F-Secure CorporationDownload PDFPatent Trials and Appeals BoardJan 7, 20212019004492 (P.T.A.B. Jan. 7, 2021) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 15/046,918 02/18/2016 Juha YLIPEKKALA 060B.0086.U1(US) 4074 29683 7590 01/07/2021 Harrington & Smith, Attorneys At Law, LLC 4 RESEARCH DRIVE, Suite 202 SHELTON, CT 06484-6212 EXAMINER SAADOUN, HASSAN ART UNIT PAPER NUMBER 2435 NOTIFICATION DATE DELIVERY MODE 01/07/2021 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address(es): USPTO@HSPATENT.COM PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE ____________________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________________ Ex parte JUHA YLIPEKKALA, JAMMU KEKKONEN, ANDREW PATEL, JARNO NIEMELA, JARI SAVANDER, JANI JAPPINEN, JUHO HEIKKINEN, and ZIMRY ONG ____________________ Appeal 2019-004492 Application 15/046,918 Technology Center 2400 ____________________ Before ELENI MANTIS MERCADER, ERIC S. FRAHM, and JULIET MITCHELL DIRBA, Administrative Patent Judges. DIRBA, Administrative Patent Judge. DECISION ON APPEAL1 Pursuant to 35 U.S.C. § 134(a), Appellant2 seeks review of the Examiner’s rejection of claims 1, 3–13, and 15–22. We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM-IN-PART. 1 This Decision uses the following abbreviations: “Spec.” for the original Specification, filed February 18, 2016, which claims the benefit of an earlier-filed foreign application; “Final Act.” for the Final Office Action, mailed March 27, 2018; “Appeal Br.” for Appellant’s Appeal Brief, filed December 27, 2018; “Ans.” for Examiner’s Answer, mailed March 21, 2019; and “Reply Br.” for Appellant’s Reply Brief, filed May 15, 2019. 2 We use the word “Appellant” to refer to “applicant” as defined in 37 C.F.R. § 1.42. According to Appellant, the real party in interest is F-Secure Corp. Appeal Br. 3. Appeal 2019-004492 Application 15/046,918 2 BACKGROUND Appellant’s disclosed embodiments and claimed invention relate to a malware scanning technique. Spec. 1:7–10; see id. at 1:14–17 (“[M]alware scanning . . . is generally directed to identify (and potentially also disinfect) any kind of malware on computer and/or communication systems, such as e.g. viruses, Trojans, worms, or the like.”). Claim 1, reproduced below, is illustrative of the claimed subject matter: 1. A method of scanning an electronic file for malware in a network, the method comprising: at a first node, generating at least one scanning object of the electronic file on the basis of a dynamic configuration provided to the first node of the network by a second node of the network, the dynamic configuration including a definition of malware-susceptible data of the electronic file, and the at least one scanning object being generated by using the malware-susceptible data of the electronic file and neglecting malware-insusceptible data of the electronic file identified by said definition, and generating a signature of the at least one scanning object; if the at least one signature matches a previously identified signature, determining whether or not the electronic file is malware based on an indication associated with the matching previously identified signature; and if the at least one signature does not match a previously identified signature, sending the at least one scanning object from the first node to the second node for scanning and receiving at the first node a scanning result from the second node. Appeal Br. 20 (Claims App.) (emphases added). Appeal 2019-004492 Application 15/046,918 3 REJECTIONS R1. Claims 1, 3, 17, and 18 stand rejected under 35 U.S.C. § 112(b) as indefinite. Final Act. 5–6. R2. Claims 1, 3–8, 10–13, and 15–22 stand rejected under 35 U.S.C. § 103 as obvious over Kim (WO 2014/168408 A1, published October 16, 2014)3 and Albrecht (US 2001/0005889 A1, published June 28, 2001). Final Act. 7–17. R3. Claim 9 stands rejected under 35 U.S.C. § 103 as obvious over Kim, Albrecht, and Watkins (US 2011/0033128 A1, published February 10, 2011). Final Act. 18–19. ANALYSIS We have considered all of Appellant’s arguments and any evidence presented. We highlight and address specific findings and arguments for emphasis in our analysis below. 3 This reference was not published in English. In the Final Office Action, the Examiner relied on a machine translation of the reference, which was mailed with a non-final office action on October 31, 2017. See MPEP § 2120(II) (“Examiners may rely on a machine translation of a foreign language document unless the machine translation is not of sufficient quality to be adequate evidence of the contents of the document.”). In the Appeal Brief, Appellant refers to a certified translation, which was filed on June 27, 2018, with Appellant’s response after the Final Office Action. See Appeal Br. 12, 16; see also Ans. 7–8 (quoting the certified translation). We agree with Appellant that the certified translation “provides a clearer picture of how the malware diagnosis of Kim is performed” (Appeal Br. 12), and that the machine translation is difficult to understand, as the specifics of Kim’s machine translation disclosure are unclear. Accordingly, in this Decision, we focus on the certified translation and refer to this document as “Kim.” Appeal 2019-004492 Application 15/046,918 4 Indefiniteness Rejection R1 of Claims 1, 3, 17, and 18 The Examiner rejected claims 1, 3, 17, and 18 as indefinite for including the limitation “the at least one signature” without providing sufficient antecedent basis. Final Act. 5–6. Appellant does not present any arguments regarding this rejection. See generally Appeal Br.; Reply Br. We deem Appellant to have waived any arguments as to these rejections. See Hyatt v. Dudas, 551 F.3d 1307, 1314 (Fed. Cir. 2008) (“When the appellant fails to contest a ground of rejection to the Board, . . . the Board may treat any argument with respect to that ground of rejection as waived.”); see also 37 C.F.R. § 41.37(c)(1)(iv) (“The arguments shall explain why the examiner erred as to each ground of rejection contested by appellant.”). Accordingly, we summarily sustain indefiniteness rejection R1. Obviousness Rejection R2 of Claims 1, 3–8, 10–13, and 15–22 Claim 1 recites: “at a first node, . . . generating a signature of the at least one scanning object,” where “the at least one scanning object [is] generated by using the malware-susceptible data of the electronic file and neglecting malware-insusceptible data of the electronic file.” Appeal Br. 20 (Claims App.) (referred to herein as the “disputed limitation”). The Examiner found that Kim teaches the disputed limitation. Final Act. 3, 7–8. In particular, the Examiner found that Kim’s “mobile device (first node) generates signature, used by processor 250 (second node) for comparing signatures.” Id. at 3 (emphasis omitted). The Examiner also found that Kim generates “at least one scanning object,” as claimed, because Kim extracts part of an application (referred to herein as Kim’s “partial file”) for malware diagnosis. Id. at 7. Appeal 2019-004492 Application 15/046,918 5 Appellant argues that Kim fails to teach generating a signature of the scanning object at the first node. Appeal Br. 11–15, 17–18. Appellant contends that, “at most, Kim’s mobile terminal generates a signature based on the entire application,” not based on the partial file, as would be required by the claim. Id. at 15 (emphasis added); see id. at 13 (“Kim discloses only that the new application, i.e. the whole of the new application, is compared with a signature database at the portable terminal.” (emphasis omitted)). Appellant further contends that, although the alleged second node (i.e., Kim’s processor 250) does perform a malware diagnosis using a partial file, this is “separate from” the mobile terminal’s analysis. Id. at 15. Stated differently, Appellant submits that “there is nothing in Kim that suggests a signature is generated by the mobile terminal for the partial file.” Id. at 15; see also id. at 18 (“There is no disclosure in Kim that teaches the same data is sent to Kim’s cloud server as was used by the mobile terminal for the initial malware diagnosis at the mobile terminal.” (emphasis omitted)). In response, the Examiner finds that Kim discloses that its portable terminal generates a signature: In reply to appellant’s comment, examiner would like to point out that: the full translation of Kim’s reference in paragraph (0059) discloses[:] . . . “the diagnosis unit 302 may preferentially compare the new application to the signature information included in the signature DB 304 to inspect whether the application is malware” . . . , and since one with ordinary skill[] in the art would understand[] that in order to perform a signature matching for a file, a file has to be associated with signatures such as a hash or other representations of a file and therefore would interpret Kim’s teaching, as a file is malware infected based on object generated signature and matching it with a previously identified signature. Appeal 2019-004492 Application 15/046,918 6 Ans. 7. The Examiner does not otherwise respond to Appellant’s argument. See generally Ans. 6–9. On this record, we are persuaded of Examiner error. Appellant argues that Kim fails to teach the disputed limitation because Kim does not teach that portable terminal 200 generates a signature of the partial file, as would be required by the claim, but rather (at most) generates a signature of the entire application for comparison with its signature database. Appeal Br. 11–15, 17–18. The Examiner fails to respond to this argument. See Ans. 6–9. In particular, although the Examiner explains why a person of ordinary skill in the art would understand Kim to teach that terminal 200 generates a signature (id. at 7), this does not mean that Kim discloses that terminal 200 generates a signature of the partial file, as would be required by the claim. Kim’s terminal 200 can “compare the application to the signature information to diagnose whether the application is malware.” Kim ¶ 46; see also id. ¶ 59 (“[T]he diagnosis unit 302 may preferentially compare the new application to the signature information included in the signature DB 304 to inspect whether the application is malware.”). Also, it “may upload a specific partial file needed for malware diagnosis among all files of the application, instead of transmitting all the files of the application.” Id. ¶ 48; see also id. ¶ 57 (“The diagnosis unit 302 receives the information regarding the new application . . . , extracts a specific partial file needed for malware diagnosis among all files of the application, transmits the specific partial file to the cloud server 230 over a communication network, receives a result of the diagnosis for the application, and determines whether the application is malware.”). Appeal 2019-004492 Application 15/046,918 7 However, the Examiner identifies no passage in Kim indicating that Kim’s terminal 200 compares a signature of the partial file—as opposed to the application as a whole—with its signature database 304. Moreover, the Examiner does not provide sufficient support for the finding that processor 250 (or cloud server 230) uses a signature generated by terminal 200, where Kim instead teaches that terminal 200 sends the partial file to the server. Compare Final Act. 3 (“The mobile device (first node) generates signature, used by processor 250 (second node) for comparing signatures.”), with Kim ¶ 52 (“[T]he cloud server 230 performs the malware diagnosis by using the received specific partial file and provides a result of the diagnosis to the portable terminal 200.”). Accordingly, we are persuaded that the rejection fails to show that the disputed limitation is taught or suggested by the cited references, and consequently, we are confined by the record to reverse the rejection.4 Therefore, we do not sustain the Examiner’s obviousness rejection of independent claim 1, or its respective dependent claims (i.e., claims 3–8 and 10–12).5 Independent claims 13 and 17 also recite the disputed limitation. As a result, for the reasons discussed above, we do not sustain the 4 The Examiner states that the rejection does not rely on Albrecht for the disputed limitation. Ans. 9. Moreover, the rejection includes no finding indicating that the disputed limitation was suggested by Kim or that it would have been an obvious modification of the references. See generally Final Act. 3–4. 7–9; Ans. 6–9. Consequently, we have not considered (and do not decide) whether Kim suggests the disputed limitation, or whether that limitation would have been obvious to a person of ordinary skill in the art. 5 Consequently, we do not reach the remaining arguments regarding claim 1. See, e.g., Beloit Corp. v. Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir. 1984) (explaining that an administrative agency may render a decision based on “a single dispositive issue”). Appeal 2019-004492 Application 15/046,918 8 Examiner’s obviousness rejection of independent claims 13 and 17, or their respective dependent claims (i.e., claims 15, 16, 18–22). Obviousness Rejection R3 of Claim 9 The Examiner rejects claim 9 over a combination of Kim, Albrecht, and Watkins. Final Act. 18–19. Claim 9 depends from independent claim 1. In light of our reversal of the rejection of independent claims 1, supra, we also reverse obviousness rejection R3 of dependent claim 9. On this record, the Examiner has not shown how the additionally cited reference (Watkins) overcomes the aforementioned deficiencies with the combination of Kim and Albrecht, as discussed above regarding claim 1. CONCLUSION In summary: Claims Rejected 35 U.S.C. § Reference(s)/Basis Affirmed Reversed 1, 3, 17, 18 112(b) Indefiniteness 1, 3, 17, 18 1, 3–8, 10– 13, 15–22 103 Kim, Albrecht 1, 3–8, 10– 13, 15–22 9 103 Kim, Albrecht, Watkins 9 Overall Outcome 1, 3, 17, 18 4–13, 15, 16, 19–22 Appeal 2019-004492 Application 15/046,918 9 TIME PERIOD FOR RESPONSE No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R. § 1.136(a)(1)(iv). AFFIRMED-IN-PART Copy with citationCopy as parenthetical citation