Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detail Action
2. This office action is response to the application filed on . Claims 26-33,43-50,104-107 are pending in this communication.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
3. Claims 26-30,33,43-47 and 50 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Fuhry et al (US 20210266329 A1) in view of Aikas et al. (US 20140143543 A1)
Regarding Claim 26:
Fuhry discloses:
a. An apparatus (Para.0082, Para.0003; “The subject matter … can be embodied in …. apparatus, methods”, “Methods…. for secure group file sharing”) comprising:
… interface circuitry (Para.0006; “… sent to the user application over a channel including a secure interface”) to obtain an access control list (Para.0017, Para.0029, Para.0047, Para.0032; “access control policies to enforce read and/or write access on files”, “A file system (FS) …composed of files ….and directories …. contains …. read and written. Each … collection of files and/or … directories…. stores a list of all ….”, “For each f∈FS, an ACL file is stored under f's path appended with a suffix (e.g., ACL 262). This ACL stores f's access permissions … and file owners”, “Every f∈FS has …. one file owner (FO), which ….is the user uploading a file or creating a directory”) for an encrypted data object from a data provider; (Para.0006, Para.0036, Para.0017, Para.0066; “The encryption of the file … occur within the enclave….and sent to the user application over a channel including a secure interface”, “the enclave ….running at the cloud provider 110”, “the enclave checks encrypted access control policies to enforce read and/or write access on files”, “one or more access control permissions to a file linked from the user application 202 to …..the cloud provider 110… access control permissions … define one or more parameters of access related to the file”)
b. …..interface circuitry ….. to obtain the encrypted data object from the data provider; (disclosed in the previous section)
c. memory to store the encrypted data object; (Para.0046, Para.0026; “all files stored in …. memory”, “a …...file system library …. provide ….. file creation, file writing…. On write, data …. separated into chunks….and each chunk encrypted before it is stored in …..memory. When file chunks are loaded back into the ….”) and
memory controller circuitry to permit or deny a request from at least one programmable circuit to access the encrypted data object based on the access control list for the encrypted data object. (Para.0046, Para.0017, Para.0032, Para.0078; “file manager components …. handle all files stored in …. memory….. file manager …. encrypts/decrypts the content of all files that should be written/read with….. All encrypted data is passed/received to/from the …. file manager …. which handles the actual memory access (e.g., internal operations read and write)” file manager components is construed as memory controller circuitry, “On every user access… checks encrypted access control policies to enforce read and/or write access on files…. On each granted file request, the file is ….sent to the user”, “file owner (FO) …. is the user uploading a file ….the FO can set read ….or write ….. permissions. Alternatively, access can be denied”, “features of the subject matter described …… realized in digital electronic circuitry….field programmable gate arrays …. executable …. on a …. programmable processor”)
however, Fuhry does not explicitly disclose:
a. first interface …..to obtain an …. object …..
b. second interface …. separate from the first interface …. to obtain the encrypted …
In an analogous reference Aikas discloses:
a. first interface …..to obtain an …. object …..(Para.0048; “A request is received by the interface frontend 106 …. to store an object” interface frontend 106 is construed as first interface)
b. second interface …. separate from the first interface …. to obtain the encrypted … (Para.0029; “The interface backend 108 can handle …authentication (e.g., ensuring a user's credentials are valid) and authorization (e.g., verifying that a requested operation is permitted) …. The interface backend … provide encryption and decryption services to prevent unauthorized access to data” interface backend 108 is construed as second interface)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Fuhry’s method for secure group file sharing by enhancing Fuhry’s method to include Aikas’s method of receiving request to access the stored resource.
The motivation: the interface frontend 106/first interface may receive requests from and send responses to the client device, while the interface backend 108/second interface can handle or pass request authentication and authorization. Thus, having two separate interfaces instead of a single one can improve design, flexibility, and maintainability.
With respect to independent claim 43, a corresponding reasoning was given earlier in this section with respect to claim 26; therefore, claim 43 rejected, for similar reasons, under the grounds as set forth for claim 26.
Regarding Claim 27:
Fuhry in view of Aikas discloses:
The apparatus of claim 26, including the at least one programmable circuit, one or more of the at least one programmable circuit to provide the request to the memory controller circuitry. (Para.0020, Para.0036, Para.0078, Para.0046, Para.0068; “user equipment 102A-N, such as a computer….(e.g., processor and memory-based devices”, “each user ….e.g., the user equipment 102) and the enclave 220 running at the cloud provider 110”, “features of the subject matter …. realized in digital electronic circuitry, integrated circuitry…. that are executable and/or interpretable on a programmable system including at least one programmable processor”, “The …. file manager component ….encrypts…. the content of all files that should be written/read with”, “a verification by the enclave 220 that a request for the file satisfies the one or more access control permissions (e.g., that a user has individual access rights” UE 102 contains programmable system including programmable processor which is construed as programmable circuit, file manager component 225, construed as the memory controller circuitry, resides within enclave 220)
With respect to dependent claim 44, a corresponding reasoning was given earlier in this section with respect to claim 27; therefore, claim 44 rejected, for similar reasons, under the grounds as set forth for claim 27.
Regarding Claim 28:
Fuhry in view of Aikas discloses:
The apparatus of claim 26, wherein the memory controller circuitry is to:
access a certificate from the at least one programmable circuit based on the request; (Fuhry, Para.0043, Para.0005, Para.0039; “A request handler component 223 …. check the …. the identity information in the client certificate 208 to allocate the request to a user”, “a user accessing a user application, …a certificate …. associated with the user…. one or more access control permissions to a file linked from the user application ….and ….. providing, by the enclave, access to the file….. is in response ….that a request for the file satisfies the one or more access control permissions” A request handler component 223/file manager 225/enclave 220 construed as the memory controller circuitry, “each user …. validates the user's identity and provides a client certificate …. certificate contains identity information (e.g., a user ID, a mail address…. and/or other identification information)”) and
determine whether to permit the request based on the certificate and the access control list. (Para.0017, Para.0039; “On every user access… checks encrypted access control policies to enforce read and/or write access on files…. On each granted file request, the file is ….sent to the user”, “each user …. validates the user's identity and provides a client certificate …. certificate contains identity information (e.g., a user ID, a mail address…. and/or other identification information)”)
With respect to dependent claim 45, a corresponding reasoning was given earlier in this section with respect to claim 28; therefore, claim 45 rejected, for similar reasons, under the grounds as set forth for claim 28.
Regarding Claim 29:
Fuhry in view of Aikas discloses:
The apparatus of claim 28, wherein the memory controller circuitry is to access ….an identifier included in the certificate to determine the access control list that is to specify whether to permit the request (Fuhry, Para.0006, Para.0005, Para.0047; “receiving, by the enclave and from the user application, an authentication token…. the authentication token based upon the certificate …. key”, “establishment …between the enclave and …. the user….. one or more access control permissions to a file linked from the user application to ….where the one or more access control permissions define one or more parameters of access related to the file and …. users, and ….. access to the file…. in response to a verification that a request for the file satisfies the one or more access control permissions….”, “This ACL stores ….access permissions … and file owners …. list ….”)
…..access a data provider mapping table…(Aikas, Para.0017, Para.0034; “the hosted storage service 120 can use an access control service 104 …. the hosted storage service …. access resources stored in the hosted storage service 120”, “the service provider that provides the hosted storage service 120”)
With respect to dependent claim 46, a corresponding reasoning was given earlier in this section with respect to claim 29; therefore, claim 46 rejected, for similar reasons, under the grounds as set forth for claim 29.
Regarding Claim 30:
Fuhry in view of Aikas discloses:
The apparatus of claim 26, wherein the memory controller circuitry is to, based on the at least one programmable circuit being permitted to access the encrypted data object:
access the encrypted data object; (Fuhry, Para.0017; “enclave checks encrypted access control policies to enforce read and/or write access on files”)
decrypt at least a portion of the encrypted data object with a cryptographic key for the encrypted data object; (Fuhry, Para.0069; “decrypts the content of all files that should be written/read with….. using a … key”) and
copy ….. the encrypted data object to a region of the memory accessible by the at least one programmable circuit. (Fuhry, Para.0049, Para.0079, Para.0048, Para.0005; “storing a single copy of redundant objects…. for example, files or blocks.”, “memory or …. equivalent storage”, “encrypted … file can be accessed by different groups”, “individual users and/or groups of users”)
…. a decrypted portion of the …. data object to a region… (Aikas, Para.0087; “the client 102 can decrypt the data object to access the data object's plaintext”)
With respect to dependent claim 47, a corresponding reasoning was given earlier in this section with respect to claim 30; therefore, claim 47 rejected, for similar reasons, under the grounds as set forth for claim 30.
Regarding Claim 33:
Fuhry in view of Aikas discloses;
The apparatus of claim 26, wherein the memory controller circuitry is to access a cryptographic key for the encrypted data object from a compute domain separate from the at least one programmable circuit. (Para.0050, Para.0006, Para.0046; “the … file manager accesses the file ….and encrypts …. the enclave has access to the file keys”, “The file …. encrypted with a file key, the file key unique to the file and derived from … the enclave”, “All encrypted data is passed/received to/from the …. file manager component …”, file manager/enclave/cloud provider [claimed memory controller circuitry] is separate from user equipment 102/ programmable circuit)
With respect to dependent claim 50, a corresponding reasoning was given earlier in this section with respect to claim 33; therefore, claim 50 rejected, for similar reasons, under the grounds as set forth for claim 33.
Claims 31,48,104-107 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Fuhry et al (US 20210266329 A1) in view of Aikas et al. (US 20140143543 A1) and further in view of Chamaraj et al. (US 20250023872 A1)
Regarding Claim 31:
Fuhry in view of Aikas discloses:
The apparatus of claim 26, wherein the request … the at least one programmable circuit is at least one first programmable circuit, (disclosed in claim 26, user equipment 102/programmable circuit of Fuhry is construed as first programmable circuit) …...
….a memory range reserved in memory for the encrypted data object ….(Fuhry, Para.0023; “a portion of the system's main memory … for processor reserved memory …. data in the processor reserved memory … encrypted …”)
……provide the memory controller circuitry with access to the access control list based on a …..request from the memory controller circuitry that includes the identifier of the encrypted data object. (Fuhry, Para.0069, Para.0005, Para.0006; “All encrypted data is passed/received to/from the … file manager component ….which handles the actual memory access (e.g., internal operations read and write)”, “access to the file…. in response to a verification that a request for the file satisfies the one or more access control permissions… the enclave receiving the file in an encrypted form”, “The file may be encrypted with a … key… The encryption of the file with the file key may occur within the enclave” file manager resides within the enclave)
…..register an identifier of the encrypted …object, a cryptographic key with which the encrypted …. object is to be encrypted, (Aikas, Para.0101, Para.0096; “The registration of the hosted storage service 120 by the client 102 in the access control service 124 may include the creation of a secret…. To create this secret, the client 102 can authenticate itself to the access control service 124 using ….tokens….Once authenticated, the client 102 and the access control service 102 can create and agree on a s….. encryption key”, “… sent the encrypted …. object encryption key by the hosted storage service 120”) the access control list, and ….. for the encrypted …. object in a data provider mapping table; (Para.0006, Para.0099, Para.0091; “The hosted storage service …. receive …. the access control service indicating that the access control service may be used for authorizing access to the resource…,”, “register the access control service … with the hosted storage service…. registration …include…. a listing …. of data objects that the access control service … can authorize access to”, “the access control service …. include the encrypted …. object”) and…
however, Fuhry in view of Aikas does not explicitly disclose:
…. the request is a first request, …..and the apparatus includes at least one second programmable circuit…..
…. provide …… access to the access control list based on a second request …..
In an analogous reference Chamaraj discloses:
…. the request is a first request, …..and the apparatus includes at least one second programmable circuit…..(Abstract, Para.0002, Para.0048; “a first request to generate a secure data asset.”, “securely provision a secure data asset to a target device”, “a Target Device 106 (e.g., …. integrated circuit) ….”)
…. provide …… access to the access control list based on a second request …..(Para.0124, Para.0020; “a second request to determine whether the client can (e.g., is granted) access the secure data asset…. the second request comprises an access control policy”, “access control policy can indicate to which … client …. is granted access….the access control policy …. includes a set of records. Each record can list, for each client, …. corresponding access”)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Fuhry in view of Aikas’s method for secure group file sharing by enhancing Fuhry in view of Aikas’s method to include Chamaraj’s method to securely provision a secure data asset to a target device.
The motivation: with two different requests, it is more efficient to securely provision a secure data asset to a target device.
With respect to dependent claim 48, a corresponding reasoning was given earlier in this section with respect to claim 31; therefore, claims 48 rejected, for similar reasons, under the grounds as set forth for claim 31.
Regarding Claim 104:
Fuhry in view of Aikas discloses:
A non-transitory computer-readable medium comprising instructions to cause at least one first programmable circuit of a compute device to: (Fuhry, Para.0020, Para.0036, Para.0078; “user equipment 102A-N, such as a computer”, “each user …. e.g., the user equipment 102…..”, “features of the subject matter described …. realized in digital electronic circuitry, integrated circuitry….. programmable processor”, UE 102 contains programmable processor which is construed as first programmable circuit)
obtain an access control list for an encrypted data object from first interface circuitry, the access control list from a data provider; and
permit or deny a request from at least one …. programmable circuit of the compute device to access the encrypted data object based on the access control list for the encrypted data object, the at least one …. programmable circuit to obtain the encrypted data object from second interface circuitry separate from the first interface circuitry, the encrypted data object from the data provider. (disclosed in claim 26)
however, Fuhry in view of Aikas does not explicitly disclose:
….one second programmable circuit of the … device to access the encrypted data ….. for the encrypted data …the at least one second programmable circuit to obtain the encrypted data ……
In an analogous reference Chamaraj discloses:
….one second programmable circuit of the … device to access the encrypted data ….. for the encrypted data …. the at least one second programmable circuit to obtain the encrypted data …..(Para.0002, Para.0048, Para.0039, Para.0016; “securely provision a secure data asset to a target device”, “a Target Device 106 (e.g., …. integrated circuit) ….”, “a target device (e.g., specialized CM Core)”, “secure data assets (e.g., encrypted data” Target Device 106/integrated circuit)/specialized CM Core) is construed as second programmable circuit)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Fuhry in view of Aikas’s method for secure group file sharing by enhancing Fuhry in view of Aikas’s method to include Chamaraj’s method to securely provision a secure data asset to a target device.
The motivation: Providing secure data to a specialized integrated circuit offers several critical advantages in protecting sensitive information and ensuring system integrity, such as; Protection Against Unauthorized Access, Enhanced Cryptographic Security, Secure Authentication and Identity Management.
With respect to dependent claim 105, a corresponding reasoning was given earlier in this section with respect to claim 28; therefore, claims 105 rejected, for similar reasons, under the grounds as set forth for claim 28.
With respect to dependent claim 106, a corresponding reasoning was given earlier in this section with respect to claim 29; therefore, claims 106 rejected, for similar reasons, under the grounds as set forth for claim 29.
With respect to dependent claim 107, a corresponding reasoning was given earlier in this section with respect to claim 30; therefore, claims 107 rejected, for similar reasons, under the grounds as set forth for claim 30.
Claims 32 and 49 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Fuhry et al (US 20210266329 A1) in view of Aikas et al. (US 20140143543 A1) further in view of Trantham et al. (US 11455402 B2)
Regarding Claim 32:
Fuhry in view of Aikas discloses:
The apparatus of claim 26, wherein the memory controller circuitry is to ….if the at least one programmable circuit is not permitted to access the encrypted data object. (Fuhry, Para.0032, Para.0046; “A user … is part of its …. group …..a group owner (GO), which initially is the user …. one file owner (FO), which initially is the user uploading a file or creating a directory. For any file f and group g, the FO can set read ….. and/or write …. permissions. Alternatively, access can be denied” user equipment 102/ programmable circuit, “file manager component …. encrypts…. the content of all files that should be written/read with ….file manager component …. handles the actual memory access (e.g., internal operations read and write)”)
however, Fuhry in view of Aikas does not explicitly disclose:
…. the …. controller circuitry is to notify the at least one programmable circuit is not permitted …..
In an analogous reference Trantham discloses:
…. the …. controller circuitry is to notify the at least one programmable circuit is not permitted ….. (Claim.11/Col.10, line 17-18; “the controller circuit …. issue a notification to the host device indicating that the write command is rejected”, “The host includes a programmable processor circuit”)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Fuhry in view of Aikas’s method for secure group file sharing by enhancing Fuhry in view of Aikas’s method to include Trantham’s method for selective overwrite protection of data.
The motivation: by issuing a notification to the host device indicating that a write command is rejected on the basis that the one or more blocks of data are write protected, in response to an attempt to write a write-protected block, results in increased security.
With respect to dependent claim 49, a corresponding reasoning was given earlier in this section with respect to claim 32; therefore, claim 49 rejected, for similar reasons, under the grounds as set forth for claim 32.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAYEDA SALMA NAHAR whose telephone number is (703)756-4609. The examiner can normally be reached M-F 12:00 PM to 6:00 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached on (571) 270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAYEDA SALMA NAHAR/Examiner, Art Unit 2435
/BEEMNET W DADA/Primary Examiner, Art Unit 2435
Prosecution Insights