Showing posts with label analysis. Show all posts
Showing posts with label analysis. Show all posts
Wednesday, April 12, 2017
Microsoft Windows 8 1 Kernel Patch Protection Analysis Attack Vectors
Microsoft Windows 8 1 Kernel Patch Protection Analysis Attack Vectors
Authors: Mark Ermolov, Artem Shishkin // Positive ResearchPDF version: link
Kernel Patch Protection (also known as "patchguard") is a Windows mechanism designed to
control the integrity of vital code and data structures used by the operating system. It was
introduced in Windows 2003 x64 and has been constantly improved in further Windows
versions. In this article we present a descriptive analysis of the patchguard for the latest
Windows 8.1 x64 OS, and primarily focus on patchguard initialization and attack vectors related
to it.
It is natural that kernel patch protection is being developed incrementally, so the initialization
process is common for all versions of Windows that have patchguard. There are a lot of papers
published about kernel patch protection on Windows, which describe the process of its
initialization, so you may use references at the end of this article to obtain details.
Initialization sources
As widely known, the main component of patchguard is initialized in a misleadingly named
function "KiFilterFiberContext". It will be the starting point of our investigation. Looking for
cross-references doesnt help us much for pointing out its call site, but several articles help us
by stating that patchguard initialization is called indirectly in a function
"KeInitAmd64SpecificState". By indirectly we mean here not just an indirect call, but the usage
of exception handlers. It is a very common trick often found in patchguard-related functions, as
well see further. So, we have an initialization function call stack:
... --> Phase1InitializationDiscard --> KeInitAmd64SpecificState -> KiFilterFiberContext
(call) (call) (exception)
This type of initialization is described in more detail in [1]. By the way, this one is always called
on the last CPU core, if it matters.
However, it is not the only way that kernel uses to initialize patchguard. With a 4% probability
patchguard context can also be initialized from a function also misleadingly called
"ExpLicenseWatchInitWorker":
... --> Phase1InitializationDiscard --> sub_14071815C (obviously with a stripped symbol because this one processes Windows license type for a current PC) --> ExpLicenseWatchInitWorker
The pseudocode of this function looks like this:
VOID ExpLicenseWatchInitWorker()
{
PVOID KiFilterParam;
NTSTATUS (*KiFilterFiberContext)(PVOID pFilterparam);
BOOLEAN ForgetAboutPG;
// KiServiceTablesLocked == KiFilterParam
KiFilterParam = KiInitialPcr.Prcb.HalReserved[1];
KiInitialPcr.Prcb.HalReserved[1] = NULL;
KiFilterFiberContext = KiInitialPcr.Prcb.HalReserved[0];
KiInitialPcr.Prcb.HalReserved[0] = NULL;
ForgetAboutPG = (InitSafeBootMode != 0) | (KUSER_SHARED_DATA.KdDebuggerEnabled >> 1);
// 96% of cases will fail
if ( __rdtsc() % 100 > 3 )
ForgetAboutPG |= 1;
if ( !ForgetAboutPG && KiFilterFiberContext(KiFilterParam) != 1 )
KeBugCheckEx(SYSTEM_LICENSE_VIOLATION, 0x42424242, 0xC000026A, 0, 0);
}
As you may notice, there is a small "present" in the HalReserved processor control block field
left for this initialization case. Tracing down the guy who left it leads us to the very beginning of
system startup:
... --> KiSystemStartup --> KiInitializeKernel --> KeCompactServiceTable --> KiLockServiceTable -v ??????
We have to pause here, because there is no code that puts data into HalReserved fields
directly. As instead, it is done using the exception handler. And it is done in a different way
from "KeInitAmd64SpecificState", because it doesnt trigger any exceptions. What it does
instead is it directly looks up the current instruction pointer, finds the corresponding function
and its exception handler manually, and then calls it. The exception handler of
"KiLockServiceTable" function is an unnamed stub to the "KiFatalExceptionFilter".
?????? ---> KiFatalExceptionFilter
KiFatalExceptionFilter in turn looks up an exception handler for "KiServiceTablesLocked"
function. And surprisingly it is the "KiFilterFiberContext"! Also, a parameter that is passed to
"KiFilterFiberContext" is located right after the "KiServiceTablesLocked" function. It is a small
structure:
typedef struct _KI_FILTER_FIBER_PARAM
{
NTSTATUS (*PsCreateSystemThread)(); // a pointer to
// PsCreateSystemThread function
KSTART_ROUTINE sub_140235C44; // unnamed checker subroutine
KDPC KiBalanceSetManagerPeriodicDpc; // global DPC struct
} KI_FILTER_FIBER_PARAM, *PKI_FILTER_FIBER_PARAM;
"KiFatalExceptionFilter" stores these pointers to HalReserved fields.
Creating patchguard context
Lets get back to the "KiFilterFiberContext" function. Its pseudocode is given below:
BOOLEAN KiFilterFiberContext(PVOID pKiFilterParam)
{
BOOLEAN Result = TRUE;
DWORD64 dwDpcIdx1 = __rdtsc() % 13;
DWORD64 dwRand2 = __rdtsc() % 10;
DWORD64 dwMethod1 = __rdtsc() % 6;
AntiDebug();
// Lets call sub_1406D6F78 KiInitializePatchGuardContext since it does initialize patchguard context
Result = KiInitializePatchGuardContext(dwDpcIdx, dwMethod1, (dwRand2 < 6) + 1, pKiFilterParam, TRUE);
// A 50% chance to create two patchguard contexts
if (dwRand2 < 6)
{
DWORD64 dwDpcIdx2 = __rdtsc() % 13;
DWORD64 dwMethod2 = __rdtsc() % 6;
do
{
dwMethod2 = __rdtsc() % 6;
}
while ((dwMethod1 != 0) && (dwMethod1 == dwMethod2));
Result = KiInitializePatchGuardContext(dwDpcIdx2, dwMethod2, 2, pKiFilterParam, FALSE);
}
AntiDebug();
return Result;
}
It is rather clear, and with provided code we can assume that up to 4 patchguard contexts can
be active on a running system simultaneously. Remember this one because wherever it is
called, we can be 100% sure that a new patchguard context is being initialized.
The function that creates and initializes patchguard context is so-called
"KiInitializePatchGuardContext". It is a huge obfuscated function. I guess it is suitable to
reference Alexs Ionescu tweet about it:
"I love the new #Windows 8 Patch Guard. Fixes so many of the obvious holes in downlevel, and the new hyper-inlined obfuscation makes me cry."
You bet it! IDA Pros decompiler works on it ~20 min on 3770 Core i7 CPU and spews out 26K
lines of code. It is not worth dealing with it as a single unit. Luckily, you can bite out small
pieces of information that give you a clue about methods that the new patchguard uses. Thats
why we did not reverse engineer it entirely, as instead we took and analyzed several parts in it.
Feel free to explore this function yourself, and you may discover new wonderful things!
It takes 5 parameters on Windows 8.1:
1. Index of DPC routine to be called from a created patchguard DPC for checking the
patchguard context. It may be one of these:
// These ones dont use exception handlers to fire checks
KiTimerDispatch (copied to random pool allocation)
KiDpcDispatch (copied into patchguard context)
// These use exception handlers to fire patchguard checks
ExpTimerDpcRoutine
IopTimerDispatch
IopIrpStackProfilerTimer
PopThermalZoneDpc
CmpEnableLazyFlushDpcRoutine
CmpLazyFlushDpcRoutine
KiBalanceSetManagerDeferredRoutine
ExpTimeRefreshDpcRoutine
ExpTimeZoneDpcRoutine
ExpCenturyDpcRoutine
Also those 10 DPCs are regular system DPCs with useful payload, but when they encounter a
DeferredContext which has non-canonical address, they fire a corresponding
KiCustomAccessRoutine function.
These functions are only called when an appropriate scheduling method is used (0, 1, 2, 5)
2. Scheduling method:
These are the methods that are used to fire a patchguard DPC object that is created inside
"KiInitializePatchGuardContext" function.
- KeSetCoalescableTimer (0). A timer object is created with a random fire period between 2 minutes and 2 minutes and 10 seconds.
- Prcb.AcpiReserved (1). In this case a patchguard DPC is fired when a certain ACPI event occurs, f.e. transitioning to idle state. In this case "HalpTimerDPCRoutine" checks if 2 minutes have passed since last queued by itself DPC, and queues another one, taken from Prcb.AcpiReserved field.
- Prcb.HalReserved (2). Here a patchguard DPC is queued when HAL timer clock interrupt occurs, in the "HalpMcaQueueDpc". It is also done with 2 minutes period at least. Queued patchguard DPC is taken from Prcb.HalReserved field.
- PsCreateSystemThread (3). In this case, patchguard DPC routine is not used, as instead a system thread is created. The thread procedure is taken from KI_FILTER_FIBER_PARAM structure. Patchguard DPC in turn is used just as a container of the address of a newly created patchguard context.
- KeInsertQueueApc (4). This time a regular kernel APC is queued to the one of the system threads with "KiDispatchCallout" APC procedure. No patchguard DPC is fired also. System thread is chosen based on its start address, i.e. it must be equal to either PopIrpWorkerControl or CcQueueLazyWriteScanThread.
- KiBalanceSetManagerPeriodicDpc (5). Patchguard DPC is stored in a global variable named "KiBalanceSetManagerPeriodicDpc". It is queued in "KiUpdateTimeAssist" function and "KeClockInterruptNotify" function within every "KiBalanceSetManagerPeriod" ticks.
3. This parameter can be either 1 or 2. We are not sure about how it affects "KiInitializePatchGuardContext" function, but it is somehow connected to the quantity of checks
being done during patchguard context verification routine execution.
4. A pointer to KI_FILTER_FIBER_PARAM structure. It is noticeable that a method chosen inside
"KiInitializePatchGuardContext" is selected based on the presence of this parameter. If it is
present, a method bit mask is tested with 0x29 (101001b) which allows methods 0, 3 and 5.
Otherwise methods 0, 1, 2 and 4 are available. That makes sense, because methods 3 and 5
require a valid KI_FILTER_FIBER_PARAM structure.
5. Boolean parameter which tells if NT kernel functions checksums have to be recalculated.
As you might guess, the only scheduling method that can be initialized twice is 0, so
"KiFilterFiberContext" takes this fact into account when chooses a method for a second call of
"KiInitializePatchGuardContext".
Firing a patchguard check
Methods that fire patchguard DPC
The main principle of patchguard check routine is to launch a patchguard context verification
routine on a DPC level, and then queue a work item that will check vital system structures on a
passive level with a proceeding context recreation and rescheduling. The verification work item
uses a copy of "FsRtlUninitializeSmallMcb" function. You can check this one out, if you want to
figure out how the check works.
For the methods which use DPC activation there is a common code inside 10 listed DPC
routines, which checks "DeferredContext" for being a non-canonical address. If it is OK, DPC
just executes its payload. Otherwise one of 10 "KiCustomAccessRoutineX" functions is called.
When "KiCustomAccessRoutineX" is called, (last 2 bits + 1) of "DeferredContext" are taken and
used to roll along "KiCustomRecurseRoutineX". These recursive routines are cycled
incrementing X value. When the roll is over, "KiCustomRecurseRoutineX" tries to dereference a
DeferredContext value as a pointer, which inevitably generates #GP exception since this
address is non-canonical.
// Inside DPC routine
if ( (DeferredContext >> 47) < 0xFFFFFFFFFFFFFFFFui64 && DeferredContext >> 47 != 0 )
// Is DeferredContext a canonical address
{
...
KiCustomAccessRoutineX(DeferredContext);
...
}
void KiCustomAccessRoutine9(DWORD64 DeferredContext)
{
return KiCustomRecurseRoutine9((DeferredContext & 3) + 1, DeferredContext);
}
void KiCustomRecurseRoutine9(DWORD dwRoll, DWORD64 DeferredContext)
{
DWORD dwNextRoll;
DWORD64 go_go_GP;
dwNextRoll = dwRoll - 1;
if ( dwNextRoll )
KiCustomRecurseRoutine0(dwNextRoll, DeferredContext);
go_go_GP = *DeferredContext; // #GP
}
// DPC routine call sequence
ExpTimerDpcRoutine -> KiCustomAccessRoutine0 -> KiCustomRecurseRoutine0 ...
KiCustomRecurseRoutineN
IopTimerDispatch -> KiCustomAccessRoutine1 -> KiCustomRecurseRoutine1 ...
KiCustomRecurseRoutineN
IopIrpStackProfilerTimer -> KiCustomAccessRoutine2 -> KiCustomRecurseRoutine2 ...
KiCustomRecurseRoutineN
PopThermalZoneDpc -> KiCustomAccessRoutine3 -> KiCustomRecurseRoutine3 ... KiCustomRecurseRoutineN
CmpEnableLazyFlushDpcRoutine -> KiCustomAccessRoutine4 -> KiCustomRecurseRoutine4 ... KiCustomRecurseRoutineN
CmpLazyFlushDpcRoutine -> KiCustomAccessRoutine5 -> KiCustomRecurseRoutine5 ... KiCustomRecurseRoutineN
KiBalanceSetManagerDeferredRoutine -> KiCustomAccessRoutine6 -> KiCustomRecurseRoutine6 ... KiCustomRecurseRoutineN
ExpTimeRefreshDpcRoutine -> KiCustomAccessRoutine7 -> KiCustomRecurseRoutine7 ... KiCustomRecurseRoutineN
ExpTimeZoneDpcRoutine -> KiCustomAccessRoutine8 -> KiCustomRecurseRoutine8 ... KiCustomRecurseRoutineN
ExpCenturyDpcRoutine -> KiCustomAccessRoutine9 -> KiCustomRecurseRoutine9 ... KiCustomRecurseRoutineN
Here comes vectored exception handling again. If you look up all the exception handlers for
these DPC routines, youll discover that there are several nested __try__except and
__try__finally blocks. For example, "ExpTimerDpcRoutine" looks something like this:
...
__try
{
__try
{
__try
{
__try
{
KiCustomAccessRoutine0(DeferredContext);
}
__finally
{
FinalSub1();
}
}
__except (FilterSub1()) // patchguard context decryption occurs here
{
// Nothing
}
}
__finally
{
FinalSub2();
}
}
__except (FilterSub2())
{
// Nothing
}
...
ExpCenturyDpcRoutine, ExpTimeZoneDpcRoutine, ExpTimeRefreshDpcRoutine,
KiBalanceSetManagerDeferredRoutine, CmpLazyFlushDpcRoutine, CmpEnableLazyFlushDpcRoutine,
PopThermalZoneDpc, ExpTimerDpcRoutine -> _C_specific_handler
IopIrpStackProfilerTimer , IopTimerDispatch -> _GSHandlerCheck_SEH (GS check + _C_specific_handler)
Depending on the DPC routine, decryption routine (based on KiWaitAlways and KiWaitNever
variables) may reside in one of the exception filters, exception handlers or termination handlers.
Further patchguard context verification occurs also inside decryption routine, right after the
decryption.
As for "KiTimerDispatch" and "KiDpcDispatch" DPC routines - they call patchguard context
verification directly. Also, depending on the DPC routine a different type of patchguard context
encryption is used (or not used at all).
Other methods
Method 3 creates a system thread. System thread procedure sleeps between 2 minutes and 2
minutes and 10 seconds using "KeDelayExecutionThread" or "KeWaitForSingleObject" on a
kernel object, which is always not signaled. After the wait is timed out it decrypts patchguard
context and executes verification routine.
Method 4 inserts an APC with "KiDispatchCallout" function as a kernel routine and
"EmpCheckErrataList" as a normal routine. Patchguard context decryption and validation occurs
upon APC delivery to the target waiting thread, which happens almost immediately. A 2 minutes
wait is located inside the verifier work item routine i
Available link for download
Thursday, March 30, 2017
Mayo v Prometheus Analysis and Implications of an Important Supreme Court Decision
Mayo v Prometheus Analysis and Implications of an Important Supreme Court Decision
When I first read the Supreme Courts decision in Prometheus, I must admit I was somewhat taken aback. To my mind, the Federal Circuit had already drawn a reasonable and relatively well-defined line between patent eligible molecular diagnostic methods that entail a physical step of analyzing for the presence of molecular marker and/or treating a patient (Prometheus) and patent ineligible diagnostic methods that could potentially be infringed by the mere analysis of genetic information (Myriad). Prior to yesterday, I had been hopeful that a majority of the Justices on the Supreme Court would agree and that the Federals Circuits decision in Prometheus would be affirmed.
Instead, as most of my readers are no doubt already aware, the Supreme Court unanimously reversed the Federal Circuit decision, declaring all of Prometheus claims at issue in the case patent ineligible. With the benefit of 20/20 hindsight, the Supreme Courts decision does not strike me as surprising at all. In his dissent from the Courts decision in 2006 to dismiss LabCorp v. Metabolite, Justice Breyer set forth in great detail his concern that "too much patent protection, for methods of molecular diagnosis can, in his words, "impede rather than promote the Progress of Science and useful Arts, [i.e.,] the constitutional objective of patent and copyright protection. In his view, patents broadly claiming this sort of innovation "can discourage research by impeding the free exchange of information, for example by forcing researchers to avoid the use of potentially patented ideas, by leading them to conduct costly and time-consuming searches of existing or pending patents, by requiring complex licensing arrangements [].
Justice Breyers LabCorp dissent held up the patent eligibility doctrine as an important tool for avoiding the "danger of overprotection." He described claims of the type at issue in LabCorp as merely a "natural law" cast by a clever patent attorney "in the abstract patent language of a process. He went on to conclude that a process "embodying" a natural phenomenon is not rendered patent eligible by the recitation of steps of physically analyzing for the presence of molecular markers or using the resulting information in the treatment of the patient. With respect to the particular claim under review in LabCorp, he stated that:
One might, of course, reduce the process to a series of steps, e.g., Step 1: gather data; Step 2: read a number; Step 3: compare the number with the norm; Step 4: act accordingly. But one can reduce any process to a series of steps. The question is what those steps embody.
Thus, Justice Breyers opinion in Prometheus represents nothing more than fruition of seeds he sowed in his LabCorp dissent. But why did all the other Justices join him in a unanimous decision? Im not sure the reason, but it seems to be the case that the Supreme Court decides patent decisions unanimously, perhaps because many of the Justices do not find patent cases particularly compelling, although Justice Breyer clearly does. In Prometheus the Supreme Court handed Justice Breyer the pen, and he decided the case in precisely the manner he set forth six years ago in his LabCorp dissent.
This blog article analyzes certain aspects of the Prometheus decision, and considers potential implications for the patentability of molecular diagnostics, personalized medicine and biotechnology in general.
The Courts expansive definition of "natural phenomena"
The Supreme Court has repeatedly stated that certain fundamental principles, including "natural phenomena," are ineligible for patent protection. At the same time, it has stressed that a useful application of a natural phenomenon can be patent eligible. To my mind, however, the Court has never clearly articulated a useful definition of "natural phenomenon," nor adequately explained how to discern the boundary between a method claim that impermissibly embodies a natural phenomenon, as opposed to a patent eligible claim reciting the specific application of a natural phenomenon. Prometheus has not remedied the situtation.
More than three years ago, when the Federal Circuit first took up the Prometheus appeal, I submitted an amicus brief on behalf of myself and a few other law professors arguing that the correlation between drug metabolite level and optimal drug dosage at the heart of Prometheus claims does not constitute a "natural" phenomenon. Unlike the LabCorp claim, which relates to a correlation between vitamin B and homocysteine that occurs naturally in human body, the Prometheus claims involve a correlation between a non-naturally occurring drug metabolite and the optimal dosage of the drug. The drug metabolite does not occur naturally, but is created as a byproduct when the human body breaks down the precursor drug. Hence the correlation between metabolite level and optimal dosage does not occur naturally, but only as the result of human intervention, i.e., the synthesis of the drug and administration of the drug to a patient. In my view, the correlation at the heart of the Prometheus claims is not a natural phenomenon, and hence it is erroneous to conclude that the claim is patent ineligible for claiming a natural phenomenon.
In its initial decision, the district court that decided Prometheus acknowledged that the drugs and their metabolites (breakdown products) do not occur absent human intervention, but nonetheless characterized the correlation between the breakdown products and optimal drug dosage as an unpatentable work of nature because the drugs are converted naturally by enzymes within the patients body to form an agent that is therapeutically active, [and thus] the correlation results from a natural body process. In essence, the district court concluded that the mere involvement of a natural process in the interaction between a man-made drug and the human body renders the interaction a natural phenomenon.
In my amicus brief, I pointed out what I saw as the flaw in the district courts logic:
Surely the lower courts expansive definition of natural phenomena cannot be correct, for virtually every patented invention is based on some discovery involving the interaction of human ingenuity with the natural environment and natural processes. For example, an airplane operates by interacting with the air in a particular manner that results in flight. The air and its properties are natural phenomena, but surely that does not render the interaction of an airplane with the air a natural phenomenon. More to the point, what biological or pharmaceutical invention is not based on an interaction with natural biological processes? In particular, drugs operate by means of chemical interactions with naturally occurring proteins and other biomolecules in the body, according to the fundamentals laws of chemistry and biology. Simply interacting with natural processes does not render a man-made biological phenomenon a natural phenomenon, but that would seem to be the result if the rationale of the lower court were applied generally to other scenarios beyond the facts of this case.On appeal, the Federal Circuit assumed that the correlations between drug metabolite level and optimal dosage are natural phenomena, without seeming to appreciate the implications of this broad definition of "natural phenomena." Justice Breyer took the same tack, concluding that:
While it takes a human action (the administration of a thiopurine drug) to trigger a manifestation of this relation in a particular person, the relation itself exists in principle apart from any human action. The relation is a consequence of the ways in which thiopurine compounds are metabolized by the bodyentirely natural processes.Under this broad interpretation of natural phenomena, it is hard to imagine any invention in biotechnology or the life sciences that is not based on the discovery of a natural phenomenon. All inventions in this realm of technology are the consequence of the way in which physical matter interacts with natural processes. PCR, recombinant DNA and monoclonal antibodies are some of the most important inventions of biotechnology, but all are based on harnessing natural biological and chemical processes, and hence seem to be "natural phenomena" under the Courts broad interpretation of the term.
What constitutes a patentable "application" of a biological natural phenomenon?
Of course, Justice Breyer acknowledged that a claim limited to a patentable "application" of a natural phenomenon remains patent eligible, but his decision does not seem to provide any coherent guidance with respect to what constitutes a patentable application of the phenomenon, as opposed to a patent ineligible claim that merely "describes" the phenomenon. Consider the rationales he set forth to justify his conclusion that the claimed steps of "administering" drug to a patient and "determining" the level of drug metabolite in a patients body were insufficient.
With respect to the administering step, he found that the step:
"simply refers to the relevant audience, namely doctors who treat patients with certain diseases with thiopurine drugs. That audience is a pre-existing audience; doctors used thiopurine drugs to treat patients suffering from autoimmune disorders long before anyone asserted these claims. In any event, the prohibition against patenting abstract ideas cannot be circumvented by attempting to limit the use of the formula to a particular technological environment. [cite to Bilski].Consider the implications if a lower court were to apply the same reasoning to a drug method of treatment claim. Method of treatment claims are extremely important for the pharmaceutical industry, and typically recite a method of treating a particular ailment by administering a drug to a patient. Applying the rationale of Justice Breyer, it would seem that doctors constitute a "pre-existing audience for method of treatment claims, no less so than with respect to the molecular diagnostic claims at issue in Prometheus. I dont see how one could make a principled distinction between the two scenarios, although, as discussed below, I suspect lower courts will find a way, rather than eliminate this important class of patents.
Regarding the step of determining the level of relevant metabolites in the blood, Justice Breyer concluded that determining the level of drug metabolites in the body is "well-understood, routine and conventional." But again, think of the implications if this rationale were to be extended to method of treatment claims. In general, I think it can be safely said that the administration of a known drug to a patient is "well understood, routine and conventional." But until now it has been generally understood and accepted that someone who discovers a new, nonobvious and useful method of using a known drug to treat a disease can patent her invention as a method of treatment. Justice Breyer does not provide any guidance as to how one would distinguish between "well understood and routine" administration of a known drug in the context of a method of treatment claim and administration of the drug as it appears in Prometheus claims.
Justice Breyer acknowledges the possibility that a combination of conventional steps might lead to a patent eligible invention, but concluded that in this case the claims "add nothing to the laws of nature that is not already present when the steps are considered separately." In particular, he concludes that "anyone who wants to make use of these laws must first administer a thiopurine drug and measure the resulting metabolite concentrations, and so the combination amounts to nothing significantly more than an instruction to doctors to apply the applicable laws when treating their patients.
But once again, what would be the implications for method of treatment claims? According to Justice Breyers interpretation of the term "natural phenomenon," the ability of Drug X to treat Disease Y seems clearly to fall within the realm of "natural phenomena." After all, the drug interacts with the body according to "entirely natural processes." But anyone who wants to make use of this "natural phenomenon" would of course need to administer Drug X to a patient requiring treatment, so how could the claim amount to anything more than, in the words of Justice Breyer, "an instruction to doctors to apply the applicable [natural phenomenon] when treating their patients?
No clear demarcation between Diehr and Flook/Prometheus
Justice Breyer asserts that the Courts decision in Prometheus is reinforced by a detailed consideration of earlier Supreme Court precedent, particularly Diehr and Flook. But his opinion provides no convincing rationale as to why the process steps recited in the Diehr claims were sufficient to establish patent eligibility, but not so in the case of Flook or Prometheus.
Justice Breyer suggests that the Supreme Court upheld the patent eligibility of the Diehr claims because they include steps of installing rubber in a press, closing the mold, constantly determining the temperature of the mold, constantly re- calculating the appropriate cure time through the use of the formula and a digital computer, and automatically opening the press at the proper time. According to Justice Breyer, the Diehr decision
"nowhere suggested that all these steps, or at least the combination of those steps, were in context obvious, already in use, or purely conventional. And so the patentees did not seek to pre-empt the use of [the] equation, but sought only to foreclose from others the use of that equation in conjunction with all of the other steps in their claimed process. These other steps apparently added to the formula something that in terms of patent laws objectives had significancethey transformed the process into an inventive application of the formula.Note that Justice Breyer never identifies which step or steps in the Diehr process transformed the patent ineligible equation into a patent eligible process, beyond the conclusory statement that one or more of the steps "apparently added . . . something that in terms of patent laws objectives had significance." Will the lower courts, not to mention patent examiners, actually be required to assess the significance to the overall objectives of patent law of the individual steps in any method claim that applies a natural phenomenon? It seems unworkable, precisely the sort of vague standard that the Federal Circuit sought to address by means of the machine or transformation test when it initially decided Bilski.
Patent eligibility as a doctrine to address obvious and/or overbroad patent claims
I am of the opinion (and I believe this opinion is shared by at least some judges on the Federal Circuit) that patent eligibility should not function as a primary doctrinal gatekeeper of patentability, but that instead the more conventional doctrines of nonobviousness, enablement and written description are better doctrinal tools for addressing the concerns that have been expressed with respect to claims of the type at issue in Prometheus, LabCorp and Myriad. However, Justice Breyer is adamant that patent eligibility performs an important function distinct from the requirements of 102, 103 and 112, and constitutes a fundamental and dynamic doctrine for addressing the problem of "too much patent protection,"
Nonetheless, it is clear from reading Prometheus that he views patent eligibility as inseparable from questions of obviousness and overbreadth, concerns more conventionally (and appropriate) addressed under Sections 103 and 112. For example, he repeatedly faults the Prometheus claims for including steps that are "well known, routine and conventional, and indicates that the Diehr claims were patent eligible because they included a combination of steps that were not "in context obvious, already in use or purely conventional. In other words, the patent eligibility of the Diehr claims seems to be inextricably linked with novelty and nonobviousness, at least in the mind of Justice Breyer.
In a similar manner, the Prometheus opinion states that patent eligibility is the appropriate mechanism for guarding against patent claims that "foreclose more future invention than the underlying discovery could reasonably justify." It goes on to complain about the breadth of the Prometheus claims, pointing out, for example that the "determining step is set forth in highly general language covering all processes that make use of the correlations after measuring metabolites, including later discovered processes that measure metabolite levels in new ways. Again, these are concerns more conventionally and appropriately addressed using the enablement requirement of section 112, not the blunt instrument of patent eligibility.
The US government, in fact, argued that the requirements of Sections 102, 103 and 112 are the more appropriate vehicles for addressing the concerns expressed with the Prometheus claims. However, Justice Breyer rejected this argument, asserting that to follow the governments advice in this regard would be to render the doctrine of patent eligibility a "dead letter." He also voiced concern that shifting the patentability inquiry entirely to Sections 102, 103 and 112 would "risk creating significantly greater legal uncertainty, while assuming that those sections can do work that they are not equipped to do."
I would disagree with both of these assertions. The doctrines of novelty, nonobviousness and enablement are all more firmly established and predictable than the recently reinvigorated patent eligibility doctrine. Shifting the focus from these better established doctrines to section 101 and patent eligibility increases rather diminishes legal certainty.
And I dont think there is any justification for thinking that the other doctrines of patentability are not flexible enough to address all of the concerns that have been express with respect to the Prometheus claims, and similar claims such as those at issue in the Myriad case. In fact, in Prometheus and Myriad the courts have never addressed the issue of whether the claims satisfy these other requirements of patentability, so how can one conclude that nonobviousness and enablement are not equipped to deal with any asserted problems with the claims? Ariad v. Eli Lilly provides an example of this - Eli Lilly initially sought to invalidate the Ariad claims using the doctrine of patent eligibility, but ultimately prevailed using the more established Section 112 doctrine of written description.
The machine or transformation test
The Federal Circuit relied heavily on the Bilski machine or transformation test in upholding the patent eligibility of the Prometheus claims. In particular, the court found that administering a drug to a patient is a method of treatment and always transformative (because it transforms the patients body). The court also found that the step of determining metabolite levels in the patient is inherently transformative, because it necessarily relies on laboratory processes that entail physical transformations of matter.
Justice Breyer, however, rejected the Federal Circuits machine or transformation analysis. He found the "administering" step irrelevant because it "simply helps pick out the group of individuals that are likely interested in applying the law of nature." I have a hard time getting my head around that one, it makes no sense to me to analyze the patent eligibility of a claim in terms of the intended audience for specific method steps recited in the claim. But in any event, if the administering step is irrelevant because it simply targets doctors as the relevant audience for the claim, the same rationale would seem to apply to any method of treatment claim that involves administering a drug to the patient.
He went on to find the "determining" step irrelevant because "science [might] develop a totally different system for determining metabolite levels that [does not inherently involve a] transformation. I guess in principle one cannot exclude the possibility that a method might be developed for determining metabolite levels that does not involve any transformation, but Im fairly certain that even if the claim had explicitly recited that the determining step must involves a physical transformation Justice Breyer would have still declared the claim to be patent ineligible.
Ever since the Supreme Court decided Bilski, Federal Circuit judges have continued to rely heavily on the machine or transformation test, pointing out that the Supreme Court had identified it as an "important and useful clue" to determining patent eligibility. But in Prometheus Justice Breyer points out that while it might be a useful clue, the machine or transformation test does not trump the fundamental test for patent eligibility, i.e., whether the claim impermissibly embodies a natural phenomenon.
Implications for diagnostics, personalized medicine pharmaceutical method of treatment claims
Prometheus and some amici argued that were the court to declare the Prometheus claims patent ineligible, it would have a chilling effect on future innovation in medical diagnostics. However, Justice Breyer swept aside this concern, stating that it was irrelevant to the question of patent eligibility of the claims, and suggesting that it was for Congress to intervene if it turns out that it is necessary to more finely tailor the rules of patent eligibility in order to protect innovations in diagnostics.
On its face, Prometheus appears to severely limit the ability of some innovators in diagnostics and personalized medicine to obtain effective patent protection. Indeed, if implemented literally, the standard of patent eligibility set forth in Prometheus would seem to deny patent protection to much of biotechnology, including drug method of treatment claims. However, I think in practice the lower courts will attempt to limit the impact of the decision, and find ways to maintain patent eligibility for drug methods of treatment, and at least to some extent for diagnostics and personalized medicine. It might require clever claim drafting in the area diagnostics and personalized medicine, and Prometheus clearly creates much uncertainty in this increasingly important sector of healthcare.
At one point in his opinion Justice Breyer states that "unlike, say, a typical patent on a new drug or a new way of using an existing drug, the patent claims do not confine their reach to particular applications of those laws. Im guessing that this sentence was intended to assuage fears that the decision had negative implications for the patenting of pharmaceuticals. Unfortunately, I dont see anything in the Prometheus decision that provides a basis for making a principled distinction between drug method of treatment claims and the Prometheus claims. Nonetheles, I think that the pharmaceutical industry will latch onto this sentence and successfully argue that claims of this type remained patent eligible.
In particular, I predict that if a court were faced with a patent eligibility challenge to a drug method of treatment claim, it would take advantage of the ambiguities in the Supreme Courts precedent in this area to find the claim patent eligible. The court would most likely perform some hand waving, and ultimately conclude that the method of treatment claims at issue in the case are more closely analogous to the Diehr claims than to the claims in Prometheus, and declare the claim patent eligible. I dont think the Federal Circuit or Supreme Court would want to overturn such decision, because I think the importance of these sort of claims for the pharmaceutical industry is widely understood and accepted.
Available link for download
Subscribe to:
Posts (Atom)