses it to encrypt the data (or model). The encrypted data and model are then uploaded to an unprotected storage on the host, which does not have the key”).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Zhang, Section 3.3, “Once the attestation is successful, each secret owner uploads its encryption key to the enclave over a TLS protected channel, with which the enclave can retrieve the encrypted data and model from the storage and decrypt them. The training starts once the data, model, and ML code are all loaded into the enclave”).
controlling the master node and each of the worker nodes to train a preset model by using corresponding respective decrypted sub-training data, respectively, to obtain a trained model (Zhang, Section 4, “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates… After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
wherein during the training process, the master node is used for transmitting a training task to each of the worker nodes and for gathering sub-training results transmitted by the worker nodes (Zhang, Section 4, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
Zhang does not teach, but Intel does teach
by the host process, encrypting each piece of sub-training data, and storing the encrypted sub-training data in a shared memory of the host process (Intel, page 5, “A pointer argument can also be used with the user_check attribute. If the pointer argument is passed with the user_check attribute, then the trusted edge routine will not verify the point … The buffer pointed by the pointer is not copied; rather the address is passed … An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data”. Examiner notes that the buffer is mapped to the address of the shared memory).
wherein the shared memory of the host process is used for being shared by the host process and the training node cluster (Intel, page 3, “When an application makes an ECALL with the in attribute and with a pointer or array argument the trusted edge routine copies the memory content into a trusted memory area and pass the copy of the trusted environment … When an application makes an ECALL with the out attribute and with an array or pointer argument, the trusted edge routine allocates a buffer in trusted memory area, zeroes it and passes it to the trusted environment”).
by the host process, recording a data storage address of each piece of the encrypted sub-training data in the shared memory, and transmitting respective data storage addresses to corresponding master node and worker nodes, respectively wherein each data storage address corresponds to one training node (Intel, page 5, “An appropriate use of the user_check attribute in an ECALL would be to load and store an encrypted collection of data … these sorts of bulk reads and writes benefit from allowing the enclave to process larger data collections in smaller chunks”. Examiner notes that the user_check attribute is the address of the encrypted collection of data, which maps to the data storage address).
controlling the master node and each of the worker nodes to acquire corresponding encrypted sub-training data from the shared memory in accordance with corresponding data storage addresses, respectively, and to decrypt the encrypted sub-training data to obtain decrypted sub-training data (Intel, page 5, “The buffer pointed by the pointer is not copied; rather the address is passed”).
Zhang and Intel are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang to use the Intel Software Guard Extensions (Intel SGX) from Intel. Intel teaches that “proper data handling/marshalling at the edge between the trusted/untrusted code parts plays a vital role in contributing to enclave’s security” (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Zhang and Intel do not teach, but Kim does teach
A non-transitory computer-readable storage medium, wherein the computer-readable storage medium stores thereon a computer program which, when executed by a processor, causes the processor to perform the following operations for model training (Kim, claim 8, “A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for efficient and scalable enclave protection for machine learning (ML) programs”).
Zhang, Intel, and Kim are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to have their methods run on the non-transitory computer readable storage medium from Kim. One of the ordinary skill in the art would have known to apply the known technique of using a non-transitory computer readable storage medium to store instructions. Therefore, applying Kim’s technique would yield the predictable result of storing instructions into non-transitory computer readable storage mediums. (See MPEP 2141 (III)(D) Applying a known technique to a known device ready for improvement to yield predicable results).
Regarding claim 17, Zhang, Intel, and Kim teach the non-transitory computer readable storage medium of claim 16, Zhang and Intel do not teach, but Kim does teach
by the host process, activating the master node and each of the worker nodes, and controlling the master node and each of the worker nodes to generate, in accordance with a size of data volume of corresponding sub-training data, a trusted memory matched with the data volume, wherein the trusted memory is used for storing the sub-training data (Kim, paragraph 0004, “Tailoring the at least one ML program includes allocating a shared memory for computing a plurality of layers of a neural network, the shared memory reducing total memory usage during the computation of the plurality of layers, loading model parameter data for each of the plurality of layers onto the shared memory on-demand”).
Zhang, Intel, and Kim are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to apply the allocation of shared memory from Kim. One of the ordinary skill in the art would have known to apply the known technique of determining the memory size for resource allocation. Therefore, applying Kim’s technique would yield the predictable result of allocating the right amount of memory in order to optimize performance. (See MPEP 2141 (III)(D) Applying a known technique to a known device ready for improvement to yield predicable results).
Regarding claim 18, Zhang, Intel and Kim teach the non-transitory computer readable storage medium of claim 16, Zhang further teaches
controlling the master node to assign a corresponding training task to each of the worker nodes based on the decrypted sub-training data corresponding to each of the worker nodes, and controlling the master node to transmit each training task to a corresponding worker node (Zhang, Abstract, “Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner” and “In Citadel, each data owner has a dedicated training enclave, which needs to be attested by both the corresponding data owner(s) and the model owner to gain their trust. It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates. As the code has direct access to the training data, it must be shared to and agreed by the data owner ... After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation” (Zhang, Section 4.1)).
controlling each of the worker nodes to train the preset model in accordance with a corresponding training task and corresponding decrypted sub-training data to obtain a corresponding sub-training result (Zhang, Section 1, “Citadel proposes a privacy preserving mechanism to divide SGX-based ML training into training and aggregating parts, making it possible to spin up a distributed cluster to accommodate voluminous multi-sourced data” and “It takes private data as input, runs data handling code (e.g., compute gradient updates) provided by the model owner, and generates model updates” (Zhang, Section 4.1)).
controlling each of the worker nodes to transmit the corresponding sub-training result to the master node (Zhang, Section 4.1, “After the model updates are computed, the training enclave sends them to the aggregator enclave for global aggregation”).
controlling the master node to gather the sub-training result of the master node and the sub-training results of the worker nodes to obtain a total training result (Zhang, Section 3.3, “The training starts once the data, model, and ML code are all loaded into the enclave. When the training completes, the model owner downloads the model, and the enclave is destroyed along with the contained data”).
repeating the above steps until the total training result meets a preset condition (Zhang, Section 4.2.2, “As described in Algorithm 1, after processing a batch, each training enclave holds its own gradients and follows a tree-structured hierarchical aggregation scheme to accumulate gradients”
PNG
media_image1.png
368
491
media_image1.png
Greyscale
Examiner notes that the algorithm shows that training function iterates through batches).
Claim(s) 4-6, 9, and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Zhang in view of Intel and Kim et al. (An Optimization Methodology for Adapting Legacy SGX Applications to Use Switchless Calls) (hereafter referred to as Kim SGX).
Regarding claim 4, Zhang and Intel teach the method of claim 1, Zhang and Intel do not teach, but Kim SGX does teach
by the host process, creating a target number of queues based on the number of the worker nodes, wherein the target number is twice the number of the worker nodes (Kim SGX, Section 3.2, “The goal of switchless calls is to eliminate enclave switches from SGX applications by making ECALL and OCALL themselves switchless, which are functions used for entering/leaving SGX enclaves. For this, an SGX run-time library executes two worker threads, one in the application (untrusted) memory region and the other in the enclave (trusted) memory region. The application worker thread handles ECALL, while the enclave worker thread handles OCALL, respectively. There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”. Examiner notes that for each enclave, there are two worker threads, which maps to there being twice the number of threads).
wherein the target number of queues is used for performing bidirectional communication between the master node and the multiple worker nodes (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”. Examiner notes that the request and response queue indicate that there is a bidirectional communication).
Zhang, Intel, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 5, Zhang, Intel, and Kim SGX teach the method of claim 4, Kim SGX further teaches
each two queues of the target number of queues are paired, and each pair of queues is used for performing bidirectional communication between the master node and one of the worker nodes (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”).
by the host process, storing the target number of queues in the shared memory, and generating a queue storage address of each queue (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”.
PNG
media_image2.png
245
598
media_image2.png
Greyscale
Examiner notes that the worker threads are stored in the untrusted region, which is mapped to the host process).
by the host process, transmitting the queue storage address of each queue in the target number of queues to the master node, and transmitting the queue storage addresses of each pair of queues to a corresponding worker node (Kim SGX, Section 3.2, “SGX developers can quickly adopt switchless SGX by linking libraries and specifying which OCALLs and ECALLs to apply switchless SGX”)
wherein the master node and each of the worker nodes communicate based on corresponding queue storage addresses (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”).
Zhang, Intel, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 6, Zhang, Intel, and Kim SGX teach the methods of claim 5, Zhang further teaches
controlling the master node to, after encrypting first target data, write the encrypted first target data into the queue storage address of the first queue (Zhang, Section 3.2, “Any memory usage beyond the EPC will cause enclave pages to evict to the unprotected main memory. To ensure the confidentiality and integrity of the evicted EPC pages, SGX uses symmetric key cryptography, which compounds to a large overhead as the number of evictions increases”).
controlling the worker node to, after encrypting second target data, write the encrypted second target data into the queue storage address of the second queue, and controlling the master node to acquire the encrypted second target data in accordance with the queue storage address of the second queue (Zhang, Section 3.2, “Any memory usage beyond the EPC will cause enclave pages to evict to the unprotected main memory. To ensure the confidentiality and integrity of the evicted EPC pages, SGX uses symmetric key cryptography, which compounds to a large overhead as the number of evictions increases”).
Zhang does not teach, but Kim SGX does teach
controlling the master node to, after encrypting first target data, write the encrypted first target data into the queue storage address of the first queue (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue”).
controlling the worker node to acquire the encrypted first target data in accordance with the queue storage address of the first queue (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL”).
controlling the worker node to, after encrypting second target data, write the encrypted second target data into the queue storage address of the second queue, and controlling the master node to acquire the encrypted second target data in accordance with the queue storage address of the second queue (Kim SGX, Section 3.2, “Finally, the worker thread updates the response queue”).
Zhang, Intel, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 9, Zhang, Intel, and Kim SGX teach the method of claim 9, Zhang further teaches
the master node and at least a portion of the worker nodes are distributed on different physical machines (Zhang, Section 1, “It is already unrealistic to train a state-of-the-art ML model with a large dataset on a single machine within a reasonable amount of time, and adopting SGX only makes the matter worse by introducing steep performance degradation” and “We use MongoDB as the storage service, and containerize all system components and orchestrate them in Kubernetes. Our implementation consists of 5,000 lines of Python code and Linux Shell script” (Zhang, Section 4)).
with respect to a target physical machine on which the master node is distributed, creating a target number of queues based on the number of the worker nodes on the target physical machine by the host process which is on the target physical machine, wherein the target number is twice the number of the worker nodes on the target physical machine (Zhang, Section 1, “It is already unrealistic to train a state-of-the-art ML model with a large dataset on a single machine within a reasonable amount of time, and adopting SGX only makes the matter worse by introducing steep performance degradation” and “We use MongoDB as the storage service, and containerize all system components and orchestrate them in Kubernetes. Our implementation consists of 5,000 lines of Python code and Linux Shell script” (Zhang, Section 4)).
wherein the target number of queues is used for performing bidirectional communication between the master node on the target physical machine and multiple worker nodes on the target physical machine (Zhang, Section 1, “It is already unrealistic to train a state-of-the-art ML model with a large dataset on a single machine within a reasonable amount of time, and adopting SGX only makes the matter worse by introducing steep performance degradation” and “We use MongoDB as the storage service, and containerize all system components and orchestrate them in Kubernetes. Our implementation consists of 5,000 lines of Python code and Linux Shell script” (Zhang, Section 4)).
Zhang does not teach, but Kim SGX does teach
with respect to a target physical machine on which the master node is distributed, creating a target number of queues based on the number of the worker nodes on the target physical machine by the host process which is on the target physical machine, wherein the target number is twice the number of the worker nodes on the target physical machine (Kim SGX, Section 3.2, “The goal of switchless calls is to eliminate enclave switches from SGX applications by making ECALL and OCALL themselves switchless, which are functions used for entering/leaving SGX enclaves. For this, an SGX run-time library executes two worker threads, one in the application (untrusted) memory region and the other in the enclave (trusted) memory region. The application worker thread handles ECALL, while the enclave worker thread handles OCALL, respectively. There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”. Examiner notes that for each enclave, there are two worker threads, which maps to there being twice the number of threads).
wherein the target number of queues is used for performing bidirectional communication between the master node on the target physical machine and multiple worker nodes on the target physical machine (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”. Examiner notes that the request and response queue indicate that there is a bidirectional communication).
Zhang, Intel, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 10, Zhang, Intel, and Kim SGX teach the method of claim 9, Zhang further teaches
with respect to another physical machine on which the master node is not distributed, controlling the worker nodes distributed on the another physical machine to perform bidirectional communication with the master node on the target physical machine by adopting a Transmission Control Protocol (TCP) (Zhang, Section 5, “As the host infrastructure is not trusted, encrypted data and models must be decrypted within the enclaves. In addition, network connections between enclaves must be secured with TLS. These requirements result in substantial cryptographic operations performed inside an enclave. Especially during the aggregation process, a single enclave has to decrypt results from multiple enclaves and add them up”. Examiner notes that TLS runs on top of TCP).
Claim(s) 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Zhang in view of Intel and Priebe et al. (SGX-LKL: Securing the Host OS Interface for Trusted Execution) (hereafter referred to as Priebe).
Regarding claim 7, Zhang and Intel teach the method of claim 1, Zhang further teaches
controlling the master node and each of the worker nodes to train the preset model based on the threads within a corresponding respective thread pool, respectively, to obtain the trained model (Zhang, Section 3.3, “we employ techniques like hierarchical aggregation and multi-threading with pre-compiled C libraries to make ML workloads adapt to SGX’s memory constraints”).
Zhang does not teach, but Priebe does teach
by the host process, creating a thread pool for the master node and each of the worker nodes, respectively, wherein each thread pool comprises a preset number of threads (Priebe, Section 3.2, “SGX allows multiple host threads to enter an enclave, The maximum number of enclave threads, however, must be specified at enclave creation time, which prevents dynamic thread creation … Therefore, SGX-LKL implements user-level threading based on the lthread library and provides synchronisation primitives inside the enclave. A fixed number of host threads are assigned to enclave threads, which enter the enclave at startup and only leave when idle”).
Zhang, Intel, and Priebe are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang and Intel to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Claim(s) 14, 15, 19, 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Zhang in view of Intel, Kim, and Kim SGX.
Regarding claim 14, Zhang, Intel, and Kim teach the system of claim 11, Zhang, Intel, and Kim do not teach, but Kim SGX does teach
by the host process, creating a target number of queues based on the number of the worker nodes, wherein the target number is twice the number of the worker nodes (Kim SGX, Section 3.2, “The goal of switchless calls is to eliminate enclave switches from SGX applications by making ECALL and OCALL themselves switchless, which are functions used for entering/leaving SGX enclaves. For this, an SGX run-time library executes two worker threads, one in the application (untrusted) memory region and the other in the enclave (trusted) memory region. The application worker thread handles ECALL, while the enclave worker thread handles OCALL, respectively. There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”. Examiner notes that for each enclave, there are two worker threads, which maps to there being twice the number of threads).
wherein the target number of queues is used for performing bidirectional communication between the master node and the multiple worker nodes (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”. Examiner notes that the request and response queue indicate that there is a bidirectional communication).
Zhang, Intel, Kim, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang, Intel, and Kim to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 15, Zhang, Intel, Kim, and Kim SGX teach the system of claim 14, Kim SGX further teaches
each two queues of the target number of queues are paired, and each pair of queues is used for performing bidirectional communication between the master node and one of the worker nodes (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”).
by the host process, storing the target number of queues in the shared memory, and generating a queue storage address of each queue (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”.
PNG
media_image2.png
245
598
media_image2.png
Greyscale
Examiner notes that the worker threads are stored in the untrusted region, which is mapped to the host process).
by the host process, transmitting the queue storage address of each queue in the target number of queues to the master node, and transmitting the queue storage addresses of each pair of queues to a corresponding worker node (Kim SGX, Section 3.2, “SGX developers can quickly adopt switchless SGX by linking libraries and specifying which OCALLs and ECALLs to apply switchless SGX”)
wherein the master node and each of the worker nodes communicate based on corresponding queue storage addresses (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”).
Zhang, Intel, Kim, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang, Intel, and Kim to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 19, Zhang, Intel, and Kim teach the non-transitory computer readable storage medium of claim 11, Zhang, Intel, and Kim do not teach, but Kim SGX does teach
by the host process, creating a target number of queues based on the number of the worker nodes, wherein the target number is twice the number of the worker nodes (Kim SGX, Section 3.2, “The goal of switchless calls is to eliminate enclave switches from SGX applications by making ECALL and OCALL themselves switchless, which are functions used for entering/leaving SGX enclaves. For this, an SGX run-time library executes two worker threads, one in the application (untrusted) memory region and the other in the enclave (trusted) memory region. The application worker thread handles ECALL, while the enclave worker thread handles OCALL, respectively. There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”. Examiner notes that for each enclave, there are two worker threads, which maps to there being twice the number of threads).
wherein the target number of queues is used for performing bidirectional communication between the master node and the multiple worker nodes (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”. Examiner notes that the request and response queue indicate that there is a bidirectional communication).
Zhang, Intel, Kim, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang, Intel, and Kim to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Regarding claim 20, Zhang, Intel, and Kim teach the non-transitory computer readable storage medium of claim 11, Zhang, Intel, and Kim do not teach, but Kim SGX does teach
each two queues of the target number of queues are paired, and each pair of queues is used for performing bidirectional communication between the master node and one of the worker nodes (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”).
by the host process, storing the target number of queues in the shared memory, and generating a queue storage address of each queue (Kim SGX, Section 3.2, “There are two thread pools to handle switchless ECALL and OCALL, and worker threads are executed asynchronously. For asynchronous execution, switchless calls utilize two shared queues: a request queue and a response queue”.
PNG
media_image2.png
245
598
media_image2.png
Greyscale
Examiner notes that the worker threads are stored in the untrusted region, which is mapped to the host process).
by the host process, transmitting the queue storage address of each queue in the target number of queues to the master node, and transmitting the queue storage addresses of each pair of queues to a corresponding worker node (Kim SGX, Section 3.2, “SGX developers can quickly adopt switchless SGX by linking libraries and specifying which OCALLs and ECALLs to apply switchless SGX”)
wherein the master node and each of the worker nodes communicate based on corresponding queue storage addresses (Kim SGX, Section 3.2, “When a caller thread inside an enclave invokes an OCALL, it first updates the request queue. Then, one of the worker threads from the thread pool in the untrusted region is assigned and handles the OCALL. Finally, the worker thread updates the response queue”).
Zhang, Intel, Kim, and Kim SGX are considered analogous to the claimed invention because they deal with enclave protection. It would have been obvious to one having ordinary skill in the art prior to the effective filling date to have modified Zhang, Intel, and Kim to use the switchless calls from Kim SGX. Kim SGX teaches “The switchless call aims to enhance the performance of SGX applications that use the asynchronous threading model” (Kim SGX, Section 4.1) (See MPEP 2141 (III)(G) Some teaching, suggestion, or motivation in the prior art that would have led one of ordinary skill to modify the prior art reference or to combine prior art reference teachings to arrive at the claimed invention).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Intel® Software Guard Extensions (Intel® SGX) Developer Guide discloses the Intel SGX technology. Chen et al. (TOWARDS EFFICIENTLY ESTABLISHING MUTUAL DISTRUST BETWEEN HOST APPLICATION AND ENCLAVE FOR SGX) discloses SGXCapsule, which is based on Intel SGX. Yuhala et al. (SGX Switchless Calls Made Configless) discloses a ZC-Switchless system that dynamically select switchless routines at run time and configure the most appropriate number of worker threads on the fly.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to STEVEN VO whose telephone number is (571)272-9622. The examiner can normally be reached Monday - Friday from 7-3 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michelle Bechtold can be reached at (571) 431-0762. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/S.V./Examiner, Art Unit 2148 /MICHELLE T BECHTOLD/Supervisory Patent Examiner, Art Unit 2148
Prosecution Insights