`
`
`
`
`
`
`
`
`
`
`
`
`
`Exhibit 17
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 2 of 84
`Trials@uspto.gov
` Paper 50
`571-272-7822 Entered: April 11, 2017
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC. and
`BLUE COAT SYSTEMS LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2016-001591
`Patent 8,677,494 B2
`____________
`
`
`
`Before ZHENYU YANG, CHARLES J. BOUDREAU, and
`SHEILA F. McSHANE, Administrative Patent Judges.
`
`BOUDREAU, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`
`
`
`
`
`1 Case IPR2016-01174 has been joined with the instant proceeding.
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 3 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`I. INTRODUCTION
`Palo Alto Networks, Inc. and Blue Coat Systems, Inc., now known as
`Blue Coat Systems LLC,2 (collectively, “Petitioner”) filed petitions
`requesting inter partes review of certain claims of U.S. Patent
`No. 8,677,494 B2 (Ex. 1001, “the ’494 patent”). Paper 2 (“Petition” or
`“Pet.”; requesting review of claims 1–18 of the ’494 patent); see also
`IPR2016-01174, Paper 2 (requesting review of claims 1–6 and 10–15 of the
`’494 patent).
`Based on the information provided in the Petition, and in
`consideration of the Preliminary Response (Paper 6; “Prelim. Resp.”) of
`Patent Owner, Finjan, Inc., we instituted a trial pursuant to 35 U.S.C.
`§ 314(a) with respect to claims 1–6 and 10–15 and subsequently joined Case
`IPR2016-01174 with the instant case. Paper 8 (“Decision on Institution” or
`“Dec. on Inst.”); see also Paper 20 (copy of decision instituting inter partes
`review in Case IPR2016-01174 and granting motion for joinder; also filed as
`IPR2016-01174, Paper 8).
`After institution, Patent Owner filed a Request for Rehearing Pursuant
`to 37 C.F.R. §§ 42.71(c) and 42.71(d) (Paper 11), challenging our decision
`to institute trial, and we issued a Decision Denying Patent Owner’s Request
`for Rehearing (Paper 13, “Rehearing Decision” or “Reh’g Dec.”).
`Thereafter, Patent Owner filed a Response (Paper 17 (“PO Resp.”)), and
`Petitioner filed a Reply (Paper 26, “Pet. Reply”). Petitioner proffered
`Declarations of Aviel D. Rubin, Ph.D. (Ex. 1002), Eugene Spafford, Ph.D.
`
`
`2 See Paper 30, 1. Blue Coat Systems LLC identifies Symantec Corp. as a
`real party in interest in this proceeding. Paper 39.
`
`2
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 4 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`(Ex. 1061), and John Hawes (Ex. 1088) with its Petition; and Supplemental
`Declarations of Dr. Rubin (Ex. 1090) and Mr. Hawes (Ex. 1089) with its
`Reply. Patent Owner proffered Declarations of Nenad Medvidovic, Ph.D.
`(Ex. 2011) and S.H. Michael Kim (Ex. 2012) with its Response. Also,
`deposition transcripts were filed for Michael T. Goodrich, Ph.D. (Ex. 1098),
`Mr. Kim (Ex. 1099), Dr. Medvidovic (Ex. 1100), Mr. Hawes (Ex. 2014),
`Dr. Rubin (Ex. 2015), and Jack W. Davidson, Ph.D., a witness proffered by
`the petitioner in related Case IPR2015-01892 (Ex. 2016).
`Petitioner moves to exclude certain paragraphs of Dr. Medvidovic’s
`Declaration and certain of Patent Owner’s Exhibits. Paper 31. Patent
`Owner filed an Opposition (Paper 43) to Petitioner’s Motion to Exclude, and
`Petitioner filed a Reply (Paper 47).
`Patent Owner also moves to exclude certain of Petitioner’s Exhibits
`and portions of Petitioner’s Reply. Paper 35. Petitioner filed a Response
`(Paper 42) to Patent Owner’s Motion to Exclude, and Patent Owner filed a
`Reply (Paper 48).
`Patent Owner additionally filed an identification of arguments alleged
`to exceed the proper scope of Petitioner’s Reply (Paper 32), to which
`Petitioner filed a response (Paper 40). Patent Owner further filed a Motion
`for Observations on the cross-examination of Mr. Hawes (Paper 34), and
`Petitioner filed a response thereto (Paper 41); and Patent Owner filed a
`Motion for Entry of the Default Protective Order and to Seal Certain
`Exhibits under 37 C.F.R. §§ 42.14 and 42.54 (Paper 45).
`An oral hearing was held on February 16, 2017; a transcript of the
`hearing is included in the record (Paper 49, “Tr.”).
`
`3
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 5 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`We have jurisdiction under 35 U.S.C. § 6. This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73.
`For the reasons that follow, we determine that Petitioner has shown by a
`preponderance of the evidence that claims 1, 2, and 6 of the ʼ494 patent are
`unpatentable, but that Petitioner has not shown by a preponderance of the
`evidence that claims 3–5 and 10–15 of the ’494 patent are unpatentable.
`We also dismiss as moot Petitioner’s Motion to Exclude;
`dismiss-in-part and deny-in-part Patent Owner’s Motion to Exclude; and
`grant Patent Owner’s Motion for Entry of the Default Protective Order and
`to Seal.
`
`II. BACKGROUND
`
`A. Related Proceedings
`The parties identify six district court actions involving the ’494 patent:
`Finjan, Inc. v. Sophos, Inc., No. 3:14-cv-01197 (N.D. Cal. 2014) (“the
`Sophos litigation”); Finjan, Inc. v. Websense, Inc., No. 14-cv-01353
`(N.D. Cal. 2014) (“the Websense litigation”); Finjan, Inc. v. Symantec
`Corp., No. 3:14-cv-02998 (N.D. Cal. 2014); Finjan, Inc. v. Palo Alto
`Networks, Inc., No. 3:14-cv-04908 (N.D. Cal. 2014); Finjan, Inc. v. Blue
`Coat Systems, Inc., No. 5:15-cv-03295 (N.D. Cal. 2015) (“the Blue Coat
`litigation”); and Finjan, Inc. v. Cisco Systems Inc., No. 3:17-cv-00072
`(N.D. Cal. 2017). Pet. 2; Paper 5, 1; PO Resp. 57; Paper 37, 1.
`The ’494 patent was also the subject of an inter partes review in
`Symantec Corp. v. Finjan, Inc., Case IPR2015-01892 (“the Symantec 1892
`IPR”), to which Blue Coat Systems, Inc. v. Finjan, Inc., Case
`IPR2016-00890, was joined; and was the subject of denied petitions for inter
`partes review in Sophos Inc. v. Finjan, Inc., Case IPR2015-01022, Symantec
`
`4
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 6 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`Corp. v. Finjan, Inc., Case IPR2015-01897, and Blue Coat Systems, Inc. v.
`Finjan, Inc., Case IPR2016-01443. We previously issued a Final Written
`Decision in the Symantec 1892 IPR, in which we determined, as in the
`instant proceeding, that claims 1, 2, and 6 of the ’494 patent are
`unpatentable. See IPR2015-01892, slip op. at 66 (PTAB Mar. 15, 2017)
`(Paper 58) (Symantec Final Written Dec.).
`
`B. The ’494 Patent
`The ’494 patent, entitled “Malicious Mobile Code Runtime
`Monitoring System and Methods,” issued March 18, 2014, from U.S. Patent
`Application No. 13/290,708 (“the ’708 application”), filed November 7,
`2011. Ex. 1001, [21], [22], [45], [54].
`The ’494 patent describes protection systems and methods “capable of
`protecting a personal computer (‘PC’) or other persistently or even
`intermittently network accessible devices or processes from harmful,
`undesirable, suspicious or other ‘malicious’ operations that might otherwise
`be effectuated by remotely operable code.” Ex. 1001, 2:51–56. “[R]emotely
`operable code that is protectable against can include,” for example,
`“downloadable application programs, Trojan horses and program code
`groupings, as well as software ‘components’, such as Java™ applets,
`ActiveX™ controls, JavaScript™/Visual Basic scripts, add-ins, etc., among
`others.” Id. at 2:59–64.
`
`C. Priority Date of the ’494 Patent
`On its face, the ’494 patent purports to claim priority from nine earlier
`applications: (1) U.S. Provisional Application No. 60/030,639 (“the ’639
`provisional”), filed November 8, 1996; (2) U.S. Patent Application No.
`08/790,097, filed January 29, 1997, and issued as U.S. Patent No. 6,167,520
`
`5
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 7 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`(“the ’520 patent”); (3) U.S. Patent Application No. 08/964,388 (“the ’388
`application”), filed November 6, 1997, and issued as U.S. Patent No.
`6,092,194 (Ex. 1013, “the ’194 patent”); (4) U.S. Patent Application
`No. 09/539,667 (“the ’667 application”), filed March 30, 2000, and issued as
`U.S. Patent No. 6,804,780 (Ex. 2004, “the ’780 patent”); (5) U.S. Patent
`Application No. 09/551,302, filed April 18, 2000; (6) U.S. Provisional
`Patent Application No. 60/205,591, filed May 17, 2000; (7) U.S. Patent
`Application No. 09/861,229 (“the ’229 application”), filed May 17, 2001,
`and issued as U.S. Patent No. 7,058,822 B2 (Ex. 1016, “the ’822 patent”);
`(8) U.S. Patent Application No. 11/370,114 (“the ’114 application”), filed
`March 7, 2006; and (9) U.S. Patent Application No. 12/471,942 (“the ’942
`application”), filed May 26, 2009. Ex. 1001, [63].
`In the Petition, Petitioner asserted that claims 1, 3–6, 9, 10, 12–15,
`and 18 of the ’494 patent are entitled only to the March 30, 2000, filing date
`of the ’667 application; that claims 2 and 11 are entitled only to the May 26,
`2009, filing date of the ’942 application; and that claims 7, 8, 16, and 17 are
`entitled only to the March 7, 2006,3 filing date of the ’114 application.
`Pet. 13–19. Petitioner’s argument regarding the first of these groups of
`claims was, essentially, that: (1) there was a break in the priority chain due
`to a failure of the ’494 patent’s great-grandparent ’822 patent to claim
`priority from or include any reference to the ’520 and ’194 patents or the
`’097 and ’388 applications from which those patents respectively issued;
`(2) as a result of that break, the ’494 patent’s “grandparent ’926 [patent]
`cannot claim priority earlier than the date of the earliest date of an
`
`3 This date is repeatedly misstated in the Petition as May 7, 2006. Pet. 6, 13,
`14.
`
`6
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 8 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`application on the face of its parent, the ’822 patent: March 30, 2000”; and
`(3) “[i]n turn, the ʼ494 [patent]—which depends on the ’926 [patent]’s
`priority—has the same priority date limitation.” Id. at 15–16. Petitioner
`acknowledged that Patent Owner later filed a “Petition to Accept
`Unintentionally Delayed Priority Claim Under 37 C.F.R. 1.78” (“Priority
`Petition”) during reexamination of the ’822 patent, requesting amendment to
`include references to the ’520 and ’194 patents, and that the Office granted
`the Priority Petition and issued a Corrected Filing Receipt including the
`priority claim to the previously omitted applications in July 2014. Pet. 16;
`Ex. 1017, 1–3 (Reexamination Control No. 90/013,017, Decision mailed
`July 25, 2014, at 1–3); Ex. 3005, 1 (Reexamination Control No. 90/013,017,
`Corrected Filing Receipt dated July 24, 2014, at 1). Nonetheless, Petitioner
`contended, because the Examiner in the reexamination later concluded that
`certain claims of the ’822 patent are entitled to a priority date no earlier than
`May 17, 2000, because no certificate of correction had been published, and
`because the reexamination of the ’822 patent had not completed and was on
`appeal after all petitioned claims in the ’822 patent were rejected as invalid,
`the Priority Petition is ineffectual with respect to the ’494 patent’s
`entitlement to the benefit of the November 6, 1997 filing date of the
`’388 application. Pet. 16.
`In the Decision on Institution, we agreed with Petitioner that the
`’494 patent was not entitled to claim the benefit of the November 8, 1996,
`filing date of the ’639 provisional or the January 29, 1997, filing date of the
`’092 application, but concluded, notwithstanding Petitioner’s arguments,
`that each of the claims is entitled to the priority date of the November 6,
`
`7
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 9 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`1997, filing date of the ’388 application. Dec. on Inst. 11–13. As we
`explained,
`Petitioner cites no authority for the proposition that a granted
`petition to accept an unintentionally delayed priority claim is
`effective only upon issuance of a certificate of correction or
`reexamination certificate, and not upon grant of the petition. In
`any event, as Patent Owner points out in its Preliminary
`Response, the Board reversed the rejection of all appealed claims
`in the reexamination of the ’822 patent (see Ex. 2007) and a
`reexamination certificate was issued by the Office on February
`16, 2016 (Ex. 2009). Prelim. Resp. 18.
`Notably, however, . . . [a]s Petitioner points out, the
`earliest priority document cited on the face of the ’926 patent
`through which the ’494 claims priority is the ’194 patent (see Pet.
`18), and there is no indication in the record that the ’926 patent,
`or the ’114 application, from which it issued, was ever the subject
`of a petition to accept a delayed priority claim to either the ’639
`provisional or the ’097 application.
`Id. at 12–13.
`Although Patent Owner argues in the Patent Owner Response that it
`“maintains that the ’494 Patent is entitled to the November 8, 1996 priority
`date established by Provisional Patent Application No. 60/030,639” (PO
`Resp. 15 n.7), it does not provide any additional explanation or cite any
`evidence in support of that conclusory argument, and does not otherwise
`challenge our determination that the ’494 patent is not entitled to claim the
`benefit of any filing date earlier than November 6, 1997.
`For its part, Petitioner did not request reconsideration of our
`determination regarding the priority date or challenge that determination in
`its Reply, but raised again at the oral hearing its argument that the proper
`priority date for the challenged claims is March 30, 2000. Tr. 6:13–13:1.
`Petitioner contends, in essence, that the correction of the priority date of the
`
`8
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 10 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`’822 patent was not effective until the issuance of a reexamination certificate
`on February 16, 2016, and that, because that was after Patent Owner sued
`Petitioner Palo Alto Networks, Inc. in November 2014 and the Petition was
`filed in November 2015, the correction does not benefit the ’494 patent. Id.
`at 6:21–7:19. According to Petitioner, “the statute governing certificates of
`correction as well as the regulations on this issue do not allow this type of
`correction to have retroactive effect, and because the IPR in this case was
`filed prior to the issuance of the reexamination certificate, that certificate has
`no effect here.” Id. at 8:5–9. Petitioner contends, more particularly, that
`“[o]n the face of section 255 it states that a certificate of correction is only
`effective for causes thereafter arising, and that language has been interpreted
`by the Federal Circuit in the H.-W. Tech. case.” Id. at 8:16–19 (citing
`35 U.S.C. § 255 and H-W Technology, L.C. v. Overstock.com, Inc., 758 F.3d
`1329 (Fed. Cir. 2014)).
`Having considered the full trial record, we remain persuaded that each
`of the challenged claims is entitled to an effective filing date of November 6,
`1997. As we explained in our Decision on Institution, we understand Patent
`Owner’s delayed priority claim to have been effective upon the Office’s
`grant of the Priority Petition and Issuance of Corrected Filing Receipt on
`July 25, 2014 (Ex. 1017, 1–3; Ex. 3005, 1), rather than upon the issuance of
`the Reexamination Certificate confirming the patentability of the claims of
`the ’822 patent (Ex. 2009). See Dec. on Inst. 11–12. Petitioner does not
`point to, and we are not aware of, any authority suggesting that a granted
`petition to correct priority date requires, in addition, the issuance of either a
`certificate of correction or a reexamination certificate before becoming
`effective. Despite Petitioner’s representation at the oral hearing that H-W
`
`9
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 11 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`Technology involved correction of a priority date (Tr. 9:2–7), we note that
`that case instead involved a certificate of correction to add a missing
`limitation to a patent claim and, thus, is not on point here. See H-W Tech.,
`758 F.3d at 1331, 1334. Accordingly, we conclude that each of the
`challenged claims is entitled to the benefit of the November 6, 1997, filing
`date of the ’388 application.
`
`D. Illustrative Challenged Claims
`Of the challenged claims, claims 1 and 10 are independent. Those
`claims are illustrative and are reproduced below:
`1. A computer-based method, comprising the steps of:
`receiving an incoming Downloadable;
`deriving security profile data for the Downloadable,
`including a list of suspicious computer operations that may be
`attempted by the Downloadable; and
`storing the Downloadable security profile data in a database.
`
`10. A system for managing Downloadables, comprising:
`a receiver for receiving an incoming Downloadable;
`a Downloadable scanner coupled with said receiver, for
`deriving security profile data for the Downloadable, including a
`list of suspicious computer operations that may be attempted by
`the Downloadable; and
`a database manager coupled with said Downloadable
`scanner, for storing the Downloadable security profile data in a
`database.
`
`Ex. 1001, 21:19–25, 22:7–16. Each of challenged claims 2–6 depends
`directly from claim 1; and each of challenged claims 11–15 depends directly
`from claim 10. Id. at 21:26–37, 22:17–30.
`
`10
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 12 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`E. Instituted Grounds of Unpatentability
`The Petition asserted six grounds of unpatentability. Pet. 5. We
`instituted trial in this case on the following two grounds:
`
`Claims
`
`1, 2, 6, 10, 11, and 15
`
`3–5 and 12–14
`
`Basis
`
`§ 103
`
`§ 103
`
`Reference(s)
`
`Swimmer4
`
`Swimmer and Martin5
`
`Dec. on Inst. 34.
`
`III. ANALYSIS
`
`A. Claim Construction
`The ’494 patent expired no later than January 29, 2017. See Paper 38,
`1 (Patent Owner representing that January 29, 2017, was the expiration date
`of the ’494 patent and that Petitioner does not dispute that date). In an inter
`partes review, we construe claims of an expired patent according to the
`standard applied by the district courts. See In re Rambus Inc., 694 F.3d 42,
`46 (Fed. Cir. 2012). Specifically, because the expired claims of a patent are
`not subject to amendment, we apply the principles set forth in Phillips v.
`AWH Corp., 415 F.3d 1303, 1312–17 (Fed. Cir. 2005) (en banc). Under that
`
`
`4 Morton Swimmer et al., Dynamic Detection and Classification of
`Computer Viruses Using General Behaviour Patterns, Virus Bull. Conf. 75
`(Sept. 1995) (Ex. 1006, “Swimmer”).
`5 David M. Martin, Jr. et al., Blocking Java Applets at the Firewall, Proc.
`1997 Symp. on Network & Distributed Sys. Sec. (©1997) (Ex. 1047,
`“Martin”). We note that Martin states on its face that it is from the
`proceedings of a symposium held February 10–11, 1997 (Ex. 1047, 1), but
`that the record copy of Martin bears a date stamp of June 5, 1998 (id. at 3),
`does not indicate a publication date, and merely has a 1997 copyright date
`(id. at 1).
`
`11
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 13 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`standard, the words of a claim are generally given their ordinary and
`customary meaning, which is the meaning the term would have to a person
`of ordinary skill at the time of the invention, in the context of the entire
`patent including the specification. See Phillips, 415 F.3d at 1312–13. Only
`those terms in controversy need to be construed, and only to the extent
`necessary to resolve the controversy. See Vivid Techs., Inc. v. Am. Sci. &
`Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999).
`Petitioner proposed constructions in the Petition for three claim terms:
`(1) “Downloadable security profile data,” as “information related to whether
`executing a downloadable is a security risk”; (2) “database,” as “a collection
`of interrelated data organized according to a database schema to serve one or
`more applications”; and (3) “Downloadable,” as “an executable application
`program, which is downloaded from a source computer and run on the
`destination computer.” Pet. 19–23. In the Decision on Institution, we noted
`that Patent Owner in its Preliminary Response challenged only Petitioner’s
`proposal with respect to the first of these terms. Dec. on Inst. 6 (citing
`Prelim. Resp. 9–12). Upon consideration of the parties’ respective
`arguments, we adopted the parties’ agreed constructions of “database” and
`“Downloadable,” and we also agreed with Patent Owner that, in view of the
`parties’ agreed interpretation of the term “Downloadable,” there was no need
`to separately construe the term “Downloadable security profile data.” Id. at
`7–8. We also determined that no other claim terms required express
`construction for purposes of the Decision on Institution. Id. at 8.
`In the Patent Owner Response, Patent Owner agrees with our
`determinations on claim construction in the Decision on Institution. PO
`Resp. 8–11. Petitioner also does not challenge those determinations in its
`
`12
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 14 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`Reply. Although our claim construction analysis in the Decision on
`Institution was rendered under the “broadest reasonable interpretation”
`standard applicable to unexpired patents (see 37 C.F.R. § 42.100(b)), we
`discern no reason to deviate from our previous determinations here.6
`
`B. Obviousness Grounds
`We have reviewed the Petition, Patent Owner Response, and
`Petitioner’s Reply, as well as the relevant evidence discussed therein. For
`the reasons that follow, we determine that Petitioner has shown by a
`preponderance of the evidence that claims 1, 2, and 6 of the ’494 patent are
`unpatentable under 35 U.S.C. § 103(a) over Swimmer.
`
`1. Principles of Law
`A patent claim is unpatentable under 35 U.S.C. § 103(a) if the
`differences between the claimed subject matter and the prior art are “such
`that the subject matter as a whole would have been obvious at the time the
`invention was made to a person having ordinary skill in the art to which said
`subject matter pertains.” KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406
`(2007). The question of obviousness is resolved on the basis of underlying
`factual determinations, including (1) the scope and content of the prior art;
`(2) any differences between the claimed subject matter and the prior art;
`(3) the level of skill in the art; and (4) objective evidence of nonobviousness,
`i.e., secondary considerations such as commercial success, long felt but
`
`
`6 We note that our adopted construction of “database” mirrors the district
`court’s express construction of that term in the Sophos litigation and that
`we also adopted the same construction in the Symantec 1892 IPR. See
`Ex. 2001, 3 (Finjan, Inc. v. Sophos, Inc., No. 14-cv-01197 (N.D. Cal. 2014),
`Claim Construction Order at 3); Symantec, slip op. at 16.
`
`13
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 15 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`unsolved needs, and failure of others. Graham v. John Deere Co., 383 U.S.
`1, 17–18 (1966).
`To prevail in an inter partes review, a petitioner must prove the
`unpatentability of the challenged claims by a preponderance of the evidence.
`35 U.S.C. § 316(e); 37 C.F.R. § 42.1(d). “[T]he petitioner has the burden
`from the onset to show with particularity why the patent it challenges is
`unpatentable.” Harmonic Inc. v. Avid Tech., Inc., 815 F.3d 1356, 1363 (Fed.
`Cir. 2016) (citing 35 U.S.C. § 312(a)(3) (requiring inter partes review
`petitions to identify “with particularity . . . the evidence that supports the
`grounds for the challenge to each claim”)). The burden of persuasion never
`shifts to Patent Owner. See Dynamic Drinkware, LLC v. Nat’l Graphics,
`Inc., 800 F.3d 1375, 1378 (Fed. Cir. 2015) (discussing the burden of proof in
`inter partes review). Furthermore, Petitioner cannot satisfy its burden of
`proving obviousness by employing “mere conclusory statements.” In re
`Magnum Oil Tools Int’l, Ltd., 829 F.3d 1364, 1380 (Fed. Cir. 2016).
`We analyze the instituted ground of unpatentability in accordance
`with the above-stated principles.
`
`2. Level of Ordinary Skill in the Art
`In determining whether an invention would have been obvious at the
`time it was made, 35 U.S.C. § 103 requires us to resolve the level of
`ordinary skill in the pertinent art at the time of the invention. Graham,
`383 U.S. at 17. “The importance of resolving the level of ordinary skill in
`the art lies in the necessity of maintaining objectivity in the obviousness
`inquiry.” Ryko Mfg. Co. v. Nu-Star, Inc., 950 F.2d 714, 718 (Fed. Cir.
`1991). The person of ordinary skill in the art is a hypothetical person who is
`presumed to have known the relevant art at the time of the invention. In re
`
`14
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 16 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`GPAC, Inc., 57 F.3d 1573, 1579 (Fed. Cir. 1995). Factors that may be
`considered in determining the level of ordinary skill in the art include, but
`are not limited to, the types of problems encountered in the art, the
`sophistication of the technology, and educational level of active workers in
`the field. Id. In a given case, one or more factors may predominate. Id.
`Generally, it is easier to establish obviousness under a higher level of
`ordinary skill in the art. Innovention Toys, LLC v. MGA Entm’t, Inc.,
`637 F.3d 1314, 1323 (Fed. Cir. 2011) (“A less sophisticated level of skill
`generally favors a determination of nonobviousness, . . . while a higher level
`of skill favors the reverse.”).
`Petitioner’s declarant, Dr. Rubin, opines that a person of ordinary skill
`at the time of the ’494 patent would have had a bachelor’s degree or the
`equivalent in computer science (or related academic fields) and three to four
`years of additional experience in the field of computer security, or
`equivalent work experience. Ex. 1002 ¶ 21. According to Dr. Rubin, “[t]his
`definition . . . would not change whether the time of the alleged invention is
`deemed to be 1996, 2000, or 2006.” Id.
`Patent Owner’s declarant, Dr. Medvidovic, opines that the person of
`ordinary skill in the art in the field of the ’494 patent would be someone with
`a bachelor’s degree in computer science or a related field and “either (1) two
`or more years of industry experience and/or (2) an advanced degree in
`computer science or related field.” Ex. 2011 ¶ 37. Nonetheless,
`Dr. Medvidovic acknowledges Dr. Rubin’s opinion as to the relevant level
`of skill and further opines that the opinions stated in his declaration would
`be the same if rendered from the perspective of the person of ordinary skill
`in the art set forth by Dr. Rubin. Id. ¶¶ 39–40 (citing Ex. 1002 ¶ 21).
`
`15
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 17 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`We determine that the differences in the declarants’ assertions are
`negligible and that both assessments are consistent with the ’494 patent and
`the referenced prior art. For the purposes of the analysis below, we adopt
`Dr. Medvidovic’s assessment but note that the factual findings and legal
`conclusions set forth below would not have differed had we adopted
`Dr. Rubin’s assessment.
`
`3. Scope and Content of the Prior Art
`a. Overview of Swimmer
`Swimmer is generally directed to a system, referred to as the “Virus
`Intrusion Detection Expert System” (“VIDES”), that is described as “a
`prototype for an automatic analysis system for computer viruses.” Ex. 1006,
`1, 2. In Swimmer’s prototype, an emulator is used to monitor the system
`activity of a virtual computer, but Swimmer also states that “VIDES could
`conceivably be used outside the virus lab to detect viruses in a real
`environment” and that “[o]ne possibility is to use it as a type of firewall for
`programs entering a protected network.” Id. at 1, 13.
`In general, Swimmer discloses that sets of rules are used to detect
`viruses and extract details of their behavior. Ex. 1006, 1–7. Swimmer
`provides a model of virus attack strategy and discloses that virus-specific
`rules can be generated and translated into a rule-based language (“RUles-
`baSed Sequence Evaluation Language,” or “RUSSEL”). Id. at 4–7. For
`example, based on assumptions about the behavior of disk operating system
`(DOS) viruses, Swimmer identifies two possible infection strategies:
`(1) writing to the beginning of a file (BOF) without a previous read to the
`same location, and (2) reading to BOF followed by a writing to BOF, with or
`without intervening reads and writes. Id. at 5–6.
`
`16
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 18 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`Swimmer discloses that VIDES collects system activity data and
`creates a set of audit records having a specified format for analysis by a tool
`referred to as “Advanced Security audit trail Analysis on uniX” (“ASAX”).
`Ex. 1006, 1, 9. ASAX is described as an expert system that analyzes the
`data produced by the VIDES emulator, using RUSSEL to identify the virus
`attack. Id. at 1, 4, 10–13. Swimmer also discloses that ASAX provides a
`filter that reduces the number of audit records to only relevant, higher-level
`records. Id. at 6–7. In particular, a “first ASAX system reads the raw audit
`trail, converts it into generic data, and pipes its output as a [Normalized
`Audit Data Format] NADF file for further processing,” and “[u]sing ASAX
`as a filter allows [for] reduc[tion in] the complexity of maintaining the
`system while not sacrificing any power.” Id. at 7, 12. The audit records
`identify, among other things, DOS functions requested by the analyzed
`program, the register/memory values used in calls to the DOS functions, and
`register/memory values returned by the function calls. Id. at 1, 7, 9.
`Swimmer explains that each VIDES audit record has the format <code
`segment, RecType, StartTime, EndTime, function number, arg (...), ret (...)>,
`where code segment is the address in memory of the executable image of the
`program; function number is the number of the DOS function requested by
`the program; arg (...) is a list of register/memory values used in the call to a
`DOS function; ret (...) is a list of register/memory values as returned by the
`function call; RecType is the type of the record; and StartTime and EndTime
`are the time stamp of action start and end, respectively. Ex. 1006, 9.
`An example of an excerpt from an audit trail is provided in Figure 3 of
`Swimmer, reproduced below.
`
`17
`
`
`
`Case 3:17-cv-05659-WHA Document 110-18 Filed 06/15/18 Page 19 of 84
`IPR2016-00159
`Patent 8,677,494 B2
`
`
`
`Figure 3, above, is described by Swimmer as an excerpt from an audit trail
`for the Vienna virus, provided as a human-readable representation of a
`binary NADF file and omitting certain fields (apparently, StartTime and
`EndTime) for clarity and brevity. Ex. 1006, 9–10.
`On its face, Swimmer includes the following header: “VIRUS
`BULLETIN CONFERENCE, SEPTEMBER 1995.” Ex. 1006, 1; see also
`id. at 3, 5, 7, 9, 11, 13 (including the same header). Along with the Petition,
`Petitioner introduced a declaration of Mr. John Hawes, Chief of Operations
`at Virus Bulletin. Ex. 1088. Mr. Hawes declares that, according to Virus
`Bulletin’s business records maintained in the ordinary course of business,
`Swimmer was published by Virus Bulletin to all 163 attendees of the Virus
`Bulletin International Conference in Boston in September 1995, and the
`conference proceedings book containing Swimmer was subsequently made
`available for private sale to individuals by Virus Bulletin. Id. ¶ 3.
`Mr. Hawes also declares that Exhibit A attached to his declaration is a true
`and correct copy of Swimmer as publis