HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.

Patent Trials and Appeals Board

Dec 16, 2021

2020006254 (P.T.A.B. Dec. 16, 2021)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
15/749,112 01/30/2018 Jeffrey Kevin Jeansonne 84914796 1015
22879 7590 12/16/2021
HP Inc.
3390 E. Harmony Road
Mail Stop 35
Fort Collins, CO 80528-9544
EXAMINER
WOLDEMARIAM, NEGA
ART UNIT PAPER NUMBER
2433
NOTIFICATION DATE DELIVERY MODE
12/16/2021 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
ipa.mail@hp.com
jessica.pazdan@hp.com
yvonne.bailey@hp.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

Ex parte JEFFREY KEVIN JEANSONNE,
RICHARD A. BRANLEY, JR., and VALI ALI
________________

Appeal 2020-006254
Application 15/749,112
Technology Center 2400
____________

Before JOSEPH L. DIXON, JOHNNY A. KUMAR, and
MATTHEW J. McNEILL, Administrative Patent Judges.

McNEILL, Administrative Patent Judge.

DECISION ON APPEAL

Appellant1 appeals under 35 U.S.C. § 134(a) from the Examiner’s
final rejection of claims 1‒6 and 8‒15, which are all the claims pending in
this application. We have jurisdiction under 35 U.S.C. § 6(b).
We affirm in part.

1 We use the word “Appellant” to refer to “applicant” as defined in
37 C.F.R. § 1.42 (2018). Appellant identifies the real party in interest as
Hewlett-Packard Development Company, LP, a wholly-owned affiliate of
HP Inc. Appeal Br. 3.
Appeal 2020-006254
Application 15/749,112

2

STATEMENT OF THE CASE
Introduction
The claimed subject matter relates to detecting intrusions into
firmware while an operating system is running. Spec. ¶ 1. Claims 1, 8, and
12 are illustrative of the claimed subject matter and read as follows:
1. A computer program product for providing notifications
to a user of an intrusion into firmware comprising:
non-transitory computer readable medium comprising
computer usable program code embodied therewith to, when
executed by a processor, detect intrusion to the firmware of a
computing system while an operating system is running.
8. A method for logging events and providing notification
of intrusions to system management mode (SMM) firmware on
a computing device during runtime, comprising:
storing an event data structure describing intrusions to
SMM firmware on a computing device during runtime in a non-
volatile memory in a computing system.
12. A computer user interface comprising:
a first window indicating a notice that an intrusion into
system management mode (SMM) firmware of a computing
system has occurred; and
an indicator describing how a user is to obtain more
details on the event.
The Examiner’s Rejections
Claims 1‒4, 6, and 8‒11 stand rejected under 35 U.S.C. § 102 as
anticipated by Jeansonne (US 2016/0063255 A1; Mar. 3, 2016). Final Act.
2‒5.
Claim 5 stands rejected under 35 U.S.C. § 103 as unpatentable over
Jeansonne and Held (US 2013/0013905 A1; Jan. 10, 2013). Final Act. 5‒6.
Appeal 2020-006254
Application 15/749,112

3

Claim 12 stands rejected under 35 U.S.C. § 103 as unpatentable over
Held and Petersen (US 2012/0005542 A1; Jan. 5, 2012). Final Act. 6‒7.
Claims 13‒15 stand rejected under 35 U.S.C. § 103 as unpatentable
over Held, Petersen, and Jeansonne. Final Act. 7‒8.
ANALYSIS
Claim 1
Appellant argues the Examiner has failed to establish that Jeansonne
discloses computer code to “detect intrusion to the firmware of a computing
system while an operating system is running.” Appeal Br. 7‒8; Reply Br. 1‒
4. In particular, Appellant argues the Examiner’s findings regarding runtime
detection are not supported by the cited portions of the reference. Reply
Br. 1‒3. Appellant argues paragraph 9 of Jeansonne discloses BIOS code
that can run after the operating system loads, but does not disclose firmware
intrusion detection after the operating system loads. Reply Br. 1‒2.
Appellant argues paragraph 13 does not disclose an operating system
running and the Examiner’s finding to the contrary has no support in the
reference. Id. at 2. Appellant argues paragraph 39 likewise does not support
the Examiner’s finding that the operating system is running during firmware
intrusion detection. Id. at 3.
Appellant has not persuaded us of Examiner error. The Examiner
finds, and we agree, Jeansonne discloses protecting firmware from being
compromised due to malware attack and a secondary non-volatile memory
that is used to store a copy of the system firmware and system date. Ans. 3
(citing Jeansonne ¶ 13). The Examiner finds Jeansonne discloses an
embedded controller that monitors the integrity of the secondary non-volatile
memory to ensure the content has not been compromised due to malware, a
Appeal 2020-006254
Application 15/749,112

4

code bug, or another cause, which the Examiner finds discloses detecting an
intrusion while an operating system is running. Id. (citing Jeansonne ¶ 39).
Appellant’s argument that the Examiner’s findings are unsupported by
the reference is unpersuasive. Jeansonne discloses “embedded controller 202
can monitor the integrity of the content (code and data) stored in the primary
non-volatile memory 204 and/or secondary non-volatile memory 216 to
ensure that the content has not been compromised due to malware, a code
bug, or other cause.” Jeansonne ¶ 39. Thus, Jeansonne discloses embedded
controller 202 can detect intrusion into secondary non-volatile memory 216,
which stores a copy of the firmware (see Ans. 3 (citing Jeansonne ¶ 13)).
Jeansonne discloses embedded controller 202 can perform this integrity
check at various times “such as when the computing system 200 comes out
of reset, during a low power state of the computing system 200, or during
runtime of the computing system 200.” Jeansonne ¶ 40 (emphasis added).
Thus, Jeansonne discloses that this intrusion detection can occur “while an
operating system is running,” as claimed. Appellant’s arguments to the
contrary do not persuasively identify error in the Examiner’s findings.
For these reasons, we sustain the Examiner’s anticipation rejection of
claim 1. We also sustain the anticipation rejection of claims 2‒4 and 6, for
which Appellant relies on the same arguments. See Appeal Br. 7‒8. We also
sustain the Examiner’s obviousness rejection of claim 5, for which Appellant
relies on the same arguments. See id. at 10.
Claim 8
The Examiner finds Jeansonne discloses “storing an event data
structure describing intrusions to system management mode (SMM)
Appeal 2020-006254
Application 15/749,112

5

firmware on a computing device during runtime.” Final Act. 4 (citing
Jeansonne ¶¶ 14, 37).
Appellant argues the Examiner’s findings do not address the
limitation that the claimed firmware is SMM firmware. Appeal Br. 9.
Appellant argues the Specification defines SMM as “an operating mode of
x86 central processing units (CPUs) in which execution of at least the
operating system is suspended and separate software, which is part of the
firmware, is executed with high privileges.” Id. (citing Spec. ¶ 21).
Appellant argues Jeansonne does not disclose SMM firmware and the
Examiner has not made findings to establish that it does. Id.
In response to Appellant’s arguments, the Examiner repeats the
findings made regarding claim 1 without specifically addressing the SMM
firmware limitation. See Ans. 3‒4. On this record, we are constrained to
agree with Appellant that the Examiner has not made sufficient factual
findings regarding all of the limitations recited in claim 8. In particular, the
Examiner has not made any findings regarding SMM firmware or explained
how Jeansonne discloses such firmware as it is defined by the Specification.
Accordingly, we do not sustain the anticipation rejection of independent
claim 8. We also do not sustain the anticipation rejection of dependent
claims 9‒11.
Claim 12
Appellant argues the portions of Held and Petersen cited by the
Examiner do not teach or suggest “SMM firmware,” as defined in the
Specification. Appeal Br. 10 (citing Spec. ¶ 21). In particular, Appellant
argues paragraph 14 of Held teaches the system may store an initialization
firmware verification module, but does not mention SMM firmware. Id.
Appeal 2020-006254
Application 15/749,112

6

Appellant argues paragraphs 28 and 51 of Held teach a high-level
description of defense of BIOS code, but do not mention SMM firmware. Id.
Appellant argues paragraph 50 of Petersen teaches a pop-up window
including details of an event, but this is not relevant to the SMM firmware
limitation. Id.
Appellant has not persuaded us of Examiner error. The Specification
defines “system management mode (SMM)” as “an operating mode of x86
central processor units (CPUs) in which execution of at least the operating
system is suspended and separate software, which is part of the firmware, is
executed with high privileges.” Spec. ¶ 21. The Examiner finds, and we
agree, Held teaches BIOS storage attack protection and notification. Final
Act. 6 (citing Held ¶¶ 14, 28, 51). Held teaches verifying the BIOS of a
computing platform by executing a processor initialization module in
response to a reset. Held ¶ 51. Held teaches that a reset is a restart event
where flow control is returned from the operating system to the processor
initialization module. Held ¶ 15. Although Held does not explicitly use the
term SMM, Held teaches the operating system is suspended and the
processor initialization module, which is part of the firmware, is executed to
verify the integrity of the BIOS. We agree with the Examiner that these
disclosures teach, or at least suggest, the disputed limitations.
For these reasons, we sustain the Examiner’s obviousness rejection of
claim 12. We also sustain the Examiner’s obviousness rejection of claims
13‒15, for which Appellant relies on the same arguments. See Appeal
Br. 10.
DECISION SUMMARY
In summary:
Appeal 2020-006254
Application 15/749,112

7

Claim(s)
Rejected
35
U.S.C. §
Reference(s)/Basis Affirmed Reversed
1‒4, 6, 8‒11 102 Jeansonne 1‒4, 6 8‒11
5 103 Jeansonne, Held 5
12 103 Held, Petersen 12
13‒15 103 Held, Petersen,
Jeansonne
13‒15
Overall
Outcome
1‒6, 12‒15 8‒11

TIME PERIOD FOR RESPONSE
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R.
§ 1.136(a)(1)(iv).

AFFIRMED IN PART