Ex Parte Choi et al

Patent Trial and Appeal Board

Jul 29, 2016

13345991 (P.T.A.B. Jul. 29, 2016)

UNITED STA TES p A TENT AND TRADEMARK OFFICE
APPLICATION NO. FILING DATE
13/345,991 01109/2012
63400 7590 08/02/2016
IBM CORP, (DHJ)
c/o DAVID H. JUDSON
15950DALLAS PARKWAY
SUITE 225
DALLAS, TX 75248
FIRST NAMED INVENTOR
Christopher Y oung-Soo Choi
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www .uspto.gov
ATTORNEY DOCKET NO. CONFIRMATION NO.
AU920110021US1 1024
EXAMINER
DINH, MINH
ART UNIT PAPER NUMBER
2437
NOTIFICATION DATE DELIVERY MODE
08/02/2016 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address( es):
mail@davidjudson.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte CHRISTOPHER YOUNG-SQQ CHOI and
NEIL IAN READSHA W 1
Appeal2015-0019342
Application 13/345,991
Technology Center 2400
Before THU A. DANG, ERIC S. FRAHM, and
JAMES W. DEJMEK, Administrative Patent Judges.
DEJMEK, Administrative Patent Judge.
DECISION ON APPEAL
Appellants appeal under 35 U.S.C. § 134(a) from the Final Rejection
of claims 9-26. Claims 1-8 have been canceled. App. Br. 1. We have
jurisdiction over the remaining pending claims under 35 U.S.C. § 6(b ).
We affirm.
1 Appellants identify International Business Machines Corporation as the
real party in interest. App. Br. 1.
2 This appeal is related to an appeal of co-pending application 13/660,357
(Appeal No. 2015-001960).
Appeal2015-001934
Application 13/345,991
STATEMENT OF THE CASE
Introduction
Appellants' invention is directed to "security policy management for
information technology (IT) systems." Spec. 1. In particular, incident data
about the IT security system is collected by an incident management system
is fed back to a security analytics system, which analyzes the incident data to
make or recommend changes to one or more security policies. Spec. 3.
According to the Specification, the use of incident data as disclosed allows
for a more efficient and optimized approach to managing a policy-based IT
security system. Spec. 22.
Claim 9 is representative of the subject matter on appeal and is
reproduced below with the disputed limitations emphasized in italics:
9. Apparatus, comprising:
a processor;
computer memory holding computer program instructions
that when executed by the processor perform a method to manage
policy changes in an information technology (IT) security
system, the method comprising:
receiving incident data associated with one or more
security incidents occurring within the IT security system;
receiving security policy data associated with a security
policy in effect within the IT security system;
applying an incident analysis rule to the received incident
data and the received security policy data to calculate a change
to one or more attributes of a new security policy for the IT
security system; and
associating the one or more attributes of the new security
policy to the IT security system.
2
Appeal2015-001934
Application 13/345,991
The Examiner ;s Rejection
Claims 9--26 stand rejected under 35 U.S.C. § 102(b) as being
anticipated by Ben-Itzhak (US 2005/0038881 Al; Feb. 17, 2005). Final
Act. 3--4.
Issues on Appeal
1. Did the Examiner err in finding Ben-Itzhak discloses an
incident analysis rule which is applied to incident data, as required by
claim 9?
2. Did the Examiner err in finding Ben-Itzhak discloses an
incident management system distinct from an IT security system and
security policy management system, as required by claim 25?
ANALYSIS 3
Claims 9, 14-17, and 22-24
Appellants argue Ben-Itzhak does not use incident data or an incident
analysis rule applied to the incident data to determine what changes are to be
made to existing security policy attributes. App. Br. 6. In particular,
Appellants assert the trusted sources (i.e., security scanners) of Ben-Itzhak,
as relied upon by the Examiner, neither generate nor receive incident data, as
recited in claim 1. App. Br. 6. Further, Appellants argue the Examiner's
3 Throughout this Decision, we have considered the Appeal Brief, filed
May 19, 2014 ("App. Br."); the Reply Brief filed, November 12, 2014
("Reply Br."); the Examiner's Answer, mailed on September 11, 2014
("Ans."); and the Final Office Action ("Final Act."), mailed on December
16, 2013, from which this Appeal is taken.
3
Appeal2015-001934
Application 13/345,991
construction of "incident data" is not reasonable in light of the Specification.
Reply Br. 2---6.
Ben-Itzhak is directed to "simplifying the setting of a security policy,
and dynamically amending the same upon introduction of changes having
security effects within the application, network, or services which the
application provides." Ben-Itzhak i-f 1. Ben-Itzhak discloses the use of
"security scanners" (i.e., "trusted sources") to check whether the
computerized environment complies with the security policy. Ben-Itzhak
i-f 4. The trusted source (i.e., scanner) is capable of issuing security reports
detailing security flaws within the system. Ben-Itzhak i-f 12. The security
reports are imported by a security correcting unit. Ben-Itzhak i-f 12. The
security correcting unit compares the imported reports against attribute files
(i.e., security policy data) to update, as appropriate, the attribute files and, in
effect, the security policy. Ben-Itzhak i-f 24.
The Examiner notes, as do we, the Specification does not provide a
definition for the terms "incident data" or "security incidents." Ans. 2.
Thus, the Examiner finds, and we agree, "a security incident is interpreted to
be any security occurrence/ event, and incident data is interpreted to be data
associated with the security occurrence/event." Ans. 2. Contrary to
Appellants' assertions, we do not find the Examiner's construction to be
inconsistent with the Specification. See, e.g., Spec. 2 ("incidents arising
from the use of a particular security policy"). Although the claims are
interpreted in light of the specification, limitations from the specification are
not read into the claims. In re Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir.
1993).
4
Appeal2015-001934
Application 13/345,991
The Examiner also finds, and we agree:
(i) the testing and challenging of the protected domain by the
security scanners and/or the security flaws detected as a result of
the testing and challenging meet the limitation of security
incidents; and (ii) the security flaw reports generated by the
security scanners and then forwarded to the security correcting
unit to update a security policy meet the limitation of incident
data.
Ans. 2. Further, the Examiner finds, and we agree, the Ben-Itzhak's security
scanners meet the claimed "incident management system," which is
interpreted to be a system that detects and/or reports security incidents.
Ans. 3.
As noted above, the security correcting unit of Ben-Itzhak applies a
set of logical rules to the reports received from the security scanners. Thus,
the Examiner finds, and we agree, Ben-Itzhak, therefore, discloses "applying
... an incident analysis rule to the received incident data," as recited in
claim 9.
For the reasons discussed supra, we are unpersuaded of Examiner
error. Accordingly, we sustain the Examiner's rejection of claim 9 and, for
similar reasons, the rejection of claim 17, which recites similar limitations
and was not argued separately. Additionally, we sustain the rejection of
dependent claims 14--16 and 22-24, which were not argued separately. App.
Br. 10.
Claims 2 5 and 2 6
Appellants assert Ben-Itzhak does not disclose an incident
management system distinct from an IT security system or a security policy
management system distinct from an incident management system, as
5
Appeal2015-001934
Application 13/345,991
required by claims 25 and 26. App. Br. 11-12; Reply Br. 6-8. Additionally,
Appellants argue the Examiner's interpretation "conflates the 'incident
management' and 'security policy management' systems into just a single
integrated system that receives both security policy data and incident data."
Reply Br. 7.
The Examiner finds Ben-Itzhak discloses an incident management
system (i.e., the security scanners) as distinct from an IT security system
(i.e., the network security and application security packages). Ans. 4 (citing
Ben-Itzhak, Fig. 2 (items 4 and 8 are distinct from items 2 and 6)). Further,
the Examiner finds the incident management system of Ben-Itzhak (i.e., the
security scanners) is distinct from the security policy management system
(which stores the security policy data, i.e., attribute files). Ans. 4 (citing
Ben-Itzhak, Fig. 2 (items 4 and 8 are distinct from items 3 and 7)).
We agree with the Examiner's findings and adopt them as our own.
Additionally, we disagree with Appellants' contention the Examiner
conflates the "incident management system" and the "security policy
management system." As noted above, the Examiner finds, and we agree,
Ben-Itzhak discloses distinct systems. See Ben-Itzhak, Fig. 2.
Accordingly, we are unpersuaded of Examiner error and sustain the
Examiner's rejection of claims 25 and 26.
Claims 10 and 18
Claims 10 and 18 recite that "the incident data is received from an
incident management system that supports the IT security system."
Appellants assert because Ben-Itzhak does not disclose the use of incident
data, it follows logically that there is no disclosure of incident data being
6
Appeal2015-001934
Application 13/345,991
received from an incident management system. App. Br. 12-13.
Additionally, Appellants argue the trusted sources (i.e., security scanners) of
Ben-Itzhak "operate merely to perform proactive scans of the application
and network being protected by a particular security package" and are not
"incident management." App. Br. 12-13.
As discussed supra, the Examiner finds, and we agree, the security
scanners of Ben-Itzhak meet the limitation of the claims "incident
management system." Ans. 4. Further, the Examiner finds, and we agree,
the security scanners of Ben-Itzhak provide the claimed "incident data" as
part of the reports sent to the security correcting unit. See Ben-Itzhak i-f 12.
Accordingly, we sustain the Examiner's rejection of claims 10 and 18.
Claims 11 and 19
Dependent claim 11 recites, in part:
wherein the incident data includes one of: a number of incidents,
a number of incidents for a given incident type, an identifier of a
system in which an incident originates, a user or user role
associated with an incident, an incident classification and
resolution, an incident lifetime, and trend data of incident arrival
and resolution.
Dependent claim 19 recites a similar limitation. Appellants contend because
Ben-Itzhak does not disclose "incident data," it follows that it also does not
disclose specific types of incident data. App. Br. 13. Additionally,
Appellants assert the security scanners ofBen-Itzhak "identify flaw
attributes" and not the enumerated type of incident data as identified in
claims 11 and 19. App. Br. 13.
As discussed supra, we are unpersuaded that the Examiner erred in
finding Ben-Itzhak discloses incident data. Further, as the Examiner
7
Appeal2015-001934
Application 13/345,991
explains, Ben-Itzhak discloses incident data including a user identification.
Ans. 4 (citing Ben-Itzhak i-fi-f 112-26 (e.g., identifying a user associated with
an intrusion detection)).
Accordingly, we sustain the Examiner's rejection of claims 11 and 19.
Claims 12, 13, 20, and 21
Appellants assert claims 12, 13, 20, and 21, which depend from
claims 9 and 17, respectively, are not anticipated for the "reasons set forth
with respect to the Group I [(i.e., claims 9, 14--17, and 22-24)] claims."
App. Br. 13. Appellants contend "[b ]ecause Ben-Itzhak does not analyze
'incident data' let alone with an 'incident analysis rule,' it follows logically
that these claim elements are not met either." App. Br. 13.
For the reasons discussed supra, we are unpersuaded of Examiner
error. Accordingly, we sustain the Examiner's rejection of claims 12, 13,
20, and 21.
DECISION
We affirm the Examiner's decision to reject claims 9-26.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R.
§ 41.50(f).
AFFIRMED
8