DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Status
Claims 17, 22, 25, 29, 36-40 are amended.
Claims 17 and 22-40 are under examination.
Response to Arguments
Applicant’s remarks filed on 6/3/2026 have been considered.
Regarding Applicant’s remarks to the provisional double patenting rejection, the provisional rejection has been withdrawn in light of the filed and approved Terminal Disclaimer.
Regarding Applicant’s remarks to the specification objection, the objection has been withdrawn in light of the specification amendment.
Regarding Applicant’s remarks to the claim objections, the objections have been withdrawn in light of the claim amendments.
Regarding Applicant’s remarks to the claim rejections under 35 U.S.C. 112(b), amendments overcome previous 112(b) rejections and those are withdrawn. However, amendments introduce other clarity issues and thus new 112(b) rejections have been made.
Regarding Applicant’s remarks to the claim rejection under 35 U.S.C. 101, the rejection is withdrawn in light of the amendments.
Regarding Applicant’s remarks on Jain’s teachings over claim 17 and 37, these have been considered and are not persuasive. One cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
Regarding Applicant’s remarks that Jain fails to teach a dual-system having a “classical system” and a separate “obfuscator system”, these have been considered and are not persuasive. It is noted that the features upon which applicant relies (i.e., the systems being separate) are not recited in the rejected claims. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Regarding Applicant’s remarks that Jain fails to teach “predicting, using an initial component of the secret seed, the error vector generated by the PUF included in the obfuscator system”, these have been considered and are not persuasive. Jain in view of Yang teaches “predicting, using an initial component of the secret seed, the error vector generated by the PUF included in the obfuscator system” as Jain teaches predicting the sparse errors using the secret seed and Yang teaches PUF hardware generating. It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Jain’s errors to be generated by Yang’s PUF to increase system efficiency and reduce the risk of unauthorized access (Yang ¶27: “The cryptographic system 3 employs the crypto processor 300 to increase operation speed and efficiency of the authentication process, reduce the risk of the authentication key from being exposed to external circuits, protect data from unauthorized access, and save data processing resources of the MCU 32”).
Regarding Applicant’s remarks that Jain fails to teach “computing, using the public seed and the predicted error vector, a corrupted PRG output obtained by evaluating the PRG on an LPN encryption of the PRG input and the predicted error vector.”, these have been considered and are not persuasive. Jain teaches computing a PRG by using both the seed σ (LPN-encrypted) and the sparse error e, which is expressed as an error vector (Jain section 1.2 Page 62: “First, homomorphically evaluate the PRG on an LPN-encryption of the seed 𝝈 (i.e., A,𝒃 above) to obtain an LPN encryption of the PRG output 𝐺(𝝈) that is however corrupted with sparse errors. Next, decrypt and correct the sparse errors all in just degree 2, by means of a simple pre-computation idea. In particular, the precomputation compresses the sparse errors to be corrected into vectors of sublinear length that later can be expanded back using a degree 2 computation.”).
Regarding Applicant’s remarks on Jain and Sakemi’s teachings, these have been considered and are not persuasive. It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Jain in view of Sakemi to compute a Hamming distance between Jain’s corrected and corrupted PRG outputs to verify the obfuscation of the program to detect if it has been spoofed or altered (Sakemi ¶119: “Therefore, as to the verification data on authentication, the authentication system 1 can easily detect verification data that is falsely generated by an attacker to perform spoofing.”).
Regarding Applicant’s remarks on the proposed modifications of Jain in view of Yang and/or Sakemi rendering it unsatisfactory for its intended purposes, these have been considered and are not persuasive. The modifications in view of Yang and Sakemi do not render Jain’s purpose of constructing and utilizing indistinguishability obfuscation unsatisfactory.
Regarding Applicant’s remarks on hindsight reasoning for the combination of Jain, Yang, and Sakemi, these have been considered and are not persuasive. It must be recognized that any judgment on obviousness is in a sense necessarily a reconstruction based upon hindsight reasoning. But so long as it takes into account only knowledge which was within the level of ordinary skill at the time the claimed invention was made, and does not include knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971).
Regarding Applicant’s remarks the nonanalagous nature of Jain, Yang, and Sakemi, these have been considered and are not persuasive. It has been held that a prior art reference must either be in the field of the inventor’s endeavor or, if not, then be reasonably pertinent to the particular problem with which the inventor was concerned, in order to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). In this case, Jain, Yang, and Sakemi share a field of endeavor of cryptography.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
Claims 17 and 22-40 rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding claims 17 and 37, they recite “a pseudorandom generator (PRG) input that is generated by a PRG” however the specification does not provide support for explaining how an input to a PRG is also outputted (generated) by a PRG. The specification ¶8 states: “wherein the LPN encryption of the PRG input is generated using an error vector generated by physically unclonable function (PUF)” and fails to support the PRG input being generated by a PRG.
Claims 22-36 and 38-40 are similarly rejected based on their respective dependency of claim 17 and 37.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 17 and 22-40 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the Applicant), regards as the invention.
Regarding claims 17 and 37, there is ambiguity with what is being embedded in the obfuscated program. The claims recite “the public seed comprising a learning with parity (LPN) encryption of a pseudorandom generator (PRG) input that is generated by a PRG, the PRG input being embedded in the obfuscated program” and it is unclear if the PRG input or LPN encryption of the PRG input is being embedded in the obfuscated program. According to the specification ¶71: “Since the LPN encryption of the input σ is embedded within an obfuscated version of the circuit or program” it appears to be intended for the LPN encryption of the PRG input to be embedded in the obfuscated program. For examination purposes, this is being interpreted as “the LPN encryption of the PRG input being embedded in the obfuscated program”.
Further regarding claims 17 and 37, there is ambiguity with the PRG input being generated by the PRG. The claims recite “a pseudorandom generator (PRG) input that is generated by a PRG” and it is unclear how the PRG input can be an input to a PRG while also being outputted (generated) by a PRG. For examination purposes, this is being interpreted as “a pseudorandom generator (PRG) input that is generatedfor a PRG”.
Claims 22-36 and 38-40 are similarly rejected based on their respective dependency of the indefinite claims 17 and 37.
Regarding claims 22 and 38, they recite the limitation “the circuit” in line 4. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, “the circuit” is being interpreted as “a circuit”.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 17, 22, 34-38 are rejected under 35 U.S.C. 103 as being unpatentable over Jain et al. (Indistinguishability Obfuscation from Well-Founded Assumptions ACM STOC June 21-25, 2021 – provided by the Applicant), hereinafter Jain, in view of Yang et al. (US Patent Publication 2021/0051010), hereinafter Yang, and in view of Sakemi et al. (US Patent Publication 2016/0204936), hereinafter Sakemi.
Regarding claim 17, Jain teaches [A classical computing system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising]: receiving, from an obfuscator system, an obfuscated program (Jain section 1: “In this work, we study the notion of indistinguishability obfuscation (iO) for general polynomial-size circuits [19, 66, 77]. iO requires that for any two circuits C₀ and C₁ of the same size, such that C₀(x) = C₁(x) for all inputs x, we have that iO(C₀) is computationally indistinguishable to iO(C₁).”), a public seed and a secret seed, the public seed comprising a learning with parity (LPN) encryption of a PRG input that is embedded in the obfuscated program (Jain section 4: “Towards this, sPRG uses a A-bit prime p and ‘encrypts’ the seed σ using LPN samples over Zp … It follows directly from the LPN over Zp assumption that (A,b) is pseudorandom and hides σ.”) wherein the LPN encryption of the PRG input is generated [using an error vector generated by physically unclonable function (PUF) included in the obfuscator system] (Jain Section 1.2: “In an sPRG, the seed consists of both a public and private part… Our key innovation is a simple way to leverage LPN over fields… To accomplish this goal, we crucially leverage the sparseness of the LPN-encryption of the seed 0 (i.e., A, b above) to obtain an LPN-encryption of the PRG…”),
computing, using the public seed, a corrected PRG output obtained by evaluating the PRG on the LPN encryption of the PRG input (Jain section 1.2: “The evaluation of our sPRG can be viewed to take two steps: First, homomorphically evaluate the PRG on an LPN-encryption of the seed σ (i.e., A, b above) to obtain an LPN- encryption of the PRG output G(σ) that is however corrupted with sparse errors.”);
predicting, using an initial component of the secret seed, the error vector [generated by the PUF included in the obfuscator system] (Jain section 1.2: “First, homomorphically evaluate the PRG on an LPN-encryption of the seed σ (i.e., A, b above) to obtain an LPN- encryption of the PRG output G(σ) that is however corrupted with sparse errors.”);
updating the public seed using the error vector by [subtracting] the error vector from the LPN encryption of the PRG input to form an updated public seed vector (Jain Section 4: “correcting by adding the difference Corr = y − y between the correct and erroneous outputs, y = EvalI (σ) and y= EvalI (σ + e); we refer to Corr as the correction vector.”);
Jain does not explicitly teach subtracting the error vector. However, Jain does teach updating the public seed by adding the error vector.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify Jain to subtract the error vector to update the public seed because this is an expected result that errors such as error vectors are typically either added or subtracted to obtain updated/corrected values.
computing, a corrupted PRG output obtained by evaluating the PRG on the updated public seed vector (Jain Section 4: “However, a new problem arises: even though the degree fits, G(1) only evaluates an erroneous output y= EvalI(σ+e),but we want to obtain the correct output y = EvalI(σ). To correct errors, we further modify the polynomial and include more pre-processed information in the private seeds. Our key observation is the following: Because LPN noises are sparse, and because EvalI has only constant locality, only a few outputs depend on erroneous seed locations. We refer to them as bad outputs and let BAD denote the set of their indices. By a simple Markov argument, the number of bad outputs is bounded by T = mlogn δ with probability 1 − o(1). Leveraging this sparsity, our sPRG corrects bad outputs using the method described below. In the low probability event where there are greater than T bad outputs, it simply outputs 0. This in particular means that we lose o(1) in the security advantage, but we deal with this issue later by relying on security amplification.”);
computing a [Hamming] distance between the corrected PRG output and the corrupted PRG output (Jain Section 4: “correcting by adding the difference Corr = y − y between the correct and erroneous outputs, y = EvalI (σ) and y= EvalI (σ + e); we refer to Corr as the correction vector.”)
Jain does not explicitly teach A classical computing system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising: … using an error vector generated by physically unclonable function (PUF) included in the obfuscator system… error vector generated by the PUF included in the obfuscator system.
However, Yang teaches A classical computing system comprising one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising (Yang Fig. 1): ... using an error vector generated by physically unclonable function (PUF) included in the obfuscator system generated by the PUF included in the obfuscator system (Yang ¶4: “The PUF unit is used to provide a random bit pool. The controller is coupled to the PUF unit and is used to extract a random bit sequence from the random bit pool. The controller includes a masking engine. The masking engine is used to perform a key derivation function to stretch the extracted random bit sequence and to mask an input signal. The memory array is coupled to the masking engine and is used to store according to the masked input signal.”) … error vector generated by the PUF included in the obfuscator system (Yang ¶13: “The PUF unit 105 may store a random bit pool and generate a PUF response from the random bit pool in response to a PUF challenge”).
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain to increase system efficiency and reduce the risk of unauthorized access (Yang ¶27: “The cryptographic system 3 employs the crypto processor 300 to increase operation speed and efficiency of the authentication process, reduce the risk of the authentication key from being exposed to external circuits, protect data from unauthorized access, and save data processing resources of the MCU 32”).
Jain in view of Yang does not explicitly teach a Hamming distance; determining whether the Hamming distance is less than a predetermined threshold that is dependent on a length of the error vector; and in response to determining that the Hamming distance is less than the predetermined threshold, verifying the obfuscation of the program.
However, Sakemi teaches Hamming distance; determining whether the Hamming distance is less than a predetermined threshold that is dependent on a length of the error vector; and in response to determining that the Hamming distance is less than the predetermined threshold, verifying the obfuscation of the program (Sakemi ¶46: “such that a calculation result of a Hamming distance between the registered data and verification data that is encrypted with the encryption algorithm includes a Hamming distance between the verification data and the user and a Hamming distance between the verification data and random vectors generated from registered data, using a processor; calculating a Hamming distance between the verification data that is input and the transformed registered data, using the processor; and determining whether the input verification data is false based on a result of comparison of each of the Hamming distance between the verification data and registered data and the Hamming distance between the verification data and random vectors generated from the registered data included in the calculated Hamming distance with a threshold set in advance, using the processor.”).
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain and Yang’s obfuscation verification to be able to better detect when it has been spoofed or altered (Sakemi ¶119: “Therefore, as to the verification data on authentication, the authentication system 1 can easily detect verification data that is falsely generated by an attacker to perform spoofing.”).
Claim 37 is substantially similar to claim 17 and is rejected under the same rationale.
Regarding claim 22, Jain, Yang, and Sakemi teach the classical computing system of claim 17, wherein the initial component of the secret seed comprises a tensor of a vector comprising an LPN secret vector used to generate the LPN encryption of the PRG input, wherein the tensor is of degree [
d
2
]
, d representing a depth of the circuit (Jain section 4: “Let PRG = (IdSamp, Eval) be the Boolean PRG with multilinear degree d and stretch τ …and we here replace the monomials in the erroneous seed with polynomials in the LPN secret– we can compute PRG on the erroneous seed σ +e via a polynomial map G(1)= (G(1) 1 ,...,G(1) m ) that depends on A and has degree d in the public component b and only degree 2 in all possible degree [
d
2
]
”).
Claim 38 is substantially similar to claim 17 and is rejected under the same rationale.
Regarding claim 34, Jain, Yang, and Sakemi teach the classical computing system of claim 17, wherein the PRG comprises a Boolean PRG in complexity class NC°. (Jain theorem 5.3: “…the existence of Boolean PRGs in NC°…”)
Regarding claim 35, Jain, Yang, and Sakemi teach the classical computing system of claim 17, wherein operations further comprise, prior to receiving the obfuscated program, public seed and the secret seed, sharing, with the obfuscator system, values of cryptographic parameters for the obfuscation of the program. (Jain Section 2: “We denote by λ the global security parameter and set all other parameters as functions of λ. The security of different assumptions, SXDH, LWE, LPN, and PRG in NC° are measured w.r.t. their own parameters, namely the order p of the bilinear pairing group, the dimension of the LWE secrets, the dimension of the LPN secrets, and the length of the PRG seeds, and thus are indirectly related to the global security parameter λ.”)
Regarding claim 36, Jain, Yang, and Sakemi teach the classical computing system of claim 17, wherein computing the corrected PRG output obtained by evaluating the PRG on the LPN encryption of the PRG input comprises using components of the secret seed to recover the corrected PRG output obtained by evaluating the PRG on the PRG input. (Jain Section 4: “However, a new problem arises: even though the degree fits, G(1) only evaluates an erroneous output y= EvalI(σ+e),but we want to obtain the correct output y = EvalI(σ). To correct errors, we further modify the polynomial and include more pre-processed in formation in the private seeds. Our key observation is the following: Because LPN noises are sparse, and because EvalI has only constant locality, only a few outputs depend on erroneous seed locations. We refer to them as bad outputs and let BAD denote the set of their indices. By a simple Markov argument, the number of bad outputs is bounded by T = mlogn δ with probability 1 − o(1). Leveraging this sparsity, our sPRG corrects bad outputs using the method described below. In the low probability event where there are greater than T bad outputs, it simply outputs 0.”)
Claims 23-25 and 39-40 are rejected under 35 U.S.C. 103 as being unpatentable over Jain, in view of Yang, in view of Sakemi, and in view of Lim (Extracting Secret Keys from Integrated Circuits – provided by the Applicant).
Regarding claim 23, Jain, Yang, and Sakemi teach the classical computing system of claim 17 but fail to teach wherein predicting the error vector sampled from the PUF included in the obfuscator system comprises inputting the initial component of the secret seed into a regression model, wherein the regression model is trained to predict responses generated by the PUF included in the obfuscator system on unseen inputs.
However, Lim teaches wherein predicting the error vector sampled from the PUF included in the obfuscator system comprises inputting the initial component of the secret seed into a regression model, wherein the regression model (Lim section 5.3.2: “Similarly, we evaluate the prediction error rate of a software model using the CRP measured on a custom silicon implementation. We use an SVM to build the software model.”) is trained to predict responses generated by the PUF included in the obfuscator system on unseen inputs. (Lim Section 5.3.2: “We examine how the prediction error rate changes as a function of the number of training CRPs of the SVM. From a test-chip, n CRPs are measured to train the software model. Using the trained model, we predict 100,000 responses of given challenges. We evaluate the prediction error rate of the software model by comparing the predicted responses to actual PUF responses.”). Examiner’s Note: A regression model under the broadest reasonable interpretation is taught by a SVM model.
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain, Yang, and Sakemi to create an error vector that is efficient to predict for the system but hard for an adversary (“Easy to evaluate: The physical device can easily evaluate the function in a short period. Hard to predict: From a polynomial number of plausible physical measurements (in particular, determination of chosen challenge-response pairs (CRPs)), an adversary who no longer has the device and can only use a polynomial amount of resources (time, matter, etc.) can extract only a negligible amount of information about the response to a randomly chosen challenge.”).
Claim 39 is substantially similar to claim 23 and is rejected under the same rationale.
Regarding claim 24, Jain, Yang, Sakemi, and Lim teach the classical computing system of claim 23, wherein operations further comprise, prior to receiving the obfuscated program, public seed and secret seed: training the regression model (Lim section 5.3.2: “Similarly, we evaluate the prediction error rate of a software model using the CRP measured on a custom silicon implementation. We use an SVM to build the software model.”), comprising: generating a set of random challenges; sending the set of random challenges to the obfuscator system, wherein the obfuscator system runs the set of random challenges multiple times using the PUF to obtain multiple responses to each challenge in the set of random challenges; receiving, from the obfuscator system, the multiple responses to each challenge in the set of random challenges; and training the regression model on training data comprising the set of random challenges and multiple responses to predict responses generated by the obfuscator PUF on an unseen input challenge (Lim Section 7.1.3 “One challenge that generates reliable responses in one condition can generate unreliable responses in another. Thus, each time we use a PUF to generate random bits, we must test responses of a number of random challenges to find the challenges that generate random responses. Statisti-cally, from 10,000 random challenges, there exist approximately 10 challenges whose responses are random. Based on the performance of the PUF circuit (cf. Section 3.3), it takes 0.5 sec to test the randomness of 10,000 challenges by 1,000 repeated measurements. This initialization of a PUF-based random number generator can be completed within 1 sec.”). Examiner’s Note: A regression model under the broadest reasonable interpretation is taught by a SVM model.
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain, Yang, and Sakemi to make the PUF run many challenge and response pairs to reduce the error probability of the PUF (Lim section 4.4.2: “the error probability can be reduced by using a larger number of CRPs”).
Claim 40 is substantially similar to claim 24 and is rejected under the same rationale.
Regarding claim 25, Jain, Yang, Sakemi, and Lim teach the classical computing system of claim 24, wherein operations further comprise receiving, from the obfuscator system, a parameter used by the obfuscator system to construct a set system (Jain Section 2: “We denote by λ the global security parameter and set all other parameters as functions of λ. The security of different assumptions, SXDH, LWE, LPN, and PRG in NC° are measured w.r.t. their own parameters, namely the order p of the bilinear pairing group, the dimension of the LWE secrets, the dimension of the LPN secrets, and the length of the PRG seeds, and thus are indirectly related to the global security parameter λ.”), and wherein the method further comprises using the parameter to verify that the LPN encryption of the PRG input was sampled from the set system (Jain section 1.2: “To accomplish this goal, we crucially leverage the sparseness of the LPN error e. The evaluation of our sPRG can be viewed to take two steps: First, homomorphically evaluate the PRG on an LPN-encryption of the seed σ (i.e., A, b above) to obtain an LPN-encryption of the PRG output G(σ) that is however corrupted with sparse errors. Next, decrypt and correct the sparse errors all in just degree 2, by means of a simple pre-computation idea. In particular, the precomputation compresses the sparse errors to be corrected into vectors of sublinear length that later can be expanded back using a degree 2 computation.”).
Claims 26-29 are rejected under 35 U.S.C. 103 as being unpatentable over Jain, in view of Yang, in view of Sakemi, and in view of Boyle et al. (Compressing Vector OLE - provided by the Applicant), hereinafter Boyle.
Regarding claim 26, Jain, Yang, and Sakemi teach the classical computing system of claim 17 but fail to teach wherein the public seed is generated by the obfuscator system using a set system constructed by the obfuscator system, wherein inner products of pairs of representative vectors of the set system are equal to zero.
However, Boyle teaches wherein the public seed is generated by the obfuscator system using a set system constructed by the obfuscator system, wherein inner products of pairs of representative vectors of the set system are equal to zero (Boyle section 2.3: “Let C be a probabilistic code generation algorithm … Note also that the LPN assumption is equivalent to its dual version, which states that it is infeasible to distinguish e · B from a random vector, where e is a noise vector and B is the parity-check matrix of the matrix A ∈ Fk×q (i.e., B is a full-rank matrix in Fq×(q−k) such that A · B = 0).”).
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain, Yang, and Sakemi to increase the security of the public seed by removing its susceptibility to algebraic decoding attacks (Boyle Section 2.3: “Unlike most of these works, the flavors of LPN on which we rely do not require the underlying code to have an algebraic structure and are thus not susceptible to algebraic (list-)decoding attacks.”).
Regarding claim 28, Jain, Yang, Sakemi, and Boyle teach the classical computing system of claim 26, wherein the LPN encryption of the PRG input further comprises a public matrix sampled from a subset of sets included in the set system, wherein the subset of sets contains supersets of a randomly selected set in the set system, wherein a plurality of representative vectors of sets included in the subset of sets form columns of the public matrix (Jain section 4: “We assign the outputs into B buckets, via a random mapping … Next, we organize each bucket i into a matrix Mi … Therefore, by the LPN over Zp assumption, the seed σ of PRG is hidden and the security of PRG ensures that the output is pseudorandom when it is not zeroized.”).
Regarding claim 29, Jain, Yang, Sakemi, and Boyle teach the classical computing system of claim 28, wherein the LPN encryption of the PRG input further comprises an LPN secret vector that is equal to a representative vector of the randomly selected set in the set system (Jain section 4: “These two wrong ideas illustrate the tension between the expansion and security of our sPRG. Our construction takes care of both, by compressing the correction vector Corr to be polynomially shorter than the output and stored in the seed, and expanding it back during evaluation in a way that is oblivious of the location of bad output bits.”).
Claim 27 is rejected under 35 U.S.C. 103 as being unpatentable over Jain, in view of Yang, in view of Sakemi, in view of Boyle, in view of Peikert et al. (Psuedorandomness of Ring-LWE for Any Ring and Modulus - provided by the Applicant), hereinafter Peikert, and in view of Coron et al. (Cryptanalysis of GGH15 Multilinear Maps - provided by the Applicant), hereinafter Coron.
Regarding claim 27, Jain, Yang, Sakemi, and Boyle teach the classical computing system of claim 26 but fail to teach wherein the LPN encryption of the PRG input is generated using a ring of integers modulo a prime number that is less than or equal to a minimum prime number included in a factorization of a parameter selected and used by the obfuscator system to construct the set system, wherein the representative vectors of the set system are sampled modulo the parameter.
However, Peikert teaches wherein the LPN encryption of the PRG input is generated using a ring of integers modulo a [prime number that is less than or equal to a minimum prime number included in a factorization] of a parameter selected and used by the obfuscator system to construct the set system, wherein the representative vectors of the set system are sampled modulo the parameter (Peikert section 2.1: “Let n and q be positive integers, and let α > 0 be an error rate. The quotient ring of integers modulo q is denoted Zq: = Z/qZ. The quotient group of reals modulo the integers is denoted T: = R/Z.”).
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain, Yang, Sakemi, and Boyle for their ring of integers to have an increased amount of options available for the number field and modulus to improve the mathematical hardness of the system (Peikert abstract: “This extends to decision all the worst-case hardness results that were previously known for the search version, for the same or even better parameters and with no algebraic restrictions on the modulus or number field. Indeed, our reduction is the first that works for decision Ring-LWE with any number field and any modulus.”).
Jain, Yang, Sakemi, Boyle, and Peikert fail to teach prime number that is less than or equal to a minimum prime number included in a factorization.
However, Coron teaches prime number that is less than or equal to a minimum prime number included in a factorization (Coron Section 2.1: “The construction works over polynomial rings R = Z[x]/(f(x)) and Rq = R/qR for some degree n irreducible integer polynomial (x) ε Z[x] and an integer q”).
It would have been obvious for one having ordinary skill in the art before the filing date of the invention to make these modifications to Jain, Yang, Sakemi, Boyle, and Peikert to have their ring of integers modulo a prime number included in a factorization to avoid susceptibility to attacks based on encodings of zero (Coron section 1: “To avoid similar attacks as the one that targeted GGH13 and CLT13, based on encodings of zero, the protocol was designed in such a way that the adversary is never given encodings of the same element that could be subtracted s3 without doing the full key-agreement computation.”).
Allowable Subject Matter
Claims 30-33 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALEC ANKRUM whose telephone number is (571)272-9209. The examiner can normally be reached M-F 7:15am-3:15pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at 571-270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ALEC C ANKRUM/Examiner, Art Unit 2434
/NOURA ZOUBAIR/Primary Examiner, Art Unit 2434
Prosecution Insights