DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2. Claims 1-20 are pending on this application. Claims 1 and 11 are in independent forms.
Priority
3. Foreign priority has been claimed to CN application # 202311533893.1 filed on 11/16/2023.
Information Disclosure Statement
4. The information disclosure statements (IDS's) submitted on 02/27/2025 is in compliance with provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Drawings
5. The drawings filed on 11/14/2024 are accepted by the examiner.
Claim Rejections - 35 USC § 103
6. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
7. Claims 1-7 and 11-17 are rejected under 35 U.S.C. 103 as being unpatentable over Mori et al. US Patent Application Publication NO. 2014/0325217 (hereinafter Mori) in view of Cheng et al. US Patent Application Publication No. 2024/0028759 (hereinafter Cheng).
Regarding claim 1, Mori discloses a data processing method for an encrypted database (Fig. 1, database system 10), wherein the method is performed by a heterogeneous processing platform including a first computing unit implemented by a general processing unit (Fig. 1, user system 20) and a second computing unit implemented by a dedicated acceleration unit (Fig. 1, database control means 12) , and the method comprises:
“obtaining, by the first computing unit, a ciphertext parameter and a database instruction from a user end device, wherein the database instruction instructs to perform a target operation on the encrypted database” (see Mori par. 0066, the database apparatus (10) receives a database operation command from the user apparatus (20). In the case wherein such a condition is met that the operation target data encrypted and stored in the database (11) is encrypted by an encryption algorithm allowing operation or computation on encrypted data to be executed as is in ciphertext, and that the operation or computation of the database operation command is operation or computation allowed to be executed on ciphertext as is in ciphertext, the control means performs operation or computation on the operation target data encrypted, as in ciphertext, and sends the result processed in ciphertext to the user apparatus (20));
“converting, by the first computing unit, the database instruction into a computing instruction to be executed by the second computing unit, and transmitting the computing instruction to the second computing unit” (see Mori par. 0072, when the user apparatus (20) receives a database processing result from the database control means (12), if conversion or decryption of the data and/or column data is necessary, the user apparatus (20) executes conversion or decryption using key information (for example, a secret key) managed by the key utilization means. As a response to the database operation command, the user apparatus (20) sends the obtained data to the source of the database operation command (for example, 21 in FIG. 1));
Mori does not explicitly discloses performing, by the second computing unit according to the computing instruction, a cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter, to obtain a ciphertext result; and transmitting, by the second computing unit, the ciphertext result to the first computing unit.
However, in analogues art, Cheng discloses performing, by the second computing unit according to the computing instruction, a cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter, to obtain a ciphertext result (see Cheng par. 0020, a database access method is provided. The method is performed in a non-secure execution environment, and includes: sending an encrypted data computation request to a ciphertext operation module, where the encrypted data computation request requests to perform computation on encrypted data of a user, and the ciphertext operation module runs in a trusted execution environment; sending the encrypted data to the ciphertext operation module, where the encrypted data is all encrypted data in a user query request; and receiving an encrypted computation result sent by the ciphertext operation module); and transmitting, by the second computing unit, the ciphertext result to the first computing unit (see Cheng par. 0020, sending the encrypted data to the ciphertext operation module, where the encrypted data is all encrypted data in a user query request; and receiving an encrypted computation result sent by the ciphertext operation module).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Cheng in to the system of Mori in order to provide an encrypted data computation request requests to perform computation on encrypted data of a user, the ciphertext operation module runs in a trusted execution environment, the transceiver module is further configured to send the encrypted data to the ciphertext operation module, the encrypted data is all encrypted data in a user query request, and the transceiver module is further configured to receive an encrypted computation result sent by the ciphertext operation module. (see Cheng par. 0035).
Regarding claims 2 and 12, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Mori further discloses wherein before the performing, by the second computing unit according to the computing instruction, the cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter, the method further comprises: reading, by the first computing unit, the ciphertext data from the encrypted database based on the database instruction, and transmitting the ciphertext data and the ciphertext parameter to the second computing unit (see Mori par. 0071, when encrypting column data in a table in the database (11), the column data is read from the database (11), public key information is obtained from the user apparatus (20), the column data is encrypted by the encryption calculation unit (126), and a ciphertext table including a set of a serial number and ciphertext of the column data is created. To manage this ciphertext table, a ciphertext table information table including a set of a table name, a column name, an encryption algorithm, and a ciphertext table name may be provided).
Regarding claims 3 and 13, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Mori further discloses wherein before the performing, by the second computing unit according to the computing instruction, the cryptographic operation corresponding to the target operation on the ciphertext data in the encrypted database and the ciphertext parameter, the method further comprises: transmitting, by the first computing unit, a read instruction determined based on the database instruction to the second computing unit (see Mori par. 0143, The security setting information operation unit 124 reads and writes security setting information from and in the security setting information storage unit 14. In response to a request for access to the security setting information storage unit 14 from the application response means 22 (a read request), the security setting information operation unit 124 accesses the security setting information storage unit and sends read security setting information to the application response means 22 via the processing and communication control unit 125); and reading, by the second computing unit, the ciphertext data from the encrypted database according to the read instruction (see Mori par. 0193-0194, The encryption calculation unit 231 in the key utilization means 23 executes encryption calculation such as processing for decrypting ciphertext by using key information (secret key) read via the key information management unit 232).
Regarding claims 4 and 14, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Mori further discloses wherein after the transmitting, by the second computing unit, the ciphertext result to the first computing unit, the method further comprises: storing, by the first computing unit, the ciphertext result in the encrypted database (see Mori par. 0180, Each ciphertext table storing encrypted data is stored in the database 11 in format as illustrated in FIGS. 7D to 7F, for example. Namely, each ciphertext table is stored so that serial number IDs 1, 2, and so on are associated with the respective ciphertext); or sending, by the first computing unit, the ciphertext result to the user end device (see Mori par. 0067, the control means (12) in the database apparatus (10) sends a computation result of partial computation of a computation of the database operation command to the user apparatus (20) in ciphertext).
Regarding claims 5 and 15, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Cheng further discloses wherein the first computing unit is a central processing unit (CPU), and the second computing unit is at least one of a graphics processing unit (GPU), a field programmable gate array (FPGA), or an application-specific integrated circuit (ASIC) (see Cheng par. 0064, the processor 110 is a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The general-purpose processor is a microprocessor or the like. For example, the processor 110 is a central processing unit (CPU)).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Cheng in to the system of Mori in order to provide an encrypted data computation request requests to perform computation on encrypted data of a user, the ciphertext operation module runs in a trusted execution environment, the transceiver module is further configured to send the encrypted data to the ciphertext operation module, the encrypted data is all encrypted data in a user query request, and the transceiver module is further configured to receive an encrypted computation result sent by the ciphertext operation module. (see Cheng par. 0035).
Regarding claims 6 and 16, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Mori further discloses wherein the encrypted database is a homomorphically encrypted database, and the cryptographic operation is a homomorphic operation (see Mori pars. 0091, 0441, The database apparatus according to any one of Supplementary Note 1 to 6, wherein regarding the computation operation corresponding to the database operation command, if the computation operation corresponds to homomorphic computation and the encryption algorithm corresponds to homomorphic encryption, the control means executes the computation operation on data in ciphertext in the database and sends the computation result in ciphertext to the user apparatus).
Regarding claims 7 and 17, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 11,
Mori further discloses wherein the user end device has a public key and a corresponding private key, the ciphertext parameter is obtained after a user parameter is encrypted by using the public key, and the private key is used to decrypt the ciphertext result (see Mori par. 0010, a database access system as a system in which the user side manages keys and a terminal on the user side encrypts and decrypts data that is stored in a database. The user terminal includes a secret key generation means for generating a secret key by using a public key, a storage means for storing the secret key, an encryption means for encrypting data on the basis of the public key, and a decryption means for decrypting the encrypted data by using the secret key).
Regarding claim 11, Mori discloses a data processing system for an encrypted database, comprising:
“at least one processor” (Fig. 1, user system 20) and
at least one memory (Fig. 1, database system 10) storing instructions executable by the at least one processor, wherein the at least one processor comprises a first computing unit implemented by a general processing unit and a second computing unit implemented by a dedicated acceleration unit, and is configured to:
“obtain, by the first computing unit, a ciphertext parameter and a database instruction from a user end device, wherein the database instruction instructs to perform a target operation on the encrypted database” (see Mori par. 0066, the database apparatus (10) receives a database operation command from the user apparatus (20). In the case wherein such a condition is met that the operation target data encrypted and stored in the database (11) is encrypted by an encryption algorithm allowing operation or computation on encrypted data to be executed as is in ciphertext, and that the operation or computation of the database operation command is operation or computation allowed to be executed on ciphertext as is in ciphertext, the control means performs operation or computation on the operation target data encrypted, as in ciphertext, and sends the result processed in ciphertext to the user apparatus (20));
“convert, by the first computing unit, the database instruction into a computing instruction to be executed by the second computing unit, and transmit the computing instruction to the second computing unit” (see Mori par. 0072, when the user apparatus (20) receives a database processing result from the database control means (12), if conversion or decryption of the data and/or column data is necessary, the user apparatus (20) executes conversion or decryption using key information (for example, a secret key) managed by the key utilization means. As a response to the database operation command, the user apparatus (20) sends the obtained data to the source of the database operation command (for example, 21 in FIG. 1));
Mori does not explicitly discloses perform, by the second computing unit according to the computing instruction, a cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter, to obtain a ciphertext result; and transmitting, by the second computing unit, the ciphertext result to the first computing unit.
However, in analogues art, Cheng discloses performing, by the second computing unit according to the computing instruction, a cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter, to obtain a ciphertext result (see Cheng par. 0020, a database access method is provided. The method is performed in a non-secure execution environment, and includes: sending an encrypted data computation request to a ciphertext operation module, where the encrypted data computation request requests to perform computation on encrypted data of a user, and the ciphertext operation module runs in a trusted execution environment; sending the encrypted data to the ciphertext operation module, where the encrypted data is all encrypted data in a user query request; and receiving an encrypted computation result sent by the ciphertext operation module); and transmit, by the second computing unit, the ciphertext result to the first computing unit (see Cheng par. 0020, sending the encrypted data to the ciphertext operation module, where the encrypted data is all encrypted data in a user query request; and receiving an encrypted computation result sent by the ciphertext operation module).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Cheng in to the system of Mori in order to provide an encrypted data computation request requests to perform computation on encrypted data of a user, the ciphertext operation module runs in a trusted execution environment, the transceiver module is further configured to send the encrypted data to the ciphertext operation module, the encrypted data is all encrypted data in a user query request, and the transceiver module is further configured to receive an encrypted computation result sent by the ciphertext operation module. (see Cheng par. 0035).
8. Claims 8 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Mori et al. US Patent Application Publication NO. 2014/0325217 (hereinafter Mori) in view of Cheng et al. US Patent Application Publication No. 2024/0028759 (hereinafter Cheng) in further view of Hostyn et al. US Patent Application Publication No. 2015/0365235 (hereinafter Hostyn).
Regarding claims 8 and 18, Mori in view of Cheng discloses the method according to claim 1, the system according to claim 17,
Mori in view of Cheng does not explicitly discloses obtaining, by the first computing unit, an auxiliary key from the user end device, and transmitting the auxiliary key to the second computing unit; and performing, by the second computing unit, the cryptographic operation based on the auxiliary key.
However, in analogues art, Hostyn discloses obtaining, by the first computing unit, an auxiliary key from the user end device, and transmitting the auxiliary key to the second computing unit (see Hostyn par. 0105, the smart watch 701 (first computing unit) generates, as a one-time password, an auxiliary key based on the shared secret key 707 and the current system time 715. The smart watch 701 further generates a representation 705 of the auxiliary key, here a QR code, and displays the representation 705 of the auxiliary key on its display. The tablet PC 703 (second computing unit) captures the representation 705 of the auxiliary key and restores the auxiliary key 709 from the representation); and performing, by the second computing unit, the cryptographic operation based on the auxiliary key (see Hostyn par. 0105, In order to authenticate the user at the web service 713, the tablet PC 709 communicates the auxiliary key 709 to the web service 713 via the Internet 711. The web service 713 receives the auxiliary key 709 and validates the auxiliary key 709 based on the shared secret key 707 and the current system time 715. If the web service can correctly validate the auxiliary key 709, then the web service 713 grants the tablet PC, respectively the user access to its services).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Hostyn in to the system of Mori and Cheng in order to provide a system comprising an electronic device for generating an auxiliary key and an electronic device for capturing and restoring the auxiliary key (see Hostyn par. 0011).
9. Claims 9 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Mori et al. US Patent Application Publication NO. 2014/0325217 (hereinafter Mori) in view of Cheng et al. US Patent Application Publication No. 2024/0028759 (hereinafter Cheng) in further view of Son et al. US Patent Application Publication No. 2023/0269067 (hereinafter Son).
Regarding claims 9 and 19, Mori in view of Cheng discloses the method according to claim 6, the system according to claim 16,
Mori in view of Cheng does not explicitly discloses wherein the second computing unit is a graphics processing unit (GPU) or an AI accelerator chip that is applicable for a matrix operation, the cryptographic operation comprises a fully homomorphic encryption operation implemented based on a fast number-theoretic transform (NTT), and the NTT is implemented by using the matrix operation.
However, in analogues art, Son discloses wherein the second computing unit is a graphics processing unit (GPU) or an AI accelerator chip that is applicable for a matrix operation, the cryptographic operation comprises a fully homomorphic encryption operation implemented based on a fast number-theoretic transform (NTT), and the NTT is implemented by using the matrix operation (see Son pars. 0093, 0106, the main processor 1100 may further include an accelerator 1130, a dedicated circuit for high-speed data operation such as artificial intelligence (AI) data operation or the like. The accelerator 1130 may include a graphics processing unit (GPU), a neural processing unit (NPU), or a data processing unit (DPU). The accelerator 1130 may be implemented as the homomorphic encryption operation accelerator described with reference to FIGS. 1 to 11. The accelerator 1130 may be implemented as a chip physically independent from the other components of the main processor 1100. The dedicated memory 5220 may temporarily store pieces of result data according to operations of the NTT circuit 5230, the INTT circuit 5240, the matrix vector multiplication circuit 5250, the modular polynomial multiplication circuit 5260, and the modular polynomial addition circuit 5270. The NTT circuit 5230 may be implemented to transform data to simplify computational complexity of polynomial multiplication. The INTT circuit 5240 may be implemented to inversely transform a computed value of an output value of the NTT circuit 5230).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Son in to the system of Mori and Cheng in order to provide a method of operating a homomorphic encryption operation accelerator, the method including performing a number theoretic transform (NTT) operation on each of first homomorphic ciphertext and second homomorphic ciphertext, and performing a base conversion operation by adding a partial sum using a first value of the NTT operation (see Son par. 0005).
10. Claims 10 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Mori et al. US Patent Application Publication NO. 2014/0325217 (hereinafter Mori) in view of Cheng et al. US Patent Application Publication No. 2024/0028759 (hereinafter Cheng) in further view of Zage et al. US Patent Application Publication No. 2022/0138286 (hereinafter Zage).
Regarding claims 10 and 20, Mori in view of Cheng discloses the method according to claim 1, the system of claim 11,
Mori in view of Cheng does not explicitly discloses wherein the first computing unit is a central processing unit, and the second computing unit is a graphics processing unit; and the performing, by the second computing unit according to the computing instruction, a cryptographic operation corresponding to the target operation on ciphertext data in the encrypted database and the ciphertext parameter comprises: storing, by the second computing unit, the ciphertext data and the ciphertext parameter in a graphics memory based on the computing instruction; and reading, by the second computing unit, the ciphertext data and the ciphertext parameter from the graphics memory, to perform the cryptographic operation to obtain the ciphertext result.
However, in analogues art, Zage discloses wherein the first computing unit is a central processing unit (CPU) (Fig. 3C CPUs 361), and the second computing unit is a graphics processing unit (GPU) (Fig. 3C GPU 380); storing, by the second computing unit, the ciphertext data and the ciphertext parameter in a graphics memory based on the computing instruction (see Zage par. 0088, the graphics multiprocessor 234 in which the graphics multiprocessor 234 couples with the pipeline manager 232 of the processing cluster 214. The graphics multiprocessor 234 has an execution pipeline including but not limited to an instruction cache 252, an instruction unit 254, an address mapping unit 256, a register file 258, one or more general purpose graphics processing unit (GPGPU) cores 262, and one or more load/store units 266. The GPGPU cores 262 and load/store units 266 are coupled with cache memory 272 and shared memory 270 via a memory and cache interconnect 268); and reading, by the second computing unit, the ciphertext data and the ciphertext parameter from the graphics memory, to perform the cryptographic operation to obtain the ciphertext result (see Zage par. 0164, In one implementation, the bias table entry associated with each access to the GPU-attached memory 420-423 is accessed prior the actual access to the GPU memory, causing the following operations. First, local requests from the GPU 410-413 that find their page in GPU bias are forwarded directly to a corresponding GPU memory 420-423. Local requests from the GPU that find their page in host bias are forwarded to the processor 405 (e.g., over a high-speed link as discussed above). Optionally, requests from the processor 405 that find the requested page in host processor bias complete the request like a normal memory read. Alternatively, requests directed to a GPU-biased page may be forwarded to the GPU 410-413. The GPU may then transition the page to a host processor bias if it is not currently using the page).
Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Zage in to the system of Mori and Cheng in order to provide a graphics processing unit (GPU) is communicatively coupled to host/processor cores to accelerate, for example, graphics operations, machine-learning operations, pattern analysis operations, and/or various general-purpose GPU (GPGPU) functions (see Zage par. 0055).
Conclusion
11. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Mori et al. (US 2013/0246813 A1): discloses A user apparatus connected to database apparatus via network comprises: unit that manages key information in order to encrypt and decrypt; storage unit that stores security configuration information of data and/or metadata; application response unit that determines whether or not encryption is necessary for database operation command, and if encryption is necessary, selects encryption algorithm corresponding to data and/or metadata, performs encryption, and transmits result to database control unit to cause database control unit to execute database operation, if encryption is not necessary, transmits database operation command to database control unit to cause database control unit to execute database operation, and receives processing result transmitted by database control unit, and if decryption or conversion of data and/or metadata of processing result is necessary, performs necessary decryption or conversion, and returns response to database operation command; and security configuration unit that configures security information of data stored in database.
Baird, III et al. (US 2019/0020629 A1): discloses An apparatus includes a processor and a memory operatively coupled to the processor and associated with an instance of a distributed database at a first compute device. The processor is configured to select an anonymous communication path. Each blinded public key from a sequence of blinded public keys associated with the anonymous communication path is associated with a pseudonym of a compute device from a set of compute devices that implement the anonymous communication path. The processor is configured to generate an encrypted message encrypted with a first blinded public key. The processor is configured to generate an encrypted data packet including the encrypted message and a compute device identifier associated with a second compute device. The encrypted data packet is encrypted with a second blinded public key. The processor is configured to send the encrypted data packet to a third compute device.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMUEL AMBAYE whose telephone number is (571)270-7635. The examiner can normally be reached M-F 9:00 AM - 6:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAMUEL AMBAYE/Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433
Prosecution Insights