F-Secure Corporation

Patent Trials and Appeals Board

Jan 7, 2021

2019004492 (P.T.A.B. Jan. 7, 2021)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
15/046,918 02/18/2016 Juha YLIPEKKALA 060B.0086.U1(US) 4074
29683 7590 01/07/2021
Harrington & Smith, Attorneys At Law, LLC
4 RESEARCH DRIVE, Suite 202
SHELTON, CT 06484-6212
EXAMINER
SAADOUN, HASSAN
ART UNIT PAPER NUMBER
2435
NOTIFICATION DATE DELIVERY MODE
01/07/2021 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
USPTO@HSPATENT.COM
PTOL-90A (Rev. 04/07)

UNITED STATES PATENT AND TRADEMARK OFFICE
____________________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________________

Ex parte JUHA YLIPEKKALA, JAMMU KEKKONEN,
ANDREW PATEL, JARNO NIEMELA, JARI SAVANDER,
JANI JAPPINEN, JUHO HEIKKINEN, and ZIMRY ONG
____________________

Appeal 2019-004492
Application 15/046,918
Technology Center 2400
____________________

Before ELENI MANTIS MERCADER, ERIC S. FRAHM, and
JULIET MITCHELL DIRBA, Administrative Patent Judges.

DIRBA, Administrative Patent Judge.

DECISION ON APPEAL1
Pursuant to 35 U.S.C. § 134(a), Appellant2 seeks review of the
Examiner’s rejection of claims 1, 3–13, and 15–22. We have jurisdiction
under 35 U.S.C. § 6(b). We AFFIRM-IN-PART.

1 This Decision uses the following abbreviations: “Spec.” for the original
Specification, filed February 18, 2016, which claims the benefit of an
earlier-filed foreign application; “Final Act.” for the Final Office Action,
mailed March 27, 2018; “Appeal Br.” for Appellant’s Appeal Brief, filed
December 27, 2018; “Ans.” for Examiner’s Answer, mailed March 21,
2019; and “Reply Br.” for Appellant’s Reply Brief, filed May 15, 2019.
2 We use the word “Appellant” to refer to “applicant” as defined in
37 C.F.R. § 1.42. According to Appellant, the real party in interest is
F-Secure Corp. Appeal Br. 3.
Appeal 2019-004492
Application 15/046,918

2
BACKGROUND
Appellant’s disclosed embodiments and claimed invention relate to a
malware scanning technique. Spec. 1:7–10; see id. at 1:14–17 (“[M]alware
scanning . . . is generally directed to identify (and potentially also disinfect)
any kind of malware on computer and/or communication systems, such as
e.g. viruses, Trojans, worms, or the like.”).
Claim 1, reproduced below, is illustrative of the claimed subject
matter:
1. A method of scanning an electronic file for
malware in a network, the method comprising:
at a first node, generating at least one scanning object of
the electronic file on the basis of a dynamic configuration
provided to the first node of the network by a second node of
the network, the dynamic configuration including a definition
of malware-susceptible data of the electronic file, and the at
least one scanning object being generated by using the
malware-susceptible data of the electronic file and neglecting
malware-insusceptible data of the electronic file identified by
said definition, and generating a signature of the at least one
scanning object;
if the at least one signature matches a previously
identified signature, determining whether or not the electronic
file is malware based on an indication associated with the
matching previously identified signature; and
if the at least one signature does not match a previously
identified signature, sending the at least one scanning object
from the first node to the second node for scanning and
receiving at the first node a scanning result from the second
node.
Appeal Br. 20 (Claims App.) (emphases added).
Appeal 2019-004492
Application 15/046,918

3
REJECTIONS
R1. Claims 1, 3, 17, and 18 stand rejected under 35 U.S.C. § 112(b)
as indefinite. Final Act. 5–6.
R2. Claims 1, 3–8, 10–13, and 15–22 stand rejected under 35
U.S.C. § 103 as obvious over Kim (WO 2014/168408 A1, published
October 16, 2014)3 and Albrecht (US 2001/0005889 A1, published June 28,
2001). Final Act. 7–17.
R3. Claim 9 stands rejected under 35 U.S.C. § 103 as obvious over
Kim, Albrecht, and Watkins (US 2011/0033128 A1, published February 10,
2011). Final Act. 18–19.
ANALYSIS
We have considered all of Appellant’s arguments and any evidence
presented. We highlight and address specific findings and arguments for
emphasis in our analysis below.

3 This reference was not published in English. In the Final Office Action,
the Examiner relied on a machine translation of the reference, which was
mailed with a non-final office action on October 31, 2017. See MPEP
§ 2120(II) (“Examiners may rely on a machine translation of a foreign
language document unless the machine translation is not of sufficient quality
to be adequate evidence of the contents of the document.”). In the Appeal
Brief, Appellant refers to a certified translation, which was filed on June 27,
2018, with Appellant’s response after the Final Office Action. See Appeal
Br. 12, 16; see also Ans. 7–8 (quoting the certified translation). We agree
with Appellant that the certified translation “provides a clearer picture of
how the malware diagnosis of Kim is performed” (Appeal Br. 12), and that
the machine translation is difficult to understand, as the specifics of Kim’s
machine translation disclosure are unclear. Accordingly, in this Decision,
we focus on the certified translation and refer to this document as “Kim.”
Appeal 2019-004492
Application 15/046,918

4
Indefiniteness Rejection R1 of Claims 1, 3, 17, and 18
The Examiner rejected claims 1, 3, 17, and 18 as indefinite for
including the limitation “the at least one signature” without providing
sufficient antecedent basis. Final Act. 5–6. Appellant does not present any
arguments regarding this rejection. See generally Appeal Br.; Reply Br. We
deem Appellant to have waived any arguments as to these rejections. See
Hyatt v. Dudas, 551 F.3d 1307, 1314 (Fed. Cir. 2008) (“When the appellant
fails to contest a ground of rejection to the Board, . . . the Board may treat
any argument with respect to that ground of rejection as waived.”); see also
37 C.F.R. § 41.37(c)(1)(iv) (“The arguments shall explain why the examiner
erred as to each ground of rejection contested by appellant.”). Accordingly,
we summarily sustain indefiniteness rejection R1.
Obviousness Rejection R2 of Claims 1, 3–8, 10–13, and 15–22
Claim 1 recites: “at a first node, . . . generating a signature of the at
least one scanning object,” where “the at least one scanning object [is]
generated by using the malware-susceptible data of the electronic file and
neglecting malware-insusceptible data of the electronic file.” Appeal Br. 20
(Claims App.) (referred to herein as the “disputed limitation”).
The Examiner found that Kim teaches the disputed limitation. Final
Act. 3, 7–8. In particular, the Examiner found that Kim’s “mobile device
(first node) generates signature, used by processor 250 (second node) for
comparing signatures.” Id. at 3 (emphasis omitted). The Examiner also
found that Kim generates “at least one scanning object,” as claimed, because
Kim extracts part of an application (referred to herein as Kim’s “partial
file”) for malware diagnosis. Id. at 7.
Appeal 2019-004492
Application 15/046,918

5
Appellant argues that Kim fails to teach generating a signature of the
scanning object at the first node. Appeal Br. 11–15, 17–18. Appellant
contends that, “at most, Kim’s mobile terminal generates a signature based
on the entire application,” not based on the partial file, as would be required
by the claim. Id. at 15 (emphasis added); see id. at 13 (“Kim discloses only
that the new application, i.e. the whole of the new application, is compared
with a signature database at the portable terminal.” (emphasis omitted)).
Appellant further contends that, although the alleged second node (i.e.,
Kim’s processor 250) does perform a malware diagnosis using a partial file,
this is “separate from” the mobile terminal’s analysis. Id. at 15. Stated
differently, Appellant submits that “there is nothing in Kim that suggests a
signature is generated by the mobile terminal for the partial file.” Id. at 15;
see also id. at 18 (“There is no disclosure in Kim that teaches the same data
is sent to Kim’s cloud server as was used by the mobile terminal for the
initial malware diagnosis at the mobile terminal.” (emphasis omitted)).
In response, the Examiner finds that Kim discloses that its portable
terminal generates a signature:
In reply to appellant’s comment, examiner would like to
point out that: the full translation of Kim’s reference in
paragraph (0059) discloses[:] . . . “the diagnosis unit 302 may
preferentially compare the new application to the signature
information included in the signature DB 304 to inspect
whether the application is malware” . . . , and since one with
ordinary skill[] in the art would understand[] that in order to
perform a signature matching for a file, a file has to be
associated with signatures such as a hash or other
representations of a file and therefore would interpret Kim’s
teaching, as a file is malware infected based on object generated
signature and matching it with a previously identified signature.
Appeal 2019-004492
Application 15/046,918

6
Ans. 7. The Examiner does not otherwise respond to Appellant’s argument.
See generally Ans. 6–9.
On this record, we are persuaded of Examiner error. Appellant argues
that Kim fails to teach the disputed limitation because Kim does not teach
that portable terminal 200 generates a signature of the partial file, as would
be required by the claim, but rather (at most) generates a signature of the
entire application for comparison with its signature database. Appeal
Br. 11–15, 17–18. The Examiner fails to respond to this argument. See Ans.
6–9. In particular, although the Examiner explains why a person of ordinary
skill in the art would understand Kim to teach that terminal 200 generates a
signature (id. at 7), this does not mean that Kim discloses that terminal 200
generates a signature of the partial file, as would be required by the claim.
Kim’s terminal 200 can “compare the application to the signature
information to diagnose whether the application is malware.” Kim ¶ 46; see
also id. ¶ 59 (“[T]he diagnosis unit 302 may preferentially compare the new
application to the signature information included in the signature DB 304 to
inspect whether the application is malware.”). Also, it “may upload a
specific partial file needed for malware diagnosis among all files of the
application, instead of transmitting all the files of the application.” Id. ¶ 48;
see also id. ¶ 57 (“The diagnosis unit 302 receives the information regarding
the new application . . . , extracts a specific partial file needed for malware
diagnosis among all files of the application, transmits the specific partial file
to the cloud server 230 over a communication network, receives a result of
the diagnosis for the application, and determines whether the application is
malware.”).
Appeal 2019-004492
Application 15/046,918

7
However, the Examiner identifies no passage in Kim indicating that
Kim’s terminal 200 compares a signature of the partial file—as opposed to
the application as a whole—with its signature database 304. Moreover, the
Examiner does not provide sufficient support for the finding that processor
250 (or cloud server 230) uses a signature generated by terminal 200, where
Kim instead teaches that terminal 200 sends the partial file to the server.
Compare Final Act. 3 (“The mobile device (first node) generates signature,
used by processor 250 (second node) for comparing signatures.”), with Kim
¶ 52 (“[T]he cloud server 230 performs the malware diagnosis by using the
received specific partial file and provides a result of the diagnosis to the
portable terminal 200.”). Accordingly, we are persuaded that the rejection
fails to show that the disputed limitation is taught or suggested by the cited
references, and consequently, we are confined by the record to reverse the
rejection.4
Therefore, we do not sustain the Examiner’s obviousness rejection of
independent claim 1, or its respective dependent claims (i.e., claims 3–8 and
10–12).5 Independent claims 13 and 17 also recite the disputed limitation.
As a result, for the reasons discussed above, we do not sustain the

4 The Examiner states that the rejection does not rely on Albrecht for the
disputed limitation. Ans. 9. Moreover, the rejection includes no finding
indicating that the disputed limitation was suggested by Kim or that it would
have been an obvious modification of the references. See generally Final
Act. 3–4. 7–9; Ans. 6–9. Consequently, we have not considered (and do not
decide) whether Kim suggests the disputed limitation, or whether that
limitation would have been obvious to a person of ordinary skill in the art.
5 Consequently, we do not reach the remaining arguments regarding
claim 1. See, e.g., Beloit Corp. v. Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir.
1984) (explaining that an administrative agency may render a decision based
on “a single dispositive issue”).
Appeal 2019-004492
Application 15/046,918

8
Examiner’s obviousness rejection of independent claims 13 and 17, or their
respective dependent claims (i.e., claims 15, 16, 18–22).
Obviousness Rejection R3 of Claim 9
The Examiner rejects claim 9 over a combination of Kim, Albrecht,
and Watkins. Final Act. 18–19. Claim 9 depends from independent claim 1.
In light of our reversal of the rejection of independent claims 1, supra,
we also reverse obviousness rejection R3 of dependent claim 9. On this
record, the Examiner has not shown how the additionally cited reference
(Watkins) overcomes the aforementioned deficiencies with the combination
of Kim and Albrecht, as discussed above regarding claim 1.
CONCLUSION
In summary:
Claims
Rejected
35 U.S.C.
§ 
Reference(s)/Basis Affirmed Reversed
1, 3, 17, 18 112(b) Indefiniteness 1, 3, 17, 18
1, 3–8, 10–
13, 15–22
103 Kim, Albrecht 1, 3–8, 10–
13, 15–22
9 103 Kim, Albrecht,
Watkins
9
Overall
Outcome
1, 3, 17, 18 4–13, 15, 16,
19–22

Appeal 2019-004492
Application 15/046,918

9
TIME PERIOD FOR RESPONSE
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R.
§ 1.136(a)(1)(iv).
AFFIRMED-IN-PART