Ex Parte Muralidharan et al

Patent Trial and Appeal Board

Feb 19, 2016

11923964 (P.T.A.B. Feb. 19, 2016)

UNITED STA TES p A TENT AND TRADEMARK OFFICE
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR
111923,964 10/25/2007 Nithya Muralidharan
42425 7590 02/23/2016
HICKMAN PALERMO BECKER BINGHAM/ORACLE
1 Almaden Boulevard
Floor 12
SAN JOSE, CA 95113
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www .uspto.gov
ATTORNEY DOCKET NO. CONFIRMATION NO.
50277-3453 1439
EXAMINER
GOFMAN,ALEXN
ART UNIT PAPER NUMBER
2163
NOTIFICATION DATE DELIVERY MODE
02/23/2016 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address( es):
usdocket@h35g.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte NITHY A MURALDHARAN and DANIEL MANHUNG WONG
Appeal2014-002437
Application 11/923 ,964
Technology Center 2100
Before CARLA M. KRIVAK, HUNG H. BUI, and JOHN F. HORVATH,
Administrative Patent Judges.
BUI, Administrative Patent Judge.
DECISION ON APPEAL
Appellants 1 seek our review under 35 U.S.C. § 134(a) of the
Examiner's Final Rejection of claims 3, 5-13, and 15-24. 2 We have
jurisdiction under 35 U.S.C. § 6(b).
WeAFFIRM. 3
1 According to Appellants, the Real Party in Interest is Oracle Corporation.
App. Br. 1.
2 Claims 1, 2, 4, and 14 have been canceled and are not on appeal.
3 Our Decision refers to Appellants' Appeal Brief filed August 13, 2013
("App. Br."); Reply Brief filed December 3, 2013 ("Reply Br."); Examiner's
Answer mailed October 13, 2013 ("Ans."); Final Office Action mailed May
16, 2013 ("Final Act."); and original Specification filed October 25, 2007
("Spec.").
Appeal2014-002437
Application 11/923,964
STATEMENT OF THE CASE
Appellants 'Invention
Appellants' invention relates to intrusion prevention in database
systems. Spec. i-f 2. According to Appellants, current intrusion detection
systems are ineffective and not suitable for detecting subtle attacks or
anomalous behavior initiated by enterprise personnel from within an
enterprise network. Id. at i-f 5. As such, Appellants seek to provide an
intrusion prevention system equipped with customized intrusion prevention
policies so as to prevent intrusion or unauthorized access to a database
system, including attacks or anomalous behavior initiated by enterprise
personnel from within an enterprise network. Id. at i-fi-1 11, 22, Abstract.
Claims 3 and 11 are independent. Claim 3 is illustrative and is
reproduced below with disputed limitations in italics:
3. A computer-implemented method for processing statements in a
database system, the method comprising:
receiving, from a user of the database system, first rttle
information that specifies a set of rules comprising at least a first rule,
wherein the first rule specifies a first condition and a first action to be
undertaken when the first condition is satisfied, the first condition
referring to at least one parameter value in parsed information used by
a database engine of the database system to execute database
statements, the first action specifying to prevent a database statement
from being submitted to the database engine for execution;
storing the set of rules at the database system;
receiving, at the database system, a request to execute a first
database statement that conforms to a database language and that
references by name one or more database objects in a database of the
database system;
within the database engine, parsing the first database statement
to generate first parsed information;
based on the first parsed information, making a determination of
whether one or more conditions are satisfied, wherein making a
2
Appeal2014-002437
Application 11/923,964
determination of whether one or more conditions are satisfied includes
determining whether the first condition of the first rule is satisfied based
on a parameter value in the first parsed information;
when the determination made for the first rule is that the first
condition is satisfied, preventing the first database statement from being
submitted to the database engine for execution; and
when the determination made for the first rule is that the first
condition is not satisfied, submitting the first database statement to the
database engine, and the database engine executing the first database
statement using the first parsed information;
wherein the method is performed by one or more computing
devices.
App. Br. 14 (Claims Appx.).
Examiner's Rejections
(1) Claims 3, 11, 12, and 21-24 stand rejected under 35 U.S.C.
§ 103(a) as being unpatentable over Tajalli and Ben. Final Act. 4--11.
(2) Claims 5-10, 12, and 15-20 stand rejected under 35 U.S.C.
§ 103(a) as being unpatentable over Tajalli, Ben, and Schlossberg. Final
Act. 11-14.
Evidence Considered
Schlossberg US 2002/0066034 Al
Ben-Itzhak ("Ben") US 2003/0023873 Al
Tajalli US 2004/0143749 Al
Issue on Appeal
May 30, 2002
Jan.30,2003
Jul. 22, 2004
Based on Appellants' arguments, the dispositive issue on appeal is
whether the combination of Tajalli and Ben teaches or suggests several
limitations of claim 3, and similarly, claim 11. App. Br. 5-12; Reply Br. 1-
5.
3
Appeal2014-002437
Application 11/923,964
ANALYSIS
With respect to claims 3 and 11, the Examiner finds Tajalli discloses
an intrusion prevention system (IDS) to prevent common operating systems
and server applications from intrusion using pre-defined and customized
system behavior policies, including Appellants' claimed limitations. Final
Act. 3-7 (citing Tajalli i-fi-f 161, 175, 186, 191, 258). The Examiner
acknowledges Tajalli does not explicitly teach that server applications
include a database system using database queries involving SQL statements,
but relies on Ben for expressly teaching an intrusion prevention system
(IDS) in the context of such a database system utilizing (1) parsing a
database query (SQL statement) to identify "malicious input" and (2)
executing the parsed information in order to support the conclusion of
obviousness. Id. 5---6 (citing Ben i-fi-1 84, 90, Fig. 6).
Appellants contend the Examiner erred in rejecting these claims under
35 U.S.C. § 103(a) because, according to Appellants, neither Tajalli nor Ben
teaches or suggests:
within the database engine, parsing the first database
statement to generate first parsed information;
based on the first parsed information, ... determining
whether the first condition of the first rule is satisfied based on
a parameter value in the first parsed information; [ ... ]
the database engine executing the first database statement
using the first parsed information
as recited in claims 3 and 11. App. Br. 5-12; Reply Br. 1-5 (emphasis
added). In particular, Appellants acknowledges paragraphs 84 and 90 of
Ben teach the use of a database query parser engine to parse a database
statement (SQL statement) for analysis, i.e., to identify if any element
included in the SQL statement is illegal or harmful for purposes of
4
Appeal2014-002437
Application 11/923,964
acceptance/rejection. App. Br. 7 (citing Ben il 90). However, Appellants
argue Ben describes such an identification is made with respect to an
operation request, not the parsed information generated from the operation
request and, as such, "Ben does not describe that the parsed information,
generated from the database statement, is used also by the database
engine to execute the database statement." Id. (emphasis in original).
According to Appellants,
"Ben does not describe that the parsed information, generated
from the database statement, is used also by the database
engine to execute the database statement. There is no
disclosure in Ben that the database engine uses the parsed
information, generated from the database statement, to execute
the database statement."
Id. at 8 (emphasis in original). Likewise, Appellants argue:
"Tajalli does not describe that a database statement is parsed in
a database engine to generate parsed information. Moreover,
Tajalli does not describe that the parsed information, generated
within a database engine is used by the database engine to
execute the database statement."
Id. at 9 (citing Tajalli i-f 175).
We do not find Appellants' arguments persuasive. Rather, we find the
Examiner has provided a comprehensive response to Appellants' arguments
supported by a preponderance of evidence. Ans. 3---6. As such, we adopt the
Examiner's findings and explanations provided therein. Id. For example, as
correctly recognized by the Examiner, the operation request as argued by
Appellants refers to a database statement (SQL statement) and, likewise,
parsing an operation request to determine illegal or harmful elements
included therein for purposes of acceptance/rejection as described in
5
Appeal2014-002437
Application 11/923,964
paragraphs 84 and 90 of Ben refers to Appellants' claimed "parsing the first
database statement to generate first parsed information," via Ben's database
query parser engine (i.e., database engine) and Appellants' claimed
"database engine executing the first database statement using the first parsed
information" as recited in claims 3 and 11. Ans. 3 (citing Ben i-f 90).
In reply, Appellants further argue: ( 1) "using the parsed information
to determine whether to execute or reject the database statement does not
mean executing the database statement using the parsed information" and
(2) "[a] person of the ordinary skill would understand that using the parsed
information to execute the database statement ... is not the same as using
the parsed information to determine whether to execute or reject the database
statement." Reply Br. 2 (emphasis in original).
We disagree. Contrary to Appellants' arguments, when an operation
request or database statement (SQL statement) is parsed for any illegal or
harmful elements included therein for purposes of acceptance/rejection, that
operation request or database statement (SQL statement) is executed using
the parsed information. We also note the test for obviousness is not whether
the claimed invention is expressly suggested in any one or all of the
references, but whether the claimed subject matter would have been obvious
to those of ordinary skill in the art in light of the combined teachings of
those references. See In re Keller, 642 F.2d 413, 425 (CCPA 1981). In an
obviousness analysis, precise teachings directed to the specific subject
matter of the challenged claim need not be identified because the inferences
and creative steps that a person of ordinary skill in the art would employ can
be taken into account. See KSR Int 'l Co. v. Teleflex Inc., 550 U.S. 398, 418
(2007); see also In re Preda, 401F.2d825, 826 (CCPA 1968) ("[I]n
6
Appeal2014-002437
Application 11/923,964
considering the disclosure of a reference, it is proper to take into account not
only specific teachings of the reference but also the inferences which one
skilled in the art would reasonably be expected to draw therefrom."). As
correctly found by the Examiner, both Tajalli and Ben teach an intrusion
prevention system (IDS)-Tajalli's intrusion prevention is based on pre-
defined and customized behavior polices at an application level, whereas
Ben's intrusion prevention is focused on a database system level. See Tajalli
i-fi-f 19--21, 133, 259-270, 267-269; Ben i-fi-121-22, 84, 90, Figs. 6 and 8.
Based on the context of these teachings, we find that a skilled artisan would
understand that Ben describes that the parsed information, generated from
the database statement, is used also by the database engine to execute the
database statement in the manner recited in claims 3 and 11.
For the reasons set forth above, Appellants have not persuaded us of
error in the Examiner's rejection of claims 3 and 11. Accordingly, we
sustain the Examiner's obviousness rejection of claims 3 and 22 and
dependent claims 12, and 21-24, which Appellants do not argue separately.
With respect to the rejection of claims 5-10, 12, and 15-20 as obvious
over Tajalli, Ben, and Schlossberg, Appellants present no separate
patentability arguments. App. Br. 12. For the same reasons discussed
above, we sustain the Examiner's obviousness rejection of these remaining
claims.
CONCLUSION
On the record before us, we conclude Appellants have not
demonstrated the Examiner erred in rejecting claims 3, 5-13, and 15-24
7
Appeal2014-002437
Application 11/923,964
under 35 U.S.C. § 103(a).
DECISION
As such, we AFFIRM the Examiner's final rejection of claims 3, 5-
13, and 15-24.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l )(iv).
AFFIRMED
8