Ex Parte 7,650,634 B2 et al

Patent Trial and Appeal Board

Jan 30, 2015

95002251 (P.T.A.B. Jan. 30, 2015)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
95/002,251 09/13/2012 7,650,634 B2 159291-0006(634PO) 8669
29000 7590 01/30/2015
IRELL & MANELLA LLP
1800 AVENUE OF THE STARS
SUITE 900
LOS ANGELES, CA 90067
EXAMINER
HENEGHAN, MATTHEW E
ART UNIT PAPER NUMBER
3992
MAIL DATE DELIVERY MODE
01/30/2015 PAPER
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE PATENT TRIAL AND APPEAL BOARD
____________

PALO ALTO NETWORKS, INC.
Third Party Requester and Appellant

v.

JUNIPER NETWORKS, INC.
Patent Owner and Respondent
____________

Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634
Technology Center 3900
____________

Before ANDREW J. DILLON, JENNIFER L. McKEOWN, and
IRVIN E. BRANCH, Administrative Patent Judges.

McKEOWN, Administrative Patent Judge.

DECISION ON APPEAL

Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

2
Third Party Requester Palo Alto Networks, Inc. (“Requester”) appeals
under 35 U.S.C. §§ 134 and 315 the Examiner’s decision to confirm
claims 1–41.
1
Patent Owner Juniper Networks, Inc. (“Patent Owner”)
responds to the Requester’s appeal.
2
We have jurisdiction under 35 U.S.C.
§§ 134 and 315.
We reverse, and newly reject claims 1–41 pursuit to 37 C.F.R.
§ 41.77(b).

STATEMENT OF THE CASE
United States Patent 7,650,634 (hereinafter the “’634 Patent”), issued
to Nir Zuk on Jan. 19, 2010, is the subject of the current inter partes
reexamination.
The ’634 Patent is the subject of the civil action, Juniper Networks,
Inc. v. Palo Alto Networks, Inc., No.1:11-cv-01258 (D. Del.). See TPR App.
Br. 2.

THE INVENTION
The invention generally relates to a method that receives a data
packet, examines the data packet, determines a single flow record associated
with the packet and extracts flow instructions for two or more devices from
the single flow record. ’634 Patent, Abstract. “The present invention

1
See Requester’s Appeal Brief, filed December 23, 2013 (“TPR App. Br.”),
at 5–6; Examiner’s Answer, mailed May 21, 2014, incorporating by
reference the Examiner’s Right of Appeal Notice, mailed
September 24, 2013 (“RAN”).
2
See Patent Owner’s Corrected Response, filed March 5, 2014 (“PO Resp.
Br.”).
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

3
provides methods and apparatus, including computer program products, for
processing data packets and for implementing computer network security.”
’634 Patent, col. 2, ll. 12–15.
Claim 1, which is illustrative of the appealed subject matter and has
not been amended during reexamination, reads as follows:
1. (Original) A method for inspecting data packets
associated with a flow in a computer network, the computer
network including two or more security devices for processing
the data packets, each data packet having associated header
data, the method comprising:
receiving the data packet;
examining the data packet;
determining a single flow record associated with the data
packet, where the determining includes:
determining a packet identifier using at least the
associated header data;
evaluating a flow table for a matching flow record entry
using the packet identifier;
when there is a matching flow record entry, retrieving the
matching flow record;
when there is no matching flow record entry, creating a
new flow record; and storing the new flow record in the flow
table;
extracting flow instructions, a session ID and flow
information, for the two or more security devices, from the
single flow record and forwarding the flow instructions, the
session ID and the flow information to the respective ones of
the two or more security devices to facilitate processing of the
data packet;
receiving, from each of the two or more security devices,
evaluation information, the evaluation information being
generated by a respective one of the two or more security
devices when processing the data packet; and

Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

4
processing the data packet using the evaluation
information.
App. Br., Claims App’x.

PRIOR ART REJECTIONS
The Requester relies on the following references:
Kirby US 5,898,784 Apr. 27, 1999
Albert US 6,704,278 Mar. 9, 2004
(filed July 2, 1999)
Ackerman US 60/235,281 filed Sep. 25, 2000
Ferguson US 2002/0059424 May. 16, 2002

Requester also relies on the Declaration of Gil Tene, dated
April 3, 2013 (“Tene Decl.”), and Declaration of Edward Curt Kersey, dated
April 3, 2013 (“Kersey Decl”). See TPR App. Br. 8–9.
Patent Owner relies on the Declaration of Mark Albert, dated
March 3, 2013 (“Albert Decl.”), the Declaration of AJ Beaverson, dated
March 3, 213 (“Beaverson Decl.”), and the Declaration of Bernhard Plattner,
dated March 4, 2013 (“Plattner Decl.”). See PO Resp. Br. 1.
Requester contends that the Examiner erred in not adopting the
following rejections:
1. The rejection of claims 1–41 under 35 U.S.C. §102(e) as being
anticipated by Albert.
2. The rejection of claims 14 and 32 under 35 U.S.C. §103(a) as
unpatentable over Albert and Kirby.
3. The rejection of claims 1–41 under 35 U.S.C. §103(a) as
unpatentable over Ackerman and Ferguson.
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

5
4. The rejection of claims 14 and 32 under 35 U.S.C. §103(a) as
unpatentable over Ackerman, Ferguson, and Kirby.

ISSUES
1. Did the Examiner err by not adopting the rejection of claims 1–41
under 35 U.S.C. §102(e) as being anticipated by Albert?
2. Did the Examiner err by not adopting the rejections of claims 1–41
under 35 U.S.C. §103(a) as being unpatentable over the cited combination of
references?

ANALYSIS
THE ANTICIPATION REJECTION OVER ALBERT
Claims 1–41
Based on the record before us, we are not persuaded that the Examiner
erred by not adopting the proposed rejection of claims 1–41 as anticipated
by Albert.
Requester contends that the Examiner erred by finding that “Albert
did not disclose flow records that relate to a plurality of security devices.”
TPR App. Br. 18. Specifically, Requester maintains that Albert discloses
sending a fixed affinity to multiple forwarding agents (i.e. security devices).
TPR App. Br. 19. Requester, for example, relies on Albert’s disclosure that
“[o]nce a service manager determines how a certain flow is to be handled,
the service manager sends a fixed affinity to each forwarding agent.”
Albert, col. 8, ll. 19–21.
On the other hand, Patent Owner asserts that while Albert may
forward flow data, Requester “never identifies any disclosure in Albert
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

6
involving flow data that is forwarded to multiple security devices to
facilitate processing of the single data packet.” PO Resp. Br. 6. Further,
Patent Owner maintains that “[s]imply forwarding flow data to two different
forwarding agents is insufficient where (as in Albert) the second forwarding
agent never processes the first data packet, but instead processes a second,
different data packet.” PO Resp. Br. 6.
We agree with the Patent Owner. The independent claims here
require two or more security devices to evaluate and return evaluation
information for the same data packet. See PO Resp. Br. 2, 5. Albert though
only discloses sending a fixed affinity to a forwarding agent (security
device) for processing a single data packet. PO Resp. Br. 5.
While column 8, lines 1–21 does describe sending the fixed affinity to
each forwarding agent, we agree with the Patent Owner that this refers to the
general procedure of providing the fixed affinity to each forwarding agent
over time in response to different data packets. See PO Resp. 7. In other
words, the fixed affinity is transmitted to a first forwarding agent when
processing a first data packet. Then, the same fixed affinity may be
transmitted to another forwarding agent in response to receiving a different
data packet from the same flow. See, e.g., PO Resp. 7; Albert col. 13, ll. 47–
col. 14, ll. 51 (explaining that when a forwarding agent receives a data
packet from a flow that was previously processed by a different forwarding
agent, the forwarding agent does not yet have the fixed affinity and must
recognize the wildcard match and send the packet to the service manager to
then receive the fixed affinity in return).
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

7
Accordingly, we see no error in the Examiner’s decision not to adopt
the proposed rejection of claims 1–41 under 35 U.S.C. §102(e) as
anticipated by Albert.

THE OBVIOUSNESS REJECTION OVER ALBERT AND KIRBY
Claims 14 and 32
Similarly, we are not persuaded that the Examiner erred by not
adopting the proposed rejection of claims 14 and 32 as unpatentable over
Albert and Kirby. Requester relies on Kirby for teaching encryption
parameters included in a single flow record. See e.g., TPR App. Br. 31–32.
As discussed above, we agree with Patent Owner that Albert fails to disclose
the limitations of independent claims 1 and 19. Kirby does not cure the
deficiencies of Albert. As such, we also agree that the Examiner correctly
decided not to adopt the proposed rejection of claims 14 and 32, which
depend from claim 1 and claim 19, respectively. We therefore affirm the
Examiner’s decision not to adopt the proposed rejection as to these claims.

THE OBVIOUSNESS REJECTION OVER ACKERMON AND FERGUSON
Claims 1–41
We are persuaded that the Examiner erred by not adopting the
proposed rejection of claims 1–41 under 35 U.S.C. §103(a) as unpatentable
in view of Ackerman and Ferguson.
According to the Examiner, the combination of Ackerman and
Ferguson “only discloses a flow record that designates a single security
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

8
device in a flow record and only would produce an evaluation from one such
device.” RAN 6. The Examiner explains that,
[f]urther regarding Ackerman in view of Ferguson, it is
important to note that in both references, the plurality of
security devices disclosed in those references only appear to be
present due to the need for redundancy. It is agreed with the
Patent Owner that the flow records are only specific to a single
security device, rather than to two or more security devices, and
that instructions from such a record are only being transmitted
to additional security devices in the context of that redundancy.
In practice, the duplicates are sent to redundant units that are
simply in a standby mode. Given that only one such security
device should even be active, it would therefore follow that
only one security device would respond with evaluation
information.
RAN 9; see also RAN 7 (finding that “in Ackerman in view of Ferguson,
only one active security device is present, plus redundant backups, and only
one of these devices actually processes the packet as per the claim
language.”). As such, we understand that the Examiner’s decision relies on
the premise that both Ferguson and Ackerman teach only one active security
device to process data.
Notably, this analysis fails to consider Ferguson’s express teaching of
multiple active Flow Processor Modules (FPMs) and of multiple FPMs
processing the same data. TPR App. Br. 35–36 (citing, for example,
Ferguson ¶¶14 and 42). While we recognize that Ferguson generally
describes selecting a FPM (i.e. a security device) to perform processing,
Ferguson also, as Requester points out, expressly teaches multiple FPMs
(i.e. two or more security devices) processing the same data. Specifically,
Ferguson discloses,
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

9
[i]n another example, data received by the [Network Processor
Module (NPM)] 14 can be processed by multiple FPMs 22,
wherein the data can be forwarded to the multiple FPMs 22
through the NPM 14, and returned to the NPM 14 for
forwarding to a destination.
Ferguson, ¶42 (emphasis added); see also TPR Resp. Br. 35–36; Ferguson,
¶44 (noting that the NPM may forward data to “one or more FPMs” for
processing before being forwarded to the storage devices while discussing
the storage features of the system); Ferguson, Abstract (describing that the
front-end processor identifies “at least one internal applications processor to
process the request/flow.”).
We also disagree that the narrow reading that the plurality of security
devices are present solely for redundancy. Instead, Ferguson generally is
directed to “increased efficiency of data flow processing” and “improved
flow scheduling methods and systems for multiple processors.” Ferguson,
¶3. Ferguson contemplates a system that “utilizes intrinsic rather than
extrinsic data from a multiplicity of processors to determine an efficient
algorithm for distributing flows to the processors.” Ferguson, ¶7. These
teachings do not support the Examiner’s finding that the plurality of FPMs is
solely for redundancy.
Patent Owner does not dispute that Ferguson’s paragraph 42 teaches
multiple FPMs processing a data packet. See PO Resp. Br. 17–18 (quoting
paragraph 42 of Ferguson and then discussing that “Ferguson provides no
further detail on how it would operate. . . .”). Instead, Patent Owner
challenges the combination, asserting that a skilled artisan would not be
motivated to combine the references. “Requester simply failed to present
any evidence suggesting a motivation to modify the intricate system
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

10
disclosed in Ackerman's hundreds of pages in accordance with this single
unexplained sentence from Ferguson.” PO Resp. Br. 18.
We disagree. As the Requester points out, Ferguson claims priority to
Ackerman and incorporates Ackerman by reference. TPR App. Br. 37
(citing Ferguson ¶1). And the systems of Ackerman and Ferguson are
directed to at least a similar, if not the same, system. TPR App. Br. 37–38
(noting similarities between Ackerman and Ferguson disclosures).
Moreover, we agree with Requester that the combination of Ackerman and
Ferguson is a predictable combination of prior art elements.
Specifically, the incorporation by reference provides an explicit
“teaching” to combine, and one of ordinary skill in the art
would have been motivated to integrate Ackerman's system
with Ferguson's technique to implement a content-aware switch
for providing different applications for multiple subscribers that
is scalable, requires less overall memory, and has better flow
scheduling for multiple FPMs (also referred to as “applications
processors” in Ferguson).
TPR App. Br. 37.
We also find unconvincing Patent Owner’s argument that the cited
combination renders Ackerman inoperable for its intended purpose.
According to the Patent Owner, Ferguson’s teaching of processing the same
data packet by multiple processors interferes with the design goals of
processing efficiency and redundancy. See PO Resp. Br. 18–19 (citing the
Beaverson Decl. ¶¶ 9c–9d). This argument, however, lacks merit as
Ferguson is directed to the same goals. See Ferguson ¶¶ 3, 7, and 14. As
such, we agree with the Requester that the combined teachings of Ackerman
and Ferguson would have at least suggested the claimed limitations for the
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

11
two or more security devices. See In re Keller, 642 F.2d 413, 425 (CCPA
1981).
Similarly, we find unavailing Patent Owner’s argument that Ferguson
fails to teach generating or receiving evaluation information. See PO Resp.
Br. 19. Ackerman, at least, teaches this limitation. See TPR App. Br. 43
(referring to Ackerman’s explanation of including information to expedite
transmission of the packet).
3
One cannot show nonobviousness by attacking
references individually where the rejections are based on combinations of
references. See In re Keller, 642 F.2d 413, 426 (CCPA 1981); In re Merck
& Co., Inc., 800 F.2d 1091, 1097 (Fed. Cir. 1986).
We also find Patent Owner’s additional arguments with respect to
claims 5–9, 12–15, 23–27, 30–33, and 41 unpersuasive. See PO Resp. Br.
22–24. More specifically, with respect to claims 6–8 and 24–26, as the
Requester points out, Ackerman teaches assessing VFP processing
capabilities and VFP load balancing information to select a VFP to forward
the packet and creating a new entry in the Active Flow Table. See Request
CC-C-21–25. These teachings at least suggest that the processing
capabilities and/or VFP load information would be retrieved from the VFPs
and be used in creating a new entry with new instructions. Ackerman
additionally teaches using a session ID (e.g. hash key) for flow entries. See
Request CC-C-24–25. As such, we agree with the Requester that the claims
6–8 and 24-26 are obvious in view of Ackerman and Ferguson.

3
We disagree with the Requester that the claim merely requires transmitting
to and receiving from only one security device. See TPR App. 43. Instead,
we agree with the Patent Owner that the claims require transmitting to and
receiving from at least two security devices.
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

12
We are also convinced that the limitations of claims 5, 12–15, 23, 30–
33, and 41 are similarly obvious. Namely, Ackerman and/or Ferguson teach
the claimed limitations of these dependent claims. See Request CC-C-20–
21, 28–31. For example, Ackerman teaches obtaining data packet memory
location information and relative position within the flow information (claim
5), policy information (claim 12), such as firewall and intrusion prevention
system policies (claim 13), encryption parameters (claim 14) and address
translation parameters (claim 15). See Request CC-C-20–21, 28–31.
Similarly, Ferguson at least describes storing policy information. See
Request CC-C-20–21, 28–31. As such, we agree with the Requester that the
claims 5, 12–15, 23, 30–33, and 41 are obvious in view of Ackerman and
Ferguson.
Further, we are persuaded that the Examiner erred in not adopting the
rejection of claims 9 and 27 for the same reasons as discussed above.
Namely, we are persuaded that together, Ackerman and Ferguson teach the
claimed two or more security device limitations. See TPR App. Br. 46, 49;
see also Ferguson ¶42.
Accordingly, we find that the Examiner erred in not adopting the
proposed rejection of claims 1–41 as unpatentable over Ackerman and
Ferguson. Therefore, we reverse the Examiner’s decision and enter a new
ground of rejection pursuant to 37 C.F.R. § 41.77.

Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

13
THE OBVIOUSNESS REJECTION OVER ACKERMAN, FERGUSON, AND KIRBY
Claims 14 and 32
As discussed above, we agree with the Requester that the Examiner
erred in finding that Ackerman and Ferguson fail to teach the limitations of
independent claims 1 and 19. Patent Owner presents no separate arguments
with respect to Kirby. See PO Resp. Br. 24. For the same reasons as
discussed above then, we agree with the Requester that the Examiner erred
by not adopting the proposed rejection of claims 14 and 32 as unpatentable
over Ackerman, Ferguson, and Kirby. As such, we reverse the Examiner’s
decision and enter a new ground of rejection of claims 14 and 32 under
35 U.S.C. § 103(a) as unpatentable over Ackerman, Ferguson, and Kirby
pursuant to 37 C.F.R. § 44.77.

CONCLUSION
We are not persuaded that the Examiner erred in not adopting the
proposed rejection of claims 1–41 under 35 U.S.C. §102(b) as anticipated by
Albert. Accordingly, we sustain this rejection.
We are not persuaded that the Examiner erred in not adopting the
proposed rejection of claims 14 and 32 under 35 U.S.C. § 103(a) as
unpatentable over Albert and Kirby. Accordingly, we sustain this rejection.
We are persuaded that the Examiner erred in not adopting the
proposed rejection of claims 1–41 under 35 U.S.C. §103(a) as unpatentable
over Ackerman and Ferguson. Accordingly, we reverse the decision not to
adopt the proposed rejection of claims 1–41 and we enter a new ground of
rejection.
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

14
We are persuaded that the Examiner erred in not adopting the
proposed rejection of claims 14 and 32 under 35 U.S.C. §103(a) as
unpatentable over Ackerman, Ferguson, and Kirby. Accordingly, we reverse
this rejection and enter a new ground of rejection.

DECISION
The Examiner’s decision not to reject claims 1–41 over Albert is
affirmed.
The Examiner’s decision not to reject claims 14 and 32 over Albert
and Kirby is affirmed.
The Examiner’s decision not to reject claims 1–41 over Ackerman and
Ferguson is reversed and, pursuant to 37 C.F.R. §41.77, we enter a NEW
GROUND OF REJECTION.
The Examiner’s decision not to reject claims 14 and 32 over
Ackerman, Ferguson, and Kirby is reversed and, pursuant to 37 C.F.R.
§41.77, we enter a NEW GROUND OF REJECTION.

TIME PERIOD FOR RESPONSE
This decision contains new grounds of rejection pursuant to 37 C.F.R.
§ 41.77(b) which provides that "[a]ny decision which includes a new ground
of rejection pursuant to this paragraph shall not be considered final for
judicial review." Correspondingly, no portion of the decision is final for
purposes of judicial review. A requester may also request rehearing under
37 C.F.R. § 41.79, if appropriate, however, the Board may elect to defer
issuing any decision on such request for rehearing until such time that a final
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

15
decision on appeal has been issued by the Board. For further guidance on
new grounds of rejection, see 37 C.F.R. § 41.77(f).
Section 41.77(b) of Title 37 of the Code of Federal Regulations also
provides that the Owner, WITHIN ONE MONTH FROM THE DATE OF
THE DECISION, must exercise one of the following two options with
respect to the new grounds of rejection to avoid termination of the appeal as
to the rejected claims:
(1) Reopen prosecution. The owner may file a response requesting
reopening of prosecution before the examiner. Such a response must be
either an amendment of the claims so rejected or new evidence relating to
the claims so rejected, or both.
(2) Request rehearing. The owner may request that the proceeding be
reheard under § 41.79 by the Board upon the same record.
Any request to reopen prosecution before the examiner under
37 C.F.R. § 41.77(b)(1) shall be limited in scope to the "claims so rejected."
Accordingly, a request to reopen prosecution is limited to issues raised by
the new ground(s) of rejection entered by the Board. A request to reopen
prosecution that includes issues other than those raised by the new ground(s)
is unlikely to be granted.
Furthermore, should the Owner seek to substitute claims, there is a
presumption that only one substitute claim would be needed to replace a
cancelled claim.
A requester may file comments in reply to Owner response. 37 C.F.R.
§ 41.77(c). Requester comments under 37 C.F.R. § 41.77(c) shall be limited
Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

16
in scope to the issues raised by the Board's opinion reflecting its decision to
reject the claims and the Owner's response under paragraph 37 C.F.R.
§ 41.77(b)(I). A newly proposed rejection is not permitted as a matter of
right. A newly proposed rejection may be appropriate if it is presented to
address an amendment and/or new evidence properly submitted by the
Owner, and is presented with a brief explanation as to why the newly
proposed rejection is now necessary and why it could not have been
presented earlier.
Compliance with the page limits pursuant to 37 C.P.R. § 1.943(b), for
all Owner responses and requester comments, is required.
The examiner, after the Board's entry of Owner response and
requester comments, will issue a determination under 37 C.P.R. § 41.77(d)
as to whether the Board's rejection is maintained or has been overcome. The
proceeding will then be returned to the Board together with any comments
and reply submitted by the owner and/or requester under 37 C.P.R.§41.77(e)
for reconsideration and issuance of a new decision by the Board as provided
by 37 C.P.R. § 41.77(t).
Requests for extensions of time in this inter partes reexamination
proceeding are governed by 37 C.P.R. § 1.956. See 37 C.P.R. § 41.77(g).

REVERSED; 37 C.F.R. §41.77(b)

Appeal 2014-008889
Reexamination Control 95/002,251
Patent 7,650,634

17
PATENT OWNER:
Irelll & Manella LLP
1800 Avenue of the Stars
Suite 900
Los Angeles, CA 90067

THIRD-PARTY REQUESTER:

Van Pelt, Yi & James LLP
10050 N. Foothill Blvd.
Suite 200
Cupertino, CA 95014