Ex parte Arnold et al.

Board of Patent Appeals and Interferences

Jun 23, 2000

08366281 (B.P.A.I. Jun. 23, 2000)

Application for patent filed December 29, 1994,1
entitled "Autonomous System For Recognition Of Patterns Formed
By Stored Data During Computer Memory Scrubbing."
- 1 -
THIS OPINION WAS NOT WRITTEN FOR PUBLICATION
The opinion in support of the decision being entered
today (1) was not written for publication in a law
journal and (2) is not binding precedent of the Board.
_______________
Paper No. 17
UNITED STATES PATENT AND TRADEMARK OFFICE

BEFORE THE BOARD OF PATENT APPEALS
AND INTERFERENCES

Ex parte WILLIAM G. ARNOLD,
JEHOSHUA BRUCK, JEFFREY O. KEPHART,
GREGORY B. SORKIN, STEVE R. WHITE,
DAVID M. CHESS, CHARLES E. COX,
and MYRON D. FLICKNER

Appeal No. 1997-3499
Application 08/366,2811

ON BRIEF

Before KRASS, BARRETT, and HECKER, Administrative Patent
Judges.
BARRETT, Administrative Patent Judge.
DECISION ON APPEAL
Appeal No. 1997-3499
Application 08/366,281
- 2 -
This is a decision on appeal under 35 U.S.C. § 134 from
the final rejection of claims 1, 8, 9, 16, 17, and 21.
Claims 2-7, 10-15, 18-20, and 22 stand objected to.
We reverse.
BACKGROUND
The disclosed invention relates to a virus signature
detection method and system for locating virus patterns during
normal memory "scrubbing" operations.
Claim 1 is reproduced below.
1. A method for operating a computer system having
a central processing unit (CPU) for processing data
responsive to interrupt signals and stored instructions,
having a memory for storing data in a plurality of
addressable locations and having scrubbing means for the
continuous autonomous detection and correction of soft
bit errors in said data stored in said memory, said
method comprising the steps of:
(a) providing one or more items of said data read by
said scrubbing means from a first memory address;
(b) mapping said one or more data items to produce a
code signature related to said one or more data items
according to a first predetermined transformation;
(c) comparing said code signature to each of one or
more stored target signatures to determine a measure of
similarity therebetween;
(d) producing a CPU interrupt signal when said
measure of similarity equals or exceeds a predetermined
threshold; and
Appeal No. 1997-3499
Application 08/366,281
- 3 -
(e) repeating steps (a) through (d) for each of said
plurality of memory locations.
The Examiner relies on the following prior art:
Ryan 4,479,214 October 23,
1984
Arnold et al. (Arnold) 5,442,699 August 15, 1995
(filed November 21, 1994)
Watson et al. (Watson) 5,475,839 December 12, 1995
(filed November 16, 1994)
Claims 1, 8, 9, 16, 17, and 21 stand rejected under
35 U.S.C. § 103 as being unpatentable over Arnold, Watson, and
Ryan. The Examiner finds that Arnold teaches detecting
possible viruses within a computer's memory, Watson teaches
halting a system from booting and issuing a warning to the
user if corrupted files are detected prior to boot, and Ryan
teaches scrubbing means. The Examiner concludes that it would
have been obvious to utilize the scrubbing means of Ryan to
check for soft errors and then subsequently to check for virus
errors as taught by Arnold and Watson because it would enable
the system to first check for any soft errors detected by the
scrubbing process prior to virus detection (Final Rejection,
page 4).
Appeal No. 1997-3499
Application 08/366,281
- 4 -
We refer to the Final Rejection (Paper No. 10) and the
Examiner's Answer (Paper No. 13) (pages referred to as "EA__")
for a statement of the Examiner's position and to the Brief
(Paper No. 12) (pages referred to as "Br__") and the Reply
Brief (Paper No. 14) for Appellants' arguments thereagainst.
OPINION
Claims 1, 8, 9, 16, 17, and 21 are grouped to stand or
fall together (Br7). Claim 1 is analyzed as representative.
Initially, as a matter of claim interpretation, we
observe that claim 1 does not recite where the virus signature
checking and interrupt operations of steps (b) through (d) are
performed. Claim 1 does not require a low-level,
hardware-implemented virus checker and does not preclude steps
(b) through (d) from being performed by the CPU; this is
consistent with the disclosure which states that the steps can
be performed by a conventional data processor (specification,
page 13, lines 24-28; claim 21). Accordingly, Appellants'
arguments that "Arnold does not suggest or motivate the use of
a low-level, hardware-implemented memory management function
to check for viruses" (Br10) and that "[c]learly, in Claim 1
the CPU is not involved in a virus (signature) checking
Appeal No. 1997-3499
Application 08/366,281
- 5 -
operation" (RBr4), are not commensurate in scope with the
claim language and are not persuasive.
Appellants argue (Br13):
The applicant concedes that the operation of
Watson's and Arnold's systems would include memory
scrubbing. However, such memory scrubbing would be an
automatically initiated, hardware-based function
performed without cooperation of a CPU. The signature
detection and virus checking performed by Watson and
Arnold's algorithm, on the other hand, would be performed
by the CPU. In this, there is no suggestion that a
memory scrubber or a scrubbing means be employed to
provide data for the purpose of producing a code
signature. Instead, the data would be provided to the
CPU by the memory controller after any soft or hard
errors were corrected by the scrubber, within its
capability. [Underlining added.]
The critical limitations at issue are "scrubbing means
for the continuous autonomous detection and correction of soft
bit errors in said data stored in said memory" and "providing
one or more items of said data read by said scrubbing means
from a first memory address." Prior art autonomous scrubbing
means operate independently and transparently to the CPU
(specification, page 2, lines 9-11), as compared to
alternative "software scrubbing" schemes (specification,
page 2, lines 11-13). Although an autonomous scrubbing means
is part of the memory controller, it reads out, tests, and
rewrites addresses containing a single soft error with correct
Appeal No. 1997-3499
Application 08/366,281
- 6 -
data independently (autonomously) from the part of the memory
controller that reads out data for the CPU. Therefore, the
issue is whether it would have been obvious to use autonomous
scrubbing means to provide data to a virus signature checking
operation.
The Examiner states (EA12): "The examiner's Final
rejection states that it would have been obvious to utilize
the scrubbing means to initially check for soft errors, as
taught by Ryan, and then subsequently check for virus errors,
as taught by Arnold and Watson because it would enable one of
ordinary skill in the art to perform well known scrubbing
operations prior to implementing Arnold's and Watson's
operations, thus allowing soft errors to be detected prior to
any viral detections."
This reasoning does not address the memory scrubber
providing data for virus signature detection. The combination
of Watson and Arnold with the memory scrubber of Ryan would
have suggested a hardware memory scrubber of Ryan that
operates independently from the virus signature detection
process of Arnold and Watson. The Examiner does not point to
any teaching or suggestion for the memory scrubber means
Appeal No. 1997-3499
Application 08/366,281
- 7 -
providing data for a virus detection process or any other
external process.
The Examiner states (EA12): "The appellant's admission
that Arnold's and Watson's system would utilize scrubbing
techniques strengthens the examiner's position that one of
ordinary skill in the art would utilize such well known
techniques within the combined system of Watson and Arnold."
The Examiner further states (EA13): "The appellant states on
lines 17-24 of page 13, that the Arnold and Watson's teachings
suggest that the 'data would be provided to the CPU by the
memory controller after any soft or hard errors were corrected
by the scrubber, within its capability'. This clearly
suggests that the appellant is admitting that the teachings of
Arnold and Watson suggest the ability for a memory scrubber to
be utilized to correct any errors within its capability, and
then send the data to the CPU, which performs the virus
(signature) checking operations."
Appellants respond that they did not admit that a memory
scrubber means would provide data for the virus checking of
Arnold and Watson (RBr2): "Simply because memory scrubbing is
an automatic background process in modern computer operations
Appeal No. 1997-3499
Application 08/366,281
- 8 -
does not suggest the use of its output in the manner recited
in the rejected claims. It is stated emphatically that the
prior art fails to teach using a scrubbing means as an element
or as the performer of a step in the detection of a virus."
We agree with Appellants. Utilizing the scrubbing means
of Ryan in combination with the virus detector in Arnold
and/or Watson does not suggest the limitation at issue that
the scrubbing means provides data to a virus signature
detection process. As Appellants note, the scrubbing means
would function as an independent background process, separate
from whatever mechanism is used to read out data to perform
the virus checking. That data is provided to the CPU by the
memory controller, as stated by Appellants at page 13 of the
brief, does not imply that data is provided to the CPU by the
memory scrubber part of the memory controller. The memory
scrubber means reads out, tests, and rewrites addresses
containing a single soft error with correct data independently
(autonomously) from the part of the memory controller that
reads out data for the CPU.
The Examiner recognizes that claim 1 recites that the
memory scrubber means provides data to the detection processes
Appeal No. 1997-3499
Application 08/366,281
- 9 -
(EA12-13) and states (EA13): "The examiner contends that the
prior art suggests this capability by the fact that memory
scrubbing is well known in the art, and utilized in computer
systems to check for soft errors, as admitted by the
appellant, prior to processing of that data, and one of
ordinary skill in the art would have recognized this and
allowed Arnold's and Watson's combined system to utilize such
techniques as well for other advantages known to scrubbing
procedures."
Again, the Examiner fails to point to any suggestion in
the references or the knowledge of those of ordinary skill in
the art for modifying the prior art scrubber means of Ryan to
perform the additional task of providing data for the virus
signature checking operation. It does not even appear that
the Examiner recognizes that a modification of the prior art
scrubber means is necessary. We find no suggestion or
motivation in the references to modify a scrubber means to
read out data for use by other processes than the memory
scrubbing process.
Appeal No. 1997-3499
Application 08/366,281
- 10 -
For the reasons stated above, we conclude that the
Examiner has failed to establish a prima facie case of
obviousness with respect to claim 1. Claims 9, 17, and 21
contain similar limitations to the missing critical limitation
about the scrubber means reading out data for use by the virus
signature detection process and, accordingly, stand with
claim 1. The rejection of claims 1, 8, 9, 16, 17, and 21 is
reversed.
REVERSED
ERROL A. KRASS )
Administrative Patent Judge )
)
)
)
) BOARD OF PATENT
LEE E. BARRETT ) APPEALS
Administrative Patent Judge ) AND
) INTERFERENCES
)
)
)
STUART N. HECKER )
Administrative Patent Judge )
Appeal No. 1997-3499
Application 08/366,281
- 11 -
Terrance A. Meador
GRAY, CARY, WARE & FREIDENRICH
401 B Street, Suite 1700
San Diego, CA 92101