why is this patent not reference significant previous work?

Question

In reference to the patent: US20130024676

The patent application (with a 2011 date) is too broad and attempts to patent the entire concept of control flow integrity.

There is HUGE previous work which is neither discussed or referenced.

For example, regarding the well known jump-to-libc attacks (but also the more general return-oriented-programming attack), there is this 2006 paper:

"Base Line Performance Measurements of Access Controls For Libraries and Modules." Jason W Kim and Vassilis Prevelakis, Proceedings of the 2nd IEEE International Workshop on Security in Systems and Networks (SSN2006) Rhode Island, Greece, April 2006.

In this paper the code of each library resides in its own address space so direct jumps to or from the main program and libraries or across libraries are impossible (as the destination address is not mapped in the current address space). In order to jump to a library, the kernel has to be invoked and the appropriate access control policy may be applied to the call in the same way as the OpenBSD systrace system works for system calls.

By segregating the address space into separate regions with access control between them, this system also dramatically reduces the number of targets for ROP attacks (since now ROP can only use the current - active - region instead of the entire code space).

Answer 1

In general, the applicant chooses to present prior art which he considers closest to his work. At least in Europe, this is the trend and if the applicant fails to cite what the examiner thinks is the closest one, eventually he will have to incorporate it if he wants to see his patent getting granted.

In the case of this patent application, both the US and the european examiner cited prior art which consisted only of patents/patent applications, no academic-related sources. The reference you are citing is proceedings from a conference. If those proceedings are not incorporated in any kind of database, it's unlikely that the examiner can spot it.

If you believe it's highly relevant and you have good reasons to stress this out, you can definitely make a third-party observation with the EPO proceedings, either anonymously or not. It's more useful when the patent is still pending (it's still an application). It's fairly easy and I can explain how to, if you want to do it. For US it's more complex, I think you have only six months from the publication of the US application to submit observations (and examiners are not so keen, as the european ones, to take a look into them) and I can see many US patents granted within the family of the application you are citing. And I am not sure if you need a US patent attorney for submitting observations with the USPTO.

That being said I suggest you add a tab with "third-party observations" if you want to receive more answers.

Answer 2

To the title question - Why doesn't this patent reference significant previous work?

An applicant is only required to inform the USPTO of references they are aware of, no applicant searching is required. Also, the proper way to officially inform the office about prior art is on an IDS document. Mentions in a background section are optional and do not actually inform as well as a listing in an IDS.

As part of the examination process, 11 patent documents were on record and several non-patent documents.

Chen et al, Log-Based Architectures for General-Purpose Monitoring of deployed code, 2006, ACM, 1-59593-576-2, 3 pages * Instruction Set, 15 May 2010, Wikipedia, Pages 1-10 * Martin Abadi et al, Control-Flow Integrity: Principles Implementations and Applications, Nov 1 2004, pages 1-33 * Opcode, 4 Dec 2007, Wikipedia, pages 1-2, [retrieved from the internet on Oct 26 2014]; retrieved from URL * Vladimiar Kiriansky et al, Secure Execution via Program Shepherding, Aug 2002, 11th USENIX Security Symposium, pages 1-16 *

Note that the author of one of these documents (Vladimiar Kiriansky) is one of the authors you mention, so it seems the examination process worked.

The application was eventually abandoned.