Ex Parte 7,650,634 B2 et alDownload PDFPatent Trial and Appeal BoardJan 30, 201595002251 (P.T.A.B. Jan. 30, 2015) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 95/002,251 09/13/2012 7,650,634 B2 159291-0006(634PO) 8669 29000 7590 01/30/2015 IRELL & MANELLA LLP 1800 AVENUE OF THE STARS SUITE 900 LOS ANGELES, CA 90067 EXAMINER HENEGHAN, MATTHEW E ART UNIT PAPER NUMBER 3992 MAIL DATE DELIVERY MODE 01/30/2015 PAPER Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE PATENT TRIAL AND APPEAL BOARD ____________ PALO ALTO NETWORKS, INC. Third Party Requester and Appellant v. JUNIPER NETWORKS, INC. Patent Owner and Respondent ____________ Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 Technology Center 3900 ____________ Before ANDREW J. DILLON, JENNIFER L. McKEOWN, and IRVIN E. BRANCH, Administrative Patent Judges. McKEOWN, Administrative Patent Judge. DECISION ON APPEAL Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 2 Third Party Requester Palo Alto Networks, Inc. (“Requester”) appeals under 35 U.S.C. §§ 134 and 315 the Examiner’s decision to confirm claims 1–41. 1 Patent Owner Juniper Networks, Inc. (“Patent Owner”) responds to the Requester’s appeal. 2 We have jurisdiction under 35 U.S.C. §§ 134 and 315. We reverse, and newly reject claims 1–41 pursuit to 37 C.F.R. § 41.77(b). STATEMENT OF THE CASE United States Patent 7,650,634 (hereinafter the “’634 Patent”), issued to Nir Zuk on Jan. 19, 2010, is the subject of the current inter partes reexamination. The ’634 Patent is the subject of the civil action, Juniper Networks, Inc. v. Palo Alto Networks, Inc., No.1:11-cv-01258 (D. Del.). See TPR App. Br. 2. THE INVENTION The invention generally relates to a method that receives a data packet, examines the data packet, determines a single flow record associated with the packet and extracts flow instructions for two or more devices from the single flow record. ’634 Patent, Abstract. “The present invention 1 See Requester’s Appeal Brief, filed December 23, 2013 (“TPR App. Br.”), at 5–6; Examiner’s Answer, mailed May 21, 2014, incorporating by reference the Examiner’s Right of Appeal Notice, mailed September 24, 2013 (“RAN”). 2 See Patent Owner’s Corrected Response, filed March 5, 2014 (“PO Resp. Br.”). Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 3 provides methods and apparatus, including computer program products, for processing data packets and for implementing computer network security.” ’634 Patent, col. 2, ll. 12–15. Claim 1, which is illustrative of the appealed subject matter and has not been amended during reexamination, reads as follows: 1. (Original) A method for inspecting data packets associated with a flow in a computer network, the computer network including two or more security devices for processing the data packets, each data packet having associated header data, the method comprising: receiving the data packet; examining the data packet; determining a single flow record associated with the data packet, where the determining includes: determining a packet identifier using at least the associated header data; evaluating a flow table for a matching flow record entry using the packet identifier; when there is a matching flow record entry, retrieving the matching flow record; when there is no matching flow record entry, creating a new flow record; and storing the new flow record in the flow table; extracting flow instructions, a session ID and flow information, for the two or more security devices, from the single flow record and forwarding the flow instructions, the session ID and the flow information to the respective ones of the two or more security devices to facilitate processing of the data packet; receiving, from each of the two or more security devices, evaluation information, the evaluation information being generated by a respective one of the two or more security devices when processing the data packet; and Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 4 processing the data packet using the evaluation information. App. Br., Claims App’x. PRIOR ART REJECTIONS The Requester relies on the following references: Kirby US 5,898,784 Apr. 27, 1999 Albert US 6,704,278 Mar. 9, 2004 (filed July 2, 1999) Ackerman US 60/235,281 filed Sep. 25, 2000 Ferguson US 2002/0059424 May. 16, 2002 Requester also relies on the Declaration of Gil Tene, dated April 3, 2013 (“Tene Decl.”), and Declaration of Edward Curt Kersey, dated April 3, 2013 (“Kersey Decl”). See TPR App. Br. 8–9. Patent Owner relies on the Declaration of Mark Albert, dated March 3, 2013 (“Albert Decl.”), the Declaration of AJ Beaverson, dated March 3, 213 (“Beaverson Decl.”), and the Declaration of Bernhard Plattner, dated March 4, 2013 (“Plattner Decl.”). See PO Resp. Br. 1. Requester contends that the Examiner erred in not adopting the following rejections: 1. The rejection of claims 1–41 under 35 U.S.C. §102(e) as being anticipated by Albert. 2. The rejection of claims 14 and 32 under 35 U.S.C. §103(a) as unpatentable over Albert and Kirby. 3. The rejection of claims 1–41 under 35 U.S.C. §103(a) as unpatentable over Ackerman and Ferguson. Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 5 4. The rejection of claims 14 and 32 under 35 U.S.C. §103(a) as unpatentable over Ackerman, Ferguson, and Kirby. ISSUES 1. Did the Examiner err by not adopting the rejection of claims 1–41 under 35 U.S.C. §102(e) as being anticipated by Albert? 2. Did the Examiner err by not adopting the rejections of claims 1–41 under 35 U.S.C. §103(a) as being unpatentable over the cited combination of references? ANALYSIS THE ANTICIPATION REJECTION OVER ALBERT Claims 1–41 Based on the record before us, we are not persuaded that the Examiner erred by not adopting the proposed rejection of claims 1–41 as anticipated by Albert. Requester contends that the Examiner erred by finding that “Albert did not disclose flow records that relate to a plurality of security devices.” TPR App. Br. 18. Specifically, Requester maintains that Albert discloses sending a fixed affinity to multiple forwarding agents (i.e. security devices). TPR App. Br. 19. Requester, for example, relies on Albert’s disclosure that “[o]nce a service manager determines how a certain flow is to be handled, the service manager sends a fixed affinity to each forwarding agent.” Albert, col. 8, ll. 19–21. On the other hand, Patent Owner asserts that while Albert may forward flow data, Requester “never identifies any disclosure in Albert Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 6 involving flow data that is forwarded to multiple security devices to facilitate processing of the single data packet.” PO Resp. Br. 6. Further, Patent Owner maintains that “[s]imply forwarding flow data to two different forwarding agents is insufficient where (as in Albert) the second forwarding agent never processes the first data packet, but instead processes a second, different data packet.” PO Resp. Br. 6. We agree with the Patent Owner. The independent claims here require two or more security devices to evaluate and return evaluation information for the same data packet. See PO Resp. Br. 2, 5. Albert though only discloses sending a fixed affinity to a forwarding agent (security device) for processing a single data packet. PO Resp. Br. 5. While column 8, lines 1–21 does describe sending the fixed affinity to each forwarding agent, we agree with the Patent Owner that this refers to the general procedure of providing the fixed affinity to each forwarding agent over time in response to different data packets. See PO Resp. 7. In other words, the fixed affinity is transmitted to a first forwarding agent when processing a first data packet. Then, the same fixed affinity may be transmitted to another forwarding agent in response to receiving a different data packet from the same flow. See, e.g., PO Resp. 7; Albert col. 13, ll. 47– col. 14, ll. 51 (explaining that when a forwarding agent receives a data packet from a flow that was previously processed by a different forwarding agent, the forwarding agent does not yet have the fixed affinity and must recognize the wildcard match and send the packet to the service manager to then receive the fixed affinity in return). Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 7 Accordingly, we see no error in the Examiner’s decision not to adopt the proposed rejection of claims 1–41 under 35 U.S.C. §102(e) as anticipated by Albert. THE OBVIOUSNESS REJECTION OVER ALBERT AND KIRBY Claims 14 and 32 Similarly, we are not persuaded that the Examiner erred by not adopting the proposed rejection of claims 14 and 32 as unpatentable over Albert and Kirby. Requester relies on Kirby for teaching encryption parameters included in a single flow record. See e.g., TPR App. Br. 31–32. As discussed above, we agree with Patent Owner that Albert fails to disclose the limitations of independent claims 1 and 19. Kirby does not cure the deficiencies of Albert. As such, we also agree that the Examiner correctly decided not to adopt the proposed rejection of claims 14 and 32, which depend from claim 1 and claim 19, respectively. We therefore affirm the Examiner’s decision not to adopt the proposed rejection as to these claims. THE OBVIOUSNESS REJECTION OVER ACKERMON AND FERGUSON Claims 1–41 We are persuaded that the Examiner erred by not adopting the proposed rejection of claims 1–41 under 35 U.S.C. §103(a) as unpatentable in view of Ackerman and Ferguson. According to the Examiner, the combination of Ackerman and Ferguson “only discloses a flow record that designates a single security Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 8 device in a flow record and only would produce an evaluation from one such device.” RAN 6. The Examiner explains that, [f]urther regarding Ackerman in view of Ferguson, it is important to note that in both references, the plurality of security devices disclosed in those references only appear to be present due to the need for redundancy. It is agreed with the Patent Owner that the flow records are only specific to a single security device, rather than to two or more security devices, and that instructions from such a record are only being transmitted to additional security devices in the context of that redundancy. In practice, the duplicates are sent to redundant units that are simply in a standby mode. Given that only one such security device should even be active, it would therefore follow that only one security device would respond with evaluation information. RAN 9; see also RAN 7 (finding that “in Ackerman in view of Ferguson, only one active security device is present, plus redundant backups, and only one of these devices actually processes the packet as per the claim language.”). As such, we understand that the Examiner’s decision relies on the premise that both Ferguson and Ackerman teach only one active security device to process data. Notably, this analysis fails to consider Ferguson’s express teaching of multiple active Flow Processor Modules (FPMs) and of multiple FPMs processing the same data. TPR App. Br. 35–36 (citing, for example, Ferguson ¶¶14 and 42). While we recognize that Ferguson generally describes selecting a FPM (i.e. a security device) to perform processing, Ferguson also, as Requester points out, expressly teaches multiple FPMs (i.e. two or more security devices) processing the same data. Specifically, Ferguson discloses, Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 9 [i]n another example, data received by the [Network Processor Module (NPM)] 14 can be processed by multiple FPMs 22, wherein the data can be forwarded to the multiple FPMs 22 through the NPM 14, and returned to the NPM 14 for forwarding to a destination. Ferguson, ¶42 (emphasis added); see also TPR Resp. Br. 35–36; Ferguson, ¶44 (noting that the NPM may forward data to “one or more FPMs” for processing before being forwarded to the storage devices while discussing the storage features of the system); Ferguson, Abstract (describing that the front-end processor identifies “at least one internal applications processor to process the request/flow.”). We also disagree that the narrow reading that the plurality of security devices are present solely for redundancy. Instead, Ferguson generally is directed to “increased efficiency of data flow processing” and “improved flow scheduling methods and systems for multiple processors.” Ferguson, ¶3. Ferguson contemplates a system that “utilizes intrinsic rather than extrinsic data from a multiplicity of processors to determine an efficient algorithm for distributing flows to the processors.” Ferguson, ¶7. These teachings do not support the Examiner’s finding that the plurality of FPMs is solely for redundancy. Patent Owner does not dispute that Ferguson’s paragraph 42 teaches multiple FPMs processing a data packet. See PO Resp. Br. 17–18 (quoting paragraph 42 of Ferguson and then discussing that “Ferguson provides no further detail on how it would operate. . . .”). Instead, Patent Owner challenges the combination, asserting that a skilled artisan would not be motivated to combine the references. “Requester simply failed to present any evidence suggesting a motivation to modify the intricate system Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 10 disclosed in Ackerman's hundreds of pages in accordance with this single unexplained sentence from Ferguson.” PO Resp. Br. 18. We disagree. As the Requester points out, Ferguson claims priority to Ackerman and incorporates Ackerman by reference. TPR App. Br. 37 (citing Ferguson ¶1). And the systems of Ackerman and Ferguson are directed to at least a similar, if not the same, system. TPR App. Br. 37–38 (noting similarities between Ackerman and Ferguson disclosures). Moreover, we agree with Requester that the combination of Ackerman and Ferguson is a predictable combination of prior art elements. Specifically, the incorporation by reference provides an explicit “teaching” to combine, and one of ordinary skill in the art would have been motivated to integrate Ackerman's system with Ferguson's technique to implement a content-aware switch for providing different applications for multiple subscribers that is scalable, requires less overall memory, and has better flow scheduling for multiple FPMs (also referred to as “applications processors” in Ferguson). TPR App. Br. 37. We also find unconvincing Patent Owner’s argument that the cited combination renders Ackerman inoperable for its intended purpose. According to the Patent Owner, Ferguson’s teaching of processing the same data packet by multiple processors interferes with the design goals of processing efficiency and redundancy. See PO Resp. Br. 18–19 (citing the Beaverson Decl. ¶¶ 9c–9d). This argument, however, lacks merit as Ferguson is directed to the same goals. See Ferguson ¶¶ 3, 7, and 14. As such, we agree with the Requester that the combined teachings of Ackerman and Ferguson would have at least suggested the claimed limitations for the Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 11 two or more security devices. See In re Keller, 642 F.2d 413, 425 (CCPA 1981). Similarly, we find unavailing Patent Owner’s argument that Ferguson fails to teach generating or receiving evaluation information. See PO Resp. Br. 19. Ackerman, at least, teaches this limitation. See TPR App. Br. 43 (referring to Ackerman’s explanation of including information to expedite transmission of the packet). 3 One cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 426 (CCPA 1981); In re Merck & Co., Inc., 800 F.2d 1091, 1097 (Fed. Cir. 1986). We also find Patent Owner’s additional arguments with respect to claims 5–9, 12–15, 23–27, 30–33, and 41 unpersuasive. See PO Resp. Br. 22–24. More specifically, with respect to claims 6–8 and 24–26, as the Requester points out, Ackerman teaches assessing VFP processing capabilities and VFP load balancing information to select a VFP to forward the packet and creating a new entry in the Active Flow Table. See Request CC-C-21–25. These teachings at least suggest that the processing capabilities and/or VFP load information would be retrieved from the VFPs and be used in creating a new entry with new instructions. Ackerman additionally teaches using a session ID (e.g. hash key) for flow entries. See Request CC-C-24–25. As such, we agree with the Requester that the claims 6–8 and 24-26 are obvious in view of Ackerman and Ferguson. 3 We disagree with the Requester that the claim merely requires transmitting to and receiving from only one security device. See TPR App. 43. Instead, we agree with the Patent Owner that the claims require transmitting to and receiving from at least two security devices. Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 12 We are also convinced that the limitations of claims 5, 12–15, 23, 30– 33, and 41 are similarly obvious. Namely, Ackerman and/or Ferguson teach the claimed limitations of these dependent claims. See Request CC-C-20– 21, 28–31. For example, Ackerman teaches obtaining data packet memory location information and relative position within the flow information (claim 5), policy information (claim 12), such as firewall and intrusion prevention system policies (claim 13), encryption parameters (claim 14) and address translation parameters (claim 15). See Request CC-C-20–21, 28–31. Similarly, Ferguson at least describes storing policy information. See Request CC-C-20–21, 28–31. As such, we agree with the Requester that the claims 5, 12–15, 23, 30–33, and 41 are obvious in view of Ackerman and Ferguson. Further, we are persuaded that the Examiner erred in not adopting the rejection of claims 9 and 27 for the same reasons as discussed above. Namely, we are persuaded that together, Ackerman and Ferguson teach the claimed two or more security device limitations. See TPR App. Br. 46, 49; see also Ferguson ¶42. Accordingly, we find that the Examiner erred in not adopting the proposed rejection of claims 1–41 as unpatentable over Ackerman and Ferguson. Therefore, we reverse the Examiner’s decision and enter a new ground of rejection pursuant to 37 C.F.R. § 41.77. Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 13 THE OBVIOUSNESS REJECTION OVER ACKERMAN, FERGUSON, AND KIRBY Claims 14 and 32 As discussed above, we agree with the Requester that the Examiner erred in finding that Ackerman and Ferguson fail to teach the limitations of independent claims 1 and 19. Patent Owner presents no separate arguments with respect to Kirby. See PO Resp. Br. 24. For the same reasons as discussed above then, we agree with the Requester that the Examiner erred by not adopting the proposed rejection of claims 14 and 32 as unpatentable over Ackerman, Ferguson, and Kirby. As such, we reverse the Examiner’s decision and enter a new ground of rejection of claims 14 and 32 under 35 U.S.C. § 103(a) as unpatentable over Ackerman, Ferguson, and Kirby pursuant to 37 C.F.R. § 44.77. CONCLUSION We are not persuaded that the Examiner erred in not adopting the proposed rejection of claims 1–41 under 35 U.S.C. §102(b) as anticipated by Albert. Accordingly, we sustain this rejection. We are not persuaded that the Examiner erred in not adopting the proposed rejection of claims 14 and 32 under 35 U.S.C. § 103(a) as unpatentable over Albert and Kirby. Accordingly, we sustain this rejection. We are persuaded that the Examiner erred in not adopting the proposed rejection of claims 1–41 under 35 U.S.C. §103(a) as unpatentable over Ackerman and Ferguson. Accordingly, we reverse the decision not to adopt the proposed rejection of claims 1–41 and we enter a new ground of rejection. Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 14 We are persuaded that the Examiner erred in not adopting the proposed rejection of claims 14 and 32 under 35 U.S.C. §103(a) as unpatentable over Ackerman, Ferguson, and Kirby. Accordingly, we reverse this rejection and enter a new ground of rejection. DECISION The Examiner’s decision not to reject claims 1–41 over Albert is affirmed. The Examiner’s decision not to reject claims 14 and 32 over Albert and Kirby is affirmed. The Examiner’s decision not to reject claims 1–41 over Ackerman and Ferguson is reversed and, pursuant to 37 C.F.R. §41.77, we enter a NEW GROUND OF REJECTION. The Examiner’s decision not to reject claims 14 and 32 over Ackerman, Ferguson, and Kirby is reversed and, pursuant to 37 C.F.R. §41.77, we enter a NEW GROUND OF REJECTION. TIME PERIOD FOR RESPONSE This decision contains new grounds of rejection pursuant to 37 C.F.R. § 41.77(b) which provides that "[a]ny decision which includes a new ground of rejection pursuant to this paragraph shall not be considered final for judicial review." Correspondingly, no portion of the decision is final for purposes of judicial review. A requester may also request rehearing under 37 C.F.R. § 41.79, if appropriate, however, the Board may elect to defer issuing any decision on such request for rehearing until such time that a final Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 15 decision on appeal has been issued by the Board. For further guidance on new grounds of rejection, see 37 C.F.R. § 41.77(f). Section 41.77(b) of Title 37 of the Code of Federal Regulations also provides that the Owner, WITHIN ONE MONTH FROM THE DATE OF THE DECISION, must exercise one of the following two options with respect to the new grounds of rejection to avoid termination of the appeal as to the rejected claims: (1) Reopen prosecution. The owner may file a response requesting reopening of prosecution before the examiner. Such a response must be either an amendment of the claims so rejected or new evidence relating to the claims so rejected, or both. (2) Request rehearing. The owner may request that the proceeding be reheard under § 41.79 by the Board upon the same record. Any request to reopen prosecution before the examiner under 37 C.F.R. § 41.77(b)(1) shall be limited in scope to the "claims so rejected." Accordingly, a request to reopen prosecution is limited to issues raised by the new ground(s) of rejection entered by the Board. A request to reopen prosecution that includes issues other than those raised by the new ground(s) is unlikely to be granted. Furthermore, should the Owner seek to substitute claims, there is a presumption that only one substitute claim would be needed to replace a cancelled claim. A requester may file comments in reply to Owner response. 37 C.F.R. § 41.77(c). Requester comments under 37 C.F.R. § 41.77(c) shall be limited Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 16 in scope to the issues raised by the Board's opinion reflecting its decision to reject the claims and the Owner's response under paragraph 37 C.F.R. § 41.77(b)(I). A newly proposed rejection is not permitted as a matter of right. A newly proposed rejection may be appropriate if it is presented to address an amendment and/or new evidence properly submitted by the Owner, and is presented with a brief explanation as to why the newly proposed rejection is now necessary and why it could not have been presented earlier. Compliance with the page limits pursuant to 37 C.P.R. § 1.943(b), for all Owner responses and requester comments, is required. The examiner, after the Board's entry of Owner response and requester comments, will issue a determination under 37 C.P.R. § 41.77(d) as to whether the Board's rejection is maintained or has been overcome. The proceeding will then be returned to the Board together with any comments and reply submitted by the owner and/or requester under 37 C.P.R.§41.77(e) for reconsideration and issuance of a new decision by the Board as provided by 37 C.P.R. § 41.77(t). Requests for extensions of time in this inter partes reexamination proceeding are governed by 37 C.P.R. § 1.956. See 37 C.P.R. § 41.77(g). REVERSED; 37 C.F.R. §41.77(b) Appeal 2014-008889 Reexamination Control 95/002,251 Patent 7,650,634 17 PATENT OWNER: Irelll & Manella LLP 1800 Avenue of the Stars Suite 900 Los Angeles, CA 90067 THIRD-PARTY REQUESTER: Van Pelt, Yi & James LLP 10050 N. Foothill Blvd. Suite 200 Cupertino, CA 95014 Copy with citationCopy as parenthetical citation