Ex Parte 6119236 et alDownload PDFBoard of Patent Appeals and InterferencesAug 30, 201290010849 (B.P.A.I. Aug. 30, 2012) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 90/010,849 02/02/2010 6119236 FORT-000010L 5148 6449 7590 08/31/2012 ROTHWELL, FIGG, ERNST & MANBECK, P.C. 607 14th Street, N.W. SUITE 800 WASHINGTON, DC 20005 EXAMINER STEELMAN, MARY J ART UNIT PAPER NUMBER 3992 MAIL DATE DELIVERY MODE 08/31/2012 PAPER Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE BOARD OF PATENT APPEALS AND INTERFERENCES ____________ Ex parte ENHANCED SECURITY RESEARCH, L.L.C. ____________ Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 Technology Center 3900 ____________ Before KARL D. EASTHOM, STEPHEN C. SIU, and THOMAS L. GIANNETTI, Administrative Patent Judges. SIU, Administrative Patent Judge. DECISION ON APPEAL Patent owner (Appellant) appeals under 35 U.S.C. §§ 134(b) and 306 from a final rejection of claims 1-5 and 7-19. Claim 6 has been cancelled. We have jurisdiction under 35 U.S.C. §§ 134(b) and 306. An oral hearing was conducted on August 8, 2012. STATEMENT OF THE CASE Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 2 This proceeding arose from a request for ex parte reexamination filed by Michael A. DeSanctis on behalf of Fortinet, Inc. on February 2, 2010, of United States Patent 6,119,236 (the ‘236 Patent) issued to Peter M. Shipley on September 12, 2000 and filed December 10, 1998. Presently, claims 1-5 and 7-19 are rejected. Claim 6 was cancelled. The prior art references relied upon by the Examiner in rejecting the claims are: Haystack Labs, Inc., “NetStalker, Installation and User’s Guide, Version 1.0.2,” (Date disputed) (“NetStalker”). G.E. Liepins and H.S. Vaccaro, “Anomaly Detection: Purpose and Framework,” pp. 495-504, Oak Ridge National Labortatory andf Los Alamos National Laboratory, research paper submitted, 1989 (“Liepins”). Eric Hall, “Sneak Previews – Seattle Software’s Firewall Keeps Watch,” Network Computing, September 24, 1996 (“Hall”). Claim 1 on appeal reads as follows: 1. In a computer system connected to an external communications medium, a security device comprising: a programmable firewall device interposed between the computer system and the external communications medium; a controller device configured within the computer system such that said controller device can access all communications into and out of the computer system; and a communications device for communicating instructions from said controller device to said firewall device for controlling said firewall device; wherein said controller device is configured to operate generally continuously and repeatedly to: (i) examine, in essentially real time, communications incoming to the computer system; Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 3 (ii) analyze, in essentially real time, communications to detect if the communications contain patterns of activity indicative of an attempted security breach; (iii) assign a weight to the attempted security breach if an attempted security breach is detected; and (iv) continuously control the firewall during the operation of the computer system to block communications between the computer system and the external communications medium, based on the weight assigned to the attempted security breach, when an attempted security breach is detected. (App. Br., Claims App’x. 1) The Examiner rejects claims 1-5 and 7-19 under 35 U.S.C. § 103(a) as unpatentable over NetStalker and one of Hall or Liepins (Ans. 8). ISSUE Did the Examiner err in rejecting claims 1-5 and 7-19? PRINCIPLES OF LAW The question of obviousness is resolved on the basis of underlying factual determinations including: (1) the scope and content of the prior art, (2) any differences between the claimed subject matter and the prior art, and (3) the level of skill in the art. Graham v. John Deere Co. of Kansas City, 383 U.S. 1, 17-18 (1966). “The combination of familiar elements according to known methods is likely to be obvious when it does no more than yield predictable results.” KSR Int’l Co. v. Teleflex, Inc., 550 U.S. 398, 416 (2007). Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 4 ANALYSIS Priority date of the ‘236 patent The ‘236 patent is a continuation-in-part of U.S. Serial No. 08/726,563 (the ‘563 application), filed October 7, 1996. Respondent argues that the ‘236 patent is not entitled to the October 7, 1996 priority date (filing date of the ‘563 application). We disagree. “Over time” Claim 1 recites code for determining, over time, if the communications between a local area network and a wide area network contain patterns of activity. The Examiner states that “the ‘236 specification provides explicit definitions for” the term “over time” (Ans. 32). The ‘236 patent discloses that “the term ‘over time’ is herein specifically defined to mean over a time period which includes the examination of a series of more than one packet” (col. 9, ll. 31-34), while the ‘563 application discloses a “look for known patterns operation 36” (p. 12, ll. 11-12) that requires retention of “data for a limited amount of time, as it is patterns of activity over time . . . that is being examined” (id. at 15-18). Hence, one of skill in the art would have understood that the process is performed over a time period. In addition, the ‘563 application discloses a that a “large number of . . . attempts [to access a port] would leave little doubt of a methodical attempt at intrusion” (p. 13, ll. 18-20), “a quantity of ‘responses’ from machines on the internet 16” (p. 13, l. 22-23), and a “multitude of responses . . . forthcoming [through] the internet 16 to the LAN12” (p. 14, ll. 1-3). One of skill in the art, given the disclosure of the ‘563 application that discloses a Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 5 “large number,” “a quantity of,” or a “multitude of responses,” would have also understood that the process includes examination of “more than one packet” since such a “large number” of responses would have included more than one packet “over time.” (Id.) Hence, the ‘563 application discloses determining patterns of activity “over time,” which appears to be precisely what is claimed in the ‘236 patent. “Controlling a firewall” The Examiner states that “the ‘236 specification provides explicit definitions” for the term “control the firewall” (Ans. 32). The Specification discloses that “[t]he term ‘control the firewall’ is herein specifically defined to mean sending instructions to the firewall to direct it to reject packets which would not otherwise be rejected” (col. 10, ll. 5-8). The ‘563 application discloses sending “a control signal to the firewall” (p. 16, ll. 22- 23), the control signal to “direct the firewall . . . . to take . . . action” (p. 16, ll. 24-25). An example of an action to take, according to the ‘563 application, is “to block all access to the LAN12 from a sender which has been detected as attempting the security breach” (p. 17, ll. 3-5). Hence, the ‘563 application discloses directing (or “controlling”) a firewall to block communications.1 It appears that the ‘563 Specification supports the feature of “controlling a firewall” as recited in claim 1 of the ‘236 patent. 1 Each of these disclosures is also present in the ‘236 patent (see, col. 7, ll.53-55 and col. 8, ll. 5-7). Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 6 NetStalker and Liepins Missing pages (NetStalker) Appellant argues that Netstalker should not be considered as prior art because “it is a woefully incomplete document, missing material that likely would be highly relevant” (App. Br. 22). We disagree with Appellant. Appellant has not indicated any reason why missing material “would be highly relevant” in this case. The disclosure of NetStalker in those portions that are present serve to disclose that portion of NetStalker that presumably is relevant to the patentability of the ‘236 patent. Indeed, Appellant has not indicated that the portions of NetStalker provided are in any way irrelevant to the patentability of the ‘975 patent. If the provided portions of NetStalker disclose, for example, each feature recited in claim 1 (which the Examiner finds and Appellant does not appear to refute), then NetStalker would anticipate claim 1, regardless of what might be further disclosed in other portions of NetStalker that were not provided. Appellant cites the Manual for Patent Examiner Procedure (MPEP § 2218) and Federal Rules of Evidence, Rule 106 (App. Br. 24-25) but neither MPEP § 2218 nor Rule 106 applies to the present situation. As Appellant points out, MPEP § 2218 merely states that references should be legible. Appellant does not argue that any of the provided portions of NetStalker are illegible. Rule 106 permits, after submission of portions of evidence by a party, the introduction of additional portions of the evidence by an adverse party. Even assuming that the Federal Rules of Evidence apply to Inter Partes Reexamination matters at the U.S. Patent & Trademark Office, Rule 106 does not pertain to the present fact pattern since Appellant has not Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 7 indicated that Appellant was denied entry of additional pages of the NetStalker reference. We therefore find unpersuasive Appellant’s argument regarding whether every page of the NetStalker reference was provided or not and its bearing on whether NetStalker qualifies as prior art. Public accessibility (NetStalker) Appellant also argues that “the Examiner has not made a prima facie showing that the NetStalker reference was publicly accessible prior to Oct. 7, 1996 (or any other date)” (App. Br. 25). However, we note that the NetStalker reference was copyrighted 1996 and has a publication date of May 1996 indicated on the cover. (In re Ronald A. Katz Tech. Licensing, L.P., 2011 WL 1676313 at *6 (BPAI May 2, 2011) (informative) (holding that a document constituted a printed publication with indicia of copyright date and notices). Appellant argues that NetStalker was not publicly available in May 1996 (as indicated on the cover of the NetStalker reference) because the version of NetStalker provided is “a draft rather than [a] final version” as evidenced by a notation (i.e., “6-1-??, 6-5”) in the index (App. Br. 26) concerning certain specified page numbers. Appellant construes the clerical errors in the index of the NetStalker reference (with question marks inserted) as indicating that the NetStalker reference “was a work-in-progress” (App. Br. 26). However, Respondent provides a Declaration of the Chief Executive Officer and chairman of the board of Haystack Labs, Inc. (Stephen Smaha) that avers that the NetStalker reference provided “was available in May Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 8 1996” and was available to “[m]embers of the public showing an interest in buying or licensing the NetStalker product” by “requesting [a copy of the manual]” (Declaration of Stephen Smaha, dated February 24, 2010, ¶ 5). Appellant has not provided evidence refuting Mr. Smaha’s sworn testimony. We also disagree with Appellant that a clerical error or a missing page reference in the index of a document (even if replaced by question marks) indicates that the reference was not publicly available since Appellant has not demonstrated a meaningful relationship between such misprints and whether a document is publicly accessible or not. Appellant argues that even if the NetStalker reference were available to members of the public, Respondent has not demonstrated that the NetStalker reference was also publicly accessible to members of the public (see, e.g., App. Br. 26-27). To be considered a printed publication, the reference “must have been sufficiently accessible to the public interested in the art; dissemination and public accessibility are the keys to the legal determination whether a prior art reference was ‘published.’” Constant v. Advanced Micro-Devices, Inc., 848 F.2d 1560, 1568 (Fed. Cir. 1988) (citation omitted). “‘[P]ublic accessibility’ has been called the touchstone in determining whether a reference constitutes a ‘printed publication’ bar . . . .” In re Hall, 781 F.2d 897, 899 (Fed. Cir. 1986) (citation omitted). In the present case, Respondent has provided testimony from the Chief Executive Officer (Stephen Smaha) of the company that developed NetStalker (Haystack, Inc.) that the NetStalker reference “was available in May 1996” and that “[m]embers of the public . . . could have obtained a copy of the manual by . . . requesting one” (Declaration of Stephen Smaha, Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 9 dated February 24, 2010, ¶ 5). Mr. Smaha also testified that “NetStalker was advertised no later than 1995 . . .” and “advertisements . . . were directed at members of the networking community” (Declaration of Stephen Smaha, dated February 24, 2010, ¶ 6). In addition, Requester has provided evidence corroborating the existence of such advertisements, for example, in PR Newswire, Minneapolis, MN (Sep. 1995) “Network Systems and Haystack Labs Introduce NetStalker to Track Hacker Attempts” Accession No. 00531881 (3 pgs.) (cited in U.S. Patent No. 6,298,445 B1, “Other Publications” to Shostack – hereinafter, “PR Newswire”). PR Newswire (dated September 1995) provides a description of the NetStalker system, pricing information (e.g., “starts at under $5000”), and contact information for providing “more information.” The contact information provided in PR Newswire includes names, telephone numbers, and e-mail addresses of contacts and website information for potential customers. Members of the relevant public would have been apprised of the NetStalker system as early as September 1995 at least by viewing advertisements, such as PR Newswire, as according to Mr. Stephen Smaha’s testifimony. The members of the public, having been informed of the availability of the NetStalker system as early as September 1995, would also have been invited to contact specifically named individuals at Haystack, Inc. (developer of the NetStalker system) as indicated in PR Newswire for more information or to obtain the NetStalker system. As early as May 1996 (publication date of the NetStalker reference), such members of the public would have received the NetStalker reference upon request, according to Mr. Stephen Smaha’s testimony. Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 10 Just as the “indexing, cataloging, and shelving” of a document in a library is “persuasive evidence that the [reference] was accessible” (In re Hall, 781, F.2d 897, 899 (Fed. Cir. 1986)), the NetStalker reference in the present case would also have been “accessible” since the advertisement, at least, would have amply informed the interested public of the accessibility of the NetStalker reference by exercising reasonable diligence (i.e., upon request). Based on the record, we disagree with Appellant’s assertion that such notification of the relevant public (e.g., via advertisements) of the NetStalker product and provision of the NetStalker reference to anyone who then requested the reference does not constitute sufficient accessibility to those interested individuals exercising reasonable diligence. Appellant argues that Requester has failed to identify “a single customer to which . . . [the NetStalker reference] was distributed by May 1996 (or even later)” (App. Br. 27). We disagree with Appellant’s theory of the requirement of the identification of a specific customer in possession of the NetStalker reference before the reference can be deemed a publicly accessible publication. Rather, a printed document may qualify as a publicly accessible publication “so long as accessibility is sufficient ‘to raise a presumption that the public concerned with the art would know of (the invention).’” (In re Bayer, 568 F.2d 1357, 1361 (CCPA 1978)) or so long as the reference was “made available to the extent that persons interested and ordinarily skilled in the subject matter or art, exercising reasonable diligence, can locate it and recognize and comprehend therefrom the essentials of the claimed invention without the need of further research or Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 11 experimentation (In re Wyer, 655 F.2d 221, 223 (CCPA 1981) (citation omitted). Prior invention Appellant submits the Declaration of Peter M. Shipley Under 37 C.F.R. § 1.131 (Shipley Dec) and the Statement of F. Eric Saunders in Support of 37 C.F.R. § 1.131 Declaration (Saunders Dec) in order to establish an earlier date of prior invention (App. Br. 28). Mr. Shipley provides general allegations of various activity conducted prior to November 6, 1995 (Shipley Dec, ¶ 3). Mr. Shipley also asserts that prior to November 6, 1995 “the system was operational and met all of the limitations of claims 1 – 19 of the ‘236 patent” (Shipley Dec, ¶ 3(m)). Although not entirely clear, Mr. Shipley appears to argue actual reduction to practice of the claimed invention “prior to November 6, 1995.” However, such assertions merely constitute a declaration by the inventor to the effect that his invention was conceived or reduced to practice prior to the date of the reference. Absent is a statement of facts demonstrating the correctness of the inventor’s conclusion. Such general allegations, without more, are not sufficient to establish earlier invention since general assertions “amount[] essentially to mere pleading, unsupported by proof or a showing of facts”. Ex parte Saunders, 1883 C.D. 23 (Comm’r Pat. 1883); In re Borkowski, 505 F.2d 713, 718. (CCPA 1974). Alternatively, Appellant argues conception of the claimed invention prior to the date of the NetStalker reference and diligence from before the date of the NetStalker reference to Appellant’s constructive reduction to Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 12 practice (October 7, 1996). With regard to showing reasonable attorney diligence, F. Eric Saunders states the following timetable: 1) February 28, 1996: First meeting with Mr. Shipley to discuss the claimed invention (Saunders Dec, ¶ 2); 2) April 1, 1996: conducted patentability search (Saunders Dec, ¶ 4); 3) April 19, 1996: analyzed results of patentability search conducted on April 1, 1996 (Saunders Dec, ¶ 4); 4) May 4, 1996: conducted second patentability search (Saunders Dec, ¶ 4); 5) May 6, 1996: reported results of second patentability search (Saunders Dec, ¶ 4); 6) June – July 1996: “had several discussions . . . [with] Mr. Shipley” (Saunders Dec, ¶ 6); 7) July – August 1996: “worked diligently and continuously on the draft patent application” (Saunders Dec, ¶ 7); and 8) September 4, 1996: “I sent . . . a draft of the patent application [to Mr. Shipley]” (Saunders Dec, ¶ 8). 9) “Late September or early October 1996”: Met with inventor for dinner (Saunders Dec, ¶ 8). 10) October 7, 1996: “I submitted the final draft . . . for review” (Saunders Dec, ¶ 9). The general evidence of attorney diligence in preparation and filing of the present patent application between May and September 1996 is the statement by Mr. Saunders that he “had several discussions . . . [with] Mr. Shipley” (Saunders Dec, ¶ 6) and “worked diligently and continuously on the draft patent application” (Saunders Dec, ¶ 7).2 However, Appellant and 2 Mr. Shipley also attaches to his declaration an invoice dated July 31, 1996 from Mr. Saunders in an attempt to corroborate “work[] on my patent application [by Mr. Saunders] during the months of June, July, and August.” (Saunders Dec. ¶ 9.) The July invoice lists specific activity in July but it Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 13 Mr. Saunders only provide details of specific activities on May 4, 6, and 20, and activity in July, but do not provide any other details for June or August. While “reasonable diligence can be shown if it is established that the attorney worked reasonably hard on the particular application in question during the continuous critical period” (Bey v. Kollonitsch, 806 F.2d 1024, 1027 (Fed. Cir. 1986)), in the present case, Appellant has not provided records or other evidence showing the exact days when activity specific to this application occurred. Id. at 1027-28 (determining an insufficient showing of attorney diligence when there is a lack of records showing the exact days when activity specific to preparation of the patent application was performed). While “it may not be possible for a patent attorney to begin working on an application at the moment the inventor makes the disclosure” (Bey, 806 F.2d at 1028), Appellant has not provided sufficient evidence pertaining to “a backlog of other cases of other cases demanding [the attorney’s] attention” (id.). For example, Appellant does not provide evidence showing “that unrelated cases are taken up in chronological order” such as docket numbers assigned “to the cases in consecutive order . . . [and] the specific dates when the cases were docketed . . . [and] that the cases were taken up in chronological order. Bey, 806 F.2d at 1028 (holding that the patent attorney must generally show that unrelated cases are “taken up in chronological order” and that “the attorney has the burden of keeping good records of the does not account for work in June or August. (See Ex. 8S of Saunders Dec.) A May 31, 1996 invoice lists activity on April 19, May 4, and May 6 for a total of 3.6 hours, and also lists a file wrapper request on May 20 with no hours charged for that service. (See Ex. 5S of Saunders Dec.) Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 14 dates when cases are docketed as well as the dates when specific work is done on the applications”). In the absence of such evidence, we cannot conclude that the mere testimony from Mr. Saunders that he “worked diligently and continuously” over the four month period preceding the filing date of October 7, 1996 and Appellant’s general assertion that four months is “a reasonable time period to prepare and file a patent application” (App. Br. 16) are sufficient to demonstrate attorney diligence. Obviousness – NetStalker and Liepins Claim 1 recites assigning a weight to a security breach and blocking communications based on the assigned weight. Appellant argues that the combination of NetStalker and Liepins fails to disclose or suggest “classifying by assigning a weight” and blocking communications “based on either the severity level or a weighted classification” (see, e.g., App. Br. 33- 34). As the Examiner points out, NetStalker discloses a “user-defined severity” (pp. 5-5 and 6-16, Table 5-3), blocking communications (i.e., “shun,” p. 5-5) (see, e.g., Ans. 42) upon triggering an alarm, and a “threshold” as the “number of events to be recognized before triggering an alarm” (p. 6-17). Appellant has not pointed out a specialized definition of the term “weight” in the Specification or any meaningful difference, as would have been understood by one of ordinary skill in the art, between the claimed “weight” and a “severity” level as disclosed by NetStalker. Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 15 Hence, NetStalker discloses not only a user defined severity level of a security breach but also triggering an alarm when a certain number of (security) events are recognized and blocking communications when the alarm is triggered. Based on the NetStalker reference, one of ordinary skill in the art would have known to characterize a security breach based on level of severity (i.e., user defined severity) and block communications based on when a condition has been achieved (for example, when a threshold number of security events have been encountered). Given NetStalker’s disclosure of blocking communications when a threshold criteria is met indicating a security breach and given that one of ordinary skill in the art is “a person of ordinary creativity, not an automaton” (KSR, 550 U.S. at 421), one of skill in the art would have understood the practice of blocking communications when a security breach is detected, the security breach being of sufficient severity as to exceed a threshold. NetStalker further discloses that a severity level is assigned to security breach events thus further indicating that blocking communications when a severity level of security breach is identified would have been obvious (as assigning severity levels to security breaches were known to those of ordinary skill in the art), or at least obvious to try, as a matter of “ordinary creativity and common sense” (id. at 421 – “When there is a design need or market pressure to solve a problem and there are finite number of . . . solutions . . . it is likely the product not of innovation but of ordinary skill and common sense. In that instance the fact that a combination was obvious to try might show that it was obvious under 103.”). Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 16 Liepins provides further support for a conclusion that blocking communications based on a severity level of a security breach would have been obvious to one of ordinary skill in the art. Like NetStalker, Liepins generally discloses the identification of security breaches. Liepins specifically discloses “anomaly detection” in “computer security” (see, e.g., p. 495) by application of rules (e.g., “administrative rules, expertly determined rules, and automatically generated rules,” for example - p. 497) in which there is a “determination of the strengths (weights) to be assigned to the rules” (p. 501, last paragraph). Appellant has not sufficiently demonstrated a difference between the explicit disclosure of Liepins of assigning “weights” to rules that are utilized to identify security breaches (and to block communications). Nor do we independently identify any differences. Claim 12 recites similar features to claim 1 and Appellant does not provide additional arguments in support of claims 2-5, 7-11, or 13-19. Hence, the Examiner did not err in rejecting claims 1-5 and 7-19 as obvious over NetStalker and Liepins. Affirmance of the rejection of claims 1-5 and 7-19 over NetStalker and Liepins renders it unnecessary to reach the propriety of the Examiner’s decision to reject those claims on a different basis. Cf. In re Gleave, 560 F.3d 1331, 1338 (Fed. Cir. 2009). As such, we need not reach to propriety of the rejection of those claims over NetStalker and Hall. . CONCLUSION Appeal 2012-008692 Reexamination Control 90/010,849 Patent 6,119,236 17 The Examiner did not err in rejecting claims 1-5 and 7-19 as unpatentable over NetStalker and Liepins. DECISION The Examiner’s decision to reject claims 1-5 and 7-19 is affirmed. AFFIRMED rvb PATENT OWNER ROTHWELL, FIGG, ERNST & MANBECK, P.C. 1425 K STREET, NW SUITE 800 WASHINGTON, DC 20005 THIRD PARTY REQUESTER MICHAEL A. DESANCTIS FINANCIAL PLAZA AT UNION SQUARE 225 UNION BOULEVARD, SUITE 305 LAKEWOOD, CO 80228 Copy with citationCopy as parenthetical citation