Office Action 1: Notice of Allowance (2024-09-11)

CLAIMS:
CLAIMS

What is claimed is:

1\. A method of securing critical data in a computer system that comprises a system on a chip (SOC) with a Reduced Instruction Set Computer (RISC) processor core that operates in a normal world and a secure world, the RISC processor core providing hardware-level isolation between the normal world and the secure world, the method comprising:
providing an external storage device that is external to the SOC;
storing the critical data in a protected data region of the external storage device;
storing a storage command pool in a secure memory space in the secure world, the secure world being a Trusted Execution Environment (TEE) and the normal world being a Rich Execution Environment (REE);
making a secure monitor call from the normal world to the secure world;
validating the secure monitor call in the secure world;
and in response to the secure monitor call passing validation in the secure world, performing a direct memory access (DMA) operation in the secure world in accordance with the storage command pool to transfer the critical data between the protected data region of the external storage device and a normal memory space in an external random-access memory (RAM) of the computer system, the normal memory space being accessible in the normal world, the external RAM being external to the SOC.

2\. The method of claim 1, wherein the RISC processor core is an ARM processor core.
3\. The method of claim 1, wherein the external storage device is a Universal Flash Storage (UFS) device.
4\. The method of claim 1, further comprising:
reporting receipt of the secure monitor call in the secure world.

5\. The method of claim 1, wherein the storage command pool is stored in the secure memory space of the external RAM.

6\. The method of claim 5, wherein performing the DMA operation comprises:
in the secure world, fetching and executing a plurality of commands of the storage command pool from the secure memory space to perform the DMA operation to transfer the critical data between the protected data region and the normal memory space.
7\. The method of claim 6, further comprising:
storing an address of the storage command pool in a secure register of a storage host interface controller (SHIC) that is internal to the SOC, wherein the external storage device is connected to and is controlled by the SHIC.

8\. A computer system comprising:
a Reduced Instruction set Computer (RISC) processor that operates in a normal world and a secure world, the RISC processor providing hardware-level isolation between the normal world and the secure world, the RISC processor being connected to a system bus of the computer system;
a storage host interface controller (SHIC) that is connected to the system bus;
a storage device that is connected to the SHIC, the storage device having a protected data region that stores critical data; and
a dynamic random-access memory (DRAM) having a normal memory space accessible in the normal world and a secure memory space that is accessible only in the secure world, the DRAM being connected to the system bus, the secure memory space storing a storage command pool that comprises a plurality of commands for transferring the critical data between the protected data region and the normal memory space by direct memory access (DMA).

9\. The computer system of claim 8, wherein the computer system includes, in the normal world but not in the secure world, a storage driver for controlling the storage device.

10\. The computer system of claim 8, wherein the RISC processor and the SHIC are integrated in a system on a chip (SOC), and the storage device and the DRAM are external to the SOC.

11\. The computer system of claim 8, wherein the RISC processor is an ARM processor.

12\. The computer system of claim 8, wherein the storage device is a Universal Flash Storage (UFS) device.

13\. The computer system of claim 8, wherein the critical data comprises platform firmware of the computer system.

14\. The computer system of claim 8. wherein the SHIC is operable in the normal world and in the secure world.

15\. The computer system of claim 14, wherein an address of the storage command pool is stored in secure registers of the SHIC, the secure registers of the SHIC being accessible only in the secure world. ATTORNEY DOCKET NO.: SMICP022 ATTORNEY DOCKET NO.: SMICPO22

OFFICE ACTION:
DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2.
Allowable Subject Matter
Claims 1-15 are allowed. The following is an examiner’s statement of reasons for allowance: Although Kim (US 2019/0114428) teaches, and further Smith et al. (US 2021/0065267) teaches implementing SoC with embedded processor such as 32-bit RISC processor [0046]. REE environment may include a plurality of elements and TEE environment may include a plurality of other elements such as a secure DMA, and wherein a secure memory stores data in an encrypted form [0043-0044] and [0047]. None of the prior arts, alone or in combination teaches the following limitations in view of other limitations in the claim:
For claim 1:
storing the critical data in a protected data region of the external storage device; storing a storage command pool in a secure memory space in the secure world, the secure world being a Trusted Execution Environment (TEE) and the normal world being a Rich Execution Environment (REE); making a secure monitor call from the normal world to the secure world; validating the secure monitor call in the secure world; and in response to the secure monitor call passing validation in the secure world, performing a direct memory access (DMA) operation in the secure world in accordance with the storage command pool to transfer the critical data between the protected data region of the external storage device and a normal memory space in an external random-access memory (RAM) of the computer system, the normal memory space being accessible in the normal world, the external RAM being external to the SOC.
For claim 8:
a storage host interface controller (SHIC) that is connected to the system bus; a storage device that is connected to the SHIC, the storage device having a protected data region that stores critical data; and a dynamic random-access memory (DRAM) having a normal memory space accessible in the normal world and a secure memory space that is accessible only in the secure world, the DRAM being connected to the system bus, the secure memory space storing a storage command pool that comprises a plurality of commands for transferring the critical data between the protected data region and the normal memory space by direct memory access (DMA).
According to MPEP 1302.14 (I): “In most cases, the examiner’s actions and the applicant’s replies make evident the reasons for allowance, satisfying the “record as a whole” proviso of the rule. This is particularly true when applicant fully complies with 37 CFR 1.111 (b) and (c) and 37 CFR 1.133(b). Thus, where the examiner’s actions clearly point out the reasons for rejection and the applicant’s reply explicitly presents reasons why claims are patentable over the reference, the reasons for allowance are in all probability evident from the record and no statement should be necessary.”
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion



CITED REFERENCE SUMMARIES: Ref US20190114428A1: [content unavailable]
Ref US20190114429A1: Claims:
An information processing apparatus operable to sequentially activate a plurality of modules after activation of a boot program by an embedded controller, each module comprises: a detection unit that uses verification information for verifying a signature of a module to be activated next to detect alteration of the module to be activated next, and an activation unit that activates the module to be activated next in a case where verification of the signature by the detection unit succeeds, and wherein each module holds in advance the verification information and its own signature.
a detection unit that uses verification information for verifying a signature of a module to be activated next to detect alteration of the module to be activated next, and
an activation unit that activates the module to be activated next in a case where verification of the signature by the detection unit succeeds, and
wherein each module holds in advance the verification information and its own signature.
The information processing apparatus according to claim 1 , wherein the embedded controller for executing the boot program: comprises the detection unit and the activation unit, and holds in advance the verification information.
the embedded controller for executing the boot program:
comprises the detection unit and the activation unit, and
holds in advance the verification information.
The information processing apparatus according to claim 1 , wherein the activation unit stops activation of the information processing apparatus in a case where verification of a signature by the detection unit fails.
The information processing apparatus according to claim 1 , wherein the plurality of modules includes a BIOS (Basic Input/Output System), a loader, a kernel, a first program, and a second program, and the boot program and the BIOS are stored in a ROM (Read-Only Memory), the loader, the kernel, and the first program are stored in a flash memory, and the second program is stored in an HDD (Hard Disk Drive).
the plurality of modules includes a BIOS (Basic Input/Output System), a loader, a kernel, a first program, and a second program, and
the boot program and the BIOS are stored in a ROM (Read-Only Memory), the loader, the kernel, and the first program are stored in a flash memory, and the second program is stored in an HDD (Hard Disk Drive).
The information processing apparatus according to claim 4 , wherein the flash memory also stores the second program, and in a case where verification of a signature by the detection unit for the second program stored in the HDD fails, the activation unit of a module that activates the second program redeploys the second program stored in the flash memory to the HDD, and activates the second program.
the flash memory also stores the second program, and
in a case where verification of a signature by the detection unit for the second program stored in the HDD fails, the activation unit of a module that activates the second program redeploys the second program stored in the flash memory to the HDD, and activates the second program.
The information processing apparatus according to claim 1 , wherein the activation unit replaces and activates a module to be activated next in accordance with a user input, each module holds in advance verification information for each of a plurality of modules that can be activated next, and its own signature.
the activation unit replaces and activates a module to be activated next in accordance with a user input,
each module holds in advance verification information for each of a plurality of modules that can be activated next, and its own signature.
The information processing apparatus according to claim 1 , further comprising a main controller that controls each module, wherein the embedded controller has a memory and a processor separate from the main controller.
further comprising a main controller that controls each module,
wherein the embedded controller has a memory and a processor separate from the main controller.
A method of controlling an information processing apparatus operable to sequentially activate a plurality of modules after activation of a boot program by an embedded controller, wherein each module includes: using verification information for verifying a signature of a module to be activated next to detect alteration of the module to be activated next, and activating the module to be activated next when verification of the signature succeeds.
each module includes:
using verification information for verifying a signature of a module to be activated next to detect alteration of the module to be activated next, and
activating the module to be activated next when verification of the signature succeeds.
A non-transitory computer-readable storage medium storing a computer program for causing a computer to execute each step of a method of controlling an information processing apparatus operable to sequentially activate a plurality of modules after activation of a boot program by an embedded controller, wherein each module includes: using verification information for verifying a signature of a module to be activated next to detect alteration of the module to be activated next, and activating the module to be activated next when verification of the signature succeeds.
Ref US20190114430A1: Claims:
A method for processing data in a plurality of processing acts, the method comprising: configuring a plurality of processing circuits in a first configuration, in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act of the plurality of processing acts; and configuring the plurality of processing circuits in a second configuration, in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
configuring a plurality of processing circuits in a first configuration, in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act of the plurality of processing acts; and
configuring the plurality of processing circuits in a second configuration, in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
The method as claimed in claim 1 , further comprising: assigning the first configuration to a first security level; and assigning the second configuration to a second security level, wherein the first security level is greater than the second security level.
assigning the first configuration to a first security level; and
assigning the second configuration to a second security level,
wherein the first security level is greater than the second security level.
The method as claimed claim 1 , further comprising: comparing a first processing result of the first processing act from the first processing circuit with a second processing result of the first processing act from the second processing circuit; and signaling an error if the second processing result differs from the first processing result.
comparing a first processing result of the first processing act from the first processing circuit with a second processing result of the first processing act from the second processing circuit; and
signaling an error if the second processing result differs from the first processing result.
The method as claimed in claim 1 , further comprising: the plurality of processing circuits further comprises a third processing circuit; configuring the plurality of processing circuits in a third configuration; and assigning the third configuration to a third security level, wherein in accordance with the third configuration the third processing circuit likewise executes the first processing act if the third security level lies above the first security level and the second security level.
the plurality of processing circuits further comprises a third processing circuit;
configuring the plurality of processing circuits in a third configuration; and
assigning the third configuration to a third security level,
wherein in accordance with the third configuration the third processing circuit likewise executes the first processing act if the third security level lies above the first security level and the second security level.
The method as claimed in claim 4 , further comprising: assigning a fourth configuration to a fourth security level, wherein in accordance with the fourth configuration the third processing circuit likewise executes the second processing act or the third processing act if the fourth security level lies between the first security level and the second security level.
assigning a fourth configuration to a fourth security level,
wherein in accordance with the fourth configuration the third processing circuit likewise executes the second processing act or the third processing act if the fourth security level lies between the first security level and the second security level.
The method as claimed in claim 4 , assigning a fifth configuration to the second security level, wherein the third processing circuit in accordance with the fifth configuration executes a fourth processing act, which is different than the first processing act, the second processing act and the third processing act.
assigning a fifth configuration to the second security level,
wherein the third processing circuit in accordance with the fifth configuration executes a fourth processing act, which is different than the first processing act, the second processing act and the third processing act.
The method as claimed in claim 1 , wherein the configuring is carried out before the process of executing the first processing acts, and between the execution of the second processing act and the third processing act.
wherein the configuring is carried out before the process of executing the first processing acts, and between the execution of the second processing act and the third processing act.
A storage medium, wherein the storage medium stores program code which, upon execution on a data processing circuit, causes the data processing circuit to execute processing acts, comprising: configuring a plurality of processing circuits in a first configuration, in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act of the plurality of processing acts; and configuring the plurality of processing circuits in a second configuration, in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
An apparatus for processing data, comprising: a plurality of processing circuits which are configurable for operation in a plurality of different configurations; and a configuration circuit configured to selectively configure the plurality of processing circuits in a first configuration in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act, and configure the plurality of processing circuits in a second, different configuration in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
a plurality of processing circuits which are configurable for operation in a plurality of different configurations; and
a configuration circuit configured to selectively configure the plurality of processing circuits in a first configuration in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act, and configure the plurality of processing circuits in a second, different configuration in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
The apparatus as claimed in claim 9 , wherein the configuration circuit is configured to assign the first configuration to a first security level and to assign the second configuration to a second security level, wherein the first security level is greater than the second security level.
The apparatus as claimed in claim 10 , wherein the configuration circuit is configured to carry out the configuring before the process of executing the plurality of processing steps and/or dynamically during the execution of a processing step or between the execution of two mutually different processing steps.
The apparatus as claimed in claim 9 , further comprising: a signaling circuit configured to output a signal representing a majority decision on the basis of weighted processing results from the plurality of processing circuits.
a signaling circuit configured to output a signal representing a majority decision on the basis of weighted processing results from the plurality of processing circuits.
The apparatus as claimed in claim 12 , wherein the signaling circuit comprises a comparison circuit configured to compare a first processing result from the first processing circuit with a second processing result from the second processing circuit and to detect and to signal if the second processing result differs from the first processing result.
The apparatus as claimed in claim 9 , further comprising: a security area configured to be safeguarded against attacks by third parties and/or impediments as a result of environmental influences more strongly than some other area of the apparatus, wherein at least the first processing circuit is arranged in the security area.
a security area configured to be safeguarded against attacks by third parties and/or impediments as a result of environmental influences more strongly than some other area of the apparatus, wherein at least the first processing circuit is arranged in the security area.
The apparatus as claimed in claim 14 , wherein the security area comprises registers of the configuration circuit which are configured to store configuration data of the plurality of configurations.
The apparatus as claimed in claim 9 , wherein the apparatus is configured, via the configuration circuit, to: configure a plurality of processing circuits in a first configuration, in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act of the plurality of processing acts; and configure the plurality of processing circuits in a second configuration, in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
configure a plurality of processing circuits in a first configuration, in such a way that both a first processing circuit and a second processing circuit of the plurality of processing circuits execute a first processing act of the plurality of processing acts; and
configure the plurality of processing circuits in a second configuration, in such a way that the first processing circuit executes a second processing act and the second processing circuit executes a third processing act, which is different than the second processing act.
The apparatus as claimed in claim 16 , further comprising: a coupling circuit configured to receive program code from a storage medium which, upon execution on a data processing circuit, causes the data processing circuit to execute processing acts in order to execute a plurality of processing acts.
a coupling circuit configured to receive program code from a storage medium which, upon execution on a data processing circuit, causes the data processing circuit to execute processing acts in order to execute a plurality of processing acts.
The apparatus as claimed in claim 9 , further comprising: a demultiplexer circuit configured to divide input data for processing in the plurality of processing acts among the plurality of processing circuits depending on the configuration, and/or a multiplexer circuit configured to combine output data from the processing circuits.
a demultiplexer circuit configured to divide input data for processing in the plurality of processing acts among the plurality of processing circuits depending on the configuration, and/or
a multiplexer circuit configured to combine output data from the processing circuits.
Ref US20190114431A1: Claims:
A method for launching a device configured with a trusted platform module, comprising: trusted launching the device and extending a trusted launch measurement to a platform configuration register of the trusted platform module, wherein the trusted launch measurement is an integrity measurement of the trusted launching of the device; loading a preset enclave and extending an enclave measurement to the platform configuration register, wherein the enclave measurement is an integrity measurement of the preset enclave; initiating a remote attestation of the preset enclave to an authentication server based on the trusted platform module; in response to receiving remote attestation pass information sent from the authenticating server, detecting an operation of loading another enclave, wherein the another enclave is an enclave different from the preset enclave among enclaves of the device; and in response to the operation of loading the another enclave being detected, performing local attestation of the another enclave based on the preset enclave.
trusted launching the device and extending a trusted launch measurement to a platform configuration register of the trusted platform module, wherein the trusted launch measurement is an integrity measurement of the trusted launching of the device;
loading a preset enclave and extending an enclave measurement to the platform configuration register, wherein the enclave measurement is an integrity measurement of the preset enclave;
initiating a remote attestation of the preset enclave to an authentication server based on the trusted platform module;
in response to receiving remote attestation pass information sent from the authenticating server, detecting an operation of loading another enclave, wherein the another enclave is an enclave different from the preset enclave among enclaves of the device; and
in response to the operation of loading the another enclave being detected, performing local attestation of the another enclave based on the preset enclave.
The method according to claim 1 , wherein the trusted launch measurement includes a boot loader measurement and a kernel measurement; and wherein the trusted launching the device and extending a trusted launch measurement to a platform configuration register of the trusted platform module comprises: loading and executing a kernel boot loader, and extending the boot loader measurement to the platform configuration register of the trusted platform module, wherein the boot loader measurement is an integrity measurement of the kernel boot loader; and loading and launching a kernel of an operating system installed in the device based on the kernel boot loader, and extending the kernel measurement to the platform configuration register, wherein the kernel measurement is an integrity measurement of the kernel.
and wherein the trusted launching the device and extending a trusted launch measurement to a platform configuration register of the trusted platform module comprises:
loading and executing a kerne
[Truncated to input limit]