Ex Parte Gilde et al

Patent Trial and Appeal BoardMar 20, 2014

11336692 (P.T.A.B. Mar. 20, 2014)

UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________ Ex parte ROBERT G. GILDE and XIN SHEN ____________ Appeal 2011-012641 Application 11/336,692 Technology Center 2400 ____________ Before CARLA M. KRIVAK, JOHN A. EVANS, and J. JOHN LEE, Administrative Patent Judges. EVANS, Administrative Patent Judge. DECISION ON APPEAL Appellants1 seek our review2 under 35 U.S.C. § 134(a) of the Examiner’s final rejection of Claims 1-12 and 14-203 as obvious. We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM.4 1 The Real Party in Interest is McAfee, Inc. 2 We have considered in this decision only those arguments Appellants actually raised in the Briefs. Any other arguments which Appellants could have made but chose not to make in the Briefs are deemed to be waived. See 37 C.F.R. § 41.37(c)(1)(iv). 3 App. Br. 4. Appeal 2011-012641 Application 11/336,692 2 STATEMENT OF THE CASE The claims relate to network security, particularly to enabling enforcement of access control on a network. Spec. 1:9-10. Claims 1, 10, 17, and 20 are independent. The claims have not been argued separately and therefore stand or fall together. 37 C.F.R. § 41.37(c)(1)(iv). An understanding of the invention can be derived from a reading of exemplary Claim 1, which is reproduced below with disputed limitations italicized: 1. An apparatus for managing access to a network, comprising: a transceiver for receiving and sending information to a computing device; a processor in communication with the transceiver; and a memory in communication with the processor and useable in storing data and machine instructions that cause the processor to perform actions, including: detecting a request to join the network; and if the device is unauthorized: causing the device to be quarantined at a layer two data link layer, wherein a message is sent to the device explaining that the device has been quarantined, and initiating an audit of the device, and if the device is successfully registered and satisfies the audit, enabling the device to access the network by, at least in part, allowing the device to be removed from a quarantined network, wherein the audit is based on a policy that prescribes evaluating whether the device includes an antivirus program and a firewall application, and 4 Our decision refers to Appellants’ Appeal Brief filed January 19, 2011 (“App. Br.”); Reply Brief filed June 13, 2011 (“Reply Br.”); Examiner’s Answer mailed April 15, 2011 (“Ans.”); Final Office Action mailed August 19, 2010 (“Final Rej.”); and the original Specification filed January 19, 2006 (“Spec.”). Appeal 2011-012641 Application 11/336,692 3 wherein the policy prescribes which servers the device is permitted to access while being quarantined. REFERENCES The Examiner relies upon the prior art as follows: Gage et al. US 6,035,405 Issued Mar. 7, 2000 Mullen et al. US 2003/0217148 A1 Pub. Nov. 20, 2003 Vermeulen et al. US 60/570,962 Filed May 12, 2004 Liang et al. US 2005/0050336 A1 Pub. Mar. 3, 2005 Cheng US 7,467,405 B2 Issued Dec. 16, 2008 The claims stand rejected as follows:5 1. Claims 1-7, 9-12, 14-17, 19, and 20 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Vermeulen, Gage, and Liang. 2. Claim 8 stands rejected under 35 U.S.C. § 103(a) as being unpatentable over Vermeulen, Gage, Liang, and Cheng. 3. Claim 18 stands rejected under 35 U.S.C. § 103(a) as being unpatentable over Vermeulen, Gage, Liang, and Mullen. ISSUES ON APPEAL Based on Appellants’ arguments in the Appeal Brief (App. Br. 9-13) and Reply Brief (Reply Br. 2-5) that the Examiner has failed to establish a prima facie case of obviousness, the issues presented on appeal are: 5 Based on Appellants’ arguments in the Appeal Brief, we will decide the appeal on the basis of claims as set forth In the Analysis. See 37 C.F.R. § 41.37(c)(1)(vii). Appeal 2011-012641 Application 11/336,692 4 I. Whether the Examiner erred in finding Vermeulen teaches: A. causing the device to be quarantined at a layer two data link layer; and B. the device is successfully registered and satisfies the audit. II. Whether the Examiner erred in finding Liang teaches: A. a message is sent to the device explaining the device has been quarantined; B. the audit is based on a policy that prescribes evaluating whether the device includes an antivirus program and a firewall application; and C. the policy prescribes which servers the device is permitted to access while being quarantined. THE VERMEULEN PROVISIONAL APPLICATION The Examiner cites the Vermeulen provisional application against Claims 1-12 and 14-20. Ans. 3. Appellants do not challenge the qualifications of Vermeulen. “If an appellant fails to present arguments on a particular issue–or, more broadly, on a particular rejection–the Board will not, as a general matter, unilaterally review those uncontested aspects of the rejection.” Ex parte Frye, 94 USPQ2d 1072, 1075 (BPAI 2010) (precedential). However, given the unusual circumstance here, where claims are rejected over a provisional application, we review, de novo, whether Vermeulen qualifies as a prior-art publication. “[P]reserving a complete de novo review on the one hand, while not diverting Board effort into issues not raised by the appellant on the other hand, preserves the right balance between thorough review and administrative efficiency.” David Kappos, Ex Parte Frye: BPAI’s Standard of Review of Examiners’ Rejections (Mar. 9, Appeal 2011-012641 Application 11/336,692 5 2010), http://www.uspto.gov/blog/director/entry/ex_parte_frye_bpai_s (citing Frye). The question of whether a reference represents a “printed publication” is a question of law that is reviewed de novo. See In re Cronyn, 890 F.2d 1158, 1159 (Fed. Cir. 1989); In re Klopfenstein, 380 F.3d 1345, 1347 (Fed. Cir. 2004). “The statutory phrase ‘printed publication’ has been interpreted to mean that before the critical date the reference must have been sufficiently accessible to the public interested in the art; dissemination and public accessibility are the keys to the legal determination whether a prior art reference was ‘published.’” Cronyn, 890 F.2d at 1160 (quoting Constant v. Advanced Micro-Devices, Inc., 848 F.2d 1560, 1568 (Fed. Cir. 1988)). The Vermeulen provisional application forms the basis of non- provisional application US 11/568,914, filed November 10, 2006, which was published August 16, 2007, as US 2007/0192862 A1. The Examiner could have rejected the claims over the Vermeulen pre-grant publication by associating the pre-grant publication with the effective date of the underlying provisional application.6 A patent publication “‘shall have the same effect,’ including a patent-defeating effect, as to the claimed invention as though it was filed on the date of the . . . provisional” application. In re Giacomini, 612 F.3d 1380, 1384 (Fed. Cir. 2010). Although the Vermeulen provisional application was not published, it became disseminated and available for public inspection upon the publication of the Vermeulen pre-grant document. We hold the Vermeulen 6 Appellants have not challenged whether the non-provisional publication contains the same disclosure as the provisional document. Appeal 2011-012641 Application 11/336,692 6 provisional application to be a valid prior-art reference against the presently rejected claims. ANALYSIS “causing the device to be quarantined at a layer two data link layer” Appellants contend that there is no disclosure of layer two quarantining in Vermeulen. App. Br. 10. Appellants argue the central management node (CMN) quarantining a device in a penalty virtual local area network (VLAN) in Vermeulen is merely a simple recitation of a VLAN activity, which does not provide support for quarantining at a layer two data link layer. App. Br. 10-11. The Examiner finds the CMN gathers data, including a media access control (MAC) address, from the network to identify an offending device, and then creates a MAC rule to quarantine an offending device by automatically placing traffic with the device’s MAC address in a penalty VLAN. Ans. 14-15. The Examiner relies upon Newton’s Telecom Dictionary to show that a MAC address is a sublayer of the layer two data link layer in the Open Systems Interconnection (OSI) model. Ans. 15. We agree with the Examiner that the OSI model is a well-known industry standard.7 Thus, quarantining an offending device using its MAC address teaches quarantining at a layer two data link layer. Appellants’ Reply Brief failed to address these findings by the Examiner. We do not find error in these findings. 7 See ISO/IEC Standard 7498-1, http://standards.iso.org; MICROSOFT COMPUTER DICTIONARY (5th ed. 2002). Appeal 2011-012641 Application 11/336,692 7 “the device is successfully registered and satisfies the audit” Appellants contend there is no evidence that Vermeulen teaches any type of successful registration of the device. App. Br. 11. Appellants argue that downloading software to remove a problem on a quarantined device is not analogous to registering an offending device. Id. The Examiner finds the software download inherently requires identification of the device or user, and thus the broadest reasonable interpretation of “registration” includes “software download registration” of a device. Ans. 16. The Examiner also finds checking the device to ensure the downloaded software corrected the offending problem is analogous to “satisfies the audit . . . allowing the device to be removed from a quarantined network.” Id. Appellants reply that the Examiner is essentially taking Official Notice of registration activities, inferring that user and device identification would be inherent in any file downloading. Reply Br. 4-5. Appellants contend that this Official Notice has no basis in any reference or any technology being cited by the Examiner. Reply Br. 5. First, we agree with the Examiner’s finding Vermeulen teaches or suggests the device “satisfies the audit.” The Specification describes an “audit” as essentially determining vulnerabilities on a quarantined device and resolving the vulnerabilities so that the device may be accepted onto the network. Spec. 4:22-29. Vermeulen discloses checking an offending device to ensure the downloaded software corrected a problem, thus we find this to be analogous to the claimed “audit.” Next, we agree with the Examiner Vermeulen teaches or suggests “registering” the device. The Specification’s description of “register” is Appeal 2011-012641 Application 11/336,692 8 essentially a server checking the validity of user credentials and/or device credentials to allow a device access to the network. Spec. 26:21-25. By allowing the device back on the network after the downloaded software has resolved the offending problem, the CMN of Vermeulen has verified the validity of the device’s credentials. We are not persuaded of Examiner error. “a message is sent to the device explaining that the device has been quarantined” The Examiner finds Liang discloses a virus monitor device that detects a network computer virus in a flow of traffic in the network and provides an early warning of the network computer virus. Ans. 15. In response to the virus outbreak warning, the system isolates a network segment affected by the network computer virus. Id. The Examiner finds isolating a network segment’s infected clients includes informing them they are infected and cordoned off. Id. Appellants reply that an early virus warning sent to the virus warning response unit within the network is not analogous to notifying an actual device that it was quarantined. Reply Br. 3. The Specification indicates the “message” that is “sent to the device explaining that the device has been quarantined” is essentially sending a message to the user of the device explaining the act of quarantining has occurred. Spec. 4:22-24. While the early virus warning message in Liang is sent to a response unit to isolate the affected segment (Liang, ¶ [0040]), we nonetheless find support in the cited portions of Liang for a message that is sent to the user of the device. The Examiner cited Liang ¶ [0053], which discloses a “user interface can be displayed” on an isolated client device Appeal 2011-012641 Application 11/336,692 9 (one that is directed “only to the anti-virus software installation server 138 and no other”), indicating the client device is isolated from communicating with other systems on the network (i.e., quarantined). A user interface display on the device informing the user of the device’s isolation is analogous to a message being sent to the user of a device explaining the device has been quarantined. We are not persuaded of Examiner error. “the audit is based on a policy that prescribes evaluating whether the device includes an antivirus program and a firewall application” The Examiner finds Liang discloses a virus monitor device that detects a network computer virus in a flow of traffic in the network and provides an early warning of the network computer virus. Ans. 17. In response to the virus outbreak warning, the system isolates a network segment affected by the network computer virus. Id. Further, the Examiner finds Liang discloses querying clients to see if they have antivirus and firewall software installed, and in those situations where a client device is found not to have the appropriate antivirus and firewall software installed, the virus monitor will direct the client device to an antivirus installation. Id. We agree with the Examiner’s finding that Liang, ¶¶ [0008] and [0053], teaches and suggests querying client devices for the required antivirus and firewall applications, which is analogous to an audit policy that evaluates whether the device includes antivirus and firewall applications. Appellants’ Reply Brief fails to address these findings by the Examiner regarding the audit policy of Liang. We are not persuaded of Examiner error. Appeal 2011-012641 Application 11/336,692 10 “the policy prescribes which servers the device is permitted to access while being quarantined” Appellants contend the Examiner has failed to provide any evidence that Liang teaches the audit policy to prescribe which servers the device is permitted to access while being quarantined. App. Br. 12. Appellants argue the cited portions of Liang fail to discuss any type of server restriction, but rather discuss HTTPS protocol, which is not relevant to a policy of restricting server access. Id.; Reply Br. 5. The Examiner finds Liang discloses a virus monitor with an audit policy that monitors and isolates infected clients and an accompanying antivirus installation server that fixes the clients that have been segmented off. Ans. 17. The Examiner further finds Liang discloses, while a client is having antivirus software installed, HTTPS transmission protocol can be used to communicate with servers on the network since it is essentially immune from viral infections. Ans. 18. We agree with the Examiner’s finding the audit policy of Liang prescribes which servers the quarantined device is permitted to access. Liang, ¶ [0053], discloses a client without the proper antivirus software is directed only to the antivirus software server and no other. Until such time as the proper software has been installed, that client device will be prevented from communication with other systems. Id. As the Examiner noted, some communications may be still be permitted through a virus-immune protocol, such as HTTPS. Thus, Liang discloses an audit policy prescribing which servers the client can access (e.g., antivirus server and a server using HTTPS) and which server the client cannot access (e.g., any other servers). We are not persuaded of Examiner error. Appeal 2011-012641 Application 11/336,692 11 ORDER The rejection of Claims 1-12 and 14-20 under 35 U.S.C. § 103(a) is AFFIRMED. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv). AFFIRMED bab