DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to communication from applicant received on January 16, 2026.
Response to Amendment
Applicant's submission filed on January 16, 2026 has been entered. Claims 11-19 are pending in the current application. Claims 11-19 are rejected.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 11-12 and 15-17 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Shahar et al. (Hereinafter Shahar, U.S. Publication No. 2019/0332291).
Regarding claim 11, Shahar teaches:
A method for providing an access point for measuring and calibrating one or more functions of a computing unit, the one or more functions being implemented by executing corresponding computer programs in at least one virtualized execution environment in the computing unit (See [0015] “the computer program code are configured, with the at least one controller, to further cause the apparatus to allow execution of an operation by the requesting virtual function using the requested target location,” See [0023] “The use of virtual functions in a Single Root I/O Virtualization (SRIOV) environment may require allocation of a certain amount of device memory for the virtual function”), wherein the at least one virtualized execution environment is provided by a management layer in the computing unit and outside of the at least one virtualized execution environment (See [0023] “The use of virtual functions in a Single Root I/O Virtualization (SRIOV) environment may require allocation of a certain amount of device memory for the virtual function.” See [0030] “the allocating entity 10 is a Peripheral Component Interconnect Express (PCIe) device with virtual functions operated in an SRIOV environment.”), wherein the management layer is configured to dynamically allocate a respective memory area in the computing unit to the at least one virtualized execution environment (See [0007] “the memory allocating framework is configured to allow execution of an operation by the requesting virtual function using the requested target location” See [0023] “The use of virtual functions in a Single Root I/O Virtualization (SRIOV) environment may require allocation of a certain amount of device memory for the virtual function.” See [0023] “example embodiments allocate physical memory to a virtual function by dynamically assigning or mapping to a particular virtual function at least one target location from a plurality of available target locations of the physical memory in the Base Address Registers (BAR) associated with the virtual function.” See [0046] “dynamically mapping or assigning at least one target location 309 of the physical memory 110 in the BAR comprises continuously assigning available target addresses on the respective target location of the physical memory.”), the method comprising the following steps, using a control module provided in the management layer (See the Controller provided in [0012] and [0014]. See the Processing Element 105 depicted in Figure 2.):
receiving, by the control module provided in the management layer, one or more access requests from a calibration unit external to the at least one virtualized execution environment and external to the computing unit via an interface of the computing unit, the requests including identifiers specifying parameters of the one or more functions executing in the at least one virtualized execution environment (See [0014] “the computer program code are configured, with the at least one controller, to further cause the apparatus to receive an access request from a requesting virtual function including the indication associated with the requesting virtual function,” See [0027] “As shown in FIG. 1, this particular embodiment may include one or more allocating entities 10, one or more access request entities 20, one or more networks 30, and/or the like. In some embodiments, the access request entities may communicate requests for a virtual function to have access to physical memory, such as physical memory 110 associated with the allocation entities 10 (FIG. 2). Upon receipt of a request for physical memory, the allocation entity 10 may designate a target location of the physical memory to the requesting virtual function, such that only that particular function is allowed access to the allocated target location.” See [0037] “With reference to FIG. 1, in various embodiments, an access request entity 20 may be configured to exchange and/or store information/data with the allocating entity 10 and the network 30.” See Figure 5, step 501. See [0054] “receiving an access request from a requesting virtual function including the indication associated with the requesting virtual function, wherein the requesting virtual function is attempting to access a requested target location. In one embodiment, the indication comprises a descriptor of the requesting virtual function and an offset indicative of the requested target location.” The indication corresponds to the claimed identifier(s), which specifies a descriptor of the requesting virtual function.);
determining, by the control module, memory addresses corresponding to the identifiers (See [0054] “In one embodiment, the indication comprises a descriptor of the requesting virtual function and an offset indicative of the requested target location. The target location (i.e. memory address(es).) corresponds to the indication included in the access request.) by taking into account the dynamic memory allocation (See [0023] “example embodiments allocate physical memory to a virtual function by dynamically assigning or mapping to a particular virtual function at least one target location from a plurality of available target locations of the physical memory in the Base Address Registers (BAR) associated with the virtual function.” See [0046] “dynamically mapping or assigning at least one target location 309 of the physical memory 110 in the BAR comprises continuously assigning available target addresses on the respective target location of the physical memory.”); and
accessing, by the control module, the memory addresses according to the one or more access requests (See Figure 5, Step 505 “… granting the requesting virtual function access to the requested target location” See Figure 5, step 507 “… allowing execution of an operation by the requesting virtual function using the requested target location”. See [0027] “the requesting virtual function may be granted access to the requested target location 309 to enable that virtual function to carry out its operations (e.g., allowing execution of an operation by the requesting virtual function using the requested target location)”)
Claim 18 and claim 19 are rejected for the same reasons as claim 1.
Regarding claim 12, Shahar teaches:
The method according to claim 11, comprising the following steps:
recording, using at least one proxy module provided in the at least one execution environment, execution environment-specific addresses of functions executed in the respective execution environment and/or of the function parameters of the function executed in the respective execution environment (See [0039] “the network 30 may be configured to receive, store, and/or provide information/data comprising mapped physical or virtual memory addresses, available target locations, identifiers, descriptors, requests, and/or other information/data that may be requested by any of a variety of system components, such as by and between the allocating entity 10 and the access request entity or components thereof 20.” See [0052] “At block 403, the allocating entity 10 may include means, such as the processing element 105 or the like, for mapping at least one target location from a plurality of available target locations of the physical memory in a BAR associated with the virtual function based on the allocation request. In one embodiment, one or more mapping indications or information may be retrieved from the physical memory 110 of the allocating entity 10 (i.e., where it had been stored or allocated sometime in the past for later analysis)” The network 30 performs the same function as the proxy module.); and
determining, using the control module, the memory addresses corresponding to the identifiers (See [0054] “In one embodiment, the indication comprises a descriptor of the requesting virtual function and an offset indicative of the requested target location. The target location (i.e. memory address(es).) corresponds to the indication included in the access request.) by taking into account the dynamic memory allocation and the execution environment-specific addresses (See [0023] “example embodiments allocate physical memory to a virtual function by dynamically assigning or mapping to a particular virtual function at least one target location from a plurality of available target locations of the physical memory in the Base Address Registers (BAR) associated with the virtual function.” See [0046] “dynamically mapping or assigning at least one target location 309 of the physical memory 110 in the BAR comprises continuously assigning available target addresses on the respective target location of the physical memory.” See [0044] “In some cases, the offset is used for mapping the address information from the requesting PCIe access request to an allocated candidate for accessing the physical memory 110.”).
Regarding claim 15, Shahar teaches:
The method according to claim 11, wherein the one or more access requests include a read request, wherein the accessing of the memory addresses includes:
reading a memory content of the memory addresses corresponding to the identifiers; and
transmitting or sending the read memory content via the interface (See [0055] “As shown in block 505, the allocating entity 10 includes means, such as processing element 105 or the like, for granting the requesting virtual function access to the requested target location, in an instance in which the descriptor and the offset of the indication matches the descriptor and the offset of the identifier.” See [0055] “as shown in block 507, the allocating entity 10 includes means, such as processing element 105 or the like, for allowing execution of an operation by the requesting virtual function using the requested target location, in an instance in which the descriptor and the offset of the indication matches the descriptor and the offset of the identifier. In some embodiments, the identifiers are being compared upon receipt of one or more READ or WRITE operations from the PCIe device.” See [0055] “For a READ operation, data in the MEMIC line associated with the identifier will be returned.”).
Regarding claim 16, Shahar teaches:
The method according to claim 11, wherein the one or more access requests include a write request and data to be written, wherein the accessing of the memory addresses includes:
writing the data to be written to the memory addresses corresponding to the identifiers (See [0055] “As shown in block 505, the allocating entity 10 includes means, such as processing element 105 or the like, for granting the requesting virtual function access to the requested target location, in an instance in which the descriptor and the offset of the indication matches the descriptor and the offset of the identifier.” See [0055] “as shown in block 507, the allocating entity 10 includes means, such as processing element 105 or the like, for allowing execution of an operation by the requesting virtual function using the requested target location, in an instance in which the descriptor and the offset of the indication matches the descriptor and the offset of the identifier. In some embodiments, the identifiers are being compared upon receipt of one or more READ or WRITE operations from the PCIe device.” See [0055] “for WRITE operation, data in the MEMIC line will be modified according to one or more WRITE values.”).
Regarding claim 17, Shahar teaches:
The method according to claim 11, wherein the identifiers include information regarding the at least one or more functions to which the parameters relate and/or regarding the execution environment in which the one or more functions is implemented (See Figure 5, step 501. See [0054] “receiving an access request from a requesting virtual function including the indication associated with the requesting virtual function, wherein the requesting virtual function is attempting to access a requested target location. In one embodiment, the indication comprises a descriptor of the requesting virtual function and an offset indicative of the requested target location.” The indication corresponds to the claimed identifier(s), which includes a descriptor of the requesting virtual function.).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 13-14 are rejected under 35 U.S.C. 103 as being unpatentable over Shahar in view Roth et al. (Hereinafter Roth, U.S. Patent No. 10,079,681).
Regarding claim 13, Roth teaches:
The method according to claim 12, further comprising the following steps:
receiving, using the control module, the one or more access requests relating to a particular function implemented in an execution environment in which a proxy module is provided, at a point in time when a particular computer program, the execution of which implements the particular function, is not yet being executed (See Col. 17, lines 17-22 “An application, process, module or some other such entity configured to provide secure execution environment functionality may start automatically when a machine and/or a virtual machine is started or may be started as needed when, for example, a client entity requests access to the secure execution environment functionality.” See Col. 15, lines 31-38 “the service 256 may include a service control plane 258 which may be configured to receive requests and/or data from the service data plane 250 and may also be configured to respond to such requests by, for example, accessing other services within one or more computer environments and to obtain and transmit data back to the service data plane 250 operating within the secure execution environment 248.” Based on the citations provided, requests related to application functions may be received prior to starting an execution environment. After the execution environment has been started, the requests may be serviced.);
transmitting, using the control module, a function start request for the particular function to the proxy module in response to receiving the access requests;
initiating, using the proxy module, a start of the particular computer program in response to the function start request (See Col. 17, lines 17-22 “An application, process, module or some other such entity configured to provide secure execution environment functionality may start automatically when a machine and/or a virtual machine is started or may be started as needed when, for example, a client entity requests access to the secure execution environment functionality.” See Col. 21, lines 17-24 “Finally, the secure execution environment agent 408 and/or the bootloader 412 may be configured to perform one or more operations to run one or more applications associated with the computer system 424. In some embodiments, the bootloader 412 may execute a command instructing the computer system 428 to run 426, thereby starting the one or more applications associated with the computer system 428.” See Col. 24, lines 58-61 “Finally, the secure execution environment agent may instruct the bootloader to execute the computer system 522 by, for example, starting one or more applications within the secure execution environment.”); and
accessing, using the control module, the memory addresses according to the one or more access requests as soon as the particular computer program is being executed (See Col. 17, lines 17-22 “An application, process, module or some other such entity configured to provide secure execution environment functionality may start automatically when a machine and/or a virtual machine is started or may be started as needed when, for example, a client entity requests access to the secure execution environment functionality.” See Col. 15, lines 31-38 “the service 256 may include a service control plane 258 which may be configured to receive requests and/or data from the service data plane 250 and may also be configured to respond to such requests by, for example, accessing other services within one or more computer environments and to obtain and transmit data back to the service data plane 250 operating within the secure execution environment 248.” Based on the citations provided, requests related to application functions may be received prior to starting an execution environment. After the execution environment has started, the requests may be serviced.).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to combine the memory allocation method of Shahar with the application request servicing method of Roth to improve security of sensitive data in a system that permits third party data access.
Regarding claim 14, Roth teaches:
The method according to claim 11, further comprising, using the control module, the following steps:
receiving the one or more access requests relating to function parameters of a function implemented in an execution environment which has not yet been provided or started;
waiting until the execution environment is provided or started; and
after the execution environment is provided or started accessing the memory addresses according to the one or more access requests (See Col. 17, lines 17-22 “An application, process, module or some other such entity configured to provide secure execution environment functionality may start automatically when a machine and/or a virtual machine is started or may be started as needed when, for example, a client entity requests access to the secure execution environment functionality.” See Col. 15, lines 31-38 “the service 256 may include a service control plane 258 which may be configured to receive requests and/or data from the service data plane 250 and may also be configured to respond to such requests by, for example, accessing other services within one or more computer environments and to obtain and transmit data back to the service data plane 250 operating within the secure execution environment 248.” Based on the citations provided, requests related to application functions may be received prior to starting/providing an execution environment. After the execution environment has been started/provided, the requests may be serviced.).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to combine the memory allocation method of Shahar with the application request servicing method of Roth to improve security of sensitive data in a system that permits third party data access.
Response to Arguments
Applicant's arguments filed January 16, 2026 have been fully considered but they are not persuasive. On pages 6-7 of applicant’s arguments, applicant submitted that Shahar does not teach the amendments filed on January 16, 2026. Examiner respectfully disagrees, as paragraphs [0014], [0027], and [0037] of Shahar provide teachings the perform the same functions as the amended limitations. See paragraphs [0014], [0027], and [0037] in combination with the rejection provided herein, as such paragraphs teach the components that send and receive the access requests as claimed. All pending claims in the instant application are rejected.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL L WESTBROOK whose telephone number is (571)270-5028. The examiner can normally be reached Mon-Fri 9am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Reginald Bragdon can be reached at (571) 272-4204. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL L WESTBROOK/Examiner, Art Unit 2139
/REGINALD G BRAGDON/Supervisory Patent Examiner, Art Unit 2139
Prosecution Insights