Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
1. This action is responsive to: an original application filed on 8 July 2025.
2. Claims 1-20 are currently pending and rejected.
Information Disclosure Statement
3. The information disclosure statement (IDS) submitted on 8 July 2025. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Priority
4. Priority claimed has been noted.
Drawings
5. The drawings filed on 8 July 2025 are accepted by the examiner.
Claim Rejections - 35 USC § 102
6. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-20 are rejected 35 U.S.C §102 (a)(1) as being anticipated by Sood et al. (US Publication No. 20240419844), hereinafter Sood.
Regarding claim 1:
A chiplet for a multi-chiplet trusted execution environment (TEE), the chiplet comprising (Sood, Fig.3):
an interface to communicate with a second chiplet (Sood, ¶29), physical connections between chiplets and dies (e.g., chiplet-to-chiplet interconnects, die-to-die interconnects, etc.) are compliant with other standards or specifications such as a Bunch of Wires (BoW) specification, a Cache Coherent Interconnect for Accelerators (CCIX) specification, a Advanced Interface Bus (AIB) standard, a 112 gigabit per second (Gbps) (112G) specification, or a Open high Bandwidth Interconnect (OpenHBI) specification, among others.
and processing circuitry that, when in operation, is to: receive, via the interface, a signal indicating creation of a TEE domain at the second chiplet, the creation of the TEE domain based on a process of the second chiplet (Sood, ¶83, ¶32), wherein the CDSM circuit 114 causes the second interface circuit 118 to forward the request to the ROT DCC circuit 120. In the example of FIG. 7, at block 714, based on receiving a response to the request from the RoT DCC circuit 120, the CDSM circuit 114 causes the second interface circuit 118 to send the response to the TSM circuit 108. At block 716, the CDSM circuit 114 accesses a session key for the secure communication session, the session key generated by the RoT DCC circuit 120.
obtain an identifier of the TEE domain based on the signal (Sood, ¶43, ¶81), respective ones of the one or more chiplets 104 are implemented by example root of trusted (RoT) device confidential computing (DCC) certificates 122 (e.g., at least one identifier certificate). For example, the RoT DCC certificates 122 are Trusted Computing Group (TCG) Device Identifier Composition Engine (DICE) certificates. A DICE certificate provides a hardware-based identity (e.g., a unique cryptographic identity). In the example of FIG. 1, the ROT DCC circuit 120 creates a public, private key pair for each of the ROT DCC certificates 122 and adds the key pairs into a key hierarchy (e.g., a DICE key hierarchy) for the system 100.
receive, via the interface, a request including an operation on the TEE domain (Sood, ¶61, ¶113). system 1100 including the FMS circuit 902 of FIG. 9. In the example of FIG. 11, the system 1100 includes a first example security domain 1102, a second example security 1104, and an example edge deployment 1106. In the example of FIG. 11, the first security domain 1102 represents a software deployment of a first tenant (e.g., an enterprise) to execute one or more workloads on the edge deployment 1106. Also, in the example of FIG. 11, the second security domain 1104 represents a software deployment of a second tenant (e.g., an enterprise) to execute one or more workloads on the edge deployment 1106.
verifying the request based on the identifier (Sood, ¶32, ¶81), wherein operations 700 begin at block 702 at which the CDSM circuit 114 of the first chiplet 104.sub.1 of a SiP (e.g., the system 100) mutually authenticates with the ROT DCC circuit 120 of the SiP. At block 704, the CDSM circuit 114 causes the second interface circuit 118 of the first chiplet 104.sub.1 to send a firmware measurement and a security version number for at least one accelerator circuit of the first chiplet 104.sub.1 to the RoT DCC circuit 120.
and executing the request based on a successful verification of the request (Sood, ¶104), the interface circuit 916 allow the FMS circuit 902 to connect to the SiP 900 and be discovered by the host SW stack executing on the core chiplet 904 via standard SoC-specific and/or standard SiP-specific internal PCIe fabrics and/or interfaces. Additionally or alternatively, the interface circuits 916 allow the FMS circuit 902 to connect to the SiP 900 and be discovered by the host SW stack executing on the core chiplet 904 via proprietary sideband and/or low performance global fabrics.
Regarding claim 2:
wherein, to obtain the identifier, the processing circuitry is to: make a request for the identifier of the second chiplet in response to the signal; and receive the identifier as a response to the request (Sood, ¶86).
Regarding claim 3:
wherein the identifier is a cryptographic element used to ensure execution isolation in a TEE of the second chiplet (Sood, ¶32).
Regarding claim 4:
wherein the chiplet includes a Resource Arbitration Login (RAL) component, and wherein, to verify the request based on the identifier, the processing circuitry is to use the RAL component (Sood, ¶81).
Regarding claim 5:
wherein the processing circuitry is to write a RAL local identifier to the RAL component based on the identifier in response to obtaining the identifier to create a RAL local identifier (Sood, ¶163).
Regarding claim 6:
wherein the chiplet includes a Trust Provisioning Agent (TPA) component, and wherein, to verify the request based on the identifier, the processing circuitry is to use the TPA component (Sood, ¶36).
Regarding claim 7:
wherein the processing circuitry is to write a TPA local identifier to the TPA component based on the identifier in response to obtaining the identifier to create a TPA local identifier (Sood, ¶43).
Regarding claim 8:
wherein the identifier is a base memory address of the process on the second chiplet (Sood, ¶43).
Regarding claim 9:
wherein the chiplet includes a set of components including at least one component, and wherein, to execute the request, the processing circuitry is to use the set of components (Sood, ¶44).
Regarding claim 10:
wherein the processing circuitry is to prevent operations from other domains on the set of components (Sood, ¶44).
Regarding claim 11:
A non-transitory machine readable media including instructions that, when executed by processing circuitry of a first chiplet in a chiplet system, cause the processing circuitry to perform operations comprising (Sood, ¶78):
receiving a signal indicating creation of a TEE domain at the second chiplet, the creation of the TEE domain based on a process of the second chiplet (Sood, ¶83, ¶32), wherein the CDSM circuit 114 causes the second interface circuit 118 to forward the request to the ROT DCC circuit 120. In the example of FIG. 7, at block 714, based on receiving a response to the request from the RoT DCC circuit 120, the CDSM circuit 114 causes the second interface circuit 118 to send the response to the TSM circuit 108. At block 716, the CDSM circuit 114 accesses a session key for the secure communication session, the session key generated by the RoT DCC circuit 120.
obtaining an identifier of the TEE domain based on the signal (Sood, ¶43, ¶81), respective ones of the one or more chiplets 104 are implemented by example root of trusted (RoT) device confidential computing (DCC) certificates 122 (e.g., at least one identifier certificate). For example, the RoT DCC certificates 122 are Trusted Computing Group (TCG) Device Identifier Composition Engine (DICE) certificates. A DICE certificate provides a hardware-based identity (e.g., a unique cryptographic identity). In the example of FIG. 1, the ROT DCC circuit 120 creates a public, private key pair for each of the ROT DCC certificates 122 and adds the key pairs into a key hierarchy (e.g., a DICE key hierarchy) for the system 100.
receiving, via the interface, a request including an operation on the TEE domain (Sood, ¶61, ¶113). system 1100 including the FMS circuit 902 of FIG. 9. In the example of FIG. 11, the system 1100 includes a first example security domain 1102, a second example security 1104, and an example edge deployment 1106. In the example of FIG. 11, the first security domain 1102 represents a software deployment of a first tenant (e.g., an enterprise) to execute one or more workloads on the edge deployment 1106. Also, in the example of FIG. 11, the second security domain 1104 represents a software deployment of a second tenant (e.g., an enterprise) to execute one or more workloads on the edge deployment 1106.
verifying the request based on the identifier (Sood, ¶32, ¶81), wherein operations 700 begin at block 702 at which the CDSM circuit 114 of the first chiplet 104.sub.1 of a SiP (e.g., the system 100) mutually authenticates with the ROT DCC circuit 120 of the SiP. At block 704, the CDSM circuit 114 causes the second interface circuit 118 of the first chiplet 104.sub.1 to send a firmware measurement and a security version number for at least one accelerator circuit of the first chiplet 104.sub.1 to the RoT DCC circuit 120.
and executing the request based on a successful verification of the request (Sood, ¶104), the interface circuit 916 allow the FMS circuit 902 to connect to the SiP 900 and be discovered by the host SW stack executing on the core chiplet 904 via standard SoC-specific and/or standard SiP-specific internal PCIe fabrics and/or interfaces. Additionally or alternatively, the interface circuits 916 allow the FMS circuit 902 to connect to the SiP 900 and be discovered by the host SW stack executing on the core chiplet 904 via proprietary sideband and/or low performance global fabrics.
Regarding claim 12:
wherein obtaining the identifier includes: making a request for the identifier of the second chiplet in response to the signal; and receiving the identifier as a response to the request (Sood, ¶86).
Regarding claim 13:
wherein the identifier is a cryptographic element used to ensure execution isolation in a TEE of the second chiplet (Sood, ¶32).
Regarding claim 14:
wherein verifying the request based on the identifier includes using a Resource Arbitration Login (RAL) component of the first chiplet (Sood, ¶81).
Regarding claim 15:
including writing a RAL local identifier to the RAL component based on the identifier in response to obtaining the identifier to create a RAL local identifier (Sood, ¶163).
Regarding claim 16:
wherein verifying the request based on the identifier includes using a Trust Provisioning Agent (TPA) component of the first chiplet (Sood, ¶36).
Regarding claim 17:
wherein the operations include writing a TPA local identifier to the TPA component based on the identifier in response to obtaining the identifier to create a TPA local identifier(Sood, ¶43).
Regarding claim 18:
wherein the identifier is a base memory address of the process on the second chiplet (Sood, ¶43).
Regarding claim 19:
wherein executing the request includes use of a set of components of the first chiplet (Sood, ¶44).
Regarding claim 20:
wherein the first chiplet prevents operations from other domains on the set of components (Sood, ¶44).
Conclusion
7. The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Monjour Rahim whose telephone number is (571)270-3890.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached on 571-272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (in USA or CANANDA) or 571-272-1000.
/Monjur Rahim/
Patent Examiner
United States Patent and Trademark Office
Art Unit: 2436; Phone: 571.270.3890
E-mail: monjur.rahim@uspto.gov
Fax: 571.270.4890
