Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 remain pending in the application under prosecution and have been reexamined.
Examiner cites particular columns and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Response to Arguments
Applicant's arguments filed 12/17/2025 have been fully considered but they are not deemed to be persuasive. For at least the following remarks.
The claims have been amended to specify the claimed memory access method being implemented by a first apparatus. One possessing ordinary skill in the art and having US 6,854,039 (STRONGIN) and US 20210073403 would have arrived at the claimed invention pertaining to claims 1-6 and 15-20.
STRONGIN’s (section references including: Fig. 15; Col. 5, Line 30 to Col. 6, Line 24; Col. 16, Lines 6-42, Col. 13, Lines 6-40) features security check at user level as well as supervisor level using security attributes of selected memory pages. First apparatus and second apparatus well represent the user system and the supervisor system, or vice versa or hardware-initiated memory access to be authorized where one system operates in secure execution mode [Fig. 4; Col. 13, Lines 6-21]. A central processing unit (CPU) to include an execution unit or security check logic to fetch instructions and execute the instructions after performing or verifying security check.
Corresponding to receiving a first access request from a second apparatus, the first access request comprising an identity number, a first security check value, and first information, and the first information comprising a first physical address, STRONGIN teaches security check unit receive the physical address and the security attributes of a selected memory page
security check unit coupled to receive the physical address and the security attributes of the selected memory page wherein information include: secure execution mode; secure execution mode value representing a security attribute of the currently executing instruction; a base address with offset value, privilege security level.
Corresponding to “obtaining a second security check value through computation based on the identity number and the first information,” STRONGIN teaches using the received physical address of the selected memory page and access of one or more security attribute data structures located in the memory to obtain an additional security attribute of the selected memory page, i.e., determining permission, privilege level; and
Corresponding to determining an access permission of the second apparatus for the first physical address based on the first security check value and the second security check value. STRONGIN teaches using the security attributes of selected memory page and the additional security attribute of the selected memory page to generate a page fault indicating unauthorized-hardware initiated memory access, wherein the security check unit generates the fault signal dependent upon the security attributes of selected memory page and the additional security attribute of the selected memory page.
SWAINE teaches, to cover memory system component comprises transaction handling circuitry to receive memory access transactions, each memory access transaction specifies an issued domain identifier which specifies a master device for the memory access transaction, wherein the master device includes generating memory access transactions, the transaction compared with entries, the result of comparison indicates whether the memory access transaction has been security checked, i.e., authorized to access targeted address. SWAINE (Par. 0045-0046) teaches memory system component comprising transaction handling circuitry to receive memory access transactions, the memory access transactions specify at least an issuing domain identifier, a target address and a security check indication with the system having flexibility to vary on a master by master basis, whether checks are done at either the master device itself or downstream in the memory system.
In view of the above remarks, the rejection is maintained and updated below.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6 and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over US 6854039 B1 (STRONGIN et al) in view of US 20210073403 A1 (SWAINE).
With respect to claims 1, 15 and 20, STRONGIN teaches memory access method of a memory access apparatus, implemented by a first apparatus, the method comprising: a memory storing instructions; a transmission interface; and at least one processor in communication with the transmission interface and the memory, the at least one processor configured, upon execution of the instructions, to perform the method comprising:
((security check unit to receive physical address and the security attributes of a selected memory page security check unit coupled to perform method for providing access security for a memory used to store data arranged within multiple memory pages);
receiving a first access request, wherein the first access request comprises an identity number, a first security check value, and first information, and the first information comprises a first physical address
(security check unit coupled to receive the physical address and the security attributes of the selected memory page wherein information include: secure execution mode; secure execution mode value representing a security attribute of the currently executing instruction; a base address with offset value, privilege security level; receiving a linear address produced during execution of an instruction and a security attribute of the instruction, wherein the instruction resides in a first memory page, wherein the linear address is used to access one or more paged memory data structures located in the memory to obtain a base address of a selected memory page and security attributes of the selected memory page);
obtaining a second security check value through computation based on the identity number and the first information
(security check unit using the physical address to access one or more security attribute data structures located in the memory to obtain an additional security attribute of the selected memory page; using the received physical address of the selected memory page and access of one or more security attribute data structures located in the memory to obtain an additional security attribute of the selected memory page, i.e., determining permission, privilege level); and
determining an access permission of the second apparatus for the first physical address based on the first security check value and the second security check value
(the security attribute of the instruction and the security attributes of the selected memory page to indicate whether or not the selected memory page is a secure page, therefore, to indicate the access is authorized; otherwise the security check unit to generate a fault signal dependent upon the security attributes of selected memory page and the additional security attribute of the selected memory page preventing access; using the security attributes of selected memory page and the additional security attribute of the selected memory page to generate a page fault indicating unauthorized-hardware initiated memory access, wherein the security check unit generates the fault signal dependent upon the security attributes of selected memory page and the additional security attribute of the selected memory page) [Abstract; Fig. 7; Fig. 14; Fig. 15; Col. 5, Line 30 to Col. 6, Line 24; Col. 10, Lines 13-41; Col. 16, Lines 6-42, Col. 13, Lines 6-40].
STRONGEN fails to specifically teach the access request coming from a second apparatus. However, SWAINE teaches memory system component comprises transaction handling circuitry to receive memory access transactions, each memory access transaction specifies at least: an issuing domain identifier which indicates an issuing security domain specified by an issuing master device for the memory access transaction, where the issuing security domain is one of a plurality of security domains; a target address; and a security check indication security checking procedure determines whether the memory access transaction indicating said issuing security domain is authorized to access the target address, based on control data indicative of which of the plurality of security domains are allowed to access the target address [Abstract; Fig. 7-8; Par. 0045-0046; Par. 0100-0101; Par. 0004-0014; Par. 0051-0053; Par. 0062-0065]. Therefore, it would have been obvious to one having at least ordinary skill in the art before, the effective filing of the instant application to combine the memory management unit for managing a memory storing data, as taught by STRONGIN, with the transaction handling system of SWAINE, in order to provide security determining solution by including in the encoding of a transaction an indicator showing whether a transaction has been security checked, as taught by SWAINE [Par. 0045]. The combination is proper because STRONGIN teaches numerical value conveyed by an additional security attribute of the first memory page being compared to a numerical value conveyed by the additional security attribute of selected memory page such that the selected memory page is accessed dependent upon a result of the comparing of the numerical values conveyed by the security attribute of the first memory page and the additional security attribute of selected memory page.
With respect to claims 2 and 16, STRONGIN and SWAINE teaches memory access method, wherein the identity number identifies the first apparatus, or the identity number identifies the second apparatus (security attribute of the selected memory page to include a security context identification (SCID) value indicating a security context level of the selected memory page, the security attribute of the current instruction may include an SCID value indicating a security context level of a memory page containing the current instruction) [SRRONGIN’s Fig. 8; Abstract; Col. 4, Line 46 to Col. 5, Line 10].
With respect to claims 3 and 17, STRONGIN and SWAINE teaches memory access method, wherein before the receiving the first access request from the second apparatus, the method further comprises: receiving a physical address application request from the second apparatus, wherein the physical address application request comprises the identity number; generating a first key for the identity number; and sending a first response to the physical address application request to the second apparatus, wherein the first response comprises the first security check value and the first information, and the first security check value is obtained through computation based on the first key (security check unit uses the physical address to access one or more security attribute data structures located in the memory to obtain a security attribute of the selected memory page, compares a numerical value conveyed by a security attribute of the current instruction to a numerical value conveyed by the security attribute of the selected memory page, and produces an output signal dependent upon a result of the comparison, the memory management unit to access selected memory page dependent upon the output of the comparison) [Fig. 7-8, Fig. 10, Col.7, Line 33 to Col. 8, Line 17].
With respect to claims 4 and 18, STRONGIN and SWAINE teaches memory access method, wherein the first information further comprises a first permission value, and the first permission value indicates a first access permission of the second apparatus for the first physical address [memory management unit including a security check for a received physical address within a selected memory page, and security attributes of the selected memory page (STRONGIN’s Col. 3, Line 38 to Col. 4, Line 26); targeted physical address areas for which the control data defines which domain has access may be areas of physical address space (SWAINE’s Par. 0058-0059)].
With respect to claims 5 and 19, STRONGIN and SWAINE teaches memory access method, wherein the first information further comprises a granularity of physical address space, the granularity of the physical address space indicates a range of the physical address space, and the physical address space comprises the first physical address [memory management unit accesses the selected memory page dependent upon the output comparison, the address page featuring the physical address resulting from the physical address determined whether the access is authorized, (STRONGIN’s Col. 3, Line 38 to Col. 4, line26; Col.7, Line 33 to Col. 8, Line 17)].
With respect to claim 6, STRONGIN and SWAINE teaches memory access method, wherein the determining the access permission of the second apparatus for the first physical address based on the first security check value and the second security check value comprises: verifying the first security check value with the second security check value; and when the first security check value is verified successfully with the second security check value, determining that the access permission of the second apparatus for the first physical address is access permitted [the security checking circuitry to perform the security checking procedure, the security checking procedure performed by the security checking circuitry and the transaction passes when indicating a positive security check indication (SWAINE’s Par. 0102); security check unit receiving a physical address generated during execution of a current instruction, the physical address residing within a selected memory page, the security check unit to compare numerical value conveyed by a security attribute of the current instruction to a numerical value conveyed by the security attribute of the selected memory page to produce an output signal dependent upon a result of the comparison (STONGIN’s Fig. 7; Col. 7, Lines 33-65)].
Allowable Subject Matter
Claims 7-14 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 20250148110 A1 (KEIDAR et al) teaching key distribution system to include a policy table and a key table to develop different policy regions for various associated managers and then map memory address locations to table locations for the policy regions, the policy regions established using different parameters and then locked after activation to prevent further editing or modification after creation.
J. Liu, Y. Xiao and C. L. P. Chen, "Authentication and Access Control in the Internet of Things," 2012 32nd International Conference on Distributed Computing Systems Workshops, Macau, China, 2012, pp. 588-592.
Y. Liu, G. Sun and S. Schuckers, "Enabling Secure and Privacy Preserving Identity Management via Smart Contract," 2019 IEEE Conference on Communications and Network Security (CNS), Washington, DC, USA, 2019, pp. 1-8.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PIERRE MICHEL BATAILLE whose telephone number is (571)272-4178. The examiner can normally be reached Monday - Thursday 7-6 ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, TIM VO can be reached at (571) 272-3642. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PIERRE MICHEL BATAILLE/ Primary Examiner, Art Unit 2136