Office Action 2: Notice of Allowance (2025-03-26)

CLAIMS:
AMENDMENTS TO THE CLAIMS

Please amend the claims as indicated in the Listing of Claims below. No new matter has been added. This Listing of Claims replaces all prior versions, and listings, of claims in this application.

Listing of Claims:

Claim 1 (Currently Amended): A method for performing computation of a function over encrypted data by a computation entity, the method comprising:
performing computation of a quadratic function by the computation entity, and
encrypting the encrypted data by a linearly homomorphic encryption scheme, or receiving the encrypted data encrypted by the linearly homomorphic encryption scheme from a data source,
wherein a homomorphic message authentication code is used for providing verifiable computation on encrypted data.

Claim 2 (Original): The method according to claim 1, wherein the homomorphic message authentication code is used to define a verifiable computation scheme.

Claim 3 (Previously Presented): The method according to claim 1, wherein the linearly homomorphic encryption scheme is a linearly homomorphic EIGamal encryption scheme.

Claim 4 (Previously Presented): The method according to claim 1, wherein a computation over authentication tags that accompany the encrypted data is performed, so that the computation entity can output an encoding that includes a ciphertext encrypting a result of the computation and a tag.

Claim 5 (Previously Presented): The method according to claim 4, wherein an integrity of the result is verified by a final tag.

Claim 6 (Previously Presented): The method according to claim 1, wherein the linearly homomorphic encryption scheme produces one or more encodings, a public evaluation key and/or a private verification key.

Claim 7 (Previously Presented): The method according to claim 6, wherein a degree-2 function of the encrypted or encoded data is computed by the computation entity by homomorphic operations over the encryptions or encodings, thereby producing an output encoding.

Claim 8 (Previously Presented): The method according to claim 7, wherein it is verified that the output encoding encodes the result of the function over the encrypted or encoded data and, if so, the output encoding is decoded.

Claim 9 (Previously Presented): The method according to claim 1, wherein the method is used in data-mining and/or in machine learning.

Claim 10 (Currently Amended): The method according to claim 1, wherein \[\[a\]\]the data source provides and/or encrypts the data.

Claim 11 (Original): The method according to claim 10, wherein the data source transmits and/or uploads the encrypted data to the computation entity.

Claim 12 (Previously Presented): The method according to claim 10, wherein the data source is a metering device or a smart energy meter.

Claim 13 (Previously Presented): The method according to claim 1, wherein the encrypted data are provided in the form of a ciphertext or ciphertexts.

Claim 14 (Previously Presented): The method according to claim 1, wherein the computation entity is a server or cloud server.

Claim 15 (Currently Amended): A system for performing computation of a function over encrypted data, the system comprising:
one or more hardware processors configured to:perform omputation of a quadratic function , and
encrypt he encrypted data y a linearly homomorphic encryption scheme, or receiving the encrypted data encrypted by the linearly homomorphic encryption scheme from a data source,

wherein a homomorphic message authentication code is used for providing verifiable computation on encrypted data.

Claim 16 (New): The method according to claim 8, wherein the data source encrypts the encrypted data by the linearly homomorphic encryption scheme and a client performs the verification that the output encoding encodes the result of the function over the encrypted or encoded data.

OFFICE ACTION:
DETAILED ACTION
Claims 1-3 and 6-16 are pending. Claims 4-5 are canceled.  Claims 1 and 15 are amended. This is in response to Applicant’s arguments and amendments filed on January 21, 2025.
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
EXAMINER'S AMENDMENT
An examiner’s amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner’s amendment was given in an interview with James Signor on March 10, 2025.
The application has been amended as follows:
Claim 1 (Currently Amended):  A method for performing verifiable computation of a quadratic function over encrypted data by a computation entity, the method comprising:
generating the encrypted data or receiving the encrypted data from a data source, wherein the encrypted data is encrypted by a linearly homomorphic encryption scheme, and
performing the computation of the over the encrypted data by the computation entity,
wherein a homomorphic message authentication code is used for providing the verifiable computation on the encrypted data,
wherein a computation over authentication tags that accompany the encrypted data is performed, so that the computation entity can output an encoding that includes a ciphertext encrypting a result of the computation and a tag, and
wherein an integrity of the result is verified by a final tag, and
wherein the tags are different from the homomorphic message authentication code.
Claim 4 (Canceled).
Claim 5 (Canceled).
Claim 15 (Currently Amended):  A system for performing verifiable computation of a quadratic function over encrypted data, the system comprising:
one or more hardware processors configured to:
generate the encrypted data or receive the encrypted data from a data source, wherein the encrypted data is encrypted by a linearly homomorphic encryption scheme, and
perform the computation of the
wherein a homomorphic message authentication code is used for providing the verifiable computation on the encrypted data,
wherein a computation over authentication tags that accompany the encrypted data is performed, so that the computation entity can output an encoding that includes a ciphertext encrypting a result of the computation and a tag,
wherein an integrity of the result is verified by a final tag, and
wherein the tags are different from the homomorphic message authentication code.
Reasons for Allowance
The following is an examiner’s statement of reasons for allowance:
Applicant agrees to the above amendments for compact prosecution since there is no art singly or in combination teaches the use of authentication tag in addition to using message authentication code. Therefore, claims 1 and 15 are allowed.
Prior art such as 20140310524 (hereinafter Yamanaka) also use the homomorphic message authentication code in the same field of power meter device data authentication. Yamanaka calculates aggregated encrypted data corresponding to a sum of the pieces of data encrypted. A second calculator is configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data. Yamanaka discloses using a second message authentication code to authenticate the sum of the first encrypted data (Fig. 11 and related text). Yamanaka does not disclose any other values used for verifying the data besides the message authentication code.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Inquiry communication

APPLICANT REBUTTAL: REMARKS / ARGUMENTS Reconsideration of the application and claims in light of the foregoing amendments and following remarks/arguments is respectfully requested. Status of the Claims Claims 1-15 are currently pending in the present application. In the Office Action, claims 1-15 were rejected. The present Response amends claims 1, 10 and 15, and adds new claim 16. No new matter has been added. Upon entry of these amendments, claims 1-16 will be pending. Rejections under 35 U.S.C. & 101 Claim 15 was rejected under 35 U.S.C. § 101 as being directed to non-statutory subject matter. Claim 15 was rejected for not falling within at least one of the four categories of patent eligible subject matter because a computing entity can be interpreted as a software device performing the recited features. See Office Action, p. 3. Claim 15 has been amended to recite "A system ... comprising: one or more hardware processors configured to." Accordingly, reconsideration and withdrawal of the rejections of claims 15 under 35 U.S.C. § 101 is respectfully requested. Rejections under 35 U.S.C. 44 102 and 103 Claims 1-2, 6-8, and 13-15 were rejected under 35 U.S.C. § 102 as being anticipated by US 2015/0215123 by Kipnis ("Kipnis"). Claim 3 was rejected under 35 U.S.C. § 103 as being obvious over Kipnis in view of US 9,641,332 by Yung ("Yung"). Claims 4-5 were rejected under 35 U.S.C. § 103 as being obvious over Kipnis in view of US 10,630,478 by Yavuz ("Yavuz"). Claims 9-11 were rejected under 35 U.S.C. § 103 as being obvious over Kipnis in view of US 2019/0386814 by Ahmed ("Ahmed"). Claim 12 was rejected under 35 U.S.C. § 103 as being obvious over Kipnis in view of Ahmed and further in view of CN 111294366 by Zhang ("Zhang"). Independent claims 1 and 15 of the present application recite "a homomorphic message authentication code is used for providing verifiable computation on encrypted data." For example, an embodiment of the present invention provides a method for performing computation of a function over encrypted data by a computation entity so that a reliable computation result is obtainable by simple means. See published specification (US PAP 2023/0269089 Al), paragraph [0013]. The use of a homomorphic message authentication code provides verifiable computation on already encrypted data. A computation entity performs computation of the function over the encrypted data. The computation over the encrypted data can include a computation over authentication tags that accompany the encrypted data, so that the computation entity can output an encoding that includes a ciphertext encrypting the result of the computation and a tag. An integrity of the result can be verified by means of a final tag as received by the computation entity or server. This verifying step can advantageously be performed by any client. See published specification, paragraph [0020]. Contrary to the assertions in the Office Action, it is respectfully submitted that Kipnis fails to disclose at least the foregoing features that "a homomorphic message authentication code is used for providing verifiable computation on encrypted data," of independent claims 1 and 15. Rather, Kipnis is silent with respect to verifying any computations on encrypted data and merely describes verifying a signature. See Kipnis, paragraphs [0207]-[0215]. Specifically, the cited portion of Kipnis describes performing verification of a signature on a message by calculating a hash of the message and a matrix M in dimension 2 subspace of matrices. In order to verify the signature, a verifier computes the hash of the message and verifies a corresponding mathematical relationship. See Kipnis, paragraphs [0207]-[0215]. While Kipnis describes a regular signature scheme, Kipnis is completely silent regarding verifying any contents of the message for which the signature is provided, much less verifying any computations in the message. The signature scheme as described in Kipnis cannot verify that a specific computation in the message was carried out correctly, but is only able to verify that the signature associated with the message is correct. On the other hand, pending independent claims 1 and 15 recite using a homomorphic message authentication code to provide verifiable computation on encrypted data. This advantageously allows a client to verify computation carried out by a computation entity or server, as described above. In contrast, Kipnis makes no mention of verifying any contents of the message, and merely provides a way to verify the signature. Therefore, Kipnis does not disclose or suggest at least "using a homomorphic message authentication code for providing verifiable computation on encrypted data," as recited in independent claim 1. Because Kipnis fails to disclose at least the above-recited features of amended independent claims 1 and 15, Kipnis cannot anticipate claim 1 or 15 or their dependent claims 2, 6-8, and 13-14. Additionally, in rejecting claim 3, the Office correctly concedes that Kipnis does not disclose that the "the linearly homomorphic encryption scheme is a linearly ElGamal encryption scheme," but suggests that Yung teaches this subject matter at col. 9, lines 6-18. The Office alleges that it would be obvious to combine the teachings of Kipnis with the teachings of Yung to teach "the linearly homomorphic encryption scheme is a linearly ElGamal encryption scheme," because one would have done so using known variation of homomorphic encryption to arrive at the claimed invention. See Office Action, p. 5. Applicant respectfully disagrees because the nature of the key as described in Kipnis is completely different from a linearly homomorphic key like ElGamal as described in Yung. Kipnis describes using a symmetric key, in which encryption and decryption is performed using the same key. However, the ElGamal key is a linearly homomorphic key that has a public key and/or a private key for encryption and decryption purposes. The same key cannot be used for both encryption and decryption in Yung. Therefore, one of skill in the art would not look to Yung to remedy the deficiencies of Kipnis with respect to pending claim 3. Furthermore, in rejecting claims 4 and 5, the Office correctly concedes that Kipnis does not teach "a computation over authentication tags that accompany the encrypted data is performed, so that the computation entity can output an encoding that includes a ciphertext encrypting a result of the computation and a tag," but states that Yavus teaches this subject matter at col. 5 line 36 - col. 6, line 44. The Office is of the opinion that it would have been obvious to modify Kipnis with Yavuz because one would have done so to provide a conditional non-repudiation in order to arrive at the claimed invention with a reasonable expectation of success. See Office Action, p. 6. However, a person of skill in the art would not have, absent hindsight reasoning, combined Kipnis and Yavuz since the teachings of Yavuz are incompatible with the teachings of Kipnis. Particularly, the cited portion of Yavuz describes symmetric key primitives like encryption and a message authentication code. This message authentication code is not homomorphic, while, in contrast Kipnis relies on a homomorphic key. Therefore, one of skill in the art would not look to modify the teachings of Kipnis with Yavuz. Also, Yavuz is completely silent regarding verifying the integrity of a computation over authenticated data. Yavuz merely deals with data that is stored in remote storage and not used for computation. Zhang and Ahmed, used to reject other dependent claims does not remedy the deficiencies of Kipnis, Yung, and Yavuz. Accordingly, reconsideration and withdrawal of the rejection of claims 1-15 under 35 U.S.C. §§ 102 and 103 based on Kipnis alone or in combination with Yung, Yavuz, Ahmed, and Zhang is respectfully requested. New Claims New claim 16 depends from independent claim 1. It is therefore respectfully submitted that new claim 16 is allowable over the cited prior art for at least the same reasons as claim 1, discussed above. Support for the new claims can be found, for example, in paragraphs [0038] of the published specification. It is further respectfully submitted that claim 16 recites features which further distinguish the present invention from the cited prior art. For example, claim 16 recites to "the data source encrypts the encrypted data by the linearly homomorphic encryption scheme and a client performs the verification that the output encoding encodes the result of the function over the encrypted or encoded data." In contrast, Kipnis describes a symmetric key that is used by a singular entity to performs the encryption and decryption of data. CONCLUSION Applicant believes that all issues raised by the Office have been addressed and that the present application is allowable for the foregoing reasons. If there are any remaining issues which the Office believes could be resolved through either a Supplemental Response or an Examiner's Amendment, Applicant respectfully invites the Office to call the telephone contact at the number indicated below. The Commissioner is hereby authorized to charge any unpaid fees deemed required in connection with this submission, including any additional filing or application processing fees required under 37 C.F.R. §1.16, 1.17 or 1.492, except for fees based on multiple dependent claims under 37 CFR §1.16(i) or (j) or 37 CFR §1.492(e) or (f), or to credit any overpayment, to Deposit Account No. 12-1216. Dated: January 21, 2025 Respectfully submitted, By /James C. Signor/ Red. No. 59,233 Naman Seth (telephone contact) Limited Recognition No. 800,009 James C. Signor Registration No. 59,233LEYDIG, VOIT & MAYER, LTD. Leydig Two Prudential Plaza, Suite 4900 180 North Stetson Avenue Chicago, Illinois 60601-6731 (312) 616-5600 (Telephone) (312) 616-5700 (Fax) Attorneys/Agents For Applicant


CITED REFERENCE SUMMARIES: Ref US20140310524A1: Claims:
A data management device, comprising: a receiver configured to receive at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data; a first calculator configured to aggregate pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted; a second calculator configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data; and a transmitter configured to transmit the aggregated encrypted data and the total value of the message authentication codes.
a receiver configured to receive at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data;
a first calculator configured to aggregate pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted;
a second calculator configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data; and
a transmitter configured to transmit the aggregated encrypted data and the total value of the message authentication codes.
The device according to claim 1 , wherein the piece of encrypted data and the message authentication code are homomorphic.
The device according to claim 1 , wherein each piece of encrypted data to be aggregated by the first calculator is encrypted with an encryption key shared between a source from which the each piece of encrypted data is transmitted and a destination to which the aggregated encrypted data is transmitted.
The device according to claim 3 , wherein the pieces of encrypted data to be aggregated by the first calculator are obtained by encrypting pieces of data used by a system corresponding to the destination, the first calculator is configured to calculate the aggregated encrypted data for the system, and the transmitter is configured to transmit the aggregated encrypted data that is calculated to the system.
the pieces of encrypted data to be aggregated by the first calculator are obtained by encrypting pieces of data used by a system corresponding to the destination,
the first calculator is configured to calculate the aggregated encrypted data for the system, and
the transmitter is configured to transmit the aggregated encrypted data that is calculated to the system.
The device according to claim 1 , wherein each of the message authentication codes to be summed up by the second calculator is generated by using a generation key shared between a source from which the each of the message authentication codes is transmitted and a destination to which the total value of the message authentication codes is transmitted.
The device according to claim 5 , wherein the message authentication codes to be summed up by the second calculator are for the pieces of encrypted data obtained by encrypting pieces of data used by a system corresponding to the destination, the second calculator is configured to calculate the total value of the message authentication code for the system, and the transmitter is configured to transmit the total value of the message authentication codes to the system.
the message authentication codes to be summed up by the second calculator are for the pieces of encrypted data obtained by encrypting pieces of data used by a system corresponding to the destination,
the second calculator is configured to calculate the total value of the message authentication code for the system, and
the transmitter is configured to transmit the total value of the message authentication codes to the system.
The device according to claim 1 , wherein the receiver is configured to receive a piece of encrypted data for a measured power usage and a message authentication code for the piece of encrypted data, the first calculator is configured to aggregate pieces of encrypted data received to calculate encrypted data for a total power usage, the second calculator is configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the total power usage, and the transmitter is configured to transmit the encrypted data for the total power usage and the total value of the message authentication codes for the total power usage to a system using the power usage.
the receiver is configured to receive a piece of encrypted data for a measured power usage and a message authentication code for the piece of encrypted data,
the first calculator is configured to aggregate pieces of encrypted data received to calculate encrypted data for a total power usage,
the second calculator is configured to sum up message authentication codes received to calculate a total value of the message authentication codes for the total power usage, and
the transmitter is configured to transmit the encrypted data for the total power usage and the total value of the message authentication codes for the total power usage to a system using the power usage.
A data management method, comprising: receiving at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data; aggregating pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted; summing up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data; and transmitting the aggregated encrypted data and the total value of the message authentication codes.
receiving at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data;
aggregating pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted;
summing up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data; and
transmitting the aggregated encrypted data and the total value of the message authentication codes.
The method according to claim 8 , wherein the piece of encrypted data and the message authentication code are homomorphic.
The method according to claim 8 , wherein each piece of encrypted data to be aggregated at the aggregating is encrypted with an encryption key shared between a source from which the each piece of encrypted data is transmitted and a destination to which the aggregated encrypted data is transmitted.
The method according to claim 10 , wherein the pieces of encrypted data to be aggregated at the aggregating are obtained by encrypting pieces of data used by a system corresponding to the destination, at the aggregating, aggregated encrypted data is calculated for the system, and at the transmitting, the aggregated encrypted data that is calculated is transmitted to the system.
the pieces of encrypted data to be aggregated at the aggregating are obtained by encrypting pieces of data used by a system corresponding to the destination,
at the aggregating, aggregated encrypted data is calculated for the system, and
at the transmitting, the aggregated encrypted data that is calculated is transmitted to the system.
The method according to claim 8 , wherein each of the message authentication codes to be summed up at the summing up is generated by using a generation key shared between a source from which the each of the message authentication codes is transmitted and a destination to which the total value of the message authentication codes is transmitted.
The method according to claim 12 , wherein the message authentication codes to be summed up at the summing up are for the pieces of encrypted data obtained by encrypting pieces of data used by a system corresponding to the destination, at the summing up, the total value of the message authentication code is calculated for the system, and at the transmitting, the total value of the message authentication codes is transmitted to the system.
the message authentication codes to be summed up at the summing up are for the pieces of encrypted data obtained by encrypting pieces of data used by a system corresponding to the destination,
at the summing up, the total value of the message authentication code is calculated for the system, and
at the transmitting, the total value of the message authentication codes is transmitted to the system.
A computer program product comprising a computer-readable medium containing a program executed by a computer, the program causing the computer to execute: receiving at least one piece of encrypted data obtained by encrypting a piece of data and at least one message authentication code for the piece of encrypted data; aggregating pieces of encrypted data received to calculate aggregated encrypted data corresponding to a sum of the pieces of data encrypted; summing up message authentication codes received to calculate a total value of the message authentication codes for the aggregated encrypted data; and transmitting the aggregated encrypted data and the total value of the message authentication codes.
The product according to claim 14 , wherein the piece of encrypted data and the message authentication code are homomorphic.
The product according to claim 14 , wherein each piece of encrypted data to be aggregated at the aggregating is encrypted with an encryption key shared between a source from which the each piece of encrypted data is transmitted and a destination to which the aggregated encrypted data is transmitted.
The product according to claim 16 , wherein the pieces of encrypted data to be aggregated at the aggregating are obtained by encrypting pieces of data used by a system corresponding to the destination, at the aggregating, aggregated encrypted data is calculated for the system, and at the transmitting, the aggregated encrypted data that is calculated is transmitted to the system.
The product according to claim 14 , wherein each of the message authentication codes to be summed up at the summing up is generated by using a generation key shared between a source from which the each of the message authentication codes is transmitted and a destination to which the total value of the message authentication codes is transmitted.