Ex Parte Lawson Tarbotton et al

Board of Patent Appeals and Interferences

May 10, 2007

10028651 (B.P.A.I. May. 10, 2007)

The opinion in support of the decision being entered today was not written
for publication and is not binding precedent of the Board.

UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE BOARD OF PATENT APPEALS
AND INTERFERENCES
____________

Ex parte LEE CODEL LAWSON TARBOTTON,
DANIEL J. WOLFF,
and NEIL A. COWIE
____________

Appeal 2007-0956
Application 10/028,651
Technology Center 2100
____________

Decided: May 10, 2007
____________

Before JOSEPH F. RUGGIERO, HOWARD B. BLANKENSHIP, and
JOHN A. JEFFERY, Administrative Patent Judges.

JEFFERY, Administrative Patent Judge.

DECISION ON APPEAL
Appellants appeal under 35 U.S.C. § 134 from the Examiner’s
rejection of claims 1-10, 12-23, 25-28, 30, and 31. We have jurisdiction
under 35 U.S.C. § 6(b).
Appeal 2007-0956
Application 10/028,651

2
STATEMENT OF THE CASE
Appellants invented a network security management system that
prevents viruses or other malicious code from overwriting or altering critical
files. Initially, factors associated with a computer are identified. Then,
requests to write to files on the computer are monitored. The writes to the
files are conditionally prevented based on the factors to prevent virus
proliferation. In addition, the factors are altered based on the monitoring of
the requests.1 Claim 1 is illustrative:
1. A method for preventing writes to critical files, comprising:

(a) identifying factors associated with a computer;

(b) monitoring requests to write to files on the computer; and

(c) conditionally preventing the writes to the files on the computer
based on the factors to prevent virus proliferation;

(d) wherein the factors are altered based on the monitoring of the
requests to write to the files on the computer;

(e) wherein the factors are updated based on the requests.

The Examiner relies on the following prior art references to show
unpatentability:
Stevens US 2002/0133702 A1 Sep. 19, 2002
(filed Mar. 16, 2001)
Rickey US 2002/0166059 A1 Nov. 7, 2002
(filed May 1, 2001)
Description of the Windows 2000 Windows File Protection Feature
(Q222193), Microsoft Personal Online Support, available at
http://web.archive.org, Jul. 8, 1999 (“WFP”).

1 See generally Specification 1:6 – 4:27.
Appeal 2007-0956
Application 10/028,651

3
The Examiner’s rejections are as follows:
1. Claims 1-7, 9, 10, 12-20, 22, 23, 25-28, and 30 are rejected under 35
U.S.C. § 103(a) as unpatentable over WFP in view of Rickey.2
2. Claims 8, 21, and 313 are rejected under 35 U.S.C. § 103(a) as
unpatentable over WFP in view of Rickey and further in view of
Stevens.
Rather than repeat the arguments of Appellants or the Examiner, we
refer to the Briefs and the Answer for their respective details. In this
decision, we have considered only those arguments actually made by
Appellants. Arguments which Appellants could have made but chose not to
make in the Briefs have not been considered and are deemed to be waived.
See 37 C.F.R. § 41.37(c)(1)(vii).

OPINION
It is our view, after consideration of the record before us, that the
evidence relied upon and the level of skill in the particular art would have
suggested to one of ordinary skill in the art the invention set forth in claims
1-10, 12-23, 25-28, and 30. We reach the opposite conclusion, however,
with respect to claim 31. Accordingly, we affirm-in-part.
We first consider the Examiner’s rejection of Claims 1-7, 9, 10, 12-
20, 22, 23, 25-28, and 30 under 35 U.S.C. § 103(a) as unpatentable over
WFP in view of Rickey. In rejecting claims under 35 U.S.C. § 103, it is

2 Although the Examiner includes claims 11 and 24 in the rejection (Answer
3), these claims have been cancelled. See Br. 5 and Claims App.; see also
Answer 3 (acknowledging copy of appealed claims as correct).
3 Claim 31 was rejected under a new grounds of rejection to correct a defect
in a previous rejection of the claim (Answer 2-3).
Appeal 2007-0956
Application 10/028,651

4
incumbent upon the Examiner to establish a factual basis to support the legal
conclusion of obviousness. See In re Fine, 837 F.2d 1071, 1073, 5 USPQ2d
1596, 1598 (Fed. Cir. 1988). In so doing, the Examiner must make the
factual determinations set forth in Graham v. John Deere Co., 383 U.S. 1,
17, 148 USPQ 459, 467 (1966). Furthermore, “‘there must be some
articulated reasoning with some rational underpinning to support the legal
conclusion of obviousness’ . . . . [H]owever, the analysis need not seek out
precise teachings directed to the specific subject matter of the challenged
claim, for a court can take account of the inferences and creative steps that a
person of ordinary skill in the art would employ.” KSR Int’l Co. v. Teleflex
Inc., No. 04-1350, slip op. at 14 (U.S., Apr. 30, 2007) (quoting In re Kahn,
441 F.3d 977, 988, 78 USPQ2d 1329, 1336 (Fed. Cir. 2006)).
If the Examiner’s burden is met, the burden then shifts to the
Appellants to overcome the prima facie case with argument and/or evidence.
Obviousness is then determined on the basis of the evidence as a whole and
the relative persuasiveness of the arguments. See In re Oetiker, 977 F.2d
1443, 1445, 24 USPQ2d 1443, 1444 (Fed. Cir. 1992).
Regarding independent claims 1, 14, and 27, the Examiner's rejection
essentially finds that WFP teaches every claimed feature except for
preventing writes to the files to prevent virus proliferation. The Examiner
cites Rickey as teaching that viruses can enter a system via critical files. The
Examiner concludes that it would have been obvious to one of ordinary skill
in the art at the time of the invention to use WFP’s method of blocking
writes to files to prevent viruses from entering the system (Answer 4).
Appeal 2007-0956
Application 10/028,651

5
Regarding claims 1, 2, 4-7, 13-15, 17-20, 26, and 27,4 Appellants
argue that WFP does not disclose altering factors based on the monitoring of
the requests to write to files on the computer as claimed. Appellants
emphasize that WFP’s system determines if a file has already been modified
and, if so, WFP restores the modified file to the correct version. That is, the
file is updated after being modified. According to Appellants, WFP’s
updating a modified file does not teach or suggest preventing writes to files
on a computer, let alone altering factors based on monitoring of the requests
or updating the factors based on the requests as claimed (Br. 9-10; Reply Br.
3-5).
The Examiner argues that the critical files in WFP are the claimed
factors. The Examiner notes that whenever a file is modified, a “write call”
– and therefore a corresponding write request – occurs in the system.
Therefore, WFP monitors write requests as claimed. The Examiner further
notes that when WFP replaces a modified file with the correct version, the
file (i.e., factor) is altered based on the modification (i.e., write request)
(Answer 7-8).
We will sustain the Examiner’s rejection of representative claim 1.
Although WFP restores modified files to their correct versions as Appellants
indicate, Appellants’ arguments are simply not commensurate with the scope
of the claim.
First, the limitation calling for “factors associated with a computer” is
fully met by particular file versions in WFP giving the term

4 Appellants designate these claims as corresponding to Group #1 (Br. 9).
We therefore select claim 1 as representative of claims corresponding to this
group. See 37 C.F.R. § 41.37(c)(1)(vii).
Appeal 2007-0956
Application 10/028,651

6
“factors” its broadest reasonable interpretation. In WFP, the system
identifies the version of the file to determine if corrective action is necessary
– a process that fully meets limitation (a) in claim 1.
Second, the limitation calling for “monitoring requests to write to files
on the computer” is fully met by the computer’s operating system in WFP.
We agree with the Examiner that write requests occur in the system when
files are modified. Significantly, the monitoring limitation in claim 1 does
not specify which requests to write to files are monitored. As such, the
limitation reads on essentially any computer operating system that inherently
“monitors” write requests associated with modifying any files on the
computer – including the protected files in WFP.
Third, the limitation calling for “conditionally preventing the writes to
the files on the computer based on the factors to prevent virus proliferation”
is fully met by WFP.5 In this regard, we note that WFP’s system replaces
the file if the version is not the correct version (WFP, last two lines of P. 1).
That is, WFP will not replace the file if it is the correct version. In this
situation, WFP in effect conditionally prevents writing to the file based at
least in part on the “factors” – namely, the version of the file identified as
correct.
Fourth, the limitation calling for altering the factors based on the
monitoring of the requests is also fully met by WFP. If the new file is not

5 We note in passing that the limitation “to prevent virus proliferation”
merely recites a desired result intended to be achieved from the conditional
prevention step. Such a desired result, however, does not patentably
distinguish over the system of WFP notwithstanding the Examiner’s reliance
on the secondary reference to Rickey to show viruses can enter a system via
critical files.
Appeal 2007-0956
Application 10/028,651

7
the correct version, the file is replaced. The very act of replacing the file in
this manner would cause the system to inherently generate an associated
request to write to the file – a write request that likewise is inherently
monitored by the computer’s operating system. Restoring the file to the
correct version both alters and updates the factors (particular file versions in
WFP) based, at least in part, on the operating system’s monitoring the
requests to write to the files and the requests themselves.
For at least these reasons, we find that WFP actually anticipates
representative claim 1. Nevertheless, obviousness rejections can be based
on references that happen to anticipate the claimed subject matter. In re
Meyer, 599 F.2d 1026, 1031, 202 USPQ 175, 179 (CCPA 1979).
Furthermore, we sustain the Examiner’s obviousness rejection based on the
teachings of WFP alone since we may rely on fewer references than the
Examiner in affirming a multiple-reference rejection under 35 U.S.C. § 103.
In re Bush, 296 F.2d 491, 496, 131 USPQ 263, 266-67 (CCPA 1961); In re
Boyer, 363 F.2d 455, 458 n.2, 150 USPQ 441, 444 n.2 (CCPA 1966).6
Therefore, we will sustain the Examiner’s rejection of representative
claim 1. Likewise, we will sustain the Examiner’s rejection of claims 2, 4-7,
13-15, 17-20, 26, and 27 as they fall with representative claim 1. See 37
C.F.R. § 41.37(c)(1)(vii).
Regarding claim 28, Appellants argue that restoring protected system
files from a cache or installation media after the files are modified does not
teach or suggest looking up at least one of critical files and file locations

6 Notwithstanding this conclusion, we nevertheless agree with the Examiner
that the teachings of Rickey would have been reasonably combinable with
WFP essentially for the reasons stated by the Examiner. The propriety of
combining the teachings of Rickey with those of WFP has not been rebutted.
Appeal 2007-0956
Application 10/028,651

8
based on requests to write to the files or file locations (Br. 10-11; Reply Br.
5-6). The Examiner argues that when the file is modified to an incorrect
version in WFP, the correct version is looked up and the incorrect file
version replaced with the correct version. According to the Examiner, the
look up is therefore based on the request to write as claimed (Answer 8-9).
We will sustain the Examiner’s rejection of claim 28. Here again, the
scope and breadth of the claim language does not preclude the disclosure of
WFP. We note that WFP actually performs at least two “look ups” giving
the term its broadest reasonable interpretation: (1) a look up of the file
signature in a catalog to determine if the file is the correct version, and (2) if
the file needs to be replaced, the correct file version is inherently “looked
up” from the Dllcache folder or installation media as appropriate. See WFP,
last three lines of P. 1 through P. 2, l. 1. Simply put, retrieving the correct
file version from either the Dllcache folder or the installation media
inherently involves looking up the file.
With this interpretation, we note that claim 28 merely broadly recites
that critical files and/or critical file locations are looked up based on requests
to write to the critical files and/or file locations. Given the broad scope of
this limitation, either of the two “look ups” in WFP noted above is based, at
least in part, on requests to write to the critical files. Although both lookups
in WFP noted above occur after modification of the file as Appellants
indicate, the lookups are nevertheless responsive to modification of the
files–a modification that necessarily involves an associated write request.
While WFP indicates that critical files can be modified and replaced
with correct file versions, WFP nevertheless also prevents writes to critical
files as claimed in the preamble. As we indicated previously, WFP will not
Appeal 2007-0956
Application 10/028,651

9
replace the file if it is the correct version.7 In this condition, writes to critical
files are prevented thus fully meeting the limitation. We reach this
conclusion emphasizing that the claim simply does not specify which writes
are being prevented. Nor does the claim specify which request to write
forms the basis for the look up.
For the foregoing reasons, we find WFP actually anticipates claim 28.
Nevertheless, as we indicated in connection with claim 1, we will sustain the
Examiner’s obviousness rejection based solely on WFP.8
We will also sustain the Examiner’s rejection of claims 3 and 16.9
Although we find the Examiner’s rationale pertaining to adjusting the cache
size on P. 9 of the Answer problematic essentially for the reasons noted by
Appellants (Reply Br. 7), we nevertheless find that WFP anticipates the
claim giving the term “user configurable” its broadest reasonable
interpretation. As we indicated previously, the claimed factors correspond
to particular file versions in WFP.10 Not only can the files themselves be
configured by the user (e.g., by updating the files), but also the attributes
associated with the particular files can be so configured. Appellants’
arguments are simply not commensurate with the scope of representative
claim 3.
Although WFP actually anticipates claim 3, we will nevertheless
sustain the Examiner’s obviousness rejection based solely on WFP for the

7 See P. 6, supra, of this opinion.
8 See id. at 6-7.
9 Appellants indicate that claims 3 and 16 correspond to Group #3 (Br. 11).
Accordingly, we select claim 3 as representative of this group.
10 See P. 5, supra, of this opinion.
Appeal 2007-0956
Application 10/028,651

10
reasons noted previously.11 Likewise, we will sustain the Examiner’s
rejection of claim 16 which falls with representative claim 3.
Regarding claims 9, 10, 22, and 23,12 Appellants argue that WFP does
not teach or suggest updating factors as claimed, but merely repairs incorrect
file versions. Appellants also argue that WFP only responds to
modifications of files and not to requests as claimed (Br. 12; Reply Br. 8).
The Examiner argues that the administrator’s ability to scan all
protected files to verify their versions in the System File Checker tool in
WFP corresponds to a user request to determine whether a file has been
modified. The Examiner adds that replacing the file to the correct version if
the file is modified corresponds to updating the file. The Examiner also
notes that such file updates can be implemented from a cache via a local
path or a network (Answer 9-10).
We will sustain the Examiner’s rejection of representative claim 9.
We agree with the Examiner that the administrator’s ability in WFP to scan
the protected files to verify their versions and replace modified files
reasonably corresponds to updating the factors (i.e., particular file versions)
based on a user request as claimed. Moreover, regarding claim 10, we agree
with the Examiner that these updates from the Dllcache can be via a network
path (WFP, at 3). Appellants’ arguments are simply not commensurate with
the scope of the claims.
Although WFP actually anticipates claims 9 and 10, we will
nevertheless sustain the Examiner’s obviousness rejection based solely on

11 See id. at 6-7.
12 Appellants indicate that claims 9, 10, 22, and 23 correspond to Group #4
(Br. 12). Accordingly, we select claim 9 as representative of this group.
Appeal 2007-0956
Application 10/028,651

11
WFP for the reasons noted previously.13 Likewise, we sustain the
Examiner’s rejection of claims 22 and 23 for similar reasons.
Regarding claims 12 and 25,14 Appellants argue that WFP’s
prompting the administrator to insert media to replace the file does not teach
or suggest conditionally preventing writes to the files based on a user
confirmation as claimed. Appellants emphasize that if WFP prevented
writing to the file, there would be no need to replace the file (Br. 12-13;
Reply Br. 9-10). The Examiner argues that “user confirmation” occurs when
the user inserts media to replace the file. The Examiner adds that since the
correct version is copied from the media in this instance, such action
therefore prevents writing to the file with the incorrect version (Answer 10).
We will sustain the Examiner’s rejection of claims 12 and 25. We
reiterate at the outset that claim 12, like claim 1, does not specify which
writes to the files are being prevented. Thus, the scope and breadth of the
claim simply does not preclude preventing either unauthorized or authorized
writes.
With this interpretation, we turn to WFP. First, we agree with the
Examiner that that “user confirmation” occurs when the user in WFP inserts
media to replace the file. Second, as we indicated in connection with claim
1, WFP’s system replaces the file if the version is not the correct version
(WFP, last two lines of P. 1). That is, WFP will not replace the file if it is
the correct version. In this situation, WFP in effect conditionally prevents
writing to the file (correct version) which is based, at least in some instances,

13 See P. 6-7, supra, of this opinion.
14 Appellants indicate that claims 12 and 25 correspond to Group #5 (Br.
12). Accordingly, we select claim 12 as representative of this group.
Appeal 2007-0956
Application 10/028,651

12
on a file that was copied from the inserted media (i.e., based at least in part
on a “user confirmation”). Claim 12 is therefore fully met by WFP.
Although WFP actually anticipates claim 12, we will nevertheless
sustain the Examiner’s obviousness rejection based solely on WFP for the
reasons noted previously.15 We also sustain the rejection of claim 25 for
similar reasons.
Regarding claim 30, Appellants argue, among other things, that
WFP’s updating a file in a cache fails to suggest that a list of critical files is
updated based on the requests as claimed (Br. 13; Reply Br. 10-11). The
Examiner argues that when the cache in WFP does not hold all critical files,
and a critical file is modified that is not on the list, media is inserted that
effectively updates the list (Answer 10-11).
We will sustain the Examiner’s rejection of claim 30. We note that
the scope and breadth of the claim does not preclude the multiple critical
files that are contained in the system of WFP which collectively constitute a
list. Since at least one file of the collection of critical files is updated
responsive to a file modification (write requests), the list is effectively
updated based at least in part on the write requests. The claim is therefore
fully met by WFP. Although we find WFP anticipates claim 30, we will
nonetheless sustain the Examiner’s obviousness rejection of claim 30 for the
reasons previously discussed.16
We next consider the Examiner’s rejection of claims 8, 21, and 31
under 35 U.S.C. § 103(a) as unpatentable over WFP in view of Rickey and

15 See P. 6-7, supra, of this opinion.
16 See id.
Appeal 2007-0956
Application 10/028,651

13
further in view of Stevens. Regarding claims 8 and 21,17 the Examiner finds
that the prior art discloses all of the claimed limitations except for the factors
to include trusted applications that initiate the requests. The Examiner cites
Stevens as teaching trusted applications and concludes that it would have
been obvious to one of ordinary skill in the art at the time of the invention to
use a trusted application in the prior art file protection system to allow
trusted applications to access protected information (Answer 5-6).
Appellants argue that Stevens does not disclose that a trusted application
initiates the requests where the requests write to files on the computer (Br.
14; Reply Br. 12).
We will sustain the Examiner’s rejection of claims 8 and 21. We note
at the outset that essentially any computer file write requests effectively are
initiated within the computer’s operating system and therefore are initiated
by “trusted applications” giving the term its broadest reasonable
interpretation. For this reason alone, we find that WFP actually anticipates
representative claim 8. We add that the replacing a file with the correct
version in WFP would likewise cause the computer’s operating system to
inherently generate an associated request to write to the file – a write request
that is initiated by a “trusted applications” (i.e., the computer’s operating
system) giving the term its broadest reasonable interpretation.
Although we find that WFP actually anticipates claim 8, we will
nevertheless sustain the Examiner’s obviousness rejection based solely on

17 Appellants indicate that claims 8 and 21 correspond to Group #1 of Issue
#2 (Br. 11). Accordingly, we select claim 8 as representative of this group.
Appeal 2007-0956
Application 10/028,651

14
WFP for the reasons noted previously.18 We also sustain the rejection of
claim 21 for similar reasons.
We will not, however, sustain the Examiner’s rejection of claim 31.
The claim requires (1) alerting the user when one of the requests is initiated
by an application that is not one of the trusted applications, and (2) allowing
the user to prevent and/or permit the request. Although WFP alerts the user
when the file is modified, and Stevens generally teaches allowing trusted
applications access to protected areas of computer as the Examiner indicates
(Answer 11), we do not agree that these collective teachings reasonably
teach or suggest alerting the user specifically when a request is initiated by
an untrusted application, and then allowing the user to prevent and/or permit
the request as claimed. In essence, the claim requires some degree of user
intervention with respect to the request itself.
Although the user in WFP is certainly alerted if a file has been
changed to an incorrect version, the user is simply not allowed to prevent
and/or permit the request that was initiated by the application. Even if the
file was modified by an unauthorized source, the very act of modifying the
file necessarily resulted in the write request being automatically permitted
without user intervention.
For the foregoing reasons, we will not sustain the Examiner’s
rejection of claim 31.

DECISION
We have sustained the Examiner's rejections with respect to claims 1-
10, 12-23, 25-28, and 30. We have not, however, sustained the Examiner’s

18 See P. 6-7, supra, of this opinion.
Appeal 2007-0956
Application 10/028,651

15
rejection with respect to claim 31. Therefore, the Examiner’s decision
rejecting claims 1-10, 12-23, 25-28, 30, and 31 is affirmed-in-part.19
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv).

AFFIRMED-IN-PART

KIS

ZILKA-KOTAB, PC
P.O. BOX 721120
SAN JOSE, CA 95172-1120

19 Although not before us on appeal, we note that at least independent claims
14 and 27 raise issues regarding whether the claims recite statutory subject
matter under 35 U.S.C. § 101. For the reasons below, the Examiner should
consider whether at least these claims recite statutory subject matter.

Claim 14, for example, recites a “computer program product” with three
“computer code” limitations and limitations directed to alerting and updating
the claimed factors. Similarly, claim 27 recites three “logic” limitations with
commensurate limitations directed to alerting and updating the claimed
factors.

Significantly, however, no computer-readable medium is recited in either
claim. In effect, the claims appear to recite mere functional descriptive
material that, without more, constitutes nonstatutory subject matter.

If, however, such functional descriptive material is recorded on a computer-
readable medium, “it becomes structurally and functionally interrelated to
the medium and will be statutory in most cases since use of technology
permits the function of the descriptive material to be realized.”). See MPEP
§ 2106.01.