Ex Parte Spurlock

Patent Trial and Appeal Board

Feb 5, 2019

14581439 (P.T.A.B. Feb. 5, 2019)

UNITED STA TES p A TENT AND TRADEMARK OFFICE
APPLICATION NO. FILING DATE
14/581,439 12/23/2014
152506 7590 02/07/2019
Patent Capital Group - McAfee, LLC
2816 Lago Vista Lane
Rockwall, TX 75032
FIRST NAMED INVENTOR
Joel R. Spurlock
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www .uspto.gov
ATTORNEY DOCKET NO. CONFIRMATION NO.
04796-1246(P78424) 7261
EXAMINER
TRAN, ELLEN C
ART UNIT PAPER NUMBER
2433
NOTIFICATION DATE DELIVERY MODE
02/07/2019 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
eofficeaction@appcoll.com
P AIR_152506@patcapgroup.com
Monica_Maluste@mcafee.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte JOEL R. SPURLOCK 1
Appeal2018-006749
Application 14/581,439
Technology Center 2400
Before JENNIFER S. BISK, LARRY J. HUME, and
JULIET MITCHELL DIRBA, Administrative Patent Judges.
DIRBA, Administrative Patent Judge.
DECISION ON APPEAL
This is a decision on appeal under 35 U.S.C. § 134(a) from the Final
Rejection of claims 1-5, 7-13, 15-21, and 23-28. We have jurisdiction
under 35 U.S.C. § 6(b ).
We REVERSE.
1 According to Appellant, the real party in interest is McAfee, LLC. App.
Br. 2.
Appeal2018-006749
Application 14/581,439
STATEMENT OF THE CASE2
The Invention
Appellant's disclosed embodiments and claimed invention relate to
determining a reputation for a process running on an electronic device.
Spec. ,r,r 1, 19.
Exemplary Claim
Claim 1, reproduced below, is representative of the subject matter on
appeal:
1. At least one non-transitory, computer-readable medium
comprising one or more instructions that, when executed by at
least one processor, cause the at least one processor to perform
a method comprising:
identifying a process, wherein the process includes
executable code that interacts with an electronic device, and a
reputation is assigned to the process;
determining a reputation for the executable code;
combining the reputation for the executable code and a
reputation of the electronic device with the reputation assigned
to the process to update the reputation for the process; and
merging the reputation assigned to the process and a
reputation of an actor process, if the actor process causes an
attach thread event or a write process memory event to the
process, to protect a resource of a computer.
2 Our Decision relies upon Appellant's Appeal Brief ("App. Br.," filed
Feb. 20, 2018); Appellant's Reply Brief ("Reply Br.," filed June 18, 2018);
Examiner's Answer ("Ans.," mailed Apr. 20, 2018); Final Office Action
("Final Act.," mailed Sept. 18, 2017); and the original Specification
("Spec.," filed Dec. 23, 2014).
2
Appeal2018-006749
Application 14/581,439
Prior Art
The Examiner relies upon the following prior art as evidence in
rejecting the claims on appeal:
Niemela et al. ("Niemela") US 2011/0225655 Al
Amitai et al. ("Amitai")
Oliver et al. ("Oliver")
Mircescu3
US 2012/0005729 Al
US 2012/0192275 Al
US 2015/0096018 Al
Rejections on Appeal
Sept. 15, 2011
Jan. 5,2012
July 26, 2012
Apr. 2, 2015
RI. Claims 1-3, 7-11, 15-19, and 23-25 stand rejected under 35
U.S.C. § 103 as being unpatentable over the combination ofMircescu and
Amitai. Final Act. 6-8.
R2. Claims 4, 5, 12, 13, 20, and 21 stand rejected under 35 U.S.C.
§ 103 as being unpatentable over the combination of Mircescu, Amitai, and
Oliver. Final Act. 8-10.
R3. Claims 26-28 stand rejected under 35 U.S.C. § 103 as being
unpatentable over the combination of Mircescu, Amitai, and Niemela. Final
Act. 10-11.
ANALYSIS
Based upon our review of the record, we find a preponderance of the
evidence supports particular arguments advanced by Appellant with respect
to claims 1-5, 7-13, 15-21, and 23-28 for the specific reasons discussed
3 Mircescu was filed on September 27, 2013 and, thus, qualifies as prior art
under 35 U.S.C. § I02(a)(2).
3
Appeal2018-006749
Application 14/581,439
below. We highlight and address specific findings and arguments regarding
claim 1 for emphasis as follows. 4
Rejection RI of Claims 1-3, 7-11, 15-19, and 23-25
Claim 1 recites: "combining [1] the reputation for the executable code
and [2] a reputation of the electronic device with [3] the reputation assigned
to the process to update [3] the reputation for the process." 5 App. Br. 12
(Claims Appendix) ( emphasis and numbers added) (referred to in this
Decision as the "combining limitation"). Appellant argues the combining
limitation is not taught or suggested by the proposed combination of
Mircescu and Amitai. App. Br. 6-8; Reply Br. 2.
The Examiner found Mircescu teaches updating the reputation of a
process and Amitai teaches the remainder of the combining limitation. Final
Act. 7. Specifically, the Examiner pointed to Amitai' s disclosure of a device
score, which is used to authenticate the device before it accesses a network.
4 Appellant discusses the limitations of claim 1 (App. Br. 5-10; Reply Br.
2--4 ), so we refer to claim 1 in this Decision. The Examiner used claim 17
as the representative claim (Final Act. 6-7), but the Appellant identifies no
relevant differences between the limitations of claims 1 and 1 7.
5 We note claim 1 was amended during prosecution, and the combining
limitation differs from the disclosure in Appellant's Specification. See Spec.
,r 44 ( disclosing an update of a process's reputation with an executable
function's reputation and a separate update to the process's reputation with
an electronic device's reputation); see also App. Br. 3 (citing Spec. ,r 44 as
disclosing the combining limitation). We have not considered, and do not
decide, whether Appellant's Specification satisfies the written description
and enablement requirements of 35 U.S.C. § 112(a). The Examiner may
wish to consider these issues in further prosecution. Although the Board is
authorized to reject claims under 37 C.F.R. § 4I.50(b), no inference should
be drawn when the Board elects not to do so. See Manual of Patent
Examining Procedure (MPEP) § 1213.02 (9th ed. 2018).
4
Appeal2018-006749
Application 14/581,439
Final Act. 7 ( citing Amitai ,r,r 4--9). The Examiner concluded that the
combining limitation was obvious because one of ordinary skill in the art
would be motivated:
[to use] a reputation indicator taught in [Mircescu] to include a
means to include a means [sic] to vary a reputation based on
changes in an electronics device reputation. One of ordinary
skill in the art would have been motivated to perform such a
modification because improvements are needed to authenticate
devices to a network see [Amitai] paragraph 3.
Final Act. 7.
Appellant acknowledges that Amitai calculates a device score, but
argues that Amitai fails to teach or suggest combining the device score with
a reputation of a process. App. Br. 6-7. The Examiner responds that "it is
the combination [of Mircescu and Amitai] that strongly suggest[s]" the
combining limitation recited in Appellant's claim. Ans. 7. In support, the
Examiner points to Mircescu' s update of a process's reputation and Amitai' s
calculation of a device score based on the reputation of a process, a software
program, and/or other executable code. Id.; see also id. at 9-11 (discussing
Amitai' s calculation of device score).
We find the Examiner has not adequately explained (and it is unclear
from our review) how the relied-upon disclosures teach or suggest
combining a reputation of an electronic device with a reputation assigned to
a process to update the reputation of the process. The Examiner finds:
Amitai discloses a reputation of an electronic device; Mircescu discloses a
reputation of a process; and both Amitai and Mircescu update their
respective reputations based on the reputation of executable code. Final
Act. 7; Ans. 7, 9-11. We agree with these factual findings. See, e.g.,
Mircescu, Abstract, ,r,r 6, 83 ( calculating and updating a process's reputation
5
Appeal2018-006749
Application 14/581,439
based on the reputations of various software modules); Amitai, Abstract,
,r,r 4--5 ( calculating and updating an electronic device's reputation based on
the reputation of various software modules). However, the Examiner fails to
provide sufficient rationale for combining these elements in the manner
required by the claim. See Transocean Offshore Deepwater Drilling, Inc. v.
Maersk Contractors USA, Inc., 617 F.3d 1296, 1303---04 (Fed. Cir. 2010)
("[I]t is not enough to simply show that the [prior art] references disclose the
claim limitations."). In particular, the Final Action vaguely references
"improvements" for authenticating devices on a network (see Final Act. 7
(citing Amitai ,r 3)), but provides no incentive, motivation, or commentary
on why a person of ordinary skill in the art would have combined Amitai' s
device score and Mircescu' s process reputation to update the process's
reputation. Moreover, we see nothing in the cited portions of these reference
themselves that provides a motivation to combine these references in this
manner. Without the necessary rationale, the Final Action does not establish
a prima facie case of obviousness of the claimed invention. See In re Kahn,
441 F.3d 977, 988 (Fed. Cir. 2006) (requiring a "rational underpinning to
support the legal conclusion of obviousness"), cited with approval in KSR
Int'! Co. v. Teleflex Inc., 550 U.S. 398,418 (2007).
Therefore, based upon the findings above, on this record, we are
persuaded of error in the Examiner's reliance on the cited prior art
combination to teach or suggest this limitation of claim 1, such that we find
error in the Examiner's resulting legal conclusion of obviousness.
Accordingly, we do not sustain the Examiner's obviousness rejection of
independent claim 1, or independent claims 9, 17, and 24, which recite the
disputed limitations in commensurate form.
6
Appeal2018-006749
Application 14/581,439
For the same reasons, we also reverse Rejection RI under 35 U.S.C.
§ 103 of claims 2, 3, 7-11, 15-19, and 23-25 that depend from independent
claims 9, 1 7, and 24.
Rejections R2 and R3 of Claims 4, 5, 12, 13, 20, 21, and 26--28
In light of our reversal of the rejections of independent claims 1, 9, 17,
and 24, supra, we also reverse obviousness Rejections R2 and R3 under
35 U.S.C. § 103 of dependent claims 4, 5, 12, 13, 20, 21, and 26-28 which
depend from independent claims 1, 9, 17, and 24. On this record, the
Examiner has not shown how the additionally cited references, Oliver and
Niemela, overcome the aforementioned deficiencies with the combination of
Mircescu and Amitai, as discussed above regarding claim 1.
Additional Clarification
Because the above is dispositive of the Appeal, we do not address
Appellant's other arguments in detail. We do, however, respond to selected
points raised by Appellant's Briefs.
Appellant argues that the references fail to disclose "a write process
memory event." App. Br. 8-9. Although Appellant submits that "an attach
thread event and a process memory event are structures recognized in the
art" (id. at 9), Appellant fails to clarify the meaning of either claim term and
fails to point to evidence in the record to define these terms. Rather,
Appellant contends that "the only evidence of record as to the meaning of a
write process memory event is para. [0025] of Appellant's [S]pecification."
Reply Br. 3. However, we find that the cited portion of the Specification
provides little guidance:
7
Appeal2018-006749
Application 14/581,439
In an example, process reputation module 110 can be
configured to establish a target or base process reputation for a
process. More specifically, process reputation module 110 can
monitor events in the system such as library load, attach
thread, write process memory, etc and if such an event occurs,
the process's reputation can be modified to include the
reputation of the event.
Spec. ,r 25 ( emphasis added). On this record, we conclude that a write to
memory falls within the scope of the broadest reasonable construction of the
claimed "write process memory event." See In re Van Geuns, 988 F.2d
1181, 1184 (Fed. Cir. 1993) ( citations omitted) ("In the patentability context,
claims are to be given their broadest reasonable interpretations," and
"limitations are not to be read into the claims from the specification.").
Further, under the broadest reasonable interpretation of claim 1, the
step of "merging" may never occur. See Ex parte Schulhauser, Appeal No.
2013-007847, at *9 (PTAB April 28, 2016) (precedential). If the condition
is not met-i.e., if the actor process does not cause "an attach thread event or
a write process memory event to the process"-then the merging step need
not be performed. See id. at *6-7. Based on the claim limitations as written,
the broadest reasonable interpretation of claim 1 encompasses an instance in
which the method ends before the merging of a reputation assigned to the
process and a reputation of an actor process. See id. at *8.
8
Appeal2018-006749
Application 14/581,439
CONCLUSION
The Examiner erred with respect to obviousness Rejections RI
through R3 of claims 1-5, 7-13, 15-21, and 23-28 under 35 U.S.C. § 103
over the cited prior art combinations of record, and we do not sustain the
rejections.
DECISION
We reverse the Examiner's decision rejecting claims 1-5, 7-13, 15-
21, and 23-28.
REVERSED
9