DETAILED ACTION
1. Claims 1-20 are pending in this examination.
Notice of Pre-AIA or AIA Status
2.1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2.2. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Allowable Subject Matter
3. Claims 7 and 14 objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Response to Arguments
4. Applicant's arguments have been considered but are moot in view of the new ground(s) of rejection.
Claim Rejections - 35 USC § 103
5.1. The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
5.2. Claims 1, 8 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over US Patent Application No. 20150277949 to Loh et al (“Loh”) in view of US Patent Application No. 20120117614 to Sahita et al (“Sahita”), and in view of US Patent Application No. 20100088699 to Sasaki et al (“Sasaki”).
As per claim 1, Loh discloses a data register access method, comprising: determining a first virtual machine identifier and a first address of a to-be-accessed data [0052] discloses tagging the transaction with a VMID. Para [0046] teaches including the VMID and the memory address in the request, fig. 4 and associated texts),
determining an access permission of the target virtual machine to the [memory address] [0052] teaches that the interconnect determines whether to allow access. This is interpreted as "determining an access permission fig. 4 and associated texts); and
determining, based on the first address, the to-be-accessed data ([0052] teaches to allow the access if the firewall rules match the VM/O, fig. 4 and associated texts).
Loh does not explicitly disclose however in the same field of endeavor, Sahita discloses wherein the first address indicates a position of the to-be-accessed data register in a target data register group to which the to-be-accessed data register belongs, and the to-be-accessed data register is a data register to be accessed; determining, based on the first virtual machine identifier, a target data register group and a target protection register that correspond to the target virtual machine from the at
least two data register groups and a preset protection register group; target data register group by using a second virtual machine identifier stored in the target protection register; register from the target data register group ([0036], TPM access control module 118 provides partitioning of the Platform Configuration Registers (PCRs) amongst the VMs (120, 122) that require access to TPM 106. TPM access control module 118 maps I/O (input/output) accesses to a specific PCR register set of TPM 106 based on the specific VM accessing TPM 106. In one embodiment, the VM ID (identification) may be used as an offset to a register bank. For example, when there are two VMs that may need access to TPM 106, wherein TPM 106 has 32 PCRs, the first VM, referred to as VM1, may access PCR register set 0-15 and the second VM, referred to as VM2, may access register set 16-31. In one embodiment, a Virtual Machine Control Structure (VMCS) is used to identify the VM. The VMCS structure consists of a VM ID (Identification) field and an Execution Instruction Pointer (EIP) field. The VM ID field identifies the VM. The EIP field is a pointer for the corresponding PCR register set).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Loh with the teaching of Sahita by including the feature of accessing register bank, in order for Loh’s system for high performance secure access to a trusted platform module on a hardware virtualization platform. Embodiments of the present invention describe an apparatus and method for achieving high performance access to a Trusted Platform Module (TPM) in a virtualization technology (VT) enabled host platform without loss of performance (in terms of added virtual device models) or loss of security. This is accomplished using a virtualized model that enables a guest OS (Operating System) or VM (Virtual Machine) to run a TPM device driver (TDD), and a VMM (Virtual Machine Monitor) to create a partition in memory for the TDD in the guest OS such that any other code at the same privilege level in the guest OS cannot access the memory contents of the TPM device driver and to map accesses to the TPM to the correct register set designated for the guest OS. Contents of the TPM requested by the TPM device driver are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD (Sahita, [0019]).
Loh and Sahita not explicitly disclose however in the same field of endeavor, Sasaki discloses generating a virtual machine identifier corresponding to each data register group of at least two data register groups based on an address realm of the each data register group ([0227]-[0230], [0025]), and storing the virtual machine identifier into a database protection register corresponding to the each data register group, wherein the each data register group corresponds to a virtual machine ([0232]);
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Loh with the teaching of Sahita/Sasaki by including the feature of accessing register bank, in order for Loh’s system for securely executing a virtual machine image and collecting user data. It makes possible to accomplish by distributing only a partial disk image to be substituted among three areas in the disk image area of a virtual machine image, i.e., the OS area, the application area, and the user data area. A virtual machine image generation means 102 generates a virtual machine image by combining a device configuration file, a virtual device configuration file, and three disk images (OS disk image, provisioning disk image, and user data disk image) stored in a virtual machine component storage means 101. A virtual machine image distribution means 103 distributes a virtual machine image generated by the virtual machine image generation means 102. A disk map generation means 106 generates a map of a write protection area and a map of an area where collection is carried out (Sasaki, abstract).
Claims 8 and 15, are rejected for similar reasons as stated above.
5.2. Claims 2-6, 9-13, and 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over Loh, Sahita and Sasaki as applied to claim above, and in view of US Patent Application No. 20190361818 to Ichikawa et al (“Ichikawa”).
As per claim 2, the combination of Loh, Sahita and Sasaki discloses the invention as described above. Loh, Sahita and Sasaki do not explicitly disclose however, In the same field of endeavor, Ichikawa discloses the method according to claim 1, wherein the determining an access permission of the target virtual machine to the target data register group by using a second virtual machine identifier stored in the target protection register comprises: obtaining the second virtual machine identifier stored in the target protection register; and determining the access permission of the target virtual machine to the target data register group based on the first virtual machine identifier and the second virtual machine identifier (Ichikawa, [0009], [0028]-[0029], also see [0073]-[0074]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Loh with the teaching of Sahita/ Sasaki / Ichikawa by including the feature of pre-stored id, in order for Loh’s system to provide a memory protection circuit and a memory protection method suitable for quick data transfer between a plurality of virtual machines via a common memory, according to an embodiment, a memory protection circuit includes a first ID storing register that stores therein an ID of any of a plurality of virtual machines managed by a hypervisor, an access determination circuit that permits the virtual machine having the ID stored in the first ID storing register to access a memory, a second ID storing register that stores therein an ID of any of the virtual machines, and an ID update control circuit that permits the virtual machine having the ID stored in the second ID storing register to rewrite the ID stored in the first ID storing register (Ichikawa, abstract).
As per claim 3, the combination of Loh, Sahita, Sasaki and Ichikawa discloses the method according to claim 2, wherein the determining the access permission of the target virtual machine to the target data register group based on the first virtual machine identifier and the second virtual machine identifier comprises: generating an enable signal based on the first virtual machine identifier and the second virtual machine identifier; and enabling the access permission of the target virtual machine to the target data register group based on the enable signal (Ichikawa, [0042]-[0043], also see [0073]-[0074]). The motivation regarding the obviousness of claim 2 is also applied to claim 3.
As per claim 4, the combination of Loh, Sahita, Sasaki and Ichikawa discloses the method according to claim 1, wherein the determining a first virtual machine identifier and a first address of a to-be-accessed data register from a register access request generated by a target virtual machine comprises: extracting a second address of the to-be-accessed data register from the register access request; extracting first bit-segment data from the second address; determining the first virtual machine identifier based on the first bit-segment data; extracting second bit-segment data from the second address; and determining the first address of the to-be-accessed data register based on the second bit-segment data (Ichikawa, [0045]-[0048]). The motivation regarding the obviousness of claim 2 is also applied to claim 4.
As per claim 5, the combination of Loh, Sahita, Sasaki and Ichikawa discloses the method according to claim 2, wherein the determining the access permission of the target virtual machine to the target data register group based on the first virtual machine identifier and the second virtual machine identifier comprises: generating a disable signal in response to determining that the first virtual machine identifier and the second virtual machine identifier do not meet an authorization condition, and disabling the access permission of the target virtual machine to the target data register group based on the disable signal (Ichikawa, [0092]-[0094]). The motivation regarding the obviousness of claim 2 is also applied to claim 5.
As per claim 6, the combination of Loh, Sahita, Sasaki and Ichikawa discloses the method according to claim 1, wherein the determining, based on the first virtual machine identifier, a target data register group and a target protection register that correspond to the target virtual machine from the at least two data register groups and a preset protection register group comprises: determining, based on the first virtual machine identifier, the target data register group from the at least two data register groups, and determining an address offset between the target data register group and the target protection register; and determining the target protection register from the protection register group based on the address offset (Sahita, [0036]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Loh with the teaching of Sahita/ Sasaki / Ichikawa by including the feature of accessing register bank, in order for Loh’s system for high performance secure access to a trusted platform module on a hardware virtualization platform. Embodiments of the present invention describe an apparatus and method for achieving high performance access to a Trusted Platform Module (TPM) in a virtualization technology (VT) enabled host platform without loss of performance (in terms of added virtual device models) or loss of security. This is accomplished using a virtualized model that enables a guest OS (Operating System) or VM (Virtual Machine) to run a TPM device driver (TDD), and a VMM (Virtual Machine Monitor) to create a partition in memory for the TDD in the guest OS such that any other code at the same privilege level in the guest OS cannot access the memory contents of the TPM device driver and to map accesses to the TPM to the correct register set designated for the guest OS. Contents of the TPM requested by the TPM device driver are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD (Sahita, [0019]).
Claims 9 and 16, are rejected for similar reasons as stated above, and claim 2.
Claims 10 and 17, are rejected for similar reasons as stated above, and claim 3.
Claims 11 and 18, are rejected for similar reasons as stated above, and claim 4.
Claims 12 and 19, are rejected for similar reasons as stated above, and claim 5.
Claims 13 and 20, are rejected for similar reasons as stated above, and claim 5.
6.1 The prior art made of record and not relied upon is considered pertinent to applicant's disclosure as the prior art discloses many of the claim features (See PTO-form 892).
6.2. a). US Patent Application No. 20210049045 to Leng et al., discloses to provide a memory protection circuit and a memory protection method suitable for quick data transfer between a plurality of virtual machines via a common memory, according to an embodiment, a memory protection circuit includes a first ID storing register that stores therein an ID of any of a plurality of virtual machines managed by a hypervisor, an access determination circuit that permits the virtual machine having the ID stored in the first ID storing register to access a memory, a second ID storing register that stores therein an ID of any of the virtual machines, and an ID update control circuit that permits the virtual machine having the ID stored in the second ID storing register to rewrite the ID stored in the first ID storing register.
b). US Patent Application No. 20090006801 to Shultz et al., discloses management of virtual memory allocated by a virtual machine control program to a plurality of virtual machines. Each of the virtual machines has an allocation of virtual private memory divided into working memory, cache memory and swap memory. The virtual machine control program determines that it needs additional virtual memory allocation, and in response, makes respective requests to the virtual machines to convert some of their respective working memory and/or cache memory to swap memory. At another time, the virtual machine control program determines that it needs less virtual memory allocation, and in response, makes respective requests to the virtual machines to convert some of their respective swap memory to working memory and/or cache memory.
Conclusion
7. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARUNUR RASHID whose telephone number is (571)270-7195. The examiner can normally be reached 9 AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A. Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
HARUNUR . RASHID
Primary Examiner
Art Unit 2497
/HARUNUR RASHID/Primary Examiner, Art Unit 2497