Ex Parte Bare et alDownload PDFPatent Trial and Appeal BoardJul 11, 201311250664 (P.T.A.B. Jul. 11, 2013) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE ____________________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________________ Ex parte BALLARD C. BARE and DANIEL E. FORD ____________________ Appeal 2011-0008941 Application 11/250,664 Technology Center 2400 ____________________ Before JEAN R. HOMERE, JEFFREY S. SMITH, and LYNNE E. PETTIGREW, Administrative Patent Judges. HOMERE, Administrative Patent Judge. DECISION ON APPEAL 1 The real party in interest is Hewlett Packard Development Company, LP. (App Br. 3.) Appeal 2011-000894 Application 11/250,664 2 STATEMENT OF THE CASE Appellants appeal under 35 U.S.C. § 134(a) from the Examiner’s Final Rejection of claims 1-28. (App. Br. 3.) We have jurisdiction under 35 U.S.C. § 6(b). We affirm. Appellants’ Invention Appellants invented a method and system for ascertaining nodes in a network that have been infected with a self-replicating threat (SRT). (Spec. [0011].) In particular, a plurality of network switches (202, 204, 206, 208) store network flow data including the source/destination addresses thereof that traverse the switches. Upon acquiring from the switches network flow data that traverse the nodes, a repository (226) coupled to the switches stores the acquired network flow data, which is subsequently analyzed to ascertain communication anomalies therein. (Fig. 2, Spec. [0011].) Illustrative Claim Independent claim 1 further illustrates the invention. It reads as follows: 1. A computer-implemented method of ascertaining an infected node in a network of nodes, comprising: providing a plurality of network switches, each of said plurality of network switches configured for storing network flow data for data that traverses each of said plurality of network switches; providing a repository for storing network flow data among at least a plurality of said nodes, said repository being operatively coupled to said plurality of network switches within said network to permit said repository to acquire said network flow data from said plurality of network switches; Appeal 2011-000894 Application 11/250,664 3 storing at said repository first network flow data among said at least a plurality of nodes, said first network flow data including a plurality of source addresses and corresponding destination addresses for a plurality of data flows; and analyzing said first network flow data at said repository to ascertain communication abnormalities that indicate whether any of said plurality of nodes is infected. Prior Art Relied Upon Wilken US 2004/0199793 A1 Oct. 7, 2004 Saurabh US 7,509,677 B2 Mar. 24, 2009 Rejections on Appeal The Examiner rejects the claims on appeal as follows: 1. Claims 1-7, 9, 11, and 13-28 stand rejected under 35 U.S.C. § 102(b) as being anticipated by Wilken. 2. Claims 8, 10, and 12 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over the combination of Wilken, Official Notice and Saurabh. ANALYSIS We consider Appellants’ arguments seriatim as they are presented in the Appeal Brief, pages 5-9, and the Reply Brief, pages 2-4. Dispositive Issue: Under 35 U.S.C. § 102, did the Examiner err in finding that Wilken describes network switches configured for storing flow data that traverse each of the switches having coupled thereto a repository, which upon acquiring from the switches network data flowing between the Appeal 2011-000894 Application 11/250,664 4 nodes, stores the acquired data for subsequently detecting anomalies therein, as recited in claim 1? Appellants argue that Wilken does not describe the disputed limitations emphasized above. (App. Br. 7-8, Reply Br. 2-3.) In particular, Appellants argue that while Wilken discloses a collector for collecting network information, the collector is not a switch. Further, Appellants argue that Wilken discloses an aggregator that receives information from the collector, and not from the network switches. (Id.) Accordingly, Appellants submit that Wilken does not anticipate claim 1. In response, the Examiner finds that the combination of Wilken’s collector and switch devices describes the claimed network switches. (Ans. 6.) Therefore, the Examiner finds that Wilken’s disclosure of a plurality of switches coupled to a collector describes a plurality of network switches, each storing traffic data that traverses the switch, which forwards to an aggregator data flowing between the nodes. (Id.) Based upon our review of the record before us, we find no error with the Examiner’s finding of anticipation regarding claim 1. We note at the outset that Appellants do not dispute the Examiner’s finding that Wilken discloses, upon receiving from a plurality of switches traffic data that traverses the switches, a collector connected thereto stores traffic data, subsequently forwards to an aggregator the collected data along with network flow data between the nodes. (Wilken [0050], [0051].) However, Appellants argue that the combination of the switch and collector, as proffered by the Examiner, is motivated by improper hindsight reasoning, Appeal 2011-000894 Application 11/250,664 5 and would be unsuitable for its intended purpose. (Reply Br. 2-3.) We do not agree with Appellants. First, we find unpersuasive Appellants’ obviousness arguments to rebut an anticipation rejection. We find nothing improper in the Examiner’s reading of Wilken’s collector and switch as a single network element. Nor do we agree with Appellants’ inference that the Examiner’s proffered reading changes the nature of the rejection from an anticipation rejection to an obviousness rejection. Second, we note that the claim recitation that the network switches are configured to store network flow data is a statement of intended use. That is, the claim language configured to merely indicates the capability or intent to perform certain action as opposed to actually performing the action. Our reviewing court has held that a statement of intended use in an apparatus claim cannot distinguish over a prior art apparatus that discloses all the recited structural limitations and is capable of performing the recited function. See In re Schreiber, 128 F.3d 1473, 1477 (Fed. Cir. 1997). We also note that “[a]n intended use or purpose usually will not limit the scope of the claim because such statements usually do no more than define a context in which the invention operates.” Boehringer Ingelheim Vetmedica, Inc. v. Schering-Plough Corp., 320 F.3d 1339, 1345 (Fed. Cir. 2003). Although “[s]uch statements often . . . appear in the claim’s preamble,” a statement of intended use or purpose can appear elsewhere in a claim. In re Stencel, 828 F.2d 751, 754 (Fed. Cir. 1987). Further, we find that the recited intended use limitation is met fully by an equivalent prior art structure disclosed in the switch-collector combination of Wilken, which appears to be capable of performing the Appeal 2011-000894 Application 11/250,664 6 recited functions. Accordingly, we are satisfied that Wilken’s switch- collector combination describes a network element that stores traffic data that traverses the switch. Similarly, because Wilken’s aggregator receives from the network switches (collector-switches) traffic data including flow data between the nodes to ascertain anomalies thereon, we find the aggregator describes the repository. It therefore follows that Appellants have failed to show error in the Examiner’s anticipation rejection of claim 1. Regarding claims 2-28, Appellants reiterate substantially the same arguments submitted for patentability of claim 1 above. (App. Br. 7-9.) As discussed above, these arguments are not persuasive. See 37 C.F.R. § 41.37(c)(1)(vii). DECISION We affirm the Examiner’s rejections of claims 1-28 as set forth above. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv). AFFIRMED msc Copy with citationCopy as parenthetical citation