Ex Parte Harrison

Patent Trial and Appeal Board

Dec 13, 2016

13822239 (P.T.A.B. Dec. 13, 2016)

United States Patent and Trademark Office
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O.Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
13/822,239 03/11/2013 Keith Harrison 83193695 4748
56436 7590 12/15/2016
Hewlett Packard Enterprise
3404 E. Harmony Road
Mail Stop 79
Fort Collins, CO 80528
EXAMINER
BEHESHTI SHIRAZI, SAYED ARESH
ART UNIT PAPER NUMBER
2435
NOTIFICATION DATE DELIVERY MODE
12/15/2016 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
hpe.ip.mail@hpe.com
chris. mania @ hpe. com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte KEITH HARRISON
Appeal 2016-002198
Application 13/822,2391
Technology Center 2400
Before ST. JOHN COURTENAY III, THU A. DANG, and
LARRY J. HUME, Administrative Patent Judges.
HUME, Administrative Patent Judge.
DECISION ON APPEAL
This is a decision on appeal under 35 U.S.C. § 134(a) of the final
rejection of claims 1—10 and 12—19. Appellant has previously canceled
claim 11. We have jurisdiction under 35 U.S.C. § 6(b).
We AFFIRM.
1 According to Appellant, the real party in interest is Hewlett-Packard
Development Company, LP. App. Br. 1.
Appeal 2016-002198
Application 13/822,239
STATEMENT OF THE CASE2
The Invention
Appellant's disclosed and claimed inventions relate to virtual
machines for virus scanning. Title.
Exemplary Claim
Claim 6, reproduced below, is representative of the subject matter on
appeal:
6. A device for secure computing, comprising:
a computer system including a processor and a memory;
a virtual machine monitor executable on the processor of
the computer system to support a user-definable number of
virtual machines;
a first forensic virtual machine to read memory allocated
by the virtual machine monitor to a target virtual machine
supported by the virtual machine monitor and to determine
presence of a signature indicative of a threat in the target virtual
machine; and
a supervisory virtual machine to deploy multiple other
forensic virtual machines to read memory allocated to the target
virtual machine to scan for presence of further signatures
indicative of the threat,
wherein each of the first and multiple other forensic
virtual machines is outside the target virtual machine and
includes a respective guest operating system.
2 Our decision relies upon Appellant's Appeal Brief ("App. Br.," filed
May 12, 2015); Reply Brief ("Reply Br.," filed Dec. 8, 2015); Examiner's
Answer ("Ans.," mailed Oct. 8, 2015); Final Office Action ("Final Act.,"
mailed Dec. 12, 2014); and the original Specification ("Spec.," filed
Mar. 11,2013).
2
Appeal 2016-002198
Application 13/822,239
Prior Art
The Examiner relies upon the following prior art as evidence in
rejecting the claims on appeal:
Midgley US 2006/0037079 A1
Overcash et al. ("Overcash") US 2008/0047009 A1
Zheng et al. ("Zheng") US 2010/0306849 Al
Sobeletal. ("Sobel") US 2011/0321040 Al
Rejections on Appeal
Rl. Claims 1,3,6, 8, 9, and 12—18 stand rejected under 35 U.S.C.
§ 103(a) as obvious over the combination of Zheng and Overcash. Ans. 3.
R2. Claims 2, 4, and 5 stand rejected under 35 U.S.C. § 103(a) as
obvious over the combination of Zheng, Overcash, and Sobel. Ans. 3.
R3. Claim 7 stands rejected under 35 U.S.C. § 103(a) as obvious
over the combination of Zheng, Overcash, and Midgley. Ans. 3.
R4. Claims 10 and 19 stand rejected under 35 U.S.C. § 103(a) as
obvious over the combination of Zheng, Sobel, and Overcash. Ans. 4.
CLAIM GROUPING
Based on Appellant's arguments (App. Br. 6—19), we decide the
appeal of obviousness Rejection Rl of claims 1,3,6, 8, 9, and 12, 13,
and 15—18 on the basis of representative claim 6. We address separately
argued dependent claim 14 in Rejection Rl, infra. We address the appeal of
obviousness rejections R2—R4 of claims 2, 4, 5, 7, 10, and 19, not argued
separately, infra.
Feb. 16, 2006
Feb. 21,2008
Dec. 2, 2010
Dec. 29, 2011
3
Appeal 2016-002198
Application 13/822,239
ISSUES AND ANALYSIS
In reaching this decision, we consider all evidence presented and all
arguments actually made by Appellant. We do not consider arguments
which Appellant could have made but chose not to make in the Briefs so that
we deem any such arguments as waived. 37 C.F.R. § 41.37(c)(l)(iv).
We disagree with Appellant's arguments with respect to claims 1, 6,
and 14, and we incorporate herein and adopt as our own: (1) the findings
and reasons set forth by the Examiner in the action from which this appeal is
taken, and (2) the reasons and rebuttals set forth in the Examiner's Answer in
response to Appellant's arguments. We incorporate such findings, reasons,
and rebuttals herein by reference unless otherwise noted. However, we
highlight and address specific findings and arguments regarding claims 1, 6,
and 14 for emphasis as follows.
1. Rejection R1 of Claims E 3, 6, 8, 9, and 12—18
Issue 1
Appellant argues (App. Br. 6—12; Reply Br. 2—12) the Examiner's
rejection of claim 6 under 35 U.S.C. § 103(a) as being obvious over the
combination of Zheng and Overcash is in error. These contentions present
us with the following issue:
Did the Examiner err in finding the cited prior art combination teaches
or suggests "[a] device for secure computing" that includes, inter alia, the
limitations of:
a supervisory virtual machine to deploy multiple other
forensic virtual machines to read memory allocated to the target
4
Appeal 2016-002198
Application 13/822,239
virtual machine to scan for presence of further signatures
indicative of the threat,
wherein each of the first and multiple other forensic
virtual machines is outside the target virtual machine and
includes a respective guest operating system,
as recited in claim 6? (Emphasis added).
Analysis
Appellant contends:
A collaborative detection module is depicted as element 308 in
Fig. 3 of Overcash, which includes multiple threat detection
engines. Id., f [0090]. However, it is clear that there is no
indication whatsoever that the multiple threat engines in the
collaborative detection module of Overcash are implemented as
forensic virtual machines.
App. Br. 7.
We are not persuaded by Appellant's argument because Appellant is
improperly arguing the references separately. The Examiner cites Zheng's
scanner virtual machines which protect the target virtual machines teaches or
at least suggests the disputed limitation "forensic virtual machine" as recited
in claim 6. Zheng teaches a virtual environment. Ans. 5—6, Final Act. 7—8,
citing Zheng Fig. 6, H 52, 59.
The Examiner cites Overcash's collaboration detection module that
includes multiple threat detection engines for teaching or suggesting a
"supervisory" machine that deploys other "forensic" machines. Ans. 5—6,
Final Act. 9, citing Overcash 112. The Examiner further finds Overcash's
illustrating interchangeability of hardware and software by a skilled person
teaches or suggests that Overcash's threat detection engines may also be
"virtual." Final Act. 9, citing Overcash 1247.
5
Appeal 2016-002198
Application 13/822,239
Appellant further argues a lack of motivation to combine the
references:
This purported motivation to combine Overcash with
Zheng is based on the false premise that the threat engines of
Overcash are "forensic virtual machines" as recited in claim 6.
Moreover, the stated motivation to combine ignores other
objective evidence of record that clearly indicates that no
reason existed that would have prompted a person of ordinary
skill in the art to combine Zheng and Overcash to achieve the
claimed subject matter.
App. Br. 10.
Appellant also argues the Sobel reference in regards to Rejection Rl.
App. Br. 10-11. We are not persuaded by Appellant's arguing a reference
(Sobel) not cited by the Examiner in Rejection Rl.
In response to Appellant's argument regarding the Examiner's
proffered motivation to combine the cited references, we find the Examiner
provides sufficient articulated reasoning with some rational underpinning to
support the legal conclusion of obviousness. See KSR Int'l Co. v. Teleflex,
Inc., 550 U.S. 398 (2007). Final Act. 9—10. We find no error with the
Examiner's conclusion it would have been obvious to someone of ordinary
skill in the art to incorporate Overcash's use of multiple forensic machines to
determine the presence of multiple other signatures into Zheng's forensic
virtual machine environment to reduce false positives, prioritize successful
attacks and provide indications of security threats detected in the application.
Both references are in the same field of art. Final Act. 9—10; Ans. 7—8.
The U.S. Supreme Court has held "[t]he obviousness analysis cannot
be confined by a formalistic conception of the words teaching, suggestion,
and motivation, or by overemphasis on the importance of published articles
6
Appeal 2016-002198
Application 13/822,239
and the explicit content of issued patents." KSR, 550 U.S. at 419. Instead,
the relevant inquiry is whether the Examiner has set forth "some articulated
reasoning with some rational underpinning to support the legal conclusion of
obviousness." In re Kahn, 441 F.3d 977, 988 (Fed. Cir. 2006) (cited with
approval in KSR, 550 U.S. at 418). Moreover, Appellant has provided no
evidence that combining such teachings was "uniquely challenging or
difficult for one of ordinary skill in the art," Leapfrog Enters., Inc. v. Fisher-
Price, Inc., 485 F.3d 1157, 1162 (Fed. Cir. 2007), nor has Appellant
presented evidence that this incorporation yielded more than expected
results. Further, Appellant has not provided objective evidence of secondary
considerations which our reviewing court guides "operates as a beneficial
check on hindsight." Cheese Sys., Inc. v. Tetra Pak Cheese and Powder
Sys., 725 F.3d 1341, 1352 (Fed. Cir. 2013).
We find Appellant's invention is simply a combination of known
teachings that, at the time of the invention, would have realized a predictable
result. We also find the Examiner has met the requisite burden by
articulating a rationale to modify Overcash's teachings and suggestions with
the "virtual machine" environment taught by Zheng. Thus, we find the
Examiner has set forth sufficient "articulated reasoning with some rational
underpinning to support the legal conclusion of obviousness."
Although Appellant separately argues method claim 1 (App. Br. 12—
13), for reasons similar to those discussed above with respect to independent
device claim 6, we also find no error in the Examiner's rejection of
independent claim 1.
7
Appeal 2016-002198
Application 13/822,239
Accordingly, Appellant has not provided sufficient evidence or
argument to persuade us of any reversible error in the Examiner's reading of
the contested limitations on the cited prior art. Therefore, we sustain the
Examiner's obviousness rejection of representative independent claim 6and
claims 1, 3, 8, 9, and 12, 13, and 15—18 which fall therewith. See Claim
Grouping, supra.
2. Rejection R1 of Dependent Claim 14
Issue 2
Appellant argues (App. Br. 14—15; Reply Br. 13—15) the Examiner's
rejection of claim 14 under 35 U.S.C. § 103(a) as being obvious over the
combination of Zheng and Overcash is in error. These contentions present
us with the following issue:
Did the Examiner err in finding the cited prior art combination teaches
or suggests the method of claim 1 that includes, inter alia, the steps of
"detecting that the threat has a risk greater than a specified risk; and in
response to the detecting, redeploying a particular one of the multiple further
forensic virtual machines to scan the host virtual machine rather than another
target virtual machine," as recited in claim 14?
Analysis
Appellant admits "[pjaragraph [0092] of Overcash states that
'anomalous traffic identified by the behavioral analysis engine ... is passed
to one or more threat detection engines to identify any attacks and provide
responsive actions.' Overcash, | [0092]." App. Br. 15.
However, Appellant then contends:
8
Appeal 2016-002198
Application 13/822,239
This passage of Overcash also provides no teaching or hint of
"detecting that the threat has a risk greater than a specified
risk," and "in response to the detecting, redeploying a particular
one of the multiple further forensic virtual machines to scan the
host virtual machine rather than another target virtual machine."
Id.
We are not persuaded by Appellant's contentions and agree with the
Examiner that under a broad but reasonable interpretation,3 Overcash's
detection of anomalies may teach or suggest "detecting that the threat has a
risk greater than a specified risk." Ans. 10—11. We agree with the Examiner
because Overcash's behavioral analysis engine 370 provides positive
validation of all application traffic against a profile of acceptable behavior.
Anomalous traffic identified by this behavioral analysis engine 370 is then
sent to one or more threat detection engines to identify any attacks and
provide responsive action. Overcash | 92. Therefore, we agree with the
Examiner's finding because Overcash's behavioral analysis engine's threat
analysis against a profile of acceptable behavior teaches or at least suggests
the disputed limitation "the threat has a risk greater than a specified risk," as
recited in claim 14.
3 Any special meaning assigned to a term "must be sufficiently clear in the
specification that any departure from common usage would be so understood
by a person of experience in the field of the invention." Multiform
Desiccants Inc. v. Medzam Ltd., 133 F.3d 1473, 1477 (Fed. Cir. 1998); see
also Helmsderfer v. Bobrick Washroom Equip., Inc., 527 F.3d 1379, 1381
(Fed. Cir. 2008) ("A patentee may act as its own lexicographer and assign to
a term a unique definition that is different from its ordinary and customary
meaning; however, a patentee must clearly express that intent in the written
description.").
9
Appeal 2016-002198
Application 13/822,239
Accordingly, Appellant has not provided sufficient evidence or
argument to persuade us of any reversible error in the Examiner's reading of
the contested limitations on the cited prior art. Therefore, we sustain the
Examiner's obviousness rejection of dependent claim 14.
3. Rejections R2—R4 of Claims 2, 4, 5, 7, 10, and 19
In view of the lack of any substantive arguments directed to the
obviousness rejections R2—R4 of claims 2, 4, 5, 7, 10, and 19 under § 103
(see App. Br. 18—19), we sustain the Examiner's rejection of these claims.
Arguments not made are waived.
REPLY BRIEF
To the extent Appellant may advance new arguments in the Reply
Brief (Reply Br. 2—15) not in response to a shift in the Examiner's position
in the Answer, we note arguments raised in a reply brief that were not raised
in the appeal brief or are not responsive to arguments raised in the
Examiner's Answer will not be considered except for good cause, which
Appellant has not shown. See 37 C.F.R. § 41.41(b)(2).
CONCLUSIONS
(1) The Examiner did not err with respect to obviousness Rejection
R1 of claims 1,3,6, 8, 9, and 12—18 under 35 U.S.C. § 103(a) over the cited
prior art combination of record, and we sustain the rejection.
(2) The Examiner did not err with respect to obviousness
Rejections R2—R4 of claims 2, 4, 5, 7, 10, and 19 under 35 U.S.C. § 103(a)
over the cited prior art combinations of record, and we sustain the rejections.
10
Appeal 2016-002198
Application 13/822,239
DECISION
We affirm the Examiner's decision rejecting claims 1—10 and 12—19.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv).
AFFIRMED
11