Ex Parte Stites et alDownload PDFPatent Trial and Appeal BoardOct 23, 201814003020 (P.T.A.B. Oct. 23, 2018) Copy Citation UNITED STA TES p A TENT AND TRADEMARK OFFICE APPLICATION NO. FILING DATE 14/003,020 09/04/2013 31894 7590 10/23/2018 OKAMOTO & BENEDICTO, LLP P.O. BOX 641330 SAN JOSE, CA 95164 FIRST NAMED INVENTOR Ronald S. Stites UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www .uspto.gov ATTORNEY DOCKET NO. CONFIRMATION NO. 10033.026700 3001 EXAMINER AMORIN, CARLOS E ART UNIT PAPER NUMBER 2498 MAIL DATE DELIVERY MODE 10/23/2018 PAPER Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte RONALD S. STITES, CRAIG D. BOTKIN, and BRIAN K. CAMPBELL Appeal2018-002652 Application 14/003,020 Technology Center 2400 Before JOHN A. JEFFERY, JOHNNY A. KUMAR, and MATTHEW J. McNEILL, Administrative Patent Judges. JEFFERY, Administrative Patent Judge. DECISION ON APPEAL Appellants 1 appeal under 35 U.S.C. § 134(a) from the Examiner's decision to reject claims 1, 30, 37, 38, and 61. We have jurisdiction under 35 U.S.C. § 6(b). We reverse. STATEMENT OF THE CASE Appellants' invention prevents computer network intrusions by matching data patterns to identify threats. To this end, both partial and full match determinations are made with respect to data blocks of a received data 1 Appellants identify the real party in interest as Trend Micro, Inc. App. Br. 1. Appeal2018-002652 Application 14/003,020 word, including the blocks' value and position in a signature data pattern. See generally Abstract; Spec. ,r 1. Claim 1 is illustrative: 1. A method of intrusion prevention for protecting a computer network, the method comprising: generating, via an intrusion-prevention system (IPS), a plurality of preprocessing-signature-pattern-hash results for a signature data pattern, wherein the IPS includes a processor and hardware; mapping, via the IPS, the signature data pattern to a first pre- processing memory address of a first memory device and a second pre- processing memory address of a second memory device based on the pre- processing-signature-pattern-hash results; flagging, via the IPS, the first pre-processing memory address of the first memory device and the second pre-processing memory address of the second memory device; receiving, via a network interface of the IPS, a subject data word; generating, via the IPS, a plurality of pre-processing-subject-hash results for the subject data word; mapping, via the IPS, the subject data word to a first subject data word preprocessing memory address of the first memory device and a second subject data word pre-processing memory address of the second memory device based on the corresponding pre-processing-subject-hash results; performing, via the IPS, subsequent to a determination that the first subject data word pre-processing memory address of the first memory device is the same as the flagged first pre-processing memory address and the second subject data word preprocessing memory address of the second memory device is the same as the flagged second pre-processing memory address, a partial-match determination including determining that a partial- match number of a plurality of subject-data blocks of the subject data word respectively match the same partial-match number of a plurality of 2 Appeal2018-002652 Application 14/003,020 signature-data blocks of the signature data pattern with respect to both value and position in the signature data pattern; performing, via the IPS, subsequent to making the partial-match determination, a full-match determination comprising a determination that all of the subject-data blocks respectively match all of the signature-data blocks with respect to both value and position in the signature data pattern; and subsequent to making the full-match determination, indicating that the subject data word comprises a known threat to the computer network. THE REJECTION The Examiner rejected claims 1, 30, 37, 38, and 61 under 35 U.S.C. § 103 as unpatentable over Pandya (US 2011/0145181 Al; published June 16, 2011) and Sherwood (US 2007/0233628 Al; published Oct. 4, 2007). Ans. 3-12.2 FINDINGS AND CONTENTIONS Regarding independent claim 1, the Examiner finds that Pandya discloses, among other things, (1) mapping a subject data word to first and second pre-processing memory addresses based on corresponding hash results by generating "k" hash indices in step 2109 of Figure 21, and (2) determining a partial match of subject- and signature-data blocks by determining whether memory bit values at memory locations HI to Hk are all "1" in step 2111. See Ans. 3---6. Although the Examiner finds that Pandya also determines an exact or "full" match in steps 2113 and 2114 after 2 Throughout this opinion, we refer to (1) the Appeal Brief filed July 13, 2017 ("App. Br."); (2) the Examiner's Answer mailed November 16, 2017 ("Ans."); and (3) the Reply Brief filed January 8, 2018 ("Reply Br."). 3 Appeal2018-002652 Application 14/003,020 the "coarse" or partial match in step 2111, the Examiner nonetheless cites Sherwood for teaching that a full-match determination, namely determining that all subject-and signature-data blocks match with respect to value and position in the signature data pattern, occurs after determining a partial match. Ans. 6-7. Based on these collective teachings, the Examiner concludes that the claim would have been obvious. Id. Appellants argue that although Pandya discloses pre-processing followed by full matching, Pandya lacks the recited partial match determination, and Sherwood does not cure this deficiency. App. Br. 4--8; Reply Br. 2-3. According to Appellants, unlike pre-processing hashing that involves matching the subject data word's hash against a compressed signature (i.e., the signature's hash), the recited partial match determination matches particular data blocks of the subject data word against those of the signature itself. App. Br. 6-7; Reply Br. 2-3. As such, Appellants contend, Pandya's hash match falls short in this regard because a hash represents more than one signature data pattern and, therefore, matching a hash does not match the signature's data blocks in both value and position. Id. ISSUE Under§ 103, has the Examiner erred in rejecting claim 1 by finding that Pandya and Sherwood collectively would have taught or suggested the recited partial match determination? ANALYSIS We begin by noting that it is undisputed that Pandya discloses hash- based pre-processing followed by a full-match determination. See App. Br. 4 Appeal2018-002652 Application 14/003,020 5-6; Reply Br. 3. Rather, this dispute hinges on whether Pandya also discloses an intervening partial-match determination that occurs after pre- processing, but before the full-match determination. Turning to claim 1, the recited partial-match determination includes determining that a number of blocks, namely a "partial-match number," of a subject data word respectively match the same number of blocks of a signature data pattern with respect to both value and position in that pattern. The subsequent full-match determination is similar, but for all such blocks. Given this distinction between a "partial-match number" of blocks and all such blocks with respect to these determinations, a "partial match- number" of blocks is less than all blocks when interpreted in light of Appellants' disclosure. Otherwise, the two determinations would be duplicative for all blocks, essentially conflating the partial-and full-match determinations in that circumstance. Such a result runs counter to the clear distinction between these determinations detailed in Appellants' disclosure. Compare Spec. ,r,r 131-172 with Spec. ,r,r 173-205. That Appellants' Abstract states explicitly that the partial-match determination involves less than all subject-data blocks only underscores this distinction, as does original claim 1 that recited explicitly that the partial-match number is less than a total number of the subject-data blocks. A key aspect of both determinations is that the subject data word's data blocks must match those of the signature data pattern with respect to both value and position. Therefore, not only must the blocks themselves match in these determinations, but also with respect to their value and position in the signature data pattern. 5 Appeal2018-002652 Application 14/003,020 Given these limitations, we find the Examiner's rejection problematic on this record. According to the Examiner, Pandya's system determines a partial match of subject-and signature-data blocks by determining whether memory bit values at memory locations HI to Hk are all "1" in step 2111 of Figure 21. See Ans. 5---6, 16 (finding that Pandya's system first compares "fully expanded" data in a "coarse" way to determine if a subset of locations have the same matching bit before determining a complete "exact" match of the entire content stream). To be sure, this memory bit value comparison in step 2111 in Pandya's Figure 21 occurs before a full-match determination in steps 2113 and 2114 and, therefore, is an initial or "coarse" match determination at least with respect to determining whether memory bit values match the value of "I." See Pandya ,r 139. But this "coarse" determination is not the particular partial-match determination in claim 1 that requires determining whether the subject data word's data blocks match those of the signature data pattern with respect to both value and position. Nor is this particular comparison achieved by Pandya's comparing hash values that represent multiple signatures as Appellants indicate. App. Br. 6-7; Reply Br. 2. So even if Pandya's system determines whether all subject-data blocks match those of the signature data pattern with respect to both value and position in the exact match determination in steps 2113 and 2114 in Figure 21, the same cannot be said for the initial or "coarse" match determination in step 2111 that is said to correspond to the recited partial- match determination. Nor does Sherwood cure that deficiency. 6 Appeal2018-002652 Application 14/003,020 Therefore, we are persuaded that the Examiner erred in rejecting (1) independent claim 1; (2) independent claim 30 that recites commensurate limitations; and (3) the dependent claims for similar reasons. CONCLUSION The Examiner erred in rejecting claims 1, 30, 37, 38, and 61 under § 103. DECISION We reverse the Examiner's decision to reject claims 1, 30, 37, 38, and 61. REVERSED 7 Copy with citationCopy as parenthetical citation