DETAILED ACTION
This action is responsive to the application filed on September 24, 2024, which claims priority from Provisional 63/557,629, filed on February 26, 2024 and from Provisional 63/671,325, filed on July 15, 2024.
Claims 1-36 are pending and presented to examination.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Examiner Notes
Examiner cites particular columns, paragraphs, figures and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Drawings
The drawings filed on September 24, 2024 are acceptable for examination purposes.
Information Disclosure Statement
As required by M.P.E.P. 609, the applicant’s submission of the Information Disclosure Statements dated September 24, 2024 and June 16, 2025 are acknowledged by the examiner and the cited references have been considered in the examination of the claims now pending.
Claim Objections
Claims 10 and 19-36 are objected to because of the following informalities: Claim 10 recites “wherein the one or more target programs further include instructions for denoting the decrypted firmware file as an unauthorized file when the target device identification code does not match the mid device identification code.”. For consistency with the hyphenated term “mid-device identification code” used elsewhere in the claims, the phrase should read “the mid-device identification code.” Claim 19 recites the limitation “wherein the first firmware update file comprises [[an]] a first encrypted firmware file.” in lines 7-9. The phrase “an first” is grammatically incorrect and should read “a first encrypted firmware file.”
Claim 27 recites “a device identification code” and “the mid device identification code.” For consistency with claim 9, of which claim 27 is the method counterpart, these should read “a mid-device identification code” and “the mid-device identification code,” respectively. Appropriate correction is required. Dependent claims 20-26 and 28-36 do not overcome the deficiency of the base claim and, therefore, are objected for the same reasons as the base claim.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 7-10, 18 and 26-28 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 7 recites “calculating a data length of the decrypted firmware file as the decryption feature value.” There is insufficient antecedent basis for “the decryption feature value” in the claim, because claim 7 depends from claim 6, and neither claim 7 nor any claim from which it depends (claims 6, 2, and 1) previously recites a decryption feature value. For purposes of examination, the limitation is interpreted as referring to a decryption feature value computed from the decrypted firmware file. Examiner suggests amending the first occurrence to recite “a decryption feature value.”. Claim 8 recites “calculating a data length of the mid-encrypted firmware file as the encryption feature value” and “generating the target security key based on the encryption feature value.” There is insufficient antecedent basis for “the encryption feature value,” because claim 8 depends directly from claim 1, and the term “encryption feature value” is first introduced only in claim 2, which is not in the line of dependency of claim 8. Examiner suggests amending the first occurrence to recite “an encryption feature value.”.
Claim 9 recites “removing the mid-device identification code from the third mid-firmware file.” There is insufficient antecedent basis for “the third mid-firmware file,” because claim 9 previously recites only “a second mid-firmware file,” and no first or third mid-firmware file appears in claim 9 or its parent claims (claims 8 and 1). It appears “the third mid-firmware file” should recite “the second mid-firmware file.”.
Claim 9 further recites “wherein the second formula will not change the data length for files after said production.” The phrase “for files after said production” is indefinite, because it is unclear which “files” are referenced and what “after said production” modifies, rendering the metes and bounds of the limitation unclear.
Claim 18 recites “adding a mid-device identification code to the authorized firmware file to produce a fourth mid-firmware file.” The ordinal “fourth” lacks antecedent basis, because no first, second, or third mid-firmware file is recited in claim 18 or its parent claims (claims 17, 16, and 1), rendering it unclear what the ordinal “fourth” serves to distinguish.
Claim 26 recites “calculating a data length of the mid-encrypted firmware file as the encryption feature value” and “generating the target security key based on the encryption feature value.” There is insufficient antecedent basis for “the encryption feature value,” because claim 26 depends directly from claim 19, which does not recite an encryption feature value (the term is first introduced in claim 20, which is not in the line of dependency of claim 26). This is the method counterpart of the defect noted in claim 8. Examiner suggests amending the first occurrence to recite “an encryption feature value.”. Claim 27 recites “checking, via the flash microcontroller, whether the target device identification code matches the second device identification code.” There is insufficient antecedent basis for “the second device identification code,” as no second device identification code is previously recited. In view of the corresponding limitation in claim 9, it appears this should recite “the mid-device identification code.”.
Claim 28 recites “denoting the decrypted firmware file as an unauthorized file when the target device identification code does not match the mid-device identification code.” Because claim 27, from which claim 28 depends, introduces “a device identification code” rather than “a mid-device identification code,” there is insufficient antecedent basis for “the mid-device identification code” in claim 28. Correction of claim 27 as set forth above (to recite “a mid-device identification code”) would also resolve this defect.
Dependent claim 10 does not overcome the deficiency of the base claim and, therefore, are rejected for the same reasons as the base claim.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-2, 6, 13-20, 24 and 31-36 are rejected under 35 U.S.C. 103 as being unpatentable over Jang et al. (US Pub. No. 2017/0277897, hereinafter Jang) in view of Hars (US Pub. No. 2006/0005046). With respect to claim 1, Jang teaches a firmware update apparatus, comprising: a flash microcontroller (Jang paragraph [0081], “the system on chip 100 includes a first memory 110, a second memory 120, and a central processing unit (CPU) 130”; see also paragraph [0086]. Jang’s CPU 130, which executes the boot and decryption code from memory within the system on chip and controls the firmware operation, is the claimed flash microcontroller), a flash memory with a program memory space, wherein the program memory space stores [[a first formula and]] a second formula (Jang paragraph [0091], the memory stores “a code … to decrypt an encrypted external program code”; paragraphs [0200]-[0203], the non-volatile flash memory. Jang’s non-volatile flash memory storing the decryption code is the claimed flash memory with a program memory space, and the stored decryption code – the algorithm that performs the decryption – is the claimed second formula), a receiver configured to receive a first firmware update file to be stored in the flash memory, wherein the first firmware update file comprises a first encrypted firmware file (Jang paragraph [0150], “the communication unit 1400 … may receive data and commands”; paragraph [0229], the received cipher text “includes a program such as a firmware that is encrypted”. Jang’s communication unit 1400, which receives the encrypted firmware and stores it, is the claimed receiver; the received encrypted firmware is the claimed first encrypted firmware file, and the received file containing it is the claimed first firmware update file), one or more target programs, wherein the one or more target programs are stored in the flash memory and configured to be executed by the flash microcontroller, and the one or more target programs include instructions for: (Jang paragraphs [0084], [0091]. Jang’s boot loader and decryption code, stored in memory and executed by CPU 130, are the claimed one or more target programs that are stored in the flash memory and executed by the flash microcontroller).
decrypting the first firmware update file based on the target security key and the second formula to produce a decrypted firmware file (Jang paragraph [0086], “The CPU 130 decrypts encrypted data … using a decryption key”; paragraph [0087], the AES algorithm. Jang’s CPU decrypting the encrypted firmware with a decryption key and the AES algorithm to produce the decrypted data discloses decrypting the first firmware update file based on a key (the target security key, generated per Hars below) and the second formula (the AES decryption algorithm) to produce the claimed decrypted firmware file).
Jang is silent to disclose, however, in an analogous art, Hars teaches: generating a target security key based on the first firmware update file and the first formula (Hars paragraph [0011], “auxiliary data from the updated firmware can be used to generate a key, K, which can be a one-way function of the auxiliary data”; paragraphs [0008]; [0014]. Hars’s key K is the claimed target security key; the one-way function that Hars applies to the auxiliary data to produce K is the claimed first formula; and because that auxiliary data is itself carried in the firmware update file – Hars paragraph [0008] (“Firmware update files can contain encrypted firmware code and auxiliary data”) and paragraph [0014] (the auxiliary data is retrieved from the unencrypted portion of the updated file) – generating K from that auxiliary data is generating the target security key based on the first firmware update file, as claimed).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to modify the firmware-decryption apparatus of Jang to generate the target security key based on the first firmware update file and the first formula, as taught by Hars (paragraph [0011]), so that the apparatus calculates the decryption key locally from the firmware update file rather than storing it – thereby eliminating the stored-key exposure that Jang itself identifies as a vulnerability (Jang paragraph [0204]: “when the decryption key value is exposed, there is a risk that the firmware stored in the flash memory may be changed”), which Hars solves because “an attacker cannot compute the key K” (Hars paragraph [0018]). With respect to claim 2, Jang is silent to disclose, however, in an analogous art, Hars teaches wherein the first firmware update file comprises the first encrypted firmware file and an encryption feature value (Hars paragraph [0008], “Firmware update files can contain encrypted firmware code and auxiliary data”; paragraph [0014]. Hars’s firmware update file containing the encrypted firmware code and the auxiliary data discloses a first firmware update file comprising the first encrypted firmware file (the encrypted firmware code) and an encryption feature value (the auxiliary data carried in the file)). wherein the operation of generating a target security key based on the first firmware update file and the first formula comprises: generating the target security key based on the encryption feature value (Hars paragraph [0011], the key K is “a one-way function of the auxiliary data”. Because Hars computes the key K as the one-way function of the auxiliary data, and that auxiliary data is the encryption feature value, Hars generates the target security key based on the encryption feature value as claimed).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to configure the firmware-update apparatus of Jang in view of Hars to generate the target security key based on the encryption feature value carried in the first firmware update file, as taught by Hars (paragraphs [0011], [0014]). A person of ordinary skill in the art would have been motivated to do so because deriving the key from a feature value that is computed from, and travels with, the update file enables the receiving apparatus to recompute the decryption key locally, eliminating any need to store a decryption key in the apparatus or to transmit the key alongside the file – the very key-exposure vulnerability that Jang identifies (Jang paragraph [0204]) – thereby improving the security of the firmware-update procedure with a reasonable expectation of success. With respect to claim 6, Jang is silent to disclose, however, in an analogous art, Hars teaches wherein the program memory space further stores a target device identification code (Hars paragraph [0027], a key “dependent on its unique serial number”; paragraph [0019], “hardware related information”. Hars’s device-unique identifier – the serial number / hardware-related information held by the device and used to bind firmware to that device – is the claimed target device identification code stored in the program memory space), wherein the operation of decrypting the first firmware update file based on the target security key and the second formula to produce a decrypted firmware file comprises: decrypting the first encrypted firmware file based on the target security key and the second formula to produce a first mid-firmware file (Hars paragraph [0017], “the new firmware is loaded (block 32) and decrypted (block 34) using the key, K”. Hars decrypting the encrypted firmware with key K yields decrypted firmware that still contains the embedded identification information; that intermediate decrypted firmware, before the identification code is removed, is the claimed first mid-firmware file). searching a mid-device identification code in the first mid-firmware file (Hars paragraph [0023], “encryption of identification information (ID) … If the decryption produces this ID data, the firmware update file is valid”. The identification information (ID) that Hars recovers from the decrypted firmware is the claimed mid-device identification code, and locating that ID within the decrypted firmware is the claimed searching). checking whether the target device identification code matches the mid-device identification code (Hars paragraph [0027], the firmware “cannot be used for any other device”; paragraph [0023]. Hars verifying the recovered ID against the device, so that firmware encrypted for one device cannot run on another, is the claimed check of whether the target device identification code matches the recovered mid-device identification code) and removing the mid-device identification code from the first mid-firmware file to produce the decrypted firmware file and activating the decrypted firmware file, when the target device identification code matches the mid-device identification code (Hars paragraph [0024], when valid the firmware “is used in the device”. Upon a valid match, the firmware body separated from the verified identification block is the claimed decrypted firmware file, and Hars using it in the device is the claimed activating).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to store a target device identification code and verify, after decryption, an embedded mid-device identification code against it before activating the firmware, as taught by Hars (paragraphs [0023], [0027]), in order to bind the firmware to a particular device so that it “cannot be used for any other device” (Hars paragraph [0027]), preventing installation of firmware not intended for that device. With respect to claim 13, Jang teaches wherein the second formula is based on Advanced Encryption Standard (AES) (Jang paragraph [0078], “an advanced encryption standard (AES) method”; paragraph [0087]. Jang’s use of the AES algorithm to decrypt the firmware discloses the claimed second formula being based on AES). With respect to claim 14, Jang teaches wherein the second formula calculates a consequence of exclusive or (XOR) (Jang paragraph [0087], “an AddRoundKey process which performs XOR operation with respect to the data”. Jang’s AES decryption performs an AddRoundKey step that XORs the data with the key; that XOR operation is the claimed second formula that calculates a consequence of XOR). With respect to claim 15, Jang teaches wherein the program memory space is divided into a bootloader section and an application section, and the one or more target programs are executed on the bootloader section (Jang paragraph [0084]; paragraph [0120], “the boot loader may be divided into the first and second boot loaders”. Jang’s memory holding the boot loader, divided into first and second boot loaders, alongside the application code is the claimed division into a bootloader section and an application section, and Jang’s secure-boot/decryption programs execute from the boot loader as claimed).
With respect to claim 16, Jang is silent to disclose, however, in an analogous art, Hars teaches further comprises: a transmitter, configured to transmit a second firmware update file, wherein the second firmware update file comprises a second encrypted firmware file (Hars paragraph [0022], “the new firmware file is encrypted with it … [and] can be stored on the distribution media”. Hars generating an encrypted firmware update file and distributing it discloses a transmitter transmitting a second firmware update file that comprises a second encrypted firmware file (the newly encrypted firmware)), wherein the one or more target programs include instructions for: generating the target security key based on an authorized firmware file and the first formula (Hars paragraph [0022], “a corresponding encryption key is computed”. Hars computing the encryption key from the firmware and its auxiliary data via the same one-way function discloses generating the target security key based on an authorized firmware file and the first formula) and encrypting the authorized firmware file based on the target security key and the second formula to produce the second encrypted firmware file (Hars paragraph [0022], “the new firmware file is encrypted with it”). Hars encrypting the authorized firmware with the computed key discloses encrypting the authorized firmware file based on the target security key and the second formula to produce the second encrypted firmware file).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to provide the firmware-update apparatus of Jang in view of Hars with a transmitter and with instructions to generate the target security key from an authorized firmware file using the first formula and to encrypt that firmware file with the target security key and the second formula to produce a second encrypted firmware file for transmission, as taught by Hars (paragraph [0022]). A person of ordinary skill in the art would have been motivated to do so because Hars computes the encryption key from the firmware and its auxiliary data at the file-creating side (paragraph [0022]), so that a self-keyed update file can be both created and distributed without ever storing or transmitting a separate key; providing the apparatus with this encrypt-and-transmit capability allows a single device both to create and to consume such update files, extending the key-distribution-free security benefit of Hars to the outbound direction with a reasonable expectation of success. With respect to claim 17, Jang is silent to disclose, however, in an analogous art, Hars teaches wherein the second firmware update file comprises the second encrypted firmware file and a header with an encryption feature value (Hars paragraph [0022], the encrypted firmware is stored “with the nonce, and other auxiliary information”; paragraph [0014]. Hars storing the encrypted firmware together with the nonce and auxiliary information discloses a second firmware update file comprising the second encrypted firmware file and a header carrying an encryption feature value (the auxiliary information)). wherein the operation of generating the target security key based on the authorized firmware file and the first formula comprises: calculating the encryption feature value based on the authorized firmware file (Hars paragraph [0008], “a digital signature of the firmware code”. Hars computing the digital signature/digest of the firmware code as auxiliary data discloses calculating the encryption feature value based on the authorized firmware file) and generating the target security key based on the encryption feature value and the first formula (Hars paragraph [0022], “a corresponding encryption key is computed”; paragraph [0011]. Hars then computing the key as the one-way function of that feature value discloses generating the target security key based on the encryption feature value and the first formula).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to configure the apparatus of Jang in view of Hars so that the second firmware update file includes a header carrying an encryption feature value calculated from the authorized firmware file, and so that the target security key is generated from that encryption feature value using the first formula, as taught by Hars (paragraphs [0011], [0014], [0022]). A person of ordinary skill in the art would have been motivated to do so because including the feature value in a header that accompanies the encrypted firmware (Hars paragraph [0022]) enables the receiving apparatus to obtain the identical feature value and recompute the identical decryption key locally, so that no key need be stored in, or transmitted to, the receiving device, yielding the predictable benefit of secure firmware updating without key distribution. With respect to claim 18, Jang is silent to disclose, however, in an analogous art, Hars teaches wherein the operation of encrypting the authorized firmware file based on the target security key and the second formula comprises: adding a mid-device identification code to the authorized firmware file to produce a fourth mid-firmware file, wherein the fourth mid-firmware file comprises the mid-device identification code and the authorized firmware file (Hars paragraph [0023], “encryption of identification information (ID)”; paragraph [0027]. Hars incorporating the identification information into the firmware before encryption discloses adding a mid-device identification code to the authorized firmware file to produce the claimed fourth mid-firmware file comprising the mid-device identification code and the authorized firmware file) and encrypting the fourth mid-firmware file based on the target security key and the second formula to produce the second encrypted firmware file (Hars paragraph [0022], “the new firmware file is encrypted with it”. Hars then encrypting that ID-containing firmware with the computed key discloses encrypting the fourth mid-firmware file based on the target security key and the second formula to produce the second encrypted firmware file).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to add a mid-device identification code to the authorized firmware file before encrypting it, producing a fourth mid-firmware file that is then encrypted with the target security key and the second formula, as taught by Hars (paragraphs [0023], [0027]). A person of ordinary skill in the art would have been motivated to do so because incorporating identification information into the firmware before encryption (Hars paragraph [0023]) binds the resulting update file to the intended device, so that the firmware “cannot be used for any other device” (Hars paragraph [0027]), preventing an update file produced for one device from being installed on another and thereby improving security with a reasonable expectation of success.
With respect to claim 19, Jang teaches a method for updating firmware, applicable to a firmware update apparatus (Jang paragraph [0035], “a method of booting of an image forming apparatus including a non-volatile memory and a system on chip”). Claim 19 otherwise recites limitations similar to claim 1 – a flash microcontroller and flash memory with a program memory space storing a first and second formula, receiving via a receiver a first firmware update file comprising a first encrypted firmware file, generating via the flash microcontroller a target security key based on the first firmware update file and the first formula, and decrypting the first firmware update file based on the target security key and the second formula to produce a decrypted firmware file – and is rejected for the same reasons set forth for claim 1 (Jang paragraph [0081], [0086], [0150]; Hars paragraph [0011]), differing only in reciting performance via the flash microcontroller and the receiver of the apparatus.
With respect to claim 20, claim 20 recites limitations similar to claim 2 and is rejected for the same reasons set forth for claim 2.
With respect to claim 24, claim 24 recites limitations similar to claim 6 and is rejected for the same reasons set forth for claim 6.
With respect to claim 31, claim 31 recites limitations similar to claim 13 and is rejected for the same reasons set forth for claim 13.
With respect to claim 32, claim 32 recites limitations similar to claim 14 and is rejected for the same reasons set forth for claim 14.
With respect to claim 33, claim 33 recites limitations similar to claim 15 and is rejected for the same reasons set forth for claim 15.
With respect to claim 34, claim 34 recites limitations similar to claim 16 and is rejected for the same reasons set forth for claim 16.
With respect to claim 35, claim 35 recites limitations similar to claim 17 and is rejected for the same reasons set forth for claim 17.
With respect to claim 36, claim 36 recites limitations similar to claim 18 and is rejected for the same reasons set forth for claim 18.
Claims 3-5, 11, 21-23 and 29 are rejected under 35 U.S.C. 103 as being unpatentable over Jang et al. (US Pub. No. 2017/0277897, hereinafter Jang) in view of Hars (US Pub. No. 2006/0005046) and further in view of Lin (US Pub. No. 2020/0311278). With respect to claim 3, Jang in view of Hars is silent to disclose, however, in an analogous art, Lin teaches wherein the one or more target programs further include instructions for: calculating a decryption feature value based on the decrypted firmware file (Lin paragraph [0040], “A hash code of the firmware instructions is calculated after decryption … stored as HASH_B”. Lin recalculating a hash code from the decrypted firmware discloses calculating a decryption feature value based on the decrypted firmware file, the recalculated value being the decryption feature value) and activating the decrypted firmware file based on a comparison result between the encryption feature value and the decryption feature value (Lin paragraph [0042], “The HASH_A is compared to the HASH_C … the new firmware is authentic (Block 714). The firmware update may then be initiated”. Lin comparing the expected feature value (HASH_A) against the recalculated feature value (HASH_C) and proceeding when they match discloses activating the decrypted firmware file based on a comparison result between the encryption feature value and the decryption feature value).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to modify the combination of Jang and Hars to calculate a decryption feature value from the decrypted firmware and activate the firmware based on a comparison of that value with the encryption feature value, as taught by Lin (paragraph [0042]), in order to verify the integrity and authenticity of the firmware before use and reject corrupted or tampered firmware. With respect to claim 4, Jang in view of Hars is silent to disclose, however, in an analogous art, Lin teaches wherein the operation of decrypting the first firmware update file based on the target security key and the second formula to produce a decrypted firmware file comprises: decrypting the encrypted firmware file of the first firmware update file based on the target security key and the second formula to produce the decrypted firmware file (Lin paragraph [0040], “The public key from read-only memory is applied to decrypt firmware instructions from encrypted firmware data block”. Lin decrypting the encrypted firmware data block to produce the firmware instructions discloses decrypting the encrypted firmware file of the first firmware update file based on the target security key and the second formula to produce the decrypted firmware file). wherein the one or more target programs further include instructions for: activating the decrypted firmware file when the encryption feature value matches the decryption feature value (Lin paragraph [0042], “determines whether the HASH_A matches the HASH_C (decision block 712). If so, the new firmware is authentic (block 714)”. Lin initiating the update only when HASH_A matches HASH_C discloses activating the decrypted firmware file when the encryption feature value matches the decryption feature value).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to activate the decrypted firmware only when the encryption feature value matches the decryption feature value, as taught by Lin (paragraph [0042]), to ensure only authentic, unaltered firmware is installed. With respect to claim 5, Jang in view of Hars is silent to disclose, however, in an analogous art, Lin teaches wherein the one or more target programs further include instructions for denoting the decrypted firmware file as an unauthorized file when the encryption feature value is not matched with the decryption feature value (Lin paragraph [0042], “If HASH_A does not match HASH_C, the new firmware is not authentic (block 716). The firmware update may then be cancelled”. Lin declaring the firmware not authentic and cancelling the update when the values do not match discloses denoting the decrypted firmware file as an unauthorized file when the encryption feature value is not matched with the decryption feature value).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to denote the decrypted firmware as an unauthorized file when the encryption feature value does not match the decryption feature value, as taught by Lin (paragraph [0042]), so that non-authentic firmware is rejected rather than executed. With respect to claim 11, Jang in view of Hars is silent to disclose, however, in an analogous art, Lin teaches wherein the encryption feature value and the decryption feature value are Cyclic Redundancy Check (CRC) (Lin paragraph [0020], the feature value generated from the firmware instructions may use “cyclic redundancy checks, checksum functions, and cryptographic hash functions”; paragraph [0043]. Lin teaching that the feature value generated from the firmware may be a cyclic redundancy check discloses that the encryption feature value and the decryption feature value are CRC as claimed).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to implement the encryption and decryption feature values of the combination as a Cyclic Redundancy Check (CRC), as taught by Lin (paragraph [0020]), because a CRC is an art-recognized technique for generating a compact integrity value from firmware.
With respect to claim 21, claim 21 recites limitations similar to claim 3 and is rejected for the same reasons set forth for claim 3. With respect to claim 22, claim 22 recites limitations similar to claim 4 and is rejected for the same reasons set forth for claim 4.
With respect to claim 23, claim 23 recites limitations similar to claim 5 and is rejected for the same reasons set forth for claim 5.
With respect to claim 29, claim 29 recites limitations similar to claim 11 and is rejected for the same reasons set forth for claim 11.
Claims 7-10 and 25-28 are rejected under 35 U.S.C. 103 as being unpatentable over Jang et al. (US Pub. No. 2017/0277897, hereinafter Jang) in view of Hars (US Pub. No. 2006/0005046) and further in view of Lu et al. (US Pub. No. 2017/0115984, hereinafter Lu). With respect to claim 7, Jang in view of Hars is silent to disclose, however, in an analogous art, Lu teaches wherein the encryption feature value is associated with a data length of an authorized firmware file (Lu paragraph [0065], “the firmware information includes a length of firmware data”. Lu carrying the firmware data length in the firmware information discloses an encryption feature value associated with a data length of an authorized firmware file), and the one or more target programs further include instructions for: calculating a data length of the decrypted firmware file as the decryption feature value (Lu paragraph [0066], “the length of firmware data cached in the firmware buffer”. Lu determining the length of the firmware data after processing discloses calculating a data length of the decrypted firmware file as the decryption feature value) and activating the decrypted firmware file based on a comparison result between the decryption feature value and the encryption feature value (Lu paragraph [0066], “whether the length of firmware data in the firmware information … is same as the length of firmware data cached … if yes, the firmware data … is legitimate; otherwise … not legitimate”. Lu deeming the firmware legitimate, and proceeding, only when the expected length matches the actual length discloses activating the decrypted firmware file based on a comparison result between the decryption feature value and the encryption feature value).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to use the data length of the firmware as the feature value and activate the decrypted firmware based on a comparison of the decrypted firmware’s data length with the expected data length, as taught by Lu (paragraph [0066]), in order to verify firmware legitimacy by a low-cost length check; moreover, the applicant’s own specification at [0017] identifies the data length and the CRC as interchangeable feature values, so substituting the data length of Lu for the feature value of the combination is a substitution of art-recognized equivalents yielding a predictable result. With respect to claim 8, Jang in view of Lu is silent to disclose, however, in an analogous art, Hars teaches wherein the program memory space further stores a target device identification code, wherein the operation of generating the target security key based on the first firmware update file and the first formula further comprises: removing an encrypted mid-device identification code from the first firmware update file to produce a mid-encrypted firmware file (Hars paragraph [0023], “attaching a block of data with the encrypted identification information”; paragraph [0025], “a key derived from a range of device serial numbers”. Hars storing the device identification information and incorporating an encrypted ID block into the firmware – separable from the firmware body – discloses storing a target device identification code and removing an encrypted mid-device identification code from the first firmware update file to produce a mid-encrypted firmware file) and generating the target security key based on the encryption feature value (Hars paragraph [0011], “generate a key, K, which can be a one-way function of the auxiliary data”. Hars computing the key K as the one-way function of the feature value discloses generating the target security key based on the encryption feature value, that feature value being the data length supplied by Lu in the paragraph below).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to store a target device identification code in the apparatus of Jang in view of Hars, remove an encrypted mid-device identification code from the first firmware update file to produce a mid-encrypted firmware file, and generate the target security key from the encryption feature value, as taught by Hars (paragraphs [0011], [0023], [0025]). A person of ordinary skill in the art would have been motivated to incorporate this device-identification handling in order to bind the firmware to the intended device, so that an update file produced for one device cannot be used on another device (Hars paragraph [0027]), improving the security of the firmware-update procedure with a reasonable expectation of success. Jang in view of Hars is silent to disclose, however, in an analogous art, Lu teaches calculating a data length of the mid-encrypted firmware file as the encryption feature value (Lu paragraph [0065], “the firmware information includes a length of firmware data”; paragraph [0066]. Lu using the data length of the firmware data as the feature value discloses calculating a data length of the mid-encrypted firmware file as the encryption feature value).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to use the data length of the mid-encrypted firmware file, as taught by Lu (paragraphs [0065]-[0066]), as the encryption feature value from which the target security key is generated. A person of ordinary skill in the art would have been motivated to do so because Lu employs the firmware data length as a measure of firmware legitimacy (Lu paragraph [0066]), and because the data length and the digest/CRC are art-recognized equivalent firmware feature values – as the applicant’s own specification admits at [0017] – so that using the data length as the feature-value input to the key-generation function is a substitution of art-recognized equivalents that yields a predictable result. With respect to claim 9, Jang in view of Hars is silent to disclose, however, in an analogous art, Lu teaches wherein the operation of decrypting the first firmware update file based on the target security key and the second formula to produce a decrypted firmware file comprises: decrypting the first encrypted firmware file based on the target security key and the second formula to produce a second mid-firmware file, wherein the second formula will not change the data length for files after said production (Lu paragraph [0010], “decrypting read data according to the symmetric key to obtain decrypted data, writing the decrypted data”; paragraphs [0024]-[0025]. Lu decrypting the cipher with the symmetric key to produce decrypted firmware while preserving the firmware data length, so the length-based legitimacy check remains valid, discloses decrypting to produce a second mid-firmware file with a second formula that will not change the data length). It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to decrypt the encrypted firmware with a second formula that does not change the data length, producing a second mid-firmware file, as taught by Lu (paragraphs [0010], [0024]-[0025]). A person of ordinary skill in the art would have been motivated to do so in order that the data length of the firmware is preserved through decryption and remains a valid basis for the data-length legitimacy check, ensuring that the integrity verification operates on the correct firmware length (Lu paragraph [0066]) with a reasonable expectation of success.
Jang in view of Lu is silent to disclose, however, in an analogous art, Hars teaches searching a mid-device identification code in the second mid-firmware file, wherein the mid-device identification code is the encrypted mid-device identification code after being decrypted based on the target security key and the second formula (Hars paragraph [0023], “If the decryption produces this ID data, the firmware update file is valid”. Hars recovering the identification information from the decrypted firmware discloses searching a mid-device identification code in the second mid-firmware file, that code being the encrypted ID after decryption). checking whether the target device identification code matches the mid-device identification code (Hars paragraph [0027], “This firmware version cannot be used for any other device”; paragraph [0023]. Hars verifying the recovered ID against the device discloses checking whether the target device identification code matches the mid-device identification code) and removing the mid-device identification code from the third mid-firmware file to produce the decrypted firmware file and activating the decrypted firmware file, when the target device identification code matches the mid-device identification code (Hars paragraph [0024], “If the decrypted firmware is valid, then it is used in the device”. Hars using the verified firmware in the device upon a valid match discloses removing the identification code to produce the decrypted firmware file and activating it when the codes match). It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to search the decrypted second mid-firmware file for a mid-device identification code, check it against the target device identification code, and remove it to produce and activate the decrypted firmware file upon a match, as taught by Hars (paragraphs [0023], [0024], [0027]). A person of ordinary skill in the art would have been motivated to do so in order to bind the firmware to the intended device, so that an update file produced for one device cannot be used on another device (Hars paragraph [0027]), preventing installation of firmware not intended for that device and thereby improving security with a reasonable expectation of success. With respect to claim 10, Jang in view of Lu is silent to disclose, however, in an analogous art, Hars teaches wherein the one or more target programs further include instructions for denoting the decrypted firmware file as an unauthorized file when the target device identification code does not match the mid device identification code (Hars paragraph [0024], the device “is deemed to be in a tampered state”. Hars deeming the device tampered and not using the firmware when the decryption does not produce valid ID data discloses denoting the decrypted firmware file as an unauthorized file when the target device identification code does not match the mid-device identification code).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to denote the decrypted firmware as unauthorized when the target device identification code does not match the recovered mid-device identification code, as taught by Hars (paragraph [0024]), to reject firmware not intended for the device.
With respect to claim 25, claim 25 recites limitations similar to claim 7 and is rejected for the same reasons set forth for claim 7.
With respect to claim 26, claim 26 recites limitations similar to claim 8 and is rejected for the same reasons set forth for claim 8.
With respect to claim 27, claim 27 recites limitations similar to claim 9 and is rejected for the same reasons set forth for claim 9.
With respect to claim 28, claim 28 recites limitations similar to claim 10 and is rejected for the same reasons set forth for claim 10.
Claims 12 and 30 are rejected under 35 U.S.C. 103 as being unpatentable over Jang et al. (US Pub. No. 2017/0277897, hereinafter Jang) in view of Hars (US Pub. No. 2006/0005046) and further in view of Bantwal (US Pub. No. 2007/0064933). With respect to claim 12, Jang in view of Hars is silent to disclose, however, in an analogous art, Bantwal teaches wherein the first formula is: y=ax+b; wherein a and b are constants, y is the target security key, and x is the encryption feature value indicated in the first firmware update file (Bantwal paragraph [0045], “the linear equation … can be in the form of y=mx+b, where “b” is a constant”. Bantwal’s linear equation y=mx+b, in which the dependent value y is computed from the variable x using constants, discloses the claimed first formula y=ax+b; applied to Hars’s key generation, x is the encryption feature value and y is the resulting target security key).
It would have been obvious to one of ordinary skill in the art at the time the invention was made before the effective filing date of the claimed invention to implement the first formula of Hars (paragraph [0011]) – which generates the target security key (y) as a function of the encryption feature value (x) – as the linear equation y=ax+b with a and b being constants, as taught by Bantwal (paragraph [0045]), because selecting a simple affine equation to map the feature value to the key is an obvious design choice using a known linear computation and yields a predictable result.
With respect to claim 30, claim 30 recites limitations similar to claim 12 and is rejected for the same reasons set forth for claim 12.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. He et al. (US Pub. No. 2021/0397441) The firmware updating method involves configuring (S100) a host to execute a firmware generating tool to digitally sign a firmware to be updated. The host is configured (S101) to execute an update tool to transmit an update command to an electronic device, such as mobile phone. The electronic device is configured (S102) to perform an authorization verification process on the update tool in response to the electronic device receiving the update command. The electronic device and the update tool are configured to generate and exchange a plurality of sets of random numbers. The update tool is configured (S103) to encrypt the firmware to be updated including the digital signature with a symmetric encryption algorithm to generate an encrypted firmware, and configured (S104) the electronic device to execute an original firmware. The update tool is configured (S106) to write the firmware to be updated. (see abstract).
Martinez (US Pub. No. 2016/0147996) A firmware image is received at an information handling system. A symmetric key is generated and stored at a trusted platform module (TPM). The firmware image is encrypted using the symmetric key. The encrypted firmware image is stored in a non-volatile memory. (see abstract).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ANIBAL RIVERACRUZ whose telephone number is (571)270-1200. The examiner can normally be reached Monday-Friday 9:30 AM-6:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hyung S Sough can be reached at 5712726799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ANIBAL RIVERACRUZ/Primary Examiner, Art Unit 2192
Prosecution Insights