DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to Application No. 19/121,487 filed on 04/16/2025.
As per the Preliminary Amendment filed on 05/12/2025, claims 1-17 are currently amended. Claims 1-17 have been examined and are pending in this application.
Priority
Acknowledgment is made of Applicant’s claim for foreign priority under 35 U.S.C. 119 (a)-(d) to Foreign Application No. FR2210698, filed on 10/17/2022.
Information Disclosure Statement
The information disclosure statement (IDS), submitted on 04/16/2025, is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim(s) 1-6 and 8-16 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Wilhelmus Michiels et al. (EP 2960891 A1; Hereinafter “Michiels”).
Regarding claim 1, Michiels teaches an encoding generation method for a computer-implemented cryptographic algorithm (Michiels: Para. [0060]), characterised in that the following steps are implemented:
- obtaining at least one characteristic specific to a computer peripheral configured to execute a cryptographic algorithm (Michiels: Para. [0060], Para. [0061], The string s may be some binary string that may be derived from the device on which the white-box implementation should be running and that cannot be derived on other devices. For instance, s may be defined as a unique identifier of the device. in Michiels a white-box implementation is derived containing s, and this white-box implementation is placed on the device where the strings is omitted where the string is part of a lookup table or operational code used in the white-box implementation.);
- on a basis of the specific characteristic, generating a dependent encoding operation of the peripheral (Michiels: Fig. 5, Para. [0089], FIG. 5 illustrates a first embodiment of binding a white-box implementation. FIG. 5 is similar to FIG. 3, but includes an extension to include binding the; string s to the white-box implementation. A dependence on an arbitrary 4-bit string s may be implemented as follows Let h0, ... ,h15 be 24 bijective encoding functions, and let T be a 8-to-4-bit look up table T550 defined by T(v,u) = 20 /h/vj where vis an output nibble from the Q-box 520 and the nibble is an identifying string value.)
- associating the generated dependent encoding operation with the cryptographic algorithm (Michiels: Fig. 6, Para. [0090], Further, the lookup table 650 corresponds to the lookup table 550 in FIG. 5 but includes 40 input decoding f and output encoding f. Finally, the lookup XOR-tables 630, 632, 63.1 correspond to the XOR-tables 530, 532, 534 in FIG. 5 but include input decoding fi-1 and output encodings f1.).
Regarding claim 2, Michiels teaches the method according to claim 1, wherein, to associate the dependent encoding operation with the algorithm, the encoding operation is combined with an elementary cryptographic operation of the algorithm in order to form a single merged operation, so that a data item processed by the merged operation is processed according to the elementary cryptographic operation and simultaneously encoded according to the dependent encoding operation (Michiels: Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded. Para. [0085], The description of the table lookup based white box implementation described above was for tt1e encryption operation of AES.).
Regarding claim 3, Michiels teaches the method according to claim 1, wherein the dependent encoding operation is associated with the algorithm before any cryptographic execution of the algorithm on the peripheral, when installing the algorithm on the peripheral, the cryptographic execution corresponding to a data encryption or decryption operation (Michiels: Para. [0065], For instance, s may be defined as a unique identifier of the device. Next, the approach of the related application or Michiels is used to make the white-box implementation dependent on s. Then the obtained white-box implementation may be installed on a device, where string s is omitted. Then, the device may only execute the whitebox implementation once the device can derive the omitted strings, i.e., the white-box implementation may only be executed on the legitimate device.).
Regarding claim 4, Michiels teaches the method according to claim 1, wherein, after installing the algorithm on the peripheral, the following steps are carried out: obtaining the specific characteristic, generating the dependent encoding operation and associating the dependent encoding operation with the algorithm, during a cryptographic execution of the algorithm on the peripheral, the cryptographic execution corresponding to a data encryption or decryption operation (Michiels: Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded. Para. [0085], The description of the table lookup based white box implementation described above was for tt1e encryption operation of AES.).
Regarding claim 5, Michiels teaches the method according to claim 3,wherein, after installing the algorithm on the peripheral, the following steps are carried out: obtaining the specific characteristic, generating the dependent encoding operation and associating the dependent encoding operation with the algorithm, during a cryptographic execution of the algorithm on the peripheral, the cryptographic execution corresponding to the data encryption or decryption operation (Michiels: Para. [0048], Various embodiments are described wherein the cryptographic implementation includes a plurality of functions including a firs! function and second function, and the method further includes: encoding an output of the first function using the set of binding string values; and performing the second function on the encoded output of the first function wherein the second function includes decoding the encoded output of !he first function based upon the identifying string value. Para. [0089]-[0090], [0032]), and
wherein the dependent encoding operation associated before any cryptographic execution being a first dependent encoding operation, the dependent encoding operation generated and associated during the cryptographic execution on the peripheral being a second dependent execution operation, this second encoding operation is generated so that a data item encoded using the first dependent encoding operation is decoded using the second dependent encoding operation (Michiels: Para. [0089], FIG. 5 illustrates a first embodiment of binding a white-box implementation. FIG. 5 is similar to FIG. 3, but includes an extension to include binding the; string s to the white-box implementation. A dependence on an arbitrary 4-bit string s may be implemented as follows Let h0, ... ,h15 be 24 bijective encoding functions, and let T be a 8-to-4-bit look up table T550 defined by T(v,u) = 20 /h/vj where vis an output nibble from the Q-box 520 and the nibble is an identifying string value Para. [0090], Para. [0090], Further, the lookup table 650 corresponds to the lookup table 550 in FIG. 5 but includes 40 input decoding f and output encoding f. Finally, the lookup XOR-tables 630, 632, 63.1 correspond to the XOR-tables 530, 532, 534 in FIG. 5 but include input decoding fi-1 and output encodings f1. Para. [0048], [0032]).
Regarding claim 6, Michiels teaches the method according to the claim 5, wherein, to associate the dependent encoding operation with the algorithm, the encoding operation is combined with an elementary cryptographic operation of the algorithm in order to form a single merged operation, so that a data item processed by the merged operation is processed according to the elementary cryptographic operation and simultaneously encoded according to the dependent encoding operation, and wherein the elementary cryptographic operation being a first elementary cryptographic operation and the merged operation being a first merged operation, the algorithm also comprising a second elementary cryptographic operation following directly after the first elementary cryptographic operation, the following steps are implemented:
- combining, before any cryptographic execution of the algorithm on the peripheral, the first dependent encoding operation with the first elementary cryptographic operation to form the first merged operation (Michiels: Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded. Para. [0085], The description of the table lookup based white box implementation described above was for the encryption operation of AES.);
- combining, during the cryptographic execution of the algorithm on the peripheral, the second dependent encoding operation with the second elementary operation, to form a second merged operation, so that, when the data item encoded and processed by the first merged operation is processed by the second merged operation, it is decoded according to the second dependent encoding operation and simultaneously processed according to the second elementary cryptographic operation (Michiels: Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded.).
Regarding claim 8, Michiels teaches the method according to claim 6, wherein, the first and the second elementary cryptographic operations forming a pair of encoded operations, the steps of generating and combining encodings are repeated for at least one other pair of encoded operations of the algorithm (Michiels: Para. [0081], operations, AddRoundKey and SubBytes can be, merged into a single T-box operation. Para. [0084]).
Regarding claim 9, Michiels teaches the method according to claim l, wherein the cryptographic algorithm is of an "AES" ("Advanced Encryption Standard") or "DES' ("Data Encryption Standard") type (Michiels: Para. [0067], In order to demonstrate embodiments of the invention, an example white-box implementation of AES will now be described).
Regarding claim 10, Michiels teaches the method according to claim l, wherein the characteristic obtained specific to the peripheral is one of the following characteristics or a combination of at least some of the following characteristics (Michiels: Para. [0061], The string s may be some binary string that may be derived from the device on which the white--box implementation should be running and that cannot be derived on other devices. ): - a MAC ("Media Access Control') number of the peripheral (Michiels: Para. [0061], For instance, s may be defined as a unique identifier of the device.); - an IMEI ("International Mobile Equipment Identity") number of the peripheral (Michiels: Para. [0061], For instance, s may be defined as a unique identifier of the device.); - a telephone serial number (Michiels: Para. [0061], For instance, s may be defined as a unique identifier of the device.); - a counter of a number of times a cryptographic algorithm has been installed in the peripheral.
Regarding claim 11, Michiels teaches the method according to claim l, wherein generating the dependent encoding operation of the peripheral comprises a step of hashing one or more characteristics specific to the peripheral, in order to generate a dependent encoding table of the peripheral or a dependent encoding matrix of the peripheral, with at least one element of the table or respectively of the dependent encoding matrix resulting from the hashing (Michiels: Para. [0064], Any strings s that represent the integrity or authenticity of the system that the white-box implementation runs on may be used. It, for instance, s is the hash of some code fragment, then it hardens the software against tampering. Also, the strings may be used for node locking where s is the unique identification of a node or hardware in the white-box system. Another use-case for the string s is traitor tracing. If the string is the name of the legitimate owner of a white--box irnplemen1ation, and if this white-box implementation is encountered on an illegitimate device or on the Internet, then the white-box implementation may be traced back to the source of the leakage. Further s may be used to identify users by being associated with a user password or hash of a user password.).
Regarding claim 12, Michiels teaches the method according to claim 11, wherein, to associate the dependent encoding operation with the algorithm, the encoding operation is combined with an elementary cryptographic operation of the algorithm in order to form a single merged operation, so that a data item processed by the merged operation is processed according to the elementary cryptographic operation and simultaneously encoded according to the dependent encoding operation (Michiels: Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded. Para. [0085], The description of the table lookup based white box implementation described above was for the encryption operation of AES.), and
wherein, to combine the dependent encoding operation with the elementary cryptographic operation, terms of a truth table corresponding to the elementary operation are substituted using the substitution table generated, to form a merged table corresponding to the merged operation, or a mathematical operation is carried out between a matrix corresponding to the elementary operation and the dependent encoding matrix generated, to form a merged matrix corresponding to the merged operation (Michiels: Para. [0081], The first two operations, AddRoundKey and SubBytes can be, merged into a single T-box operation. For ease of presentation, this operation is omitted in this description. But may be incorporated into the look-up table implementing Ti,j or implemented as a separate manipulation of the state matrix. Para. [0074], Each round is includes similar processing steps operating on bytes, rows, or columns of the state matrix, each round using a different round key in these processing steps. Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded.).
Regarding claims 13-14, Claims 13-14 are rejected under the same rational as claim 1.
Regarding claim 15, Claim 15 is rejected under the same rational as claim 1.
Regarding claim 16, Claim 16 is rejected under the same rational as claim 1.
Regarding claim 17, Claim 17 is rejected under the same rational as claim 1.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim(s) 7 is rejected under 35 U.S.C. 103 as being unpatentable over Wilhelmus Michiels et al. (EP 2960891 A1; Hereinafter “Michiels”) in view of Lee et al. (US 2012/0163582; Hereinafter “Lee”).
Regarding claim 7, Michiels teaches the method according to claim 6 wherein the following steps are also implemented: - before any cryptographic execution of the algorithm, combining the third encoding operation with the first merged operation, to form a new first merged operation to simultaneously encode the data item according to the first encoding operation and to the third encoding operation and process the data item according to the first elementary operation (Michiels: Fig. 3-5Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded.);
- during the cryptographic execution, combining the fourth encoding operation with the second merged operation, to form a new second merged operation to simultaneously decode the data item according to the second encoding operation and to the fourth encoding operation and process the data item according to the second elementary operation (Michiels: Fig. 3-5, Para. [0084], To prevent this, the input and outputs of all lookup tables are encoded with arbitrary bijective functions. That means that a lookup table is merged with an encoding function that encodes the output and with a decoding function that decodes the input. The encodings are chosen such that the output encoding of one table matches the input encoding assumed in the next table. A portion of the implementation of FIG. 3 is depicted in FIG. 4 for the first round. In this exam pie, the input 1o the round is not encoded in order to be compliant with AES, but the output of the round is encoded.).
Michiels does not explicitly teach: - before the steps of obtaining the at least one characteristic specific to a computer peripheral, generating the dependent encoding operation of the peripheral, and associating the generated dependent encoding operation with the cryptographic algorithm, a step of generating a third encoding operation, not dependent on the peripheral, and a fourth encoding operation, not dependent on the peripheral and generated so that a data item encoded using the third encoding operation is decoded using the fourth encoding operation.
In an analogous art, Lee teaches teach wherein the following steps are also implemented: - before the steps of obtaining the at least one characteristic specific to a computer peripheral, generating the dependent encoding operation of the peripheral, and associating the generated dependent encoding operation with the cryptographic algorithm, a step of generating a third encoding operation, not dependent on the peripheral, and a fourth encoding operation, not dependent on the peripheral and generated so that a data item encoded using the third encoding operation is decoded using the fourth encoding operation (Lee: Fig. 1, Fig. 4, Para. [0033], With reference to FIG. 3, a data decoding apparatus implemented in a client terminal includes a decoding unit 302, an arithmetic logic unit 300 and the like to decode data such as encoded content, an encoded white box or the like. Para. [0036], At this time, the license RO is input to the arithmetic logic unit 300 of the data decoding apparatus implemented in the client terminal, and the arithmetic logic unit 300 performs an arithmetic operation, e.g., an XOR operation on the license RO and the encoded white box cipher table 304, which has been obtained by performing the XOR operation with the license RO, to thereby decode the encoded white box cipher table to obtain the original white box cipher table before performing the encoding therefor. [client includes device external to server in Fig. 1,4]),
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Lee with the system and method of Michiels to include - before the steps of obtaining the at least one characteristic specific to a computer peripheral, generating the dependent encoding operation of the peripheral, and associating the generated dependent encoding operation with the cryptographic algorithm, a step of generating a third encoding operation, not dependent on the peripheral, and a fourth encoding operation, not dependent on the peripheral and generated so that a data item encoded using the third encoding operation is decoded using the fourth encoding operation because this functionality provides for provisioning of white box cipher tables for encoding and decoding while preserving integrity (Lee: Para. [0002]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
European Patent Application No.: EP 3477889 A1 by Michiels et al.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Nelson Giddins whose telephone number is (571)272-7993. The examiner can normally be reached on Monday - Friday, 9:00 AM - 5:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Linglan Edwards can be reached at (571) 270-5440. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NELSON S. GIDDINS/ Primary Examiner, Art Unit 2408
