Ex Parte Sprosts et al

Patent Trial and Appeal Board

Dec 16, 2013

11635921 (P.T.A.B. Dec. 16, 2013)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
11/635,921 12/07/2006 Craig Sprosts 60063-0136 6876
29989 7590 12/17/2013
HICKMAN PALERMO TRUONG BECKER BINGHAM WONG LLP
1 ALMADEN BOULEVARD
FLOOR 12
SAN JOSE, CA 95113
EXAMINER
LANIER, BENJAMIN E
ART UNIT PAPER NUMBER
2432
MAIL DATE DELIVERY MODE
12/17/2013 PAPER
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
PTOL-90A (Rev. 04/07)

UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

Ex parte CRAIG SPROSTS, SCOT KENNEDY,
DANIEL QUINLAN, LARRY ROSENSTEIN,
and CHARLES SLATER
____________

Appeal 2011-007180
Application 11/635,921
Technology Center 2400
____________

Before ST. JOHN COURTENAY III, THU A. DANG, and
CARL W. WHITEHEAD JR., Administrative Patent Judges.

COURTENAY, Administrative Patent Judge.

DECISION ON APPEAL

Appeal 2011-007180
Application 11/635,921
2
STATEMENT OF THE CASE
The Examiner finally rejected claims 1-11 and 13-23. Claim 12 was
canceled. (App. Br. 1). Appellants appeal therefrom under 35 U.S.C.
§ 134(a). We have jurisdiction under 35 U.S.C. § 6(b).
We affirm.

INVENTION
This invention relates to "techniques for responding to new
occurrences of threats in electronic messages, managing a quarantine queue
of threat-bearing messages, and scanning messages for threats." (Spec. 1).
Claim 1, reproduced below, is representative of the claimed subject matter:
1. An apparatus, comprising:
a network interface;
one or more processors coupled to the network interface;
logic coupled to the one or more processors which, when
executed by the one or more processors, causes the one or more
processors to perform:
[a] receiving an electronic mail message having a destination
address for a recipient account;
[b] determining a threat score value for the message;
[c] when the threat score value is greater than or equal to a
specified threat threshold, storing the message in a quarantine
queue without immediately delivering the message to the
recipient account;
[d] automatically releasing the message from the quarantine
queue in other than first-in-first-out order upon any of a
plurality of quarantine exit criteria, wherein each quarantine
exit criterion is associated with one or more exit actions; and
Appeal 2011-007180
Application 11/635,921
3
[e] upon a particular exit criterion, selecting and performing the
associated one or more exit actions comprising delivery of the
message to the recipient account;
[f] wherein the quarantine exit criteria comprise overflow of the
quarantine queue, or determining that a second threat score
value obtained after rescanning the message already stored in
the quarantine is lower than the specified threat threshold.
(Disputed limitation emphasized, elements lettered).
REFERENCES
The prior art relied upon by the Examiner as evidence in rejecting the
claims on appeal is:
Galea
Kissel
Costea
US 2002/0004908 A1
US 2004/0117648 A1
US 2006/0161988 A1
Jan. 10, 2002
Jun. 17, 2004
Jul. 20, 2006

REJECTIONS
1

R1. Claims 1-11 and 13-23 stand rejected under 35 U.S.C. § 112, first
paragraph, as failing to comply with the written description requirement.
R2. Claims 1-3, 5-8, 10, 11, 13-15, 17-20, 22, and 23 stand rejected
under 35 U.S.C. § 103(a) as unpatentable over the combined teachings and
suggestions of Kissel and Costea.
R3. Claims 4, 9, 16, and 21 stand rejected under 35 U.S.C. § 103(a) as
unpatentable over the combined teachings and suggestions of Kissel, Costea,
and Galea.

1
Claim 12 was canceled and therefore not rejected. (App. Br. 1).
Appeal 2011-007180
Application 11/635,921
4
GROUPING OF CLAIMS
Based on Appellants' arguments, we decide the appeal of the written
description rejection R1 of claims 1-11 and 13-23 on the basis of
representative claim 1. See 37 C.F.R. § 41.37(c)(1)(vii)(2004).
2

Based on Appellants' arguments, we decide the appeal of the
obviousness rejection R2 of claims 1-3, 5-8, 10, 11, 13-15, 17-20, 22, and 23
on the basis of claim 1. (Id.).
We address the rejection R3 separately, infra.

ANALYSIS
R1.
Regarding the claim 1 limitation [f] "wherein the quarantine exit
criteria comprise overflow of the quarantine queue, or determining that a
second threat score value obtained after rescanning the message already
stored in the quarantine is lower than the specified threat threshold"
(emphasis added), Appellants contend:
the disclosure of FIG. 3, 9 and paragraph [234] clearly supports
one embodiment in which the second threat score value,
computed upon rescanning of the message, is compared to the
same threat threshold value to which the first threat score,

2
Appellants filed a Notice of Appeal on Aug. 20, 2010. The date of filing
the Notice of Appeal determines which set of rules applies to an Ex Parte
appeal. If a notice of appeal is filed prior to January 23, 2012, then the 2004
version of the Board Rules last published in the 2011 edition of Title 37 of
the Code of Federal Regulations (37 C.F.R. § 41.1 et seq.) applies to the
appeal. See also MPEP Rev. 8, July 2010.

Appeal 2011-007180
Application 11/635,921
5
computed upon the first scanning of the message, was
compared, as claimed.
(App. Br. 5-6).
The Examiner finds:
This argument is not persuasive because the specification never
states that the second VSV is compared to the same threshold
used in Fig. 3 when described the comparison of the first VSV.
Paragraph [0234] of page 45, discloses that "In step 908, a test
is performed to determine if the new VSV for a message is
greater than or equal to a particular threshold, as in step 312 of
FIG. 3." . . . Simply stated, there is nothing in the
specification to suggest that the threshold used in step 908 is the
exact same numerical value as the threshold used in step 312.
(Ans. 7).
Appellants' contentions are persuasive. We find Appellants'
disclosure of Figures 3, 9, and the Specification at paragraph [0234],
evidences the inventors had possession
3
of the limitation [f] "specific threat
threshold" as being any value including a value the same as limitation [c]'s
"specific threat threshold." (App. Br. 5-6). Specifically, the support for
limitation [f] (Spec. ¶[0234]) does not limit the value of the "specific threat
threshold" in the rescan process in Figure 9, step 908. More specifically, we
observe the Specification (paragraph [0234]) describes "as in step 312 of
FIG. 3" which merely refers to Step 312, and not to any particular value of

3
While there is no in haec verba requirement, newly added claim limitations
must be supported in the specification through express, implicit, or inherent
disclosure. The fundamental factual inquiry is whether the specification
conveys with reasonable clarity to those skilled in the art that, as of the filing
date sought, Applicant was in possession of the invention as now claimed.
(See, e.g., Vas-Cath Inc. v. Mahurkar, 935 F.2d 1555, 1563-64 (Fed. Cir.
1991)).
Appeal 2011-007180
Application 11/635,921
6
the threat threshold in step 312. Therefore the Specification provides
support for the limitation [f] "specific threat threshold" (Fig. 9, step 908),
which can be any value, including the same value as the limitation [c]
"specific threat threshold" (Fig. 3, step 312). Accordingly, we reverse the
written description §112, first paragraph, rejection R1 of claims 1-11 and 13-
23.
R2.
Regarding the combination of references in obviousness rejection R2,
Appellants contend the combination is based on hindsight because "[b]ut
only the special insight of invention can account for the selection of the
same specified threat threshold to be used by the threat detection system and
all third parties cooperating with the threat detection system." (App. Br. 11).
The Examiner responds:
Costea discloses rescanning a file that was initially scanned an
identified as malicious and quarantined ([0029]). Examiner
stated that, it would have been obvious to one of ordinary skill
in the art at the time the invention was made for the quarantined
email messages of Kissel to be rescanned once in quarantine in
order to ensure that the message are in face infected as taught
by Costea ([0010]). Therefore, the rescanning of quarantined
email messages, in the proposed modification of Kissel, would
utilize the same scanning software and threshold value to the
extent discussed in Appellant's specification (Page 45, [0234]).
(Ans. 8-9).
Regarding Appellants’ hindsight argument, we note that our
reviewing courts have not established a bright-line test for hindsight. In KSR
Int’l Co. v. Teleflex, Inc., 550 U.S. 398 (2007), the U.S. Supreme Court
guides that “[a] factfinder should be aware, of course, of the distortion
caused by hindsight bias and must be cautious of argument reliant upon ex
Appeal 2011-007180
Application 11/635,921
7
post reasoning.” KSR, 550 U.S. at 421 (citing Graham v. John Deere Co.of
Kansas City, 383 U.S. 1, 36 (1966)). Nevertheless, the Supreme Court also
qualified the issue of hindsight by stating “[r]igid preventative rules that
deny factfinders recourse to common sense, however, are neither necessary
under our case law nor consistent with it.” Id.
Here, we see the hindsight question before us as a balancing test,
whether the Examiner’s proffered combination of references is merely:
(1) “the predictable use of prior art elements according to their established
functions” (KSR, 550 U.S. at 417), consistent with common sense; or,
(2) would an artisan reasonably have combined the cited references in the
manner proffered by the Examiner but for having the benefit of the claim to
use as a guide (i.e., impermissible hindsight)?
After reviewing the respective teachings and suggestions of the cited
references, we find the evidence more strongly supports the first prong of the
balancing test. We conclude that it would have been obvious to an artisan
having general knowledge of managing electronic messaging systems to
repeat Kissel's same scanning and testing steps (compare the threat score
with a threshold) in order to ensure that the messages are in fact infected as
taught by Costea, because we find changing the threshold would add
additional complexity to the process without adding significant benefit.
Therefore, the rescanning and retesting of quarantined email messages, in
the proposed modification of Kissel with the teachings of Costea, would
simply repeat the same steps using the same scanning software and same
specific threat threshold value. (Ans. 4-5, 8). For these reasons, on this
record, we are not persuaded the Examiner erred.

Appeal 2011-007180
Application 11/635,921
8
B.
Regarding the claim 1 limitation [f] "wherein the quarantine exit
criteria comprise . . . determining that a second threat score value obtained
after rescanning the message already stored in the quarantine is lower than
the specified threat threshold," (emphasis added) Appellants contend that
Costea would not have taught or suggested "second threat score value" and
"the specified threat threshold," because Costea "scans a file to determine
whether the file contains a virus-a yes-or-no, binary decision." (App. Br. 8).
Appellants' contentions are not persuasive because Appellants
consider the teachings of Costea in isolation and fail to specifically rebut the
Examiner's ultimate legal conclusion of obviousness that is based on the
combination of Kissel and Costea.
4
(Ans. 7-9). For these reasons, on this
record, we are not persuaded the Examiner erred. Accordingly, we sustain
the rejection R2 of claims 1-3, 5-8, 10, 11, 13-15, 17-20, 22, and 23.
R3.
Regarding rejection R3 of claims 4, 9, 16, and 21, Appellants
contend these claims are patentable by virtue of their dependency from
parent claims 1 and 13. (App. Br. 12). However, we find no deficiencies in
the rejections of claims 1 and 13 for the reasons discussed above. Therefore,
we sustain the Examiner's rejection R3 of these claims 4, 9, 16, and 21.

4
One cannot show nonobviousness by attacking references individually
where the rejections are based on combinations of references. In re Merck
& Co., Inc., 800 F.2d 1091, 1097 (Fed. Cir. 1986).

Appeal 2011-007180
Application 11/635,921
9
DECISION
We reverse the Examiner's rejection R1 of claims 1-11 and 13-23
under § 112.
We affirm the Examiner's rejections R2 and R3 of claims 1-11 and 13-
23 under § 103.
Because we have affirmed at least one ground of rejection with
respect to each claim on appeal, the Examiner’s decision is affirmed. See 37
C.F.R. § 41.50(a)(1).
No time for taking any action connected with this appeal may be
extended under 37 C.F.R. § 1.136(a)(1). See 37 C.F.R. § 41.50(f).

AFFIRMED

ELD