DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-22 are pending for examination. Claims 1, 13, and 22 are independent claims. This Office Action is Non-Final.
Claim Objections
Claims 7, 10, and 22 are objected to because of the following informalities:
Claim 7, line 2, acronym “EM” should be spelled out first time it is used. Please amend with –electromagnetic (EM)--. Appropriate correction is required.
Claim 10, lines 1-2, acronym “field-programmable gate array (FGPA)” is misspelled. Please amend with --field-programmable gate array (FPGA)--. Appropriate correction is required.
Claim 20, line 1 “a sensor” is unclear if refers to claim 13, line 9 “a sensor” or a new sensor? For the remainder of this Office Action, the Examiner will interpret claim 20 as referring back to the sensor of claim 13, thus claim 20, line 1 “[a] the sensor”. Appropriate correction or explanation is required.
Claim 22, line 4 “the sensor” is unclear if refers to line 3 “a voltage sensor” or a different set of sensors? Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 11-12, 17-18, and 22 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 11, line 1 “the voltage sensors” lacks antecedent basis. Appropriate correction is required.
Claim 12, line 1 “the voltage sensors” lacks antecedent basis. Appropriate correction is required.
Claim 17, line 2 “the fault” lacks antecedent basis because in claim 13 is introduced as plural “a plurality of faults”. Appropriate correction is required.
Claim 18 depends on claim 17 and inherits the deficiencies of claim 17. Applicant may cancel the claim, amend the claim to place the claim in proper dependent form, rewrite the claim in independent form, or present a sufficient showing that the dependent claim complies with the statutory requirements.
Claim 22, line 2 “the improvement” lacks antecedent basis. Appropriate correction is required.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes multiple claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitations use a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are recited in claim 22 with functional language italicized and generic placeholder and linking phrase in bold for claim 22:
22. A method for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) wherein the improvement comprises using a voltage sensor forming part of the IC to capture an effect corresponding to instantaneous voltage measurements by the sensor.
Because these claim limitations are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. The portions of the originally filed specification that describe the corresponding structure that performs the claimed functions for the claims above are Fig. 1, paragraphs [0010], [0027], and [0031], .
If applicant does not intend to have these limitations interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 22 rejected under 35 U.S.C. 101 because the claimed invention is directed to (an) abstract idea(s) without significantly more.
Claim 22 recites:
characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC)
using a voltage sensor forming part of the IC to measure voltage
capture an effect corresponding to instantaneous voltage measurements.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes:
Claim 22 is a process.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘characterizing’ limitation in # 1 and ‘capture an effect’ limitation in #3 above, as claimed and under broadest reasonable interpretation (BRI), are mental processes that covers performance of the limitations in the human mind. For example, “characterizing” in the context of this claim encompasses a person making a judgement about fault injection vulnerabilities. Furthermore, “capture an effect” in the context of this claim encompasses a person making a judgement about data measurements.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘using a voltage sensor’ limitation in # 2 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “using” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
With regards to # 2 above, per MPEP 2106.05(g), the courts have recognized the following functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
ii. Testing a system for a response, the response being used to determine system malfunction, In re Meyers, 688 F.2d 789, 794; 215 USPQ 193, 196-97 (CCPA 1982).
For at least the reasoning provided above, claim 22 is patent ineligible.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-7 and 9-22 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-7 and 9-22 of U.S. Patent No. 12,147,284 (reference application). Although the Instant Application claims 1-7 and 9-22 and Patent No. 12,147,284 claims 1-7 and 9-22 at issue are not identical, they are not patentably distinct from each other because, as shown in the table below, Instant Application claims 1-7 and 9-22 are anticipated by Patent No. 12,147,284 claims 1-7 and 9-22.
Instant Application
18/951,018
U.S. Patent No. 12,147,284
1. A method for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) comprising:
delivering a series of repeated power distribution network-based fault injection attacks comprising a plurality of faults;
capturing, by an array of sensors forming part of the IC, effects of the faults, the captured effects corresponding to instantaneous voltage measurements by such sensors; and
analyzing the captured effects to identify any vulnerabilities in the IC.
1. A method for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) comprising:
delivering a series of repeated power distribution network-based fault injection attacks comprising a plurality of faults;
capturing, by an array of sensors forming part of the IC, effects of the faults, the captured effects corresponding to instantaneous voltage measurements by such sensors; and
generating, based on the captured effects of the fault, a vulnerability map visually identifying locations of vulnerable locations in the IC.
2. The method of claim 1, wherein the faults are commenced at an initial pulse delay and a delay of subsequent faults is iteratively stepped.
Claim 2
3. The method of claim 2, wherein the delivering comprises:
arming a pulse generator to deliver a series of electromagnetic pulses through a probe on to the IC, the pulses commencing at the initial pulse delay.
Claim 3
4. The method of claim 3 further comprising:
selectively moving the probe over a surface routing relative to the IC.
Claim 4
5. The method of claim 4, wherein the probe is moved using a probe positioner.
Claim 5
6. The method of claim 3, wherein the probe comprises a crescent probe.
Claim 6
7. The method of claim 3, wherein the probe comprises a cylindrical probe or any other type of nearfield EM probe.
Claim 7
9. The method of claim 8 further comprising:
associating sensors on the IC with other components on the IC such that the one or more vulnerabilities are specified in relation to components in which the associated sensor captures effects above a pre-defined threshold.
Claim 9
10. The method of claim 1 wherein the IC comprises a field-programmable gate array (FGPA).
Claim 10
11. The method of claim 1, wherein the voltage sensors comprise:
time-to-digital converter sensors spatially characterize voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered.
Claim 11
12. The method of claim 1, wherein the voltage sensors comprise: ring oscillators.
Claim 12
13. A system for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) comprising:
at least one probe;
a probe positioner coupled to the at least one probe; and
a controller comprising memory and at least one data processor, the memory storing instructions which, when executed, result in operations comprising:
delivering power distribution network-based fault injection attacks comprising a plurality of faults across the IC using the at least one probe;
wherein a sensor forming part of the IC is configured to capture an effect corresponding to instantaneous voltage measurements by the sensor.
13. A system for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) comprising:
at least one probe;
a probe positioner coupled to the at least one probe; and
a controller comprising memory and at least one data processor, the memory storing instructions which, when executed, result in operations comprising:
delivering a series of repeated power distribution network-based fault injection attacks comprising a plurality of faults across the IC using the at least one probe while it is moved by the probe positioner;
wherein an array of sensors forming part of the IC capture effects of the faults during each iteration, the captured effects corresponding to instantaneous voltage measurements by such sensors.
14. The system of claim 13, wherein the delivering comprises:
arming a pulse generator to deliver a series of electromagnetic pulses through the probe on to the IC.
Claim 14
15. The system of claim 14, wherein the operations further comprise:
selectively moving the probe over a predetermined surface routing relative to the IC.
Claim 15
16. The system of claim 14, wherein the probe comprises a cylindrical probe.
Claim 16
17. The system of claim 13, wherein the operations further comprise:
generating, based on captured effects of the fault, a vulnerability map visually identifying locations of vulnerable locations in the IC.
Claim 17
18. The system of claim 17, wherein the operations further comprise:
associating a sensor on the IC with one or more components on the IC such that the one or more vulnerabilities are specified in relation to components in which the associated sensor captures effects above a pre-defined threshold.
Claim 18
19. The system of claim 13 wherein the IC comprises a field-programmable gate array (FGPA).
Claim 19
20. The system of claim 13, wherein a sensor comprises:
a time-to-digital converter sensor spatially characterizing voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered.
Claim 20
21. The system of claim 13, wherein a voltage sensor comprises a ring oscillator.
Claim 21
22. A method for characterizing power distribution network-based fault injection vulnerabilities in an integrated circuit (IC) wherein the improvement comprises using a voltage sensor forming part of the IC to capture an effect corresponding to instantaneous voltage measurements by the sensor.
Claim 22
With regards to claims 1-7 and 9-22 of the Instant Application, claims 1-7 and 9-22 of U.S. Patent No. 12,147,284 is in essence a “species” of the generic invention of Instant Application claims 1-7 and 9-22. It has been held that a generic invention is “anticipated” by a “species” within the scope of the generic invention. See In re Goodman, 29 USPQ2d 2010 (Fed. Cir. 1993).
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 8-10, and 22 are rejected under 35 U.S.C. 102(a)(1) and 102(a)(2) as being anticipated by Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana.
Regarding claim 1, Yana teaches:
A method for characterizing power distribution network (Yana, Abstract “one independent power network”, Fig. 2, 202 the independent power network is distributed throughout chip 100)-based fault injection (The Examiner under BRI interprets “fault injection” as injecting or “delivering” a fault into the IC. Yana, paragraph 0001 teaches “fault injection attacks, where an adversary injects something in the circuit to alter the behavior of the circuit.” Thus, the adversary acts to deliver/generate/transmit a fault to create a fault injection attack. ) vulnerabilities in an integrated circuit (IC) (Yana, Abstract “detect a change in a power characteristic of the independent power network”. Paragraph 0002 “identify elevated power characteristics on an independent power network”. Fig. 2, paragraph 0018 teaches “fault injection attack detection”. Paragraph 0016 teaches “chip 100 implementing an IC”. Paragraph 0017 teaches “examples of heat maps representing impact area of a variety of fault injection attacks that may be made against an IC such as shown in Fig. 1A.”) comprising:
delivering a series of repeated power distribution network-based fault injection attacks (The Examiner under BRI interprets “delivering … fault injection attacks” as injecting or “delivering” a fault into the IC. Yana, paragraph 0001 teaches “fault injection attacks, where an adversary injects something in the circuit to alter the behavior of the circuit.” Thus, the adversary acts to deliver/generate/transmit a fault to create a fault injection attack. Paragraph 0020 “can be detected from the independent power network 202, for example, by an abnormal spike in the power activity (e.g., change in power signature).”) comprising a plurality of faults (Yana, paragraph 0021 “An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area), for example, concentrated in the areas of known or expected preferred glitches ...” The “glitches” are created by a plurality of faults);
capturing, by an array of sensors forming part of the IC (Yana, Fig. 3, paragraph 0021 “an IC with an independent power network that shows attached sensors for fault injection attack detection. An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area)”), effects of the faults (Yana, paragraph 0022 “The configurations for the sensors can be selected such that the sensors respond to (e.g., have sensitivity to) at least two types of fault injection attacks. Indeed, at least two different fault injection attacks may be detected from the same sensor element.”), the captured effects corresponding to instantaneous voltage measurements by such sensors (Yana, paragraph 0025 “the detector 420 include a voltage sensor. In some cases, the detection can be based on …a value of the voltage on the line (or charge storage device).”); and
analyzing the captured effects to identify any vulnerabilities in the IC (Yana, paragraph 0002 “The described fault injection attack detection and corresponding circuitry can identify elevated power characteristics on an independent power network to detect a fault injection attack.” Paragraph 0014 “fault injection attack detection and corresponding circuitry can protect secure or sensitive information that might be contained on an IC by identifying elevated power characteristics on an independent power network.” Paragraph 0017 “FIG. 1B shows examples of heat maps representing impact area of a variety of fault injection attacks that may be made against an IC such as shown in FIG. 1A.”).
Regarding claim 8, the rejection of claim 1 is incorporated as given above. Yana teaches associating identified vulnerabilities in the IC with respective locations on the IC (Yana, Fig. 3, paragraph 0021 “an IC with an independent power network that shows attached sensors for fault injection attack detection. An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area)”. Each sensor identifies a location in the IC. Fig. 6 shows different multiple independent power networks that are in different locations, paragraph 0035 “The multiple independent power networks 610 can have overlapping areas of coverage [i.e. respective locations] that make sure that malicious energy can be sensed even in a case when an adversary disables one or more independent power networks.”).
Regarding claim 9, the rejection of claim 8 is incorporated as given above. Yana teaches associating sensors on the IC with other components on the IC such that the one or more vulnerabilities are specified in relation to components in which the associated sensor captures effects above a pre-defined threshold (Yana, paragraph 0035 “if the energy levels detected by one independent power network can be checked against the energy levels detected by another independent power network in order to improve the probability of the detection of malicious activity.” The energy levels correspond to a threshold. Fig. 1A Processor 102, Other blocks 108, Memory 104, Analog 106, CryptoBlocks 110 are other components that are coupled to one or more sensors as shown in Fig. 3 or separate independent power networks comprising separate sensors as shown in Fig. 6).
Regarding claim 10, the rejection of claim 1 is incorporated as given above. Yana teaches wherein the IC comprises a field-programmable gate array (FGPA) (Yana, paragraph 0036 “This can be carried out at the chip level—for integrated circuits or a field programmable gate array—or at a circuit board level—for printed circuit boards or other circuit packages.”).
Regarding claim 22, Yana teaches:
A method for characterizing power distribution network(Yana, Abstract “one independent power network”, Fig. 2, 202 the independent power network is distributed throughout chip 100)-based fault injection (The Examiner under BRI interprets “fault injection” as injecting or “delivering” a fault into the IC. Yana, paragraph 0001 teaches “fault injection attacks, where an adversary injects something in the circuit to alter the behavior of the circuit.” Thus, the adversary acts to deliver/generate/transmit a fault to create a fault injection attack. ) vulnerabilities in an integrated circuit (IC) (Yana, Abstract “detect a change in a power characteristic of the independent power network”. Paragraph 0002 “identify elevated power characteristics on an independent power network”. Fig. 2, paragraph 0018 teaches “fault injection attack detection”. Paragraph 0016 teaches “chip 100 implementing an IC”. Paragraph 0017 teaches “examples of heat maps representing impact area of a variety of fault injection attacks that may be made against an IC such as shown in Fig. 1A.”) wherein the improvement comprises using a voltage sensor forming part of the IC (Yana, Fig. 3, paragraph 0021 “an IC with an independent power network that shows attached sensors for fault injection attack detection. An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area)”) to capture an effect (Yana, paragraph 0022 “The configurations for the sensors can be selected such that the sensors respond to (e.g., have sensitivity to) at least two types of fault injection attacks. Indeed, at least two different fault injection attacks may be detected from the same sensor element.”) corresponding to instantaneous voltage measurements by the sensor (Yana, paragraph 0025 “the detector 420 include a voltage sensor. In some cases, the detection can be based on …a value of the voltage on the line (or charge storage device).”).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. §§ 102 and 103 (or as subject to pre-AIA 35 U.S.C. §§ 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. § 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2-3 are rejected under 35 U.S.C. § 103 as being unpatentable over Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana, in view of Rossi et al., (U.S. Patent Number 5,682,100), hereinafter Rossi.
Regarding claim 2, the rejection of claim 1 is incorporated as given above. Yana does not appear to distinctly disclose wherein the faults are commenced at an initial pulse delay and a delay of subsequent faults is iteratively stepped. Rossi, in the same field of endeavor, teaches wherein the faults are commenced at an initial pulse delay and a delay of subsequent faults is iteratively stepped (Rossi, Abstract “a monitoring point to sense the arrival of the transient fault pulse and for transmitting a timing pulse a known time delay after sensing the arrival of the transient fault pulse …” Col. 2, lines 20-60 “means for injecting timing … pulses responsive to the first sensing means into the power distribution system at the monitoring point; a time delay means at the monitoring point for interposing a delay of a specific known time interval before injecting the timing … pulses after sensing the arrival of the transient fault signal; second means for sensing the arrival of the transient fault pulse and the injected pulses at each of the plurality of receiving points along the power distribution system…” The timing interval varies and can be in steps. See Figs. 4-7 and description, col. 8 lines 20-55 “number of times these calculations are repeated will depend on the desired accuracy level sought to be attained.”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Yana to incorporate the teachings of Rossi and provide wherein the faults are commenced at an initial pulse delay and a delay of subsequent faults is iteratively stepped. Doing so would provide the advantage and capability of improving the accuracy of locating the fault (Rossi, Abstract).
Regarding claim 3, the rejection of claim 2 is incorporated as given above. Yana teaches arming a pulse generator to deliver a series of electromagnetic pulses through a probe on to the IC, the pulses commencing at the initial pulse delay (Yana, paragraph 0032 “For an electromagnetic fault injection (EMFI) attack, a probe coil applies an amplified signal from a signal generator to, for example, emit a signal that can modify the voltage on the wires (e.g., a signal line) to influence execution of instructions.”).
Claims 4-7 are rejected under 35 U.S.C. § 103 as being unpatentable over Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana, in view of Rossi et al., (U.S. Patent Number 5,682,100), hereinafter Rossi and further in view of Takemoto et al., (U.S. Patent Publn Num. 2001/0015650 A1), hereinafter Takemoto.
Regarding claim 4, Yana and Rossi teach all of the features with respect to claim 3 as given above. Yana and Rossi does not appear to distinctly disclose selectively moving the probe over a surface routing relative to the IC.
Takemoto, in the same field of endeavor, teaches selectively moving the probe over a surface routing relative to the IC (Takemoto, paragraphs 0011, 0014 “a plurality of probes adapted to input/output an electric signal for verifying an operation of the semiconductor integrated circuit to/from a plurality of positions on the semiconductor integrated circuit…”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Yana and Rossi to incorporate the teachings of Takemoto for selectively moving the probe over a surface routing relative to the IC because this allows complete verification of the operation of the semiconductor integrated circuit rather than just a localized area thus improving reliability (Takemoto, paragraphs 0008, 0011 and 0014).
Regarding claim 5, Yana and Rossi and Takemoto teach all of the features with respect to claim 4 as given above. Yana and Rossi does not appear to distinctly disclose wherein the probe is moved using a probe positioner.
Takemoto, in the same field of endeavor, teaches wherein the probe is moved using a probe positioner (Takemoto, paragraphs 0011, 0014 “ to/from a plurality of positions on the semiconductor integrated circuit…” Thus, the probe card shown in Figs. 10-12 is moved using a positioner for precise testing of semiconductor IC).
The motivation to combine for claim 5 is the same as the motivation to combine for claim 4.
Regarding claim 6, Yana and Rossi teach all of the features with respect to claim 3 as given above. Yana and Rossi does not appear to distinctly disclose wherein the probe comprises a crescent probe.
Takemoto, in the same field of endeavor, teaches wherein the probe comprises a crescent probe (Takemoto, Fig. 8 shows a crescent probe 9. Paragraph 0082 teaches angle 29 when becomes smaller, the probe becomes even more crescent shaped paragraph 0097 teaches probe tip not limited to semi-spherical shape but “may be formed in a desired shape.”).
The motivation to combine for claim 6 is the same as the motivation to combine for claim 4.
Regarding claim 7, Yana and Rossi teach all of the features with respect to claim 3 as given above. Yana and Rossi does not appear to distinctly disclose wherein the probe comprises a cylindrical probe or any other type of nearfield EM probe.
Takemoto, in the same field of endeavor, teaches wherein the probe comprises a cylindrical probe or any other type of nearfield EM probe (Takemoto, Fig. 12 and paragraphs 0090-0092 show and describe a cylindrical probe).
The motivation to combine for claim 7 is the same as the motivation to combine for claim 4.
Claims 11-12 are rejected under 35 U.S.C. § 103 as being unpatentable over Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana, in view of Tehranipoor et al., (U.S. Patent Publn Num. 2013/0019324 A1), hereinafter Tehranipoor.
Regarding claim 11, the rejection of claim 1 is incorporated as given above. Yana does not appear to distinctly disclose wherein the voltage sensors comprise: time-to-digital converter sensors spatially characterize voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered. Tehranipoor, in the same field of endeavor, teaches wherein the voltage sensors comprise: time-to-digital converter sensors spatially characterize voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered (Tehranipoor, paragraph 0118 teaches sensors include time-to-digital converter, the sensor can be a current sensor, power sensor or voltage sensor).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Yana to incorporate the teachings of Tehranipoor and provide that the voltage sensors include time-to-digital converter sensors that spatially characterize voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered because use of time-to-digital converter sensor in an on-chip structure improves sensitivity of such structure to noise induced by hardware insertion of the sensor (Tehranipoor, paragraph 0064).
Regarding claim 12, the rejection of claim 1 is incorporated as given above. Yana does not appear to distinctly disclose wherein the voltage sensors comprise: ring oscillators. Tehranipoor, in the same field of endeavor, teaches wherein the voltage sensors comprise: ring oscillators (Tehranipoor, paragraph 0119 teaches that voltage sensor can include a ring oscillator network (RON)).
The motivation to combine for claim 12 is the same as the motivation to combine for claim 11.
Claims 13-19 are rejected under 35 U.S.C. § 103 as being unpatentable over Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana in view of Takemoto et al., (U.S. Patent Publn Num. 2001/0015650 A1), hereinafter Takemoto.
Regarding claim 13, Yana teaches:
A system for characterizing power distribution network(Yana, Abstract “one independent power network”, Fig. 2, 202 the independent power network is distributed throughout chip 100)-based fault injection (The Examiner under BRI interprets “fault injection” as injecting or “delivering” a fault into the IC. Yana, paragraph 0001 teaches “fault injection attacks, where an adversary injects something in the circuit to alter the behavior of the circuit.” Thus, the adversary acts to deliver/generate/transmit a fault to create a fault injection attack. ) vulnerabilities in an integrated circuit (IC) comprising (Yana, Abstract “detect a change in a power characteristic of the independent power network”. Paragraph 0002 “identify elevated power characteristics on an independent power network”. Fig. 2, paragraph 0018 teaches “fault injection attack detection”. Paragraph 0016 teaches “chip 100 implementing an IC”. Paragraph 0017 teaches “examples of heat maps representing impact area of a variety of fault injection attacks that may be made against an IC such as shown in Fig. 1A.”):
at least one probe (Yana, paragraph 0032 “For an electromagnetic fault injection (EMFI) attack, a probe coil applies an amplified signal from a signal generator to, for example, emit a signal that can modify the voltage on the wires (e.g., a signal line) to influence execution of instructions.”);
a controller comprising memory and at least one data processor, the memory storing instructions which, when executed (Yana, Abstract “a detector coupled to the at least one independent power network to detect a change in a power characteristic of the independent power network” Paragraph 0024-0025 describes the detector in more detail. Paragraph 0003 describes implementation of a system incorporating fault injection attack detection. Fig. 1A also shows a processor and memory that can store instructions for execution), result in operations comprising:
delivering power distribution network-based fault injection attacks (The Examiner under BRI interprets “delivering … fault injection attacks” as injecting or “delivering” a fault into the IC. Yana, paragraph 0001 teaches “fault injection attacks, where an adversary injects something in the circuit to alter the behavior of the circuit.” Thus, the adversary acts to deliver/generate/transmit a fault to create a fault injection attack. Paragraph 0020 “can be detected from the independent power network 202, for example, by an abnormal spike in the power activity (e.g., change in power signature).”) comprising a plurality of faults across the IC using the at least one probe (Yana, paragraph 0021 “An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area), for example, concentrated in the areas of known or expected preferred glitches ...” The “glitches” are created by a plurality of faults. Paragraph 0032 “For an electromagnetic fault injection (EMFI) attack, a probe coil applies an amplified signal from a signal generator to, for example, emit a signal that can modify the voltage on the wires (e.g., a signal line) to influence execution of instructions.”);
wherein a sensor forming part of the IC (Yana, Fig. 3, paragraph 0021 “an IC with an independent power network that shows attached sensors for fault injection attack detection. An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area)”) is configured to capture an effect (Yana, paragraph 0022 “The configurations for the sensors can be selected such that the sensors respond to (e.g., have sensitivity to) at least two types of fault injection attacks. Indeed, at least two different fault injection attacks may be detected from the same sensor element.”) corresponding to instantaneous voltage measurements by the sensor (Yana, paragraph 0025 “the detector 420 include a voltage sensor. In some cases, the detection can be based on …a value of the voltage on the line (or charge storage device).”).
Yana does not appear to distinctly disclose a probe positioner coupled to the at least one probe.
Takemoto, in the same field of endeavor, teaches a probe positioner coupled to the at least one probe (Takemoto, paragraphs 0011, 0014 “ to/from a plurality of positions on the semiconductor integrated circuit…” Thus, the probe card shown in Figs. 10-12 is moved using a positioner for precise testing of semiconductor IC).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have combined the teachings of Yana with that of Takemoto providing a probe positioner coupled to the at least one probe because such a probe positioner allows for easy manufacturing and testing of a semiconductor integrated circuit with greater reliability (Takemoto, paragraph 0008).
Regarding claim 14, the rejection of claim 13 is incorporated as given above. Yana further teaches wherein the delivering comprises arming a pulse generator to deliver a series of electromagnetic pulses through the probe on to the IC (Yana, paragraph 0032 “For an electromagnetic fault injection (EMFI) attack, a probe coil applies an amplified signal from a signal generator to, for example, emit a signal that can modify the voltage on the wires (e.g., a signal line) to influence execution of instructions.”).
Regarding claim 15, the rejection of claim 14 is incorporated as given above. Yana does not appear to distinctly disclose selectively moving the probe over a predetermined surface routing relative to the IC.
Takemoto, in the same field of endeavor, teaches selectively moving the probe over a predetermined surface routing relative to the IC (Takemoto, paragraphs 0011, 0014 “a plurality of probes adapted to input/output an electric signal for verifying an operation of the semiconductor integrated circuit to/from a plurality of positions on the semiconductor integrated circuit…”).
The motivation to combine for claim 15 is the same as the motivation to combine for claim 13.
Regarding claim 16, the rejection of claim 14 is incorporated as given above. Yana does not appear to distinctly disclose wherein the probe comprises a cylindrical probe.
Takemoto, in the same field of endeavor, teaches wherein the probe comprises a cylindrical probe (Takemoto, Fig. 12 and paragraphs 0090-0092 show and describe a cylindrical probe).
The motivation to combine for claim 16 is the same as the motivation to combine for claim 13.
Regarding claim 17, the rejection of claim 13 is incorporated as given above. Yana further teaches generating, based on captured effects of the fault, a vulnerability map visually identifying locations of vulnerable locations in the IC (Yana, Fig. 3, paragraph 0021 “an IC with an independent power network that shows attached sensors for fault injection attack detection. An array of sensors 300 can be coupled to the independent power network 202 and placed along the surface of the chip (e.g., active device area)”. Each sensor identifies a location in the IC. Fig. 6 shows different multiple independent power networks that are in different locations, paragraph 0035 “The multiple independent power networks 610 can have overlapping areas of coverage [i.e. respective locations] that make sure that malicious energy can be sensed even in a case when an adversary disables one or more independent power networks.”).
Regarding claim 18, the rejection of claim 17 is incorporated as given above. Yana further teaches associating a sensor on the IC with one or more components on the IC such that the one or more vulnerabilities are specified in relation to components in which the associated sensor captures effects above a pre-defined threshold (Yana, paragraph 0035 “if the energy levels detected by one independent power network can be checked against the energy levels detected by another independent power network in order to improve the probability of the detection of malicious activity.” The energy levels correspond to a threshold. Fig. 1A Processor 102, Other blocks 108, Memory 104, Analog 106, CryptoBlocks 110 are components that are coupled to one or more sensors as shown in Fig. 3 or separate independent power networks comprising separate sensors as shown in Fig. 6).
Regarding claim 19, the rejection of claim 13 is incorporated as given above. Yana further teaches wherein the IC comprises a field-programmable gate array (FGPA) (Yana, paragraph 0036 “This can be carried out at the chip level—for integrated circuits or a field programmable gate array—or at a circuit board level—for printed circuit boards or other circuit packages.”).
Claims 20-21 are rejected under 35 U.S.C. § 103 as being unpatentable over Yanamadala et al., (U.S. Patent Publn Num. 2019/0372751 A1), hereinafter Yana, in view of Takemoto et al., (U.S. Patent Publn Num. 2001/0015650 A1), hereinafter Takemoto and further in view of Tehranipoor et al., (U.S. Patent Publn Num. 2013/0019324 A1), hereinafter Tehranipoor.
Regarding claim 20, Yana and Takemoto teach all of the features with respect to claim 13 as given above. Yana and Takemoto does not appear to distinctly disclose wherein a sensor comprises: a time-to-digital converter sensor spatially characterizing voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered.
Tehranipoor, in the same field of endeavor, teaches wherein a sensor comprises: a time-to-digital converter sensor spatially characterizing voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered (Tehranipoor, paragraph 0118 teaches sensors include time-to-digital converter, the sensor can be a current sensor, power sensor or voltage sensor).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Yana to incorporate the teachings of Tehranipoor and provide that the sensor includes time-to-digital converter sensor that spatially characterize voltages on an on-chip power distribution network (PDN) forming part of the IC while the faults are being delivered because use of time-to-digital converter sensor in an on-chip structure improves sensitivity of such structure to noise induced by hardware insertion of the sensor (Tehranipoor, paragraph 0064).
Regarding claim 21, Yana and Takemoto teach all of the features with respect to claim 13 as given above. Yana and Takemoto does not appear to distinctly disclose wherein a voltage sensor comprises a ring oscillator.
Tehranipoor, in the same field of endeavor, teaches wherein a voltage sensor comprises a ring oscillator (Tehranipoor, paragraph 0119 teaches that voltage sensor can include a ring oscillator network (RON)).
The motivation to combine for claim 21 is the same as the motivation to combine for claim 20.
Conclusion
The prior art made of record and not relied upon is considered pertinent to Applicants’ disclosure. Applicants are required under 37 C.F.R. § 1.111(c) to consider these references fully when responding to this action.
It is noted that any citation to specific pages, columns, lines, or figures in the prior art references and any interpretation of the references should not be considered to be limiting in any way. A reference is relevant for all it contains and may be relied upon for all that it would have reasonably suggested to one having ordinary skill in the art. In re Heck, 699 F.2d 1331, 1332-33, 216 U.S.P.Q. 1038, 1039 (Fed. Cir. 1983) (quoting In re Lemelson, 397 F.2d 1006, 1009, 158 U.S.P.Q. 275, 277 (C.C.P.A. 1968)).
In the interests of compact prosecution, Applicants are invited to contact the examiner via electronic media pursuant to USPTO policy outlined MPEP § 502.03. All electronic communication must be authorized in writing. Applicants may wish to file an Internet Communications Authorization Form PTO/SB/439. Applicants may wish to request an interview using the Interview Practice website: http://www.uspto.gov/patent/laws-and-regulations/interview-practice.
Applicants are reminded Internet e-mail may not be used for communication for matters under 35 U.S.C. § 132 or which otherwise require a signature. A reply to an Office action may NOT be communicated by Applicants to the USPTO via Internet e-mail. If such a reply is submitted by Applicants via Internet e-mail, a paper copy will be placed in the appropriate patent application file with an indication that the reply is NOT ENTERED. See MPEP § 502.03(II).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to INDRANIL CHOWDHURY whose telephone number is (571)272-0446. The examiner can normally be reached on M-Fri 9:30-7:00 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ashish Thomas can be reached on 571-272-0631. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/INDRANIL CHOWDHURY/Examiner, Art Unit 2114
Prosecution Insights