Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 1 of 11
`
`Exhibit 12
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Exhibit 12
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 2 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`“fundamental computer operations,” not “suspicious computer operations. See
`
`‘639 Provisional, Pg. 18, l. 9–13. Petitioner ignores the disclosure from the ‘194
`
`Patent, which actually relates to “suspicious computer operations.” ‘194 Patent at
`
`5:50–54 (disclosing listing the operations that could be deemed potentially hostile).
`
`Additionally, the ‘194 Patent provides “An Example List of Operations Deemed
`
`Potentially Hostile,” meaning that there is no a priori understanding of what
`
`constitutes a “suspicious computer operation.” See ‘194 Patent at 5:58–6:4
`
`(emphasis added). Rather, some subset of all possible computer operations must
`
`first be deemed suspicious in order to derive a list of suspicious computer
`
`operations for a Downloadable. See id. at FIG. 7; 9:20–42.
`
`Furthermore, this argument is contrary to the law as the Board now attempts
`
`to equate standard MS-DOS functions as “suspicious computer operations” by
`
`relying on knowledge gleaned from the ‘494 Patent itself—namely the insight to
`
`deem some subset of “calls made to an operating system, a file system, a network
`
`system, and to memory” as suspicious in deriving a list of the suspicious computer
`
`operations that may be attempted by a Downloadable. See Institution Decision at
`
`22 (“Petitioner provides evidence that such function numbers were known in the
`
`prior art to correspond to, among other functions, the same four types of operations
`
`that are recited as ‘suspicious computer operations in challenged dependent claims
`
`6 and 15.”). To the contrary, in assessing obviousness Petitioner may consider
`
`- 11 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 3 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`trail” improperly reads out the “storing . . . in a database” claim limitation which is
`
`prohibited. mFormation Techs., Inc. v. Research in Motion Ltd., 764 F.3d 1392,
`
`1399 (Fed. Cir. 2014) (reaffirming that claim limitations cannot be construed in a
`
`way that “would render another limitation superfluous.”) (citation and internal
`
`quotations omitted).
`
`Consequently, the unequivocal disclosure in the ‘494 Patent and Petitioner’s
`
`misleading attempt to conflate claim terms require that this construction be adopted
`
`to make clear that “deriving DSP data” is separate from “storing the DSP data in a
`
`database,” and that the DSP data is only placed in the database upon derivation of
`
`the profile, including the list of suspicious computer operations.
`
`IV.
`
` SWIMMER DOES NOT INVALIDTE THE ‘494 PATENT
`
`A.
`
`
`
`Swimmer was not Publically Available
`
`Inter partes review may only be requested based on prior art that consists of
`
`patents or printed publications that were publically available. 35 U.S.C. § 311(b).
`
`Public accessibility is the key factor in determining whether a reference is deemed
`
`a “printed publication.” In re Hall, 781 F.2d 897, 898–99 (Fed. Cir. 1986); see
`
`also L-3 Commc’n Holdings, Inc. v. Power Survey, LLC, IPR2014-00832, Paper 9
`
`at 11–12 (PTAB Nov. 14, 2014). Swimmer, however, was not publically
`
`accessible. Swimmer makes this clear by stating: "No part of this publication may
`
`be reproduced, stored in a retrieval system, or transmitted in any form without the
`
`- 16 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 4 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`writing audit records one-by-one to the audit trail.” Id. at ¶ 79. As a result, each
`
`individual audit record (e.g. <CS=3911 Type=0 Fn=30 arg() ret (AX=5)>) merely
`
`includes a single DOS function number (Fn=30), as highlighted below:
`
`
`
`Swimmer at 000009, Figure 3. Accordingly the system activity data within a
`
`single audit record cannot be equated with the claimed DSP data because each
`
`audit record can only include a single MS-DOS function number, not a list of
`
`computer operations, let alone a list of suspicious computer operations, as required
`
`by the claims.
`
`Moreover, independent claim 10 requires “a Downloadable scanner coupled
`
`with said receiver.” However, Swimmer does not disclose the “Downloadable
`
`scanner,” and actually teaches against the use of scanners by reasoning that they
`
`are easily circumvented. Swimmer at 000003, ¶¶ 1–5. In fact, Dr. Davidson
`
`admitted that the Swimmer system does not use a scanner at all. Davidson Tr. at
`
`- 29 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 5 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`not disclose the underlying facts or data on which the opinion is based is entitled to
`
`little or no weight,” Petitioner’s argument is entitled to little or no weight.”
`
`Furthermore, a POSITA would understand the difference between a “flat
`
`file” or log file, like Swimmer’s audit record, and a “flat file database:”
`
` flat file a file consisting of records of a single record type in which
`there is no embedded structure information that governs
`relationships between records.
`
` flat file database a database that takes the form of a table, where
`only one table can be used for each database.
`
`Ex. 2024, Microsoft Press Computer Dictionary Third Edition at 199. As Dr.
`
`Medvidovic explains, a POSITA would have understood Swimmer’s audit record
`
`to be a flat file—and in particular a log file—not a flat file database because the
`
`audit trail is not in the form of a table but rather a large sequential file of consisting
`
`of audit records of a single generically formatted record type (i.e. “an MS-DOS
`
`audit record”). See Medvidovic, ¶ 140; see also id. at ¶ 121.
`
`Moreover, contrary to Petitioner’s argument that a POSITA would consider
`
`the audit record format illustrated in Swimmer’s Figure 3 to be a type of database,
`
`Swimmer’s “audit trail” does not meet the Board’s construction because it does not
`
`contain a database schema. See Medvidovic, ¶ 121. As Dr. Medvidovic explains,
`
`“a person skilled in the art at the time would understand a ‘database schema” to be
`
`‘a description of a database to a database management system (DBMS) in the
`
`- 38 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 6 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`dollars for the right to use Finjan’s patented technology. See Ex. 2010, Declaration
`
`of S.H. Michael Kim (“Kim Decl.”), ¶¶ 4-10, Exs. 2017-2022. Finjan’s
`
`commercial success through its licensing program is relevant to Petitioner’s
`
`obviousness challenges. See Demaco Corp. v. F. Von Langsdorff Licensing Ltd.,
`
`851 F.2d 1387, 1391 (Fed. Cir. 1988) (“The commercial response to an invention
`
`is significant to determinations of obviousness, and is entitled to fair weight.”)
`
`(citations omitted).
`
`After the ‘494 issued, several licensees entered into licenses agreements,
`
`which included a license to the ‘494 Patent, to avoid litigation and to obtain a
`
`license to continue to make, use, offer to sell, and sell products that embodied the
`
`inventions disclosed in the ‘494 Patent. More specifically, Finjan has entered into
`
`several licenses agreements, which included a license to the ‘494 Patent, including
`
`agreements with F-Secure, Avast, another confidential licensee, Proofpoint and
`
`Websense, all major players that operate in the same space as Petitioner. See Kim
`
`Decl., ¶¶ 5-11; Exs. 2015-2016.
`
`Two of these licenses were entered into to avoid litigation and to obtain a
`
`license for products that embodied the inventions disclosed in the ‘494 Patent. See
`
`Kim Decl., ¶¶ 8-9. Without a license to the ‘494 Patent, the licensees would have
`
`lost business and revenues for its infringing products. Websense and Proofpoint
`
`were two licensees that settled during the course of litigation. See id. Finjan
`
`- 55 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 7 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`provided these licensees notice of the fact that products that the licensees offered
`
`for sale embodied at least the invention disclosed in one claim of the ‘494 Patent.
`
`See id. After receiving notice that the licensees products infringed the ‘494 Patent,
`
`the licensees entered into licenses so they could continue selling their products.
`
`Avast
`
`Avast’s Endpoint Protection and its connection with Avast Research Labs to
`
`identify new malicious threats utilize the inventions disclosed in the ‘494 Patent,
`
`which is demonstrated in the attached chart. See Medvidovic Decl., ¶ 172; see also
`
`Ex. 2014 at 1-3. Avast revenues are not publically available, however, Avast
`
`revenues for 2015 were estimated at $300 million, a jump of nearly 40 percent
`
`from 2014, with about 85 percent of revenue attributed to sales to consumers. See
`
`Ex. 2040. The majority of these sales are related to the Endpoint Protection
`
`products and attributable to the invention of the ‘494 Patent. Because the ‘494
`
`Patent provides the ability to find new malicious threats by deriving a DSP with a
`
`list of suspicious computer operations, Avast is able to identify new threats and
`
`provide more protection for its customers. See Medvidovic Decl., ¶ 172.
`
`F-Secure
`
`In 2015, revenues for F-Secure were at $147.6 Million. Ex. 2037. F-
`
`Secure’s multi-layered approach to security is comprised of five modules, each
`
`designed to address a particular aspect of the threat landscape and work together to
`
`- 56 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 8 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`provide a complete solution using the technology of the ‘494 Patent which is
`
`demonstrated in the attached chart. See Medvidovic Decl., ¶ 173; Ex. 2035.
`
`Attached is a chart that shows how the inventions disclosed in the ‘494 Patent are
`
`embodied in the F-Secure products. Ex. 2014 at 4-7. These modules are browsing
`
`protection, signature-based scanning, file reputation analysis, behavioral analysis
`
`and exploit interception. Id. Three of these modules are tied to the inventions
`
`disclosed in the ‘494 Patent.
`
`Websense
`
`On March 18, 2014, Finjan asserted patent infringement of the ‘494 Patent
`
`against Websense, Inc. (“Websense”). Finjan v. Websense, Inc., 14-CV-01353-
`
`BLF (N.D. Cal.). During that litigation, Finjan provided Websense with notice
`
`regarding how its products embodied the inventions disclosed in the ‘494 Patent as
`
`demonstrated in the attached chart. See Medvidovic, ¶ 171; Ex. 2013. In
`
`September of 2014, Websense, Inc. took a license to Finjan’s patent portfolio,
`
`including the ‘494 Patent. See Kim Decl., ¶8. Websense was acquired for $1.5
`
`billion in 2015. Websense’s revenue information is not publically available.
`
`However, in 2012, revenues for Websense were $361.4 million. See Ex. 2038.
`
`Websense (Forcepoint) uses the inventions disclosed in the ‘494 Patent. See
`
`Medvidovic, ¶ 171; Ex. 2013. Websense touts the importance of this technology
`
`in brochures that list the “three key security requirements” organizations need to
`
`- 57 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 9 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`defend themselves. See Medvidovic, ¶ 171. Those three requirements are: (1)
`
`Real-time, in-line defenses that can identify Zero-day, signature-less threats and
`
`APTs; (2) Integrated Web, Email and Data security solutions powered by real-time
`
`intelligence and (3) Advanced outbound containment defenses to protect against
`
`data theft and data loss. See id.; see also Ex. 2034. The ‘494 patent covers two out
`
`of the three requirements. See id. Thus, the sales of the Triton product coincide
`
`directly with the inventions disclosed in the ‘494 Patent.
`
`Proofpoint
`
`On December 16, 2013, Finjan filed a complaint alleging patent
`
`infringement against Proofpoint, Inc. (“Proofpoint”) and Armorize Technologies,
`
`Inc. (“Armorize”). Kim Decl., ¶ 9. The ‘494 Patent had not issued when Finjan
`
`filed this case, so it was not a part of the litigation. However, in June of 2016, after
`
`the ‘494 Patent issued, Proofpoint and Finjan entered into a license agreement
`
`which included the ‘494 Patent and dismissed the litigation. Proofpoint’s SEC
`
`filing demonstrates the increasing need for protection against unknown malicious
`
`content that is covered under the ‘494 Patent. See Medvidovic, ¶ 175; Ex. 2023 at
`
`5, Ex. 2036 at 5. “A fundamental shift in the sources of cybercrime, from hackers
`
`to organized crime and governments, combined with the emergence of
`
`international data trafficking and sophisticated advanced persistent threats
`
`(“APTs”), polymorphic threats, zero-day exploits, and user-transplant “drive-by”
`
`- 58 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 10 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`downloads, is driving an unprecedented wave of both targeted and broad-based
`
`malicious attack campaigns designed to steal valuable information. At the same
`
`time, the growth of business-to-business collaboration and the use of social media
`
`for mass communication, as well as the consumerization of IT and the associated
`
`adoption of mobile devices and unmanaged Internet-based applications, has
`
`increased organizations’ attack surface through the proliferation of sensitive data,
`
`reducing the effectiveness of many existing security products. These factors have
`
`contributed to an increasing number of severe data breaches and expanding
`
`regulatory mandates, all of which have accelerated demand for effective data
`
`protection and governance solutions.” Ex. 2023 at 5, Ex. 2036 at 5. Proofpoint
`
`revenues for 2015 were $265.4 million. See Ex. 2039 at 3. The Proofpoint
`
`products practice the inventions disclosed in the ‘494 Patent and Proofpoint has
`
`obtained significant revenues from the sales of those products. Medvidovic, ¶ 174,
`
`Ex. 2014 at 8-13.
`
`The fact that various companies have taken a license to the ‘494 Patent is
`
`powerful evidence of non-obviousness. See Minnesota Mining & Mfg. Co. v.
`
`Johnson & Johnson Orthopaedics, Inc., 976 F.2d 1559, 1575 (Fed. Cir. 1992)
`
`(stating that taking a license “provide[s] a colorful picture of the state of the art,
`
`what was known by those in the art, and a solid evidentiary foundation on which to
`
`rest a nonobviousness determination.”).
`
`- 59 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 11 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Because Finjan’s licensees have products that are sold, which embody the
`
`inventions disclosed in the ‘494 Patent, in the same security market as Petitioner, a
`
`presumption exists that the commercial success of Finjan’s licensees products is
`
`due to the patented invention of the ‘494 Patent. Petitioner has failed to overcome
`
`this presumption as it failed to even address it in its Petition. Consequently, the
`
`fact that licensees entered into a license agreement, which included a license to the
`
`‘494 Patent, to avoid litigation and to continue conducting business, including
`
`selling and offering for sale products that encompass the patented technology
`
`licensed from Finjan shows that there is a nexus between these license agreements
`
`and the claims of the ‘494 Patent, and that the ‘494 Patent is not obvious.
`
`A.
`
` Long-Felt But Unresolved Need and Recognition of a Problem
`
`A long-felt but unmet need for an invention supports the non-obviousness of
`
`the inventions disclosed in the ‘494 Patent because there was unmet need for a
`
`network based system that generated DSP and stored it in a database, such as that
`
`disclosed in the ‘494 Patent. Medvidovic, ¶ 176-177. If the inventions under
`
`consideration were obvious, the long-felt need would have been met before the
`
`time of the inventions. Id. As discussed above, Swimmer indicates such a need
`
`still existed at the time of that reference. Dr. Medvidovic explains that such long-
`
`felt need was also not met at the time of the ‘494 Patent application because if it
`
`had then Swimmer would not have thought a database system was impractical. Id.
`
`- 60 -
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
