Ex Parte Choi et alDownload PDFPatent Trial and Appeal BoardJul 29, 201613345991 (P.T.A.B. Jul. 29, 2016) Copy Citation UNITED STA TES p A TENT AND TRADEMARK OFFICE APPLICATION NO. FILING DATE 13/345,991 01109/2012 63400 7590 08/02/2016 IBM CORP, (DHJ) c/o DAVID H. JUDSON 15950DALLAS PARKWAY SUITE 225 DALLAS, TX 75248 FIRST NAMED INVENTOR Christopher Y oung-Soo Choi UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www .uspto.gov ATTORNEY DOCKET NO. CONFIRMATION NO. AU920110021US1 1024 EXAMINER DINH, MINH ART UNIT PAPER NUMBER 2437 NOTIFICATION DATE DELIVERY MODE 08/02/2016 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address( es): mail@davidjudson.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte CHRISTOPHER YOUNG-SQQ CHOI and NEIL IAN READSHA W 1 Appeal2015-0019342 Application 13/345,991 Technology Center 2400 Before THU A. DANG, ERIC S. FRAHM, and JAMES W. DEJMEK, Administrative Patent Judges. DEJMEK, Administrative Patent Judge. DECISION ON APPEAL Appellants appeal under 35 U.S.C. § 134(a) from the Final Rejection of claims 9-26. Claims 1-8 have been canceled. App. Br. 1. We have jurisdiction over the remaining pending claims under 35 U.S.C. § 6(b ). We affirm. 1 Appellants identify International Business Machines Corporation as the real party in interest. App. Br. 1. 2 This appeal is related to an appeal of co-pending application 13/660,357 (Appeal No. 2015-001960). Appeal2015-001934 Application 13/345,991 STATEMENT OF THE CASE Introduction Appellants' invention is directed to "security policy management for information technology (IT) systems." Spec. 1. In particular, incident data about the IT security system is collected by an incident management system is fed back to a security analytics system, which analyzes the incident data to make or recommend changes to one or more security policies. Spec. 3. According to the Specification, the use of incident data as disclosed allows for a more efficient and optimized approach to managing a policy-based IT security system. Spec. 22. Claim 9 is representative of the subject matter on appeal and is reproduced below with the disputed limitations emphasized in italics: 9. Apparatus, comprising: a processor; computer memory holding computer program instructions that when executed by the processor perform a method to manage policy changes in an information technology (IT) security system, the method comprising: receiving incident data associated with one or more security incidents occurring within the IT security system; receiving security policy data associated with a security policy in effect within the IT security system; applying an incident analysis rule to the received incident data and the received security policy data to calculate a change to one or more attributes of a new security policy for the IT security system; and associating the one or more attributes of the new security policy to the IT security system. 2 Appeal2015-001934 Application 13/345,991 The Examiner ;s Rejection Claims 9--26 stand rejected under 35 U.S.C. § 102(b) as being anticipated by Ben-Itzhak (US 2005/0038881 Al; Feb. 17, 2005). Final Act. 3--4. Issues on Appeal 1. Did the Examiner err in finding Ben-Itzhak discloses an incident analysis rule which is applied to incident data, as required by claim 9? 2. Did the Examiner err in finding Ben-Itzhak discloses an incident management system distinct from an IT security system and security policy management system, as required by claim 25? ANALYSIS 3 Claims 9, 14-17, and 22-24 Appellants argue Ben-Itzhak does not use incident data or an incident analysis rule applied to the incident data to determine what changes are to be made to existing security policy attributes. App. Br. 6. In particular, Appellants assert the trusted sources (i.e., security scanners) of Ben-Itzhak, as relied upon by the Examiner, neither generate nor receive incident data, as recited in claim 1. App. Br. 6. Further, Appellants argue the Examiner's 3 Throughout this Decision, we have considered the Appeal Brief, filed May 19, 2014 ("App. Br."); the Reply Brief filed, November 12, 2014 ("Reply Br."); the Examiner's Answer, mailed on September 11, 2014 ("Ans."); and the Final Office Action ("Final Act."), mailed on December 16, 2013, from which this Appeal is taken. 3 Appeal2015-001934 Application 13/345,991 construction of "incident data" is not reasonable in light of the Specification. Reply Br. 2---6. Ben-Itzhak is directed to "simplifying the setting of a security policy, and dynamically amending the same upon introduction of changes having security effects within the application, network, or services which the application provides." Ben-Itzhak i-f 1. Ben-Itzhak discloses the use of "security scanners" (i.e., "trusted sources") to check whether the computerized environment complies with the security policy. Ben-Itzhak i-f 4. The trusted source (i.e., scanner) is capable of issuing security reports detailing security flaws within the system. Ben-Itzhak i-f 12. The security reports are imported by a security correcting unit. Ben-Itzhak i-f 12. The security correcting unit compares the imported reports against attribute files (i.e., security policy data) to update, as appropriate, the attribute files and, in effect, the security policy. Ben-Itzhak i-f 24. The Examiner notes, as do we, the Specification does not provide a definition for the terms "incident data" or "security incidents." Ans. 2. Thus, the Examiner finds, and we agree, "a security incident is interpreted to be any security occurrence/ event, and incident data is interpreted to be data associated with the security occurrence/event." Ans. 2. Contrary to Appellants' assertions, we do not find the Examiner's construction to be inconsistent with the Specification. See, e.g., Spec. 2 ("incidents arising from the use of a particular security policy"). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. In re Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir. 1993). 4 Appeal2015-001934 Application 13/345,991 The Examiner also finds, and we agree: (i) the testing and challenging of the protected domain by the security scanners and/or the security flaws detected as a result of the testing and challenging meet the limitation of security incidents; and (ii) the security flaw reports generated by the security scanners and then forwarded to the security correcting unit to update a security policy meet the limitation of incident data. Ans. 2. Further, the Examiner finds, and we agree, the Ben-Itzhak's security scanners meet the claimed "incident management system," which is interpreted to be a system that detects and/or reports security incidents. Ans. 3. As noted above, the security correcting unit of Ben-Itzhak applies a set of logical rules to the reports received from the security scanners. Thus, the Examiner finds, and we agree, Ben-Itzhak, therefore, discloses "applying ... an incident analysis rule to the received incident data," as recited in claim 9. For the reasons discussed supra, we are unpersuaded of Examiner error. Accordingly, we sustain the Examiner's rejection of claim 9 and, for similar reasons, the rejection of claim 17, which recites similar limitations and was not argued separately. Additionally, we sustain the rejection of dependent claims 14--16 and 22-24, which were not argued separately. App. Br. 10. Claims 2 5 and 2 6 Appellants assert Ben-Itzhak does not disclose an incident management system distinct from an IT security system or a security policy management system distinct from an incident management system, as 5 Appeal2015-001934 Application 13/345,991 required by claims 25 and 26. App. Br. 11-12; Reply Br. 6-8. Additionally, Appellants argue the Examiner's interpretation "conflates the 'incident management' and 'security policy management' systems into just a single integrated system that receives both security policy data and incident data." Reply Br. 7. The Examiner finds Ben-Itzhak discloses an incident management system (i.e., the security scanners) as distinct from an IT security system (i.e., the network security and application security packages). Ans. 4 (citing Ben-Itzhak, Fig. 2 (items 4 and 8 are distinct from items 2 and 6)). Further, the Examiner finds the incident management system of Ben-Itzhak (i.e., the security scanners) is distinct from the security policy management system (which stores the security policy data, i.e., attribute files). Ans. 4 (citing Ben-Itzhak, Fig. 2 (items 4 and 8 are distinct from items 3 and 7)). We agree with the Examiner's findings and adopt them as our own. Additionally, we disagree with Appellants' contention the Examiner conflates the "incident management system" and the "security policy management system." As noted above, the Examiner finds, and we agree, Ben-Itzhak discloses distinct systems. See Ben-Itzhak, Fig. 2. Accordingly, we are unpersuaded of Examiner error and sustain the Examiner's rejection of claims 25 and 26. Claims 10 and 18 Claims 10 and 18 recite that "the incident data is received from an incident management system that supports the IT security system." Appellants assert because Ben-Itzhak does not disclose the use of incident data, it follows logically that there is no disclosure of incident data being 6 Appeal2015-001934 Application 13/345,991 received from an incident management system. App. Br. 12-13. Additionally, Appellants argue the trusted sources (i.e., security scanners) of Ben-Itzhak "operate merely to perform proactive scans of the application and network being protected by a particular security package" and are not "incident management." App. Br. 12-13. As discussed supra, the Examiner finds, and we agree, the security scanners of Ben-Itzhak meet the limitation of the claims "incident management system." Ans. 4. Further, the Examiner finds, and we agree, the security scanners of Ben-Itzhak provide the claimed "incident data" as part of the reports sent to the security correcting unit. See Ben-Itzhak i-f 12. Accordingly, we sustain the Examiner's rejection of claims 10 and 18. Claims 11 and 19 Dependent claim 11 recites, in part: wherein the incident data includes one of: a number of incidents, a number of incidents for a given incident type, an identifier of a system in which an incident originates, a user or user role associated with an incident, an incident classification and resolution, an incident lifetime, and trend data of incident arrival and resolution. Dependent claim 19 recites a similar limitation. Appellants contend because Ben-Itzhak does not disclose "incident data," it follows that it also does not disclose specific types of incident data. App. Br. 13. Additionally, Appellants assert the security scanners ofBen-Itzhak "identify flaw attributes" and not the enumerated type of incident data as identified in claims 11 and 19. App. Br. 13. As discussed supra, we are unpersuaded that the Examiner erred in finding Ben-Itzhak discloses incident data. Further, as the Examiner 7 Appeal2015-001934 Application 13/345,991 explains, Ben-Itzhak discloses incident data including a user identification. Ans. 4 (citing Ben-Itzhak i-fi-f 112-26 (e.g., identifying a user associated with an intrusion detection)). Accordingly, we sustain the Examiner's rejection of claims 11 and 19. Claims 12, 13, 20, and 21 Appellants assert claims 12, 13, 20, and 21, which depend from claims 9 and 17, respectively, are not anticipated for the "reasons set forth with respect to the Group I [(i.e., claims 9, 14--17, and 22-24)] claims." App. Br. 13. Appellants contend "[b ]ecause Ben-Itzhak does not analyze 'incident data' let alone with an 'incident analysis rule,' it follows logically that these claim elements are not met either." App. Br. 13. For the reasons discussed supra, we are unpersuaded of Examiner error. Accordingly, we sustain the Examiner's rejection of claims 12, 13, 20, and 21. DECISION We affirm the Examiner's decision to reject claims 9-26. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R. § 41.50(f). AFFIRMED 8 Copy with citationCopy as parenthetical citation