Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Patents

IPFilter Infriging on Bay Network Patent? 229

Posted by CmdrTaco from the there-is-no-spoon dept.
jorhan writes "Darren Reed, the author of IPFilter, recently posted this message to the IPFilter mailing list. Apparently IPFilter may infringe upon USA patents owned by Bay Networks, specifically, #5790554. The patent might seem to own just about every conceivable way one might wish to filter and forward data packets, but trying to read through all of the "wherein said first condition" started to give me a headache (ObIANAL). But when you read what application the authors specifically had in mind, it really has little to do with network layer firewalling. Even more important is the question Darren's mail indirectly poses, "Anyone know of any prior art?""
This discussion has been archived. No new comments can be posted.

IPFilter Infriging on Bay Network Patent? More

IPFilter Infriging on Bay Network Patent?

Comments Filter:

  • Patent Patent Process (Score:3, Funny)

    by maximillionus ( 185440 ) on Sunday July 14, 2002 @05:35PM (#3882999)
    How long until someones recieves notice of patent infringement for their method of submitting patents?

    • Re:Patent Patent Process (Score:4, Funny)

      by Anonymous Coward on Sunday July 14, 2002 @06:09PM (#3883106)
      I hereby patent the process in said application for said patent thereto and hereforth known as patent submission process where as there is a generally vague and ambiguous definition of said patentable process in said application of section 1 and hereto and thereto and whereto and whoto ad naseum carpe diem magna cum lauder and e pluribus unim.

    • Re:Patent Patent Process (Score:5, Interesting)

      by Anonymous Coward on Sunday July 14, 2002 @07:23PM (#3883316)
      I've got prior art on the patent assuming that the patent's filing date (Oct 14, 1995) is the priority date.

      I wrote ipfirewall, a packet filtering program for BSD/OS in 1993. I released my software via a mailing list (don't recall which one but I'm sure that I can find it) in about September of 1993. It was ported to Linux at around that time by Bob Beck and later by Ugen Antsilevich (Ugen's version is the one that made it into the Linux kernel distribution). The Linux variant was called ipfw. If you look in the kernel source code files netfilter/ipchains_core.c and netfilter/ipfwadm_core.c ipfw, you can still find my copyright:

      Copyright (c) 1993 Daniel Boulet

      ipfirewall v1.0 was also ported to NetBSD and FreeBSD. I also distributed ipfirewall v2.0 as a shareware product and as part of the Juniper Firewall Toolkit.

      • Re:Patent Patent Process (Score:5, Interesting)

        by Anonymous Coward on Monday July 15, 2002 @01:05AM (#3884276)
        I can only confirm everything said in the previous posting.

        I've been working with Ugen Antsilevich on the
        FreeBSD port of the ipfw in 1992-1993 at Technion,
        Israeli Institute of Technology.

        Initial version was indeed based on Daniel's BSD/OS version, but was later almost completely redesigned.

        The functionality and architecture of the ipfw very much resembles that of the ipfilter, so the claims by Bay seems ridiculous.

        Gennady Sorokopud

  • found (Score:2, Informative)

    by Anonymous Coward
    I believe the drawbridge software well predates this (1993?) and darren is now aware of it.

    But does Bay actually really exist anymore? Nortel sucked up them (after they had sucked up Annex). Getting updates for Annex is a bear. Bay was sort of sinking beneath the relentless Cisco; getting bought by a telco wasn't going to make them more agile.

    • Re:found (Score:2, Interesting)

      by Strog ( 129969 )
      It doesn't really matter if they exist anymore or not. Nortel bought all the intelectual properties so now the problem goes to Nortel and beyond.

    • Re:found (Score:2, Interesting)

      by unhooked ( 21010 )
      Screend has roots dating back to 1989.
      Check DEC resources or maybe vix.com.

    • Re:found (Score:5, Interesting)

      by Syre ( 234917 ) on Sunday July 14, 2002 @07:17PM (#3883305)
      I was using a Digital Equipment Corporation ethernet bridge in the late 80s which was able to selectively move packets from one port to another, by looking at the packets and determining if the destination ethernet address referenced in the packet was known on the network connected to by the second port.

      There was also a way of loading configuration information into it to tell it whether to forward certain kinds of packets (multicast, most notably) or not. This sounds like a filter to me, in the definition of the patent.
      • Um, not only addresses but packet types as well. Certainly we had this capability because we could filter and route on traffic type.

  • Early bird (corporate whore) gets the worm(patent) (Score:3, Insightful)

    by man_ls ( 248470 ) on Sunday July 14, 2002 @05:38PM (#3883018)
    I suppose the title could be talking about early adopters of Microsoft products, but that's not quite my intention. :)

    The company that thinks of an idea that may be used widely later has the responsibility to patent it. The younger the technology is, the easier it is to get away with un-necessarely broad patent language, because people aren't aware of the number of uses that can fall within a patent's grounds.

    My official recommendation for the situation is that tech patents granted in the last 5 years be reviewed by a panal of experts...patent lawyers from the government (FTC, department of commerce), paid consultants, and computer professionals from promonant comporations, i.e. Cisco Systems, IBM Corp, Microsoft, etc. to review their scope and reword them if necessary.

    Note that it wouldn't be a party to get rid of tech patents, but to refine the existing ones as to nail down exactly what's protected and what isn't.

    Bay Networks owns the patent, and as such, it is their responsibility to enforce it. Now, if they're nice, they could grant the authors if IPFilter a royalty-free license to use their intellectual property, but because IPFilter is an open source project, that is in effect granting the entire world permission to use it, and that is something Bay doesn't want. Hence, they need to stop the entire thing.

    Conclusion: Yet another example of the shortcomings of the United States patent system. Sure, it's better than anything else in the world--but that doesn't mean it's perfect. Far from it, infact.

    • Re:Early bird (corporate whore) gets the worm(pate (Score:5, Insightful)

      by mickwd ( 196449 ) on Sunday July 14, 2002 @05:49PM (#3883048)
      "Conclusion: Yet another example of the shortcomings of the United States patent system. Sure, it's better than anything else in the world--but that doesn't mean it's perfect. Far from it, infact."

      Hmmmm, I'm curious - it's the "best" patent system in the world, but here we have "yet another example" of its failings.

      How much do your actually know about the patent systems of every other country in the world?
    • IANAL, but my understanding has always been that you're taking a risk when you submit an overbroad patent - if even one of the listed embodiments doesn't actually work, the patent is invalid, at least from that claim to the end of that chain of patent claims.
    • I have no problem with your suggestiond, but would like to comment on two minor points:

      Bay Networks owns the patent, and as such, it is their responsibility to enforce it.

      Assuming that's what you meant, and AFAIK: The "enforce or lose it" rule is only for trademarks. So Bay could just ignore the project as long as they want, and still demand fees from other (commercial) projects.

      the United States patent system. Sure, it's better than anything else in the world

      That one surprised me, why would you think that? It seems that regarding the basic setup the US patent system is virtually indistinguishable from any European one.

    • Maybe a better scheme would be to accept the fact that there's no way a bunch of paper pushers at the patent office are ever going to be able to meaningfully separate out the genuine innovations from the absolute BS that currently gets through.

      Instead, let patent applicants put up a, say, $5K bond with their application. The patent office makes no attempt to validate the patent (just as presently, you might say :) but merely publish it.

      Then, if someone finds any prior art, let them forward it to the patent office to examine it. Then the patent office makes a judgement, pays the bond across to the finder, and marks the patent as cancelled. Interested parties (those suckered into paying licensing fees) get notified by email alert.

      Perhaps this would generate a thriving third world industry of people frantically chopping down many of the stupid patents which currently get issued.

      Before complaining that putting up $5K would stifle creativity for the small guy, consider whether the current state of affairs actually works in the little guy's behalf or not...

    • "My official recommendation for the situation is that tech patents granted in the last 5 years be reviewed by a panal of experts... patent lawers ... and computer professionals from promonant comporations, i.e. Cisco Systems, IBM Corp, Microsoft, etc."

      What if an expert (from one of the big companies) comes across a patent from a competing company that would make things easier for their own company business-wise? They could argue for it to be removed. Of course, the other experts could probably just veto that opinion, but the influence is still there. This also works the other way too; a representative from one company will be in a better position to defend their own company's patents.

      I say keep the professionals out of it because their own interests will taint the process. To replace them, bring in university professors that have nothing better to do than to sit on this panel of review.
      • To replace them, bring in university professors that have nothing better to do than to sit on this panel of review.
        And don't forget to pay them well. The USPTO's biggest problem is that it is horribly underfunded considering how much damage it is capable of causing. Homeland Security is frankly useless if your economy is cripped by rampant trivial patents being used as weapons of mass economic destruction.
        • Homeland Security is frankly useless if your economy is cripped by rampant trivial patents being used as weapons of mass economic destruction.

          While the patent system is in dire need of being addressed, I think that being blown up by a terrorist would suck a great deal more ass than being involved in patent litigation. At least in the long run.
    • From the patent:

      receiving a data frame at a port of a network device coupled to said network said data frame to be forwarded to a destination node in said network based on a destination address for said destination node associated with said data frame

      I'm having a hard time thinking of a network device that doesn't do this. :)

    • A process already exists for people to assert prior art raising substantial new questions of patentability against an existing patent, and in a forum where the presumption of validity does not apply. In extraordinary cases, such as the Compton's patent, the PTO Commissioner can call for a reexamination by himself.

  • Claims.. (Score:1, Interesting)

    by Anonymous Coward
    Keep in mind, ALL of a patent's claims must apply to your invention. If a single one isn't a match, then you are free of the entire patent.

    IANAL.

    • Keep in mind, ALL of a patent's claims must apply to your invention.

      This applies only to parts of one Claim, or to Claims that depend on other Claims ("4. The invention of claim 1 where the number of consecutive items is four"). If something infringes even one independent Claim, then it infringes the patent.

  • How would this affect ZoneAlarm [zonealarm.com] and Linksys [linksys.com] and D-link [dlink.com] routers?

  • a day in the life of IT (Score:5, Funny)

    by Vodak ( 119225 ) on Sunday July 14, 2002 @05:46PM (#3883038)
    I have seen the enemy and it is us... and we attack with a sea of legal papers which will kill us with paper cuts
  • Filters may be configured on a per port basis, i.e., a filter can be applied to data packets entering or exiting a specific port on a networking device such as a LAN switch
    The patent seems to be specific to network switching/routing hardware based solutions, not software based. IANAL, but it could be shown that the intent that Bay had was to do packet level filtering inside of switches on a port-to-port basis (as some of their hardware, like the Accelar series does), and not on a software-ontop-of-an-OS basis as this shows

    Referring to FIG. 1, a network device 100 as may be utilized by an embodiment of the present invention is shown. Network device 100 is a LAN switch, however, it is understood by those of ordinary skill in the art that an embodiment of the present invention may be applied to other network devices such as a hub or bridge.
    If I'm wrong, then a lot more than IPFilter is in trouble... Checkpoint and Raptor (now Symantec) better watch out!.

    • Hardware router/hub/firewalls may be a more interesting problem.. The patent seems to apply to using rules to figure out which (physical) port to send stuff to... I don't think it references anything like the idea of rewriting packets so that they go (for example) to a machine at a different address or a different TCP/UDP port on the recieving machine.
    • The patent actually acknowledges that there is "related art" in the are of packet filtering. This patent claims four improvements:
      • Directing data to multiple ports (obviously very oriented towards LAN switching)
      • Filtering on variable length fields
      • Jumping between rules rather than sequential processing
      • Less than/greater than comparisons in addition to equals/not equals
      I am not too familiar with IPFilter, but a quick read of the web page indicates that it doesn't support these features, although NAT may come close in some ways to the first (IANAL).

      I also suspect that some bigger fish, such as Cisco, may infringe on this patent if IPFilter does

      Here are the relevent piecesof the related art section:

      prior art techniques also allow filtering on an arbitrary offset within a packet. However, these techniques do not allow filtering on the contents of well known variable length fields, e.g., the routing information field (RIF) of an IEEE 802.5 token ring data packet.
      Prior art filtering mechanisms allow for the application of multiple filters to the same data packet; however, the filters are applied in sequential order--no skipping to other filters is allowed. As soon as a match is found, no further filters are considered and the packet is processed according to the filter for which a match occurred. The only processing provided is to either permit the packet to be forwarded or drop the packet. There is no mechanism by which the data packet may be redirected to a port of the network device other than the normal destination port to which the packet is forwarded in the absence of an access list or filter, nor is a packet redirected to multiple destination ports.
      and
      Moreover, a filter cannot jump to another filter, rather, filters are applied according to the order in which they are configured in the network device. Furthermore, prior art filtering systems do not allow forwarding of a data packet to an alternative port or an additional port. The packets may only be forwarded to the normal destination port or dropped. Finally, filters heretofore have only allowed the logical operators equal and not equal in determining whether a value specified by the filter matches or fails to match the contents of a data packet at the location in the packet specified by the filter. The additional logical operators of less than, less than or equal to, greater than, and greater than or equal to, have not been permissible
      • I suppose I should read the whole patent before I comment, but just reading your quotes here, I can't imagine how this ever got approved. Add less/greater than logical opertors is somehow new and unique, and not a logical extension that would be obvious to anyone with experience in the field? Non-sequential rules, and rules beyond forward/drop? Fitering on a variable length field when there's already prior art for filtering on an arbitrary offset? None of this solves any new problems - it's just logical extensions to the feature set of a router. Anyone writing filtering software would implement exactly the same features, if they decided they wanted them.

  • Not surprising (Score:3, Insightful)

    by Magila ( 138485 ) on Sunday July 14, 2002 @05:50PM (#3883052) Homepage
    In case you didn't already notice the patent office is in a pretty sad state, they will accept patents on virtually anything. This has resulted in companies filling for tons of frivolous patents on completely obvious technologies. That way if one of them tries to go after another for patent infringement that company can retaliate with it's own patents. The big looser in all of this is of course basically any non-corporate entity. Without a mile high stack of patents they become easy targets. I hate to sound naive but I'm a bit surprised at how little attention this has drawn in the political arena, you'd think by now someone would have started pushing for some reform but I haven't heard of any serious efforts to do so.

  • Not only ipfilter (Score:3, Insightful)

    by palme999 ( 82528 ) on Sunday July 14, 2002 @05:50PM (#3883053)
    From the patent: the present invention relates to a method and apparatus for controlling the forwarding of data packets from a network device...

    Seems obvious to me that this would affect a broad range of devices from switches to load-balancers to firewalls and would probably benefit a large group of corporations to begin either investigating prior art or ask Bay nicely to license the tech.

  • No red alert yet. (Score:5, Informative)

    by darkonc ( 47285 ) <stephen_samuel.bcgreen@com> on Sunday July 14, 2002 @05:55PM (#3883067) Homepage Journal
    This isn't a serious lawyer-cease-and-desist type of situation. It's just someone bringing up the possibility that an old patent infringes, and noting that the probability is that it does not .. ianal/ymmv.

    It'd be nice if someone had a few thousand dollars to hire a lawyer and get a more definitive answer, but it seems like prior art was also mentioned in the (two message) thread, so this isn't (yet) a serious issue.

    The patent seems to only apply if you use numeric offsets into fields. If the patent is an intent to patent just about any rule-based firewalling, just about any commercial firewall product -- like FW1 product for Solaris would be simple examples of prior art. If this isn't the case, then it's got too many differences between itself and IPFilter or IPtables to be of much use in shutting down the IPfilter project.

    • Re:No red alert yet. (Score:5, Insightful)

      by drix ( 4602 ) on Sunday July 14, 2002 @06:09PM (#3883102) Homepage
      Or, better yet, it would be nice if there were some lawyer out there who would just donate a few hours his time and settle it for us. It's funny how the reputation of lawyers has fallen so low that it doesn't even cross our mind to ask them to do something charitable anymore (the extremely small minority of social justice lawyers excepted -- Ann Beeson, I love you.) Whether this is justified, I don't know. But there's no profession I frown on more, and goodness knows I won't be going to law school anytime soon.

      And I'm a newspaper reporter :)

      • Re:No red alert yet. (Score:2, Funny)

        by Anonymous Coward
        It's funny how the reputation of lawyers has fallen so low .... And I'm a newspaper reporter

        Pot... kettle... black.
    • The law doesn't work like that. What a lawyer will do is give you legal advice. That advice may or may not stand up in court.

      People in technical fields seem to think that the law is a black and white list of rules like engineers might write down and other engineers might use. The law is not like that. The law is whatever a lawyer can sell to a judge or jury at a particular moment. The quality of the lawyers in a given case is much more important to the outcome of the case than whatever it is that the law says; if you have the law and a bad lawyer on your side you are probably going to lose.

      A court room is a fight, and fights are generally won by the best fighters - not necessarily by the side that is in the right. Because of this it is very easy to be on the side that is in the right and lose.
    • Just how old it that patent? If it's old enough, perhaps it would be beneficial... in blocking other patents.

  • Switches only? (Score:5, Insightful)

    by ajs ( 35943 ) <ajs AT ajs DOT com> on Sunday July 14, 2002 @05:56PM (#3883070) Homepage Journal
    Reading the patent, both the abstract and the claims say many things to indicate that this patent covers network devices "such as a switch". Much of the patent is faily specific to forwarding between ports on such a device. I really don't think it can be said to generically cover generic layer-3+ packet filtering (in fact, I think it's pretty specifically layer-2ish).

    Now, I'm not a lawyer, but I am a network engineer who deals with packet filtering all the time, and any "expert witness" worth his salt would bring these points up in a patent-suit. Someone should step up to be first on this one (Checkpoint or Cisco would be good choices, but there are many others who would be hurt by having to license this stuff).

    On a more general point, I'm sure there are patents out there on just about everything that a modern Linux, BSD, etc system does. Some are already expired, but many are not. We really need to get a game plan here. My personal take is that patents are still a good thing, even on software, but it's the duration and disclosure that kill us. How can we reasonably get patent duration for software down to 2 years and require early disclosure of a pending patent? If those two things happened, patents would actually be a good thing for Open Source!
    • What is the justification for software patents at all? This has never made any sense to me. Copyright, yes. Trade secret, yes. But patents?

      It's not only that the patent examiners are basically clueless in the software field, though that would be enough of a reason to repudiate them right there. It's that the basic idea doesn't make any sense. A piece of software is a mathematical expression. It may have several identity transforms performed on it (e.g., compiling, etc.). It is a precise recipie for how to do something that is so detailed that a certain kind of machine can follow it. This is clearly something for which the appropriate protection mechanisms are copyright and trade secret. The fact that you can store the program on a chip means no more than the fact that you could store the patterns for a Jaquard loom on punched cards. It's the same thing!

      Software patents are a perversion of the law. Not the worst one that we've seen, but not a good one, either.

  • if they don't enforce it, it doesn't matter (Score:3, Interesting)

    by g4dget ( 579145 ) on Sunday July 14, 2002 @05:56PM (#3883072)
    As long as they don't try to enforce it, it doesn't matter. They may well realize that the patent is bogus and has plenty of prior art. Lots of companies have lots of bogus patents that someone in their organization applied for, unaware of prior art.

    Of course, unlike trademarks, the risk that they will try to enforce it remains throught the life of the patent. However, if it really worries you, you can have the patent reexamined or get a declaratory judgement.

  • One Example of Prior Art (Score:5, Informative)

    by llywrch ( 9023 ) on Sunday July 14, 2002 @05:58PM (#3883076) Homepage Journal
    This patent claim was filed 4 October 1995.

    I have a first edition copy of the book, D. Brent Chapman & Elizabeth D. Zwicky, _Building Internet Firewalls_ (Sevastopol, California: O'Reilly and Associates), dated September 1995. Thumbing thru it, I find chapter 6, which is titled ``Packet Filtering". ISTR that September is the month that preceeds October.

    Since it takes about a year for a book to go from start of writing, thru production & at last release, I'd say Packet Filtering was a technology very familiar if not much used in late 1994.

    Is that satisfactory evidence of prior art?

    Geoff

  • LawerSpeak (Score:4, Funny)

    by Tablizer ( 95088 ) on Sunday July 14, 2002 @06:02PM (#3883083) Journal
    (* The patent might seem to own just about every conceivable way one might wish to filter and forward data packets, but trying to read through all of the "wherein said first condition" started to give me a headache *)

    Laywers should learn how to clean up their source code.

    For one, they should give clauses names or ID's. Then they can have phrases like:

    "If ($trans and $horgton) or $rollsNice or $tamper5 or ($beforeExpire7 and $gasoline) then coveredUnderStateStatute("Nebraska", 43726)"

    • Oh, yes!

      That's so much easier for the average person to understand.

      • (* Oh, yes! That's so much easier for the average person to understand. *)

        That is not the point. I don't think street-able legalese is possible (except maybe as approximate summaries of the detail), however the second approach is understandable by both lawyers and programmers, whereas, the first is understandable by only lawyers. Thus, better to target two niches instead of one.

    • "Laywers should learn how to clean up their source code.
      "For one, they should give clauses names or ID's. Then they can have phrases like:
      "If ($trans and $horgton) or $rollsNice or $tamper5 or ($beforeExpire7 and $gasoline) then coveredUnderStateStatute("Nebraska", 43726)"

      What you read in a patent application isn't soure code, it's an executable designed to run on the US justice system. You are not supposed to understand it. In fact, a patent has greater value to the person who files the patent if it is (1) meaningful and yet (2) impossible to understand.

      Of course if you try to disassemble a patent, the labels will be meaningless mumbo jumbo which you have to decipher, without the benefit of a symbol table.

      IANAL but if I did become AL I'd write an open-source legalese compiler. Then any programmer can produce complex gobbledygook to jam up the works of the US legal system, rather than relying on money and teams of paralegals. Onward the revolution!

  • What's to problem? He wasn't served. (Score:5, Insightful)

    by AxelTorvalds ( 544851 ) on Sunday July 14, 2002 @06:04PM (#3883089)
    Patents aren't evil by nature. PKWare owns patents that cover the way the inflate/deflate alogrithms work. PKWare also put them in the public domain. Or the RTLinux patent. He wasn't served with papers or told to stop doing what he is doing. IPFilter isn't exactly an unknown piece of code either. I'd assume it's not a problem. Companies don't want to test patents like those becuase they lose all the marbles when they don't win in court.
    • The managers of certain companies aren't evil by nature.

      You didn't make an argument about patents. That's a comment about the management of some companies.

      OTOH, a patent is no more evil than a pistol or a car. A patent is a tool that can be used in certain ways. This doesn't make them a good idea. Not every tool that can be built, should be built, and I feel that patents, especially software patents, are one of the mistakes.

      Of course, mistake is only in terms of a certain set of desired results. If your aim is to concentrate power in a small number of hands, and to increase the domination of a subset of lawers* over the economy, then I suppose they could be considered a good idea.

      * Patent lawyers are a specialized subset of lawyers who are allowed to speak at a patent court. Most lawyers are forbidden to. I have heard that this is because patent law twists the language in new and exciting ways, so that even ordinary lawyers can't properly understand it.

  • read http://marc.theaimsgroup.com/?l=openbsd-misc&m=102 663216302242&w=2

    but in the thread it talks about a prior art, the main writer of OpenBSD's PF mentioned a prior art: http://marc.theaimsgroup.com/?l=openbsd-misc&m=102 665630513591&w=2
  • I hope the judge who first allowed a software patent is proud of the monster he created, because this has turned software development into a minefield. The greatest creations of our generation are public and open, and at every turn, pathetically obvious 'innovations' seal off every avenue of advancement with patents.

    Lame.
  • A method and apparatus for filtering data packets from a network device, such as a LAN switch, onto a network coupled thereto based on the content of the data packets.

    This to me seems to be the crux of the matter. They are patenting all type of filter (normal routing, re-routing, droping, etc.) based on the contents of the data packet, in some form. While I can't be certain, I think any decent packet sniffer would have this capability. (I can't remmber if any I've used are actually older than 1995, when the patent was filed.)

    Anyone got more specific info? I bet we can find several examples of test equipment previous to this patent to derive data based filtering from.

    How about IP stacks? Anyone know of an IP stack that could sniff the data section of a packet before 1995? Now there's gotta be a few examples of that!

  • OpenBSD pf and the solutions (Score:3, Informative)

    by mirabilos ( 219607 ) on Sunday July 14, 2002 @06:19PM (#3883133) Homepage
    Darren Reed also asked in the OpenBSD misc mailing list
    for prior art and points to pf probably being affected,
    too (read here [theaimsgroup.com]).

    Daniel Hartmeier, swiss Author of PF, the OpenBSD packet
    filter, has a good reply finding prior art [theaimsgroup.com] and Darren even thanks him explicitly [theaimsgroup.com] a lot, which is not what we _were_ used to read from him.

    I personally do not have any objections against him,
    still - though I use pf as it is in OpenBSD [openbsd.org] - the operating system of my choice, and not
    even the recent OpenSSH bug could prevent me from
    trusting that team.
  • There must be a Linux company somewhere willing to help you obtain legal help or maybe even an IP lawyer willing to provide Pro Bono help.

    Do it yourself and you could end up making matters worse for yourself (read: willful infringement) or making a mistake.

    Here is a brief overview of patent infringement lawsuits [lawnotes.com]. If this does not make you want to seek legal help, then I wish you luck.


  • I understand the "I Am Not A Lawyer" portion of ObIANAL, but what's the "Ob" prefix mean?

    Yeah, yeah - perhaps offtopic, but I must ask. My karma is already 50... wait, "excellent", what's up with that?! :^)

    Ryan Fenton

  • Patent acknowledges traditional patent filters (Score:4, Informative)

    by werdna ( 39029 ) on Sunday July 14, 2002 @07:10PM (#3883287) Journal
    The patent specfification appears to expressly acknowledge that the prior art contains traditional patent filter firewalls, and seems to focus more on modes for redirecting packets based on a ruleset, rather than drop/pass decisions:
    2. Description of the Related Art


    A technique that has been employed by prior art network devices such as a LAN switch involves access lists, or filters, that allow the network administrator to control the forwarding of packets from a network device based upon the contents of the data packet. Such access lists allow a user to define a value within a specific field of a data packet. For example, to filter on an Internet protocol (IP) data packet with an IP address of 129.1.1.1, a user may configure and then apply to a particular port an access list that forwards or drops data packets having a value of 129.1.1.1 in the IP header of the data packet.

    prior art techniques also allow filtering on an arbitrary offset within a packet. However, these techniques do not allow filtering on the contents of well known variable length fields, e.g., the routing information field (RIF) of an IEEE 802.5 token ring data packet.
    Prior art filtering mechanisms allow for the application of multiple filters to the same data packet; however, the filters are applied in sequential order--no skipping to other filters is allowed. As soon as a match is found, no further filters are considered and the packet is processed according to the filter for which a match occurred. The only processing provided is to either permit the packet to be forwarded or drop the packet. There is no mechanism by which the data packet may be redirected to a port of the network device other than the normal destination port to which the packet is forwarded in the absence of an access list or filter, nor is a packet redirected to multiple destination ports.

    There are a number of disadvantages to the above approach for controlling the flow of data packets in a network device. A network administrator must specify a well known field based on an access list type, i.e., the manager is not allowed to specify an arbitrary offset within the data packet at which to compare the contents of the data packet to a value specified by the filter. Moreover, a filter cannot jump to another filter, rather, filters are applied according to the order in which they are configured in the network device. Furthermore, prior art filtering systems do not allow forwarding of a data packet to an alternative port or an additional port. The packets may only be forwarded to the normal destination port or dropped. Finally, filters heretofore have only allowed the logical operators equal and not equal in determining whether a value specified by the filter matches or fails to match the contents of a data packet at the location in the packet specified by the filter. The additional logical operators of less than, less than or equal to, greater than, and greater than or equal to, have not been permissible.

  • Scary, isn't it. (Score:5, Informative)

    by FreeLinux ( 555387 ) on Sunday July 14, 2002 @07:25PM (#3883324)
    The patent is certainly valid but, don't panic just yet. This particular patent, though very general and broad scoped in nature, was actually filed to protect a very nice feature found in Bay / Nortel layer 2/3 and beyond switches. This feature has been in their switches since 1995 and possibly earlier and it allows for the routing/switching of packets based on a specified pattern match of ANY arbitrary portion of a FRAME. Note the specific reference to ATM?

    Using this filtering method, you can switch/route a packet or frame from/to any port based on ANY part of the frame. If you wanted, for some bizzar reason, to make your decision based on the crc checksum you can do it. Also, because you are looking at the entire frame/packet, it is not specific to IP. You can filter/switch/route ANY protocol IP, IPX, HTTP, DECNet, APPN, anything. It is extraordinarily powerful, though infrequently used. But it is great to have when you need it. You can find it on most of their switches and routers from the BayStack 450 to the Bay BCN router to the Passport 8600 series layer 3 switches.

    I do not feel that IPFilters needs to be concerned as this patent and could possibly be applied to ANY filtering tecnique in use today. Anything from MAC based port blocking to layer 7 web switching. However, even Bay/Nortel has notr choesen to challenge or attempt to enforce the patent on anyone so far.

    As an interesting side note. Up until last year Nortel was filing and being awarded patents at a rate of two per day. They patented any and everything that they did. Hell, there is even a patent(not copyright) on a set of icons they designed for you on mobile phone type PDAs. That's right, a patent on a small set of crappy looking icons. Try doing a patent search with keyword Nortel. You'll be amazed.

    • If that's the case then I'm once again baffled by the patent process. Sure it might be a neat feature, but it's standard CS101 pattern matching used in everything from parsers to image processing.

      Surely they can't patent pattern matching, nor can they patent filtering. So is the patent for 'using pattern matching to filter'?

      And which part of the invention is non-obvious? If nobody else has this feature then it's just because nobody else thought it would be useful, not because it's difficult to do.

  • Nortel is close to going broke... always be wary when you start to hear about patents and companies in trouble. Investers, creditors start looking really hard for company "assets" to recoup their losses.

    It's the classic change of stategy to ligitation to keep your company afloat.

    Be afraid, be very afraid.
    • Not so fast.

      Nortel (My employer) is doine MUCH better than what the media would let you beleive. There's a lot of BIG entities in the US that would like to see Nortel fail (need I mention any names??) Don't beleive everything you read/see.

      Also, nowhere has Nortel issued any statement regarding this patent. Nortel hasn't said a word, so don't be putting up the defector shields too fast there....

  • IPfilter doesn't seem to do type/offset matching - that sounds like what Ascend used to in the MAX products ("generic filters") or the packet filter that used to ship with Irix 5.3 (whose name I forget).

  • I'm confused (Score:2, Insightful)

    by Grax ( 529699 )
    In the old days patents applied to the invention, not the result. You can't patent "a method for fastening clothing" but you can patent a zipper or velcro.

    So it seems to me that filtering packets is a result, not a method, and as long as IPFilter doesn't use Bay Networks' code or some slick algorythm patented by them then I don't see why this should even be an issue.

  • This is too utterly obvious to be innovative. This patent should be used as the "poster boy" of reforming the patent system. I bet those guys at Bay Networks thought they were so clever in doing what thousands of others would consider to be quite obvious (but had other important work to do, so they never implemented it). That would tend to make me think that the level of IQ among engineers at Bay Networks is not very high if this kind of thing is something they consider to be an invention. Now we know the examiners in the USPTO are low IQ. But now I have to add in the engineers at Bay Networks, too. Boycott time.

  • How to read a patent (Score:5, Interesting)

    by aeaeae ( 96565 ) on Sunday July 14, 2002 @09:09PM (#3883556)

    When reading a patent such as this it's important to keep a few things in mind:

    1. Ignore the abstract. It has no legal effect -- it is illustrative only. The abstract is often drafted by legal (but not technical) staff based on some summaries prepared by technical (but not "legal") staff. A lot is lost in the translation.

    2. Ignore the summary -- skip to the claims. The most important part of a patent is the Claims section. Everything else is illustrative. The summary of the "present embodiment" (ie what was actually built) is only useful in so far as it gives you an idea of what the patentee is trying to protect. But you will almost always see that the claims are far wider and it is the claims that have legal effect.

    3. Concentrate on the base claims. Almost all patents set out 3 or 4 "base claims". The rest of the claims will be derived claims -- they'll start with "The method set forth in claim X, where...". If a base claim is invalid (or not applicable to what you're doing) then all derived claims are also invalid. So, concentrate on them and try to find your points of difference there.

    4. Claims repeat themselves. Generally, you'll find that the earlier base claims are narrow in scope. They'll then refine some of this in derived claims to make the application clearer or cover the most valuable applications of the invention. Then, a new base claim is started, with more generic language. That process tends to continue until the patent is very large. This is deliberate -- the patent attorney is trying to be as broad as possible, but if they're too broad, the patent will be invalid. So the strategy is to repeat the basic claims so that if a broad claim is struck down as invalid the narrower ones can still survive. If you don't infringe the narrowest patent you can often skip the broader claims. This one's a little different -- some of the claims cover different aspects of the "invention".

    5. Get a lawyer if you're serious. A real lawyer properly briefed will do a better job than you're own analysis or general advice from others -- as Darren suggests.

    6. Careful what you write. Finally, if you're doing some kind of patent analysis, never write "we infringe this" or "possible infringement." Instead, draw up two columns -- the list of patents you "do not infringe" (with reasons) and the list of patents "under investigation".

    In this case, note that base claim 1 does not require type or offset. Derived claim 2 simply adds that as a possible variation. Like all patents it's difficult to read (it should be taken out back and shot) -- however, it does seem to envisage only a hub, depending on your definition of "destination node" and "destination port." I think claim 1 could be distinguished from IPfilter on that basis. It follows that claims 2 - 13 are also distinguishable and don't apply to IPFilter.

    Claim 14 seems overly broad and relates to configuration of the invention under patent. Not easily dismissed based solely on the language of the claim though. Claims 15 - 21 are derived.

    Claims 22 and 28 are problematic, and frankly, poorly drafted. 28 seems most likely to cause IPFilter grief, if it applies. But they're both (overly) broad and could be covered by prior art. These two claims need some careful analysis.

    Basically, prior art is not the only way to show that you don't infringe a patent. Going the prior art route can require you to go to court to invalidate or modify the patent -- expensive proposition. It's cheaper and easier to invent around the patent by avoiding the base claims.

    My two cents.

    • Useful, but one BIG error (Score:4, Interesting)

      by werdna ( 39029 ) on Monday July 15, 2002 @05:39AM (#3884874) Journal
      If a base claim is invalid (or not applicable to what you're doing) then all derived claims are also invalid. So, concentrate on them and try to find your points of difference there.

      This is not generally true, and often false. The dependent (you called them derived) claims include all the limitations of their parent independent (you called them base) claims. For this reason, if the parent independent is NOT INFRINGED (because one or more limitation is not present in the accused), the dependent claims are not infringed. (There is an obscure exception to this rule, but it holds almost always).

      The converse is not generally true. If a parent claim for A+B+C IS INFRINGED, the dependent claim for A+B+C+D might not be infringed by an accused device with A, B and C, but no D. For similar resons, the corresponding proposition for validity is NOT generally true.

      A parent claim for A+B+C can read on a piece of prior art, while one of its dependents for A+B+C+D might not, because the dependent claim could have one or more additional limitations, in this case D, that are not disclosed in the prior art. This happens all the time -- invalidating the broad claim does not put an end to the case if the dependent claims are also infringed.

  • Bay Networks has apaprently patented IP routing. (Score:3, Insightful)

    by Brett Glass ( 98525 ) on Monday July 15, 2002 @12:56AM (#3884250) Homepage
    The first claim says:
    1. A method for redirecting data frames in a network comprising the steps of: receiving a data frame at a port of a network device coupled to said network said data frame to be forwarded to a destination node in said network based on a destination address for said destination node associated with said data frame; comparing contents of said data frame with a user defined filter; and, processing said data frame depending on said user defined filter, wherein processing said data frame comprises the step of forwarding said data frame in said network device to at least one of a monitor port, a destination port associated with said destination node, or an additional destination port associated with an additional node other than said destination node or dropping said data frame, depending on said user defined filter.
    If you read this carefully, it essentially covers anything that routes IP packets according to a set of rules. This, of course, includes any UNIX system that forwards packets between interfaces by consulting entries in a routing table. So, is there prior art? Gee, not much.... Just every UNIX or UNIX-like operating system since DARPA commissioned the development of the BSD IP stack.

    Patents should be reserved for true innovations, not something completely un-novel such as this.

  • How patent claims work (Score:4, Informative)

    by Paul Johnson ( 33553 ) on Monday July 15, 2002 @02:51AM (#3884559) Homepage
    The "Claims" section of a patent is the most important bit. It lays out what the patent covers. It consists of a series of numbered items, each of which covers one idea or variation. So far so simple.

    The key thing is that a court might in future decide that some claims are valid but others are not. So the first couple of claims in a patent might well lay claim to the entire state of the art, and might only be there as a kind of #define macro for subsequent claims. I once read an encryption patent (ISTR it was for a DVD system that didn't get used) where Claim 1 was for XORing the output of a random number generator with the cleartext. This was followed by a series of claims that started "A system as in Claim 1 where the random number generator is...".

    So when you see a patent that seems to claim the whole of some technology, don't panic. There is going to be tons of prior art. You just have to work out where the prior art ends and the real invention starts. This is going to be a bit grey on the boundary (thats where patent lawyers make their money), but you can still get a fairly clear idea pretty quickly. You can also get a fair idea just by looking at the claims and thinking about the technology they represent. Once you get to precise descriptions of obscure algorithms then you are into the meat of the patent.

    Incidentally, don't be scared of legalese. Just think of it as an unusually verbose and unstructured programming language.

    Paul.

  • Berkeley Packet Filter? (Score:2, Informative)

    by Anonymous Coward
    Given the general terms of the patent, might the Berkeley Packet Filter, published in December 1992, constitute prior art? (see http://citeseer.nj.nec.com/mccanne92bsd.html )

  • Yeah, I've got your prior art. It's called the Post Office.

    Gee, individual packets of unknown data with a sender, a reciever, which is then acted upon by a list of rules, and generally passes through a series of 'stations' and 'hubs' until it gets to it's destination?

Slashdot Top Deals

USENET would be a better laboratory is there were more labor and less oratory. -- Elizabeth Haley

Close