Ex Parte Malloy et alDownload PDFPatent Trial and Appeal BoardFeb 5, 201311180878 (P.T.A.B. Feb. 5, 2013) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________ Ex parte PATRICK J. MALLOY, MICHAEL COHEN, and ALAIN J. COHEN ____________ Appeal 2010-008528 Application 11/180,878 Technology Center 2400 ____________ Before JOHN A. JEFFERY, JAMES B. ARPIN, and DAVID C. McKONE, Administrative Patent Judges. McKONE, Administrative Patent Judge. DECISION ON APPEAL Appellants appeal under 35 U.S.C. § 134(a) from a Final Rejection of claims 1-43, which constitute all the claims pending in this application. See App. Br. 2.1 We have jurisdiction under 35 U.S.C. § 6(b). We affirm-in-part. 1 Throughout this opinion, we refer to the Appeal Brief filed September 25, 2009 (“App. Br.”), the Examiner’s Answer mailed December 30, 2009 (“Ans.”), and the Reply Brief filed February 23, 2010 (“Reply Br.”). Appeal 2010-008528 Application 11/180,878 2 STATEMENT OF THE CASE Appellants’ invention relates to tracing packets in a multi-tier network environment. See Spec. ¶ 0001. Claims 1 and 20, which are illustrative of the invention, read as follows: 1. A method of identifying a sequence of transmissions corresponding to a target transaction for embodiment on a network analysis system, comprising: identifying a reference transaction corresponding to the target transaction that includes a sequence of reference transmissions from multiple nodes, collecting traffic information corresponding to a period of time within which the target transaction occurs, the traffic information including a plurality of production transmissions, comparing the sequence of reference transmissions to the plurality of production transmissions to identify corresponding transmissions that form the sequence of transmissions corresponding to the target transaction. 20. A system comprising: a first memory area that is configured to store a set of reference transmissions from multiple nodes corresponding to a target transaction, a second memory area that is configured to store a plurality of production transmissions, and one or more filters that are configured to distinguish a set of production transmissions of the plurality of production transmissions corresponding to the set of reference transmissions. Appeal 2010-008528 Application 11/180,878 3 THE REJECTIONS Claims 1-8 stand rejected under 35 U.S.C. § 102(e) as anticipated by Kan (US 7,313,141 B2, issued Dec. 25, 2007, filed Oct. 9, 2002). See Ans. 3-5. Claims 9-43 stand rejected under 35 U.S.C. § 103(a) as unpatentable over Kan and Ferguson (US 7,215,637 B1, issued May 8, 2007, filed Dec. 14, 2001). See Ans. 6-23. ISSUES The Examiner finds that Kan anticipates claim 1. The issue is whether Kan discloses “a sequence of reference transmissions from multiple nodes.” See App. Br. 6-7. Regarding claim 20, the Examiner concedes that Kan does not teach a first memory area configured to store a plurality of reference transmissions, a second memory area configured to store a plurality of production transmissions, and one or more filters configured to distinguish a set of production transmissions corresponding to the set of reference transmissions. See Ans. 10. The Examiner finds that Ferguson teaches these limitations. See id. The issues are whether Kan and Ferguson teach or suggest: 1. “a first memory area that is configured to store a set of reference transmissions from multiple nodes corresponding to a target transaction.” See App. Br. 9; 2. “a second memory area that is configured to store a plurality of production transmissions.” See id.; and Appeal 2010-008528 Application 11/180,878 4 3. “one or more filters that are configured to distinguish a set of production transmissions of the plurality of production transmissions corresponding to the set of reference transmissions” See App. Br. 10. Regarding claim 40, the Examiner concedes that Kan does not teach a first memory area configured to store a set of reference packets, a second memory area configured to store a plurality of production packets, and a plurality of filters as recited in claim 40. See Ans. 21. The Examiner finds that Ferguson teaches these limitations. See id. The issues are whether Kan and Ferguson teach or suggest: 1. “a first filter that is configured to filter the production packets based on a sequence order of a plurality of the set of reference packets.” See Ans. 10-11; and 2. “a second filter that is configured to filter the production packets based on a size of one or more of the set of reference packets.” See id. ANALYSIS REJECTION OF CLAIMS 1-8 UNDER 35 U.S.C. § 102(e) Kan describes a network monitoring system including a monitoring circuit that monitors a sequence of packets communicated between a source and a destination in a set of network nodes. See Kan, Abstract; col. 3, l. 67- col. 4, l. 7. Kan’s packets include packet identifiers that uniquely identify the packets. See Kan, Abstract; col. 4, ll. 7-11. According to Kan, a predicted identifier for a characteristic (e.g., time of arrival (“TOA”)) can be generated based on the value of that characteristic found in other packets with the same source and destination. See Kan, col. 18, ll. 9-15. In other words, Kan discloses predicting the value of packet identifiers of subsequent Appeal 2010-008528 Application 11/180,878 5 packets in a sequence based on previously monitored packets from that sequence. See id. The monitoring circuit compares the packet identifiers of subsequently received packets with the predicted identifier to determine if there is a deviation, which may indicate an irregularity in network traffic. See Kan, col. 4, ll. 1-19. The Examiner finds that the “source” described in Kan is the “reference transaction” recited in independent claim 1 and that Kan’s “destination” is the recited “target transaction.” Ans. 3. According to the Examiner, Kan describes a packet, which includes a packet identifier, that is communicated between the source and destination in a first set of network nodes, which the Examiner finds is the “multiple nodes” recited in claim 1. See id. The Examiner also finds that Kan describes collecting TCP sequence number information about the monitored packets and that this constitutes collecting traffic information corresponding to a period of time within which the target transaction occurs. See Ans. 4. Finally, the Examiner finds that Kan’s disclosure of comparing a packet identifier of a received packet to the predicted identifier is comparing a sequence of reference transmissions to a plurality of production transmissions to identify corresponding transmissions that form the sequence of transmissions corresponding to the target transaction, as recited in claim 1. See id. Appellants argue several instances of error in the Examiner’s findings, mainly by way of reciting phrases from claim 1 and stating, without more, that such phrases are not disclosed in Kan. See App. Br. 6-7. Most of these arguments we find unpersuasive. See, e.g., In re Lovin, 652 F.3d 1349, 1357 (Fed. Cir. 2011) (“[T]he Board reasonably interpreted [37 C.F.R. § 41.37] to require more substantive arguments in an appeal brief than a mere recitation Appeal 2010-008528 Application 11/180,878 6 of the claim elements and a naked assertion that the corresponding elements were not found in the prior art.”). We do, however, agree that the Examiner has not shown that Kan discloses a reference transaction that includes a sequence of reference transmissions from multiple nodes, see App. Br. 6. While not intending to limit the claim, we look to the Specification to better understand the terminology used in claim 1. The Specification describes “reference transmissions” as communications, e.g., packets, that are typically recorded in a laboratory environment modeling a production environment. See Spec. ¶¶ 0005, 0011. The Specification uses “packet” and “transmission” synonymously to identify communications between network nodes. See Spec. ¶ 0018. “Production transmissions” are distinguished from “reference transmissions” in that they occur in a production environment. See Spec. ¶ 0010. “Transactions” are made up of sequences of transmissions (e.g., a “reference transaction” is made up of a sequence of “reference transmissions”). See Spec. 0010-11. We fail to see how Kan’s “source” discloses a “reference transaction.” While a source may be the initiation point of a communication, it is not a “sequence of reference transmissions,” as recited in claim 1. While the Examiner finds that a packet is “communicated between a source and destination in the first set of network nodes,” the Examiner does not explain how the “source” is a “sequence of reference transmissions from multiple nodes.” See Ans. 3. In the Response to Argument, the Examiner recasts the rejection of claim 1, finding that a packet communicated between a source and a destination is a “reference transaction” and that a sequence of communications between the source and the destination is a “sequence of Appeal 2010-008528 Application 11/180,878 7 reference transmissions.” See Ans. 24. The Examiner further identifies Kan’s received packet as the “production transmission” and the predicted identifier as the “target transaction.” See id. As Appellants point out (Reply Br. 2), the Examiner’s change of course makes it difficult to determine precisely which parts of Kan are mapped with the elements of claim 1. In reply, Appellants argue that a “packet,” identified in the Response to Argument as the recited “reference transaction,” is not a sequence of transmissions. See id. We agree with Appellants that a “packet” is not a “sequence of transmissions” and, thus, is not a “reference transaction.” Moreover, even if the Examiner intended to identify a single packet as a reference transmission and a sequence of Kan’s packets as the reference transaction, the Examiner still does not explain in the Response to Argument how the sequence of packets communicated between Kan’s source and destination is a sequence “from multiple nodes.” The Examiner points to Kan’s description of IP routers at column 1, lines 30-35 (also not identified in the rejection), as disclosing “multiple nodes.” See Ans. 24. However, this is merely a background description of monitoring network nodes. See Kan, col. 1, ll. 30-35. The Examiner has not shown how this background description applies to the communications between Kan’s source and destination. See Ans. 24. Moreover, the Examiner does not explain why Kan’s received packet is both a reference transmission and the production transmission to which the reference transmission is compared. See id. In short, even recast, the Examiner’s rejection of claim 1 does not show a “reference transaction” that includes “a sequence of reference transmissions from multiple nodes.” Appeal 2010-008528 Application 11/180,878 8 Accordingly, we do not sustain the rejection of: (1) claim 1; and (2) claims 2-8, which depend on claim 1. REJECTION OF CLAIMS 9-43 UNDER 35 U.S.C. § 103(a) Claims 9-19 Claims 9-19 depend on claim 1. Thus, each includes a recitation of the subject matter that we find has not been disclosed by the cited prior art. The Examiner does not rely on Ferguson to cure the above-noted deficiency. See Ans. 6-9. Accordingly, we do not sustain the rejection of claims 9-19. Claims 20-39 Ferguson teaches a system configured to receive packets, store them in memory, and filter those packets. See Ferguson, Abstract; Figs. 2B, 15; col. 50, ll. 58-67. The filtering can be used for protecting the network. See Ferguson, col. 51, ll. 18-23. The Examiner finds that Ferguson’s description of memory banks 0 and 1, shown in Figure 2B, teaches first and second memory areas for storing reference transmissions and production transmissions, as recited in independent claim 20. See Ans. 10 (citing Ferguson, col. 12, ll. 12-18). The Examiner further finds that Ferguson’s description of filtering, at column 50, lines 59-67, teaches the claimed one or more filters. See Ans. 10. Appellants contest the Examiner’s findings that Ferguson teaches a first memory area that is configured to store a set of reference transmissions and a second memory area that is configured to store a set of production transmissions. See App. Br. 9. However, Appellants merely state, without explanation, that it is “clearly evident” that the Examiner’s citation to Appeal 2010-008528 Application 11/180,878 9 Ferguson does not show the recited memory areas. Id. This is insufficient to show that the Examiner erred. See Lovin, 652 F.3d at 1357. The Examiner has pointed to separate memory locations capable of storing packets. See Ans. 10. Appellants do not adequately explain why these memory locations are incapable of storing packets corresponding to reference transmissions and production transmissions. See App. Br. 9. Appellants also contend that Ferguson does not teach the one or more filters recited in claim 20. See App. Br. 10. Appellants once again state that it is “clearly evident” that the Examiner’s citation to Ferguson is insufficient, without explaining why. See id. This argument, too, is unpersuasive. The Examiner has cited to a disclosure in Ferguson of packet filtering. See Ans. 10. Appellants do not adequately explain why such filters could not distinguish, from the production transmissions, a set of production transmissions corresponding to the set of reference transmissions. See App. Br. 10. In their Reply, Appellants further argue that “[c]ontrolling the flow of packets has no relationship to distinguishing a set of transmissions corresponding to another set of transmissions.” Reply Br. 5. However, Appellants provide insufficient explanation as to why the Examiner erred in finding that there was such a relationship. See id. Thus, the weight of the evidence on this record favors the Examiner’s position. Appellants do not separately argue claims 21-39. See App. Br. 9-10. Accordingly, we sustain the rejection of: (1) claim 20; and (2) claims 21-39, which depend on claim 20. Appeal 2010-008528 Application 11/180,878 10 Claims 40-43 Independent claim 40 includes several limitations that overlap with claim 20 (i.e., first and second memory areas and a plurality of filters configured to filter production packets to distinguish a set of production packets that correspond to a set of reference packets). Appellants argue claim 40 together with claim 20 for these limitations. See App. Br. 9. As explained above, these arguments are unpersuasive. Claim 40 also recites “a first filter that is configured to filter the production packets based on a sequence order of a plurality of the set of reference packets” and “a second filter that is configured to filter the production packets based on a size of one or more of the set of reference packets.” The Examiner finds these filters taught in Ferguson. See Ans. 22 (citing Ferguson, Fig. 15). Appellants disagree, arguing that Figure 15 teaches no such filters. See App. Br. 11. In response, the Examiner cites additionally to Ferguson, column 33, lines 35-40, and column 39, lines 5-10. See Ans. 28. Appellants reply that these cites do not teach the recited filters either. See Reply Br. 6. We agree with Appellants. We do not find the recited first and second filters to be taught in any of the Examiner’s citations, either in the rejection or the Response to Argument. For example, Ferguson’s Figure 15 depicts a graph showing the effect of increasing a number of filters, but says nothing about whether the filters are filtering for sequence order or packet size. The other citations are similarly silent regarding filtering for order or size. See Ferguson, col. 33, ll. 35-40; col. 39, ll. 5-10. Accordingly, we do not sustain the rejection of: (1) claim 40; and (2) claims 41-43, which depend on claim 40, and, thus, include recitations of the Appeal 2010-008528 Application 11/180,878 11 subject matter that we find has not been taught or suggested by the cited prior art. ORDER The decision of the Examiner to reject claims 1-19 and 40-43 is reversed. The decision of the Examiner to reject claims 20-39 is affirmed. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(1). See 37 C.F.R. § 1.136(a)(1)(iv) (2010). AFFIRMED-IN-PART rwk Copy with citationCopy as parenthetical citation