Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claims 1-20 are presented for examination.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) the limitations of a method for data storage comprising “mapping protected information of” two VMs to area of a cache which is a process that can be perform in the mind. The limitations encompass a human mind carrying out the function through observation, evaluation, judgment and /or opinion, or even with the aid of pen and paper, therefore, it falls within the “Mental Processes” grouping of abstract ideas.
This judicial exception is not integrated into a practical application. In particular, the claim recites the following additional elements of “applied to a cloud system that includes a plurality of virtual machines and a control device, the method being performed by the control device” is recited so generically that they represent not more than mere instructions to apply the exception using or on a generic computing system and performing generic computer function. Additionally, “receiving at least two requests …” do nothing more than add insignificant extra solution activity to the judicial exception of merely gathering or transmitting data. Accordingly, the additional elements do not integrate the recited judicial exception into a practical application because it does not impose any meaningful limits on practicing the abstract idea, the claim is therefore directed to the judicial exception. See MPEP 2106.05(g).
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of “applied to a cloud system that includes a plurality of virtual machines and a control device, the method being performed by the control device” is recited so generically that they represent no more than mere instructions to apply the exception using or on a generic computing system and performing generic computer function, and as to the “receiving at least two requests …”, the courts have identified mere data transmission as well-understood, routine and conventional activities. See MPEP 2106.05(d). Accordingly, the claim is not patent eligible under 35 USC 101.
As to claim 5, the claim recites additional mental process of “mapping…” which is rejected for the same reason as claim 1 above.
As to claims 6-8, the claims recite the additional elements of “an identifier of a computational library” and “storage information” as being included in the request which is merely insignificant extra solution activity under prong 2. Under step 2B, as explained above, the courts have identified transmitting data/information as well-understood, routine and conventional activity.
As to claim 9, the claim does not recite any mental process, however, the additional elements recited in the claim merely describes the use of the request “to indication critical information”, thus are considered to merely apply the abstract idea which is neither a practical application under prong 2, or amount to significantly more under step 2B.
As to claims 10-11, the claim does not recite any mental process, however, the additional elements recited in the claim merely describes the location of “the cache”, thus are considered to merely apply the abstract idea which is neither a practical application under prong 2, or amount to significantly more under step 2B.
As to claims 12-13, the claims recite the additional elements of the timing of “receiving the at least two requests” which is merely insignificant extra solution activity under prong 2. Under step 2B, as explained above, the courts have identified transmitting data/information as well-understood, routine and conventional activity.
As to claims 15 and 19, these claims are rejected for the same rationale as claims 1 and 5 above. Additionally, the claims recite the additional elements of “a computing device”, “at least one processor” and “memory” to perform the method which are merely generic computer components, thus is neither a practical application under prong 2, nor amount to significantly more under step 2B.
As to claim 20, this claim is rejected for the same rationale as claim 1 above. Additionally, the claims recite the additional elements of “non-transitory computer-readable storage medium, having stored thereon computer instructions” and “a computer” to perform the method which are merely generic computer components, thus is neither a practical application under prong 2, nor amount to significantly more under step 2B.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-2, 6, 8-9, 11-12, 14-16 and 20 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US Patent 10,706,147 to Pohlack et al. (hereafter Pohlack).
As to claim 1, Pohlack teaches the invention as claimed including a method for data storage, applied to a cloud system that includes a plurality of virtual machines (VMs) and a control device, the method being performed by the control device [in a network environment having computing devices implementing a virtualization host executing a plurality of co-located VMs and implementation of a system and method(s) for mitigating side-channel attacks using a shared cache, abstract; col. 6, line 65-col. 7, line 30], the method comprising:
receiving at least two requests from at least two VMs among the plurality of VMs, wherein a request from each VM of the at least two VMs is used to indicate protected information of the VM [one or more victims accessing the shared cache, col. 11, lines 11-21; side-channel attack aim to review confidential information such as encryption keys of victim(s), col. 1, lines 44-47; col. 3, lines 38-55]; and
mapping protected information of the at least two VMs to a first area of a cache [mapping of eviction/primed set in the shared cache as well as mapping victim memory page(s) to the primed cache set as a result of access to the shared cache by the victim(s), col. 10, line 50-col. 11, line 21].
As to claim 2, Pohlack teaches the invention as claimed including wherein mapping the protected information of the at least two VMs to the first area of the cache, includes: adjusting storage areas in a main memory for the protected information of the at least two VMs [changing memory mapping between VM memory pages to the host memory pages in a shuffling operation, col. 4, lines 24-48; col. 12, lines 4-12 and 26-31].
As to claim 6, Pohlack teaches the invention as claimed including wherein the request of each VM of the at least two VMs includes an identifier of a computational library that the VM uses [deduce/infer by extracting a key from the share cache access for an ecryption software library, col. 3, lines 38-50].
As to claim 8, Pohlack teaches the invention as claimed including wherein the request of each VM of the at least two VMs includes storage information of the VM [victim VMs access to a page, col. 11, lines 12-14].
As to claim 9, Pohlack teaches the invention as claimed including wherein the request of each VM of the at least two VMs is used to indicate critical information that the VM uses, and the critical information includes at least one of an encryption algorithm, an encryption library, packet metadata, an interpreted code, or persistently stored identity secrets [victim VMs access to a page, col. 11, lines 12-14; access pattern can be used to deduce encryption/decryption operation, col. 3, lines 38-55; col. 11, lines 23-26].
As to claim 11, Pohlack teaches the invention as claimed including wherein the cache is a cache in a processor where any of the plurality of VMs is deployed in the cloud system [in a network environment having computing devices implementing a virtualization host executing a plurality of co-located VMs and implementation of a system and method(s) for mitigating side-channel attacks using a shared cache, abstract; col. 6, line 65-col. 7, line 30; software including VMs or VM instances executing on hardware including processor and shared cache located on the CPU chip/processor, Fig. 1 and corresponding text]
As to claim 12, Pohlack teaches the invention as claimed including wherein receiving the at least two requests from the at least two VMs among the plurality of VMs, includes: receiving the at least two requests from the at least two VMs within a period [time interval for one or more victims to access the cache, col. 11, lines 20-22].
As to claim 14, Pohlack teaches the invention as claimed including wherein the cloud system further includes a detection device; and the method further comprises: controlling the detection device to detect whether an attack exists in the cloud system; and receiving alert information sent by the detection device when the detection device detects the attack [memory usage monitor detecting potential side-channel attacks and triggering corrective actions including alerting the host, col. 8, lines 31-36 and 41-49; col. 9, lines 23-45; col. 12, lines 4-14].
As to claims 15-16, Pohlack teaches the method for data storage, applied to a cloud system that includes a plurality of virtual machines (VMs) and a control device as claimed in claims 1-2, therefore Pohlack teaches the device for implementing the method.
As to claim 20, Pohlack teaches the method for data storage, applied to a cloud system that includes a plurality of virtual machines (VMs) and a control device as claimed in claim 1, therefore Pohlack teaches the non-transitory computer-readable storage medium, having stored thereon computer instructions that, when executed by a computer, cause the computer to perform the method.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 10 and 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Pohlack as applied to claim 1 above.
As to claim 10, Pohlack does not specifically teach wherein the cache is a cache in a processor other than a processor where the plurality of VMs are deployed in the cloud system. However, Pohlack disclosed the cache being in a computing device(s) of a network environment that implements a virtualization host executing a plurality of co-located VMs and implementation of a system and method(s) for mitigating side-channel attacks on the cache [abstract; col. 6, line 65-col. 7, line 30] such that the VMs or VM instances execute on hardware including processor and shared cache located on the CPU chip/processor [Fig. 1 and corresponding text]. Furthermore, centralized web caching where the cache or processor where cache occurs is remote with respect to the processes/VMs is well known in the art and would have been obvious to one or ordinary skill in the art before the effective filing date of the claim invention to have implement a well known method in achieving the predictable result of caching.
As to claim 13, Pohlack does not specifically teach receiving the at least two requests from the at least two VMs at the same time. However, Pohlack teaches a time interval for one or more victims to access the cache [col. 11, lines 20-22]. Furthermore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claim invention to have recognized that requests or access to the cache can be received either at the same or different time and to have alternatively implement one or the other as a matter of design choice.
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Patent 9,009,385 disclosed a virtual machine in a cloud environment to test/verify whether other virtual machines are running on the same physical server and to stay away from a chosen part of the machine’s cache memory for a short time and watch that area for unexpected activity. If enough activity is seen, the system infers that some other virtual machine is sharing the same hardware. The technique is intended to help cloud tenants verify whether they really have exclusive use of a server. Multiple friend virtual machines cooperate, although a single virtual machine can also perform the detection. The selected memory area is often a cache set or group of cache sets, especially in L2 cache. The system may randomly choose which cache sets to avoid for each detection period. The virtual machines may also use a prime-probe timing technique to detect cache interference. To keep the test reliable, the virtual machines may remap memory pages so they do not use the chosen cache sets. The result is an indication that another, unrelated tenant may be co-resident on the same physical machine.
US Patent 10,868,665 disclosed a solution in addressing side-channel attack by rearranging code so that different branches of a program are mixed together in the same cache lines, making them look the same to an observer; scrambles data structures so that sensitive table entries or other elements appear in unpredictable memory locations. The system may use a compiler, analysis tool, or post-processor to detect likely sensitive code or data and then transform the application automatically. The sensitive data can include cryptographic keys or data used to derive keys. The scrambling can be based on an unpredictable address translation function initialized with a random value at runtime. The translation can also be changed periodically to re-scramble the data.
US Patent 12,229,248 disclosed another solution in addressing cache-based side-channel attacks by moving a memory page between different physical pages over time. The system uses a main memory and a shared cache, where the cache’s set selection depends partly on certain address bits. Instead of always using the same physical page for a virtual page, the system reserves multiple physical pages that differ in those cache-relevant address bits. When the virtual page is accessed or a remap event occurs, the system switches which physical page is mapped to that virtual page. Because the underlying physical page changes, the virtual page’s cache-set behavior also changes over time. That makes it harder for an attacker to predict which cache set to monitor. The approach is described for ordinary processes and for virtual machines.
“Random Fill Cache Architecture” disclosed the implementation of random fill cache architecture in preventing cache side-channel attacks.
Allowable Subject Matter
Claims 5, 7 and 19 are allowable by overcoming the 35 U.S.C. 101 rejection above.
Claims 3-4 and 17-18 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is a statement of reasons for the indication of allowable subject matter:
The prior arts of record when taken individually or in combination do not expressly teach or render obvious, in the context of the claims taken as a whole, the invention as recited in claims 3-5, 7 and 17-19.
The prior art(s) of record when taken individually or in combination do not expressly teach or render obvious the invention as a whole as recited in claims 3-5, 7 and 17-19.
Neither a reference uncovered that would have provided a basis of evidence for asserting a motivation, nor one of ordinary skill in the art before the effective filing date of the claimed invention, knowing the teaching of the prior arts of record would have combined them to arrive at the present invention as recited in the context of claims 3-5, 7 and 17-19 as a whole.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to QING YUAN WU whose telephone number is (571)272-3776. The examiner can normally be reached M-F 9AM-6PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lewis Bullock can be reached on 571-272-3759. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/QING YUAN WU/Primary Examiner, Art Unit 2199
Prosecution Insights