`
`Exhibit 12
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 2 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`“fundamental computer operations,” not “suspicious computer operations. See
`
`‘639 Provisional, Pg. 18, l. 9–13. Petitioner ignores the disclosure from the ‘194
`
`Patent, which actually relates to “suspicious computer operations.” ‘194 Patent at
`
`5:50–54 (disclosing listing the operations that could be deemed potentially hostile).
`
`Additionally, the ‘194 Patent provides “An Example List of Operations Deemed
`
`Potentially Hostile,” meaning that there is no a priori understanding of what
`
`constitutes a “suspicious computer operation.” See ‘194 Patent at 5:58–6:4
`
`(emphasis added). Rather, some subset of all possible computer operations must
`
`first be deemed suspicious in order to derive a list of suspicious computer
`
`operations for a Downloadable. See id. at FIG. 7; 9:20–42.
`
`Furthermore, this argument is contrary to the law as the Board now attempts
`
`to equate standard MS-DOS functions as “suspicious computer operations” by
`
`relying on knowledge gleaned from the ‘494 Patent itself—namely the insight to
`
`deem some subset of “calls made to an operating system, a file system, a network
`
`system, and to memory” as suspicious in deriving a list of the suspicious computer
`
`operations that may be attempted by a Downloadable. See Institution Decision at
`
`22 (“Petitioner provides evidence that such function numbers were known in the
`
`prior art to correspond to, among other functions, the same four types of operations
`
`that are recited as ‘suspicious computer operations in challenged dependent claims
`
`6 and 15.”). To the contrary, in assessing obviousness Petitioner may consider
`
`- 11 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 3 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`trail” improperly reads out the “storing . . . in a database” claim limitation which is
`
`prohibited. mFormation Techs., Inc. v. Research in Motion Ltd., 764 F.3d 1392,
`
`1399 (Fed. Cir. 2014) (reaffirming that claim limitations cannot be construed in a
`
`way that “would render another limitation superfluous.”) (citation and internal
`
`quotations omitted).
`
`Consequently, the unequivocal disclosure in the ‘494 Patent and Petitioner’s
`
`misleading attempt to conflate claim terms require that this construction be adopted
`
`to make clear that “deriving DSP data” is separate from “storing the DSP data in a
`
`database,” and that the DSP data is only placed in the database upon derivation of
`
`the profile, including the list of suspicious computer operations.
`
`IV.
`
` SWIMMER DOES NOT INVALIDTE THE ‘494 PATENT
`
`A.
`
`
`
`Swimmer was not Publically Available
`
`Inter partes review may only be requested based on prior art that consists of
`
`patents or printed publications that were publically available. 35 U.S.C. § 311(b).
`
`Public accessibility is the key factor in determining whether a reference is deemed
`
`a “printed publication.” In re Hall, 781 F.2d 897, 898–99 (Fed. Cir. 1986); see
`
`also L-3 Commc’n Holdings, Inc. v. Power Survey, LLC, IPR2014-00832, Paper 9
`
`at 11–12 (PTAB Nov. 14, 2014). Swimmer, however, was not publically
`
`accessible. Swimmer makes this clear by stating: "No part of this publication may
`
`be reproduced, stored in a retrieval system, or transmitted in any form without the
`
`- 16 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 4 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`writing audit records one-by-one to the audit trail.” Id. at ¶ 79. As a result, each
`
`individual audit record (e.g. <CS=3911 Type=0 Fn=30 arg() ret (AX=5)>) merely
`
`includes a single DOS function number (Fn=30), as highlighted below:
`
`
`
`Swimmer at 000009, Figure 3. Accordingly the system activity data within a
`
`single audit record cannot be equated with the claimed DSP data because each
`
`audit record can only include a single MS-DOS function number, not a list of
`
`computer operations, let alone a list of suspicious computer operations, as required
`
`by the claims.
`
`Moreover, independent claim 10 requires “a Downloadable scanner coupled
`
`with said receiver.” However, Swimmer does not disclose the “Downloadable
`
`scanner,” and actually teaches against the use of scanners by reasoning that they
`
`are easily circumvented. Swimmer at 000003, ¶¶ 1–5. In fact, Dr. Davidson
`
`admitted that the Swimmer system does not use a scanner at all. Davidson Tr. at
`
`- 29 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 5 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`not disclose the underlying facts or data on which the opinion is based is entitled to
`
`little or no weight,” Petitioner’s argument is entitled to little or no weight.”
`
`Furthermore, a POSITA would understand the difference between a “flat
`
`file” or log file, like Swimmer’s audit record, and a “flat file database:”
`
` flat file a file consisting of records of a single record type in which
`there is no embedded structure information that governs
`relationships between records.
`
` flat file database a database that takes the form of a table, where
`only one table can be used for each database.
`
`Ex. 2024, Microsoft Press Computer Dictionary Third Edition at 199. As Dr.
`
`Medvidovic explains, a POSITA would have understood Swimmer’s audit record
`
`to be a flat file—and in particular a log file—not a flat file database because the
`
`audit trail is not in the form of a table but rather a large sequential file of consisting
`
`of audit records of a single generically formatted record type (i.e. “an MS-DOS
`
`audit record”). See Medvidovic, ¶ 140; see also id. at ¶ 121.
`
`Moreover, contrary to Petitioner’s argument that a POSITA would consider
`
`the audit record format illustrated in Swimmer’s Figure 3 to be a type of database,
`
`Swimmer’s “audit trail” does not meet the Board’s construction because it does not
`
`contain a database schema. See Medvidovic, ¶ 121. As Dr. Medvidovic explains,
`
`“a person skilled in the art at the time would understand a ‘database schema” to be
`
`‘a description of a database to a database management system (DBMS) in the
`
`- 38 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 6 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`dollars for the right to use Finjan’s patented technology. See Ex. 2010, Declaration
`
`of S.H. Michael Kim (“Kim Decl.”), ¶¶ 4-10, Exs. 2017-2022. Finjan’s
`
`commercial success through its licensing program is relevant to Petitioner’s
`
`obviousness challenges. See Demaco Corp. v. F. Von Langsdorff Licensing Ltd.,
`
`851 F.2d 1387, 1391 (Fed. Cir. 1988) (“The commercial response to an invention
`
`is significant to determinations of obviousness, and is entitled to fair weight.”)
`
`(citations omitted).
`
`After the ‘494 issued, several licensees entered into licenses agreements,
`
`which included a license to the ‘494 Patent, to avoid litigation and to obtain a
`
`license to continue to make, use, offer to sell, and sell products that embodied the
`
`inventions disclosed in the ‘494 Patent. More specifically, Finjan has entered into
`
`several licenses agreements, which included a license to the ‘494 Patent, including
`
`agreements with F-Secure, Avast, another confidential licensee, Proofpoint and
`
`Websense, all major players that operate in the same space as Petitioner. See Kim
`
`Decl., ¶¶ 5-11; Exs. 2015-2016.
`
`Two of these licenses were entered into to avoid litigation and to obtain a
`
`license for products that embodied the inventions disclosed in the ‘494 Patent. See
`
`Kim Decl., ¶¶ 8-9. Without a license to the ‘494 Patent, the licensees would have
`
`lost business and revenues for its infringing products. Websense and Proofpoint
`
`were two licensees that settled during the course of litigation. See id. Finjan
`
`- 55 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 7 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`provided these licensees notice of the fact that products that the licensees offered
`
`for sale embodied at least the invention disclosed in one claim of the ‘494 Patent.
`
`See id. After receiving notice that the licensees products infringed the ‘494 Patent,
`
`the licensees entered into licenses so they could continue selling their products.
`
`Avast
`
`Avast’s Endpoint Protection and its connection with Avast Research Labs to
`
`identify new malicious threats utilize the inventions disclosed in the ‘494 Patent,
`
`which is demonstrated in the attached chart. See Medvidovic Decl., ¶ 172; see also
`
`Ex. 2014 at 1-3. Avast revenues are not publically available, however, Avast
`
`revenues for 2015 were estimated at $300 million, a jump of nearly 40 percent
`
`from 2014, with about 85 percent of revenue attributed to sales to consumers. See
`
`Ex. 2040. The majority of these sales are related to the Endpoint Protection
`
`products and attributable to the invention of the ‘494 Patent. Because the ‘494
`
`Patent provides the ability to find new malicious threats by deriving a DSP with a
`
`list of suspicious computer operations, Avast is able to identify new threats and
`
`provide more protection for its customers. See Medvidovic Decl., ¶ 172.
`
`F-Secure
`
`In 2015, revenues for F-Secure were at $147.6 Million. Ex. 2037. F-
`
`Secure’s multi-layered approach to security is comprised of five modules, each
`
`designed to address a particular aspect of the threat landscape and work together to
`
`- 56 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 8 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`provide a complete solution using the technology of the ‘494 Patent which is
`
`demonstrated in the attached chart. See Medvidovic Decl., ¶ 173; Ex. 2035.
`
`Attached is a chart that shows how the inventions disclosed in the ‘494 Patent are
`
`embodied in the F-Secure products. Ex. 2014 at 4-7. These modules are browsing
`
`protection, signature-based scanning, file reputation analysis, behavioral analysis
`
`and exploit interception. Id. Three of these modules are tied to the inventions
`
`disclosed in the ‘494 Patent.
`
`Websense
`
`On March 18, 2014, Finjan asserted patent infringement of the ‘494 Patent
`
`against Websense, Inc. (“Websense”). Finjan v. Websense, Inc., 14-CV-01353-
`
`BLF (N.D. Cal.). During that litigation, Finjan provided Websense with notice
`
`regarding how its products embodied the inventions disclosed in the ‘494 Patent as
`
`demonstrated in the attached chart. See Medvidovic, ¶ 171; Ex. 2013. In
`
`September of 2014, Websense, Inc. took a license to Finjan’s patent portfolio,
`
`including the ‘494 Patent. See Kim Decl., ¶8. Websense was acquired for $1.5
`
`billion in 2015. Websense’s revenue information is not publically available.
`
`However, in 2012, revenues for Websense were $361.4 million. See Ex. 2038.
`
`Websense (Forcepoint) uses the inventions disclosed in the ‘494 Patent. See
`
`Medvidovic, ¶ 171; Ex. 2013. Websense touts the importance of this technology
`
`in brochures that list the “three key security requirements” organizations need to
`
`- 57 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 9 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`defend themselves. See Medvidovic, ¶ 171. Those three requirements are: (1)
`
`Real-time, in-line defenses that can identify Zero-day, signature-less threats and
`
`APTs; (2) Integrated Web, Email and Data security solutions powered by real-time
`
`intelligence and (3) Advanced outbound containment defenses to protect against
`
`data theft and data loss. See id.; see also Ex. 2034. The ‘494 patent covers two out
`
`of the three requirements. See id. Thus, the sales of the Triton product coincide
`
`directly with the inventions disclosed in the ‘494 Patent.
`
`Proofpoint
`
`On December 16, 2013, Finjan filed a complaint alleging patent
`
`infringement against Proofpoint, Inc. (“Proofpoint”) and Armorize Technologies,
`
`Inc. (“Armorize”). Kim Decl., ¶ 9. The ‘494 Patent had not issued when Finjan
`
`filed this case, so it was not a part of the litigation. However, in June of 2016, after
`
`the ‘494 Patent issued, Proofpoint and Finjan entered into a license agreement
`
`which included the ‘494 Patent and dismissed the litigation. Proofpoint’s SEC
`
`filing demonstrates the increasing need for protection against unknown malicious
`
`content that is covered under the ‘494 Patent. See Medvidovic, ¶ 175; Ex. 2023 at
`
`5, Ex. 2036 at 5. “A fundamental shift in the sources of cybercrime, from hackers
`
`to organized crime and governments, combined with the emergence of
`
`international data trafficking and sophisticated advanced persistent threats
`
`(“APTs”), polymorphic threats, zero-day exploits, and user-transplant “drive-by”
`
`- 58 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 10 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`downloads, is driving an unprecedented wave of both targeted and broad-based
`
`malicious attack campaigns designed to steal valuable information. At the same
`
`time, the growth of business-to-business collaboration and the use of social media
`
`for mass communication, as well as the consumerization of IT and the associated
`
`adoption of mobile devices and unmanaged Internet-based applications, has
`
`increased organizations’ attack surface through the proliferation of sensitive data,
`
`reducing the effectiveness of many existing security products. These factors have
`
`contributed to an increasing number of severe data breaches and expanding
`
`regulatory mandates, all of which have accelerated demand for effective data
`
`protection and governance solutions.” Ex. 2023 at 5, Ex. 2036 at 5. Proofpoint
`
`revenues for 2015 were $265.4 million. See Ex. 2039 at 3. The Proofpoint
`
`products practice the inventions disclosed in the ‘494 Patent and Proofpoint has
`
`obtained significant revenues from the sales of those products. Medvidovic, ¶ 174,
`
`Ex. 2014 at 8-13.
`
`The fact that various companies have taken a license to the ‘494 Patent is
`
`powerful evidence of non-obviousness. See Minnesota Mining & Mfg. Co. v.
`
`Johnson & Johnson Orthopaedics, Inc., 976 F.2d 1559, 1575 (Fed. Cir. 1992)
`
`(stating that taking a license “provide[s] a colorful picture of the state of the art,
`
`what was known by those in the art, and a solid evidentiary foundation on which to
`
`rest a nonobviousness determination.”).
`
`- 59 -
`
`
`
`Case 3:17-cv-05659-WHA Document 126-16 Filed 06/28/18 Page 11 of 11
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Because Finjan’s licensees have products that are sold, which embody the
`
`inventions disclosed in the ‘494 Patent, in the same security market as Petitioner, a
`
`presumption exists that the commercial success of Finjan’s licensees products is
`
`due to the patented invention of the ‘494 Patent. Petitioner has failed to overcome
`
`this presumption as it failed to even address it in its Petition. Consequently, the
`
`fact that licensees entered into a license agreement, which included a license to the
`
`‘494 Patent, to avoid litigation and to continue conducting business, including
`
`selling and offering for sale products that encompass the patented technology
`
`licensed from Finjan shows that there is a nexus between these license agreements
`
`and the claims of the ‘494 Patent, and that the ‘494 Patent is not obvious.
`
`A.
`
` Long-Felt But Unresolved Need and Recognition of a Problem
`
`A long-felt but unmet need for an invention supports the non-obviousness of
`
`the inventions disclosed in the ‘494 Patent because there was unmet need for a
`
`network based system that generated DSP and stored it in a database, such as that
`
`disclosed in the ‘494 Patent. Medvidovic, ¶ 176-177. If the inventions under
`
`consideration were obvious, the long-felt need would have been met before the
`
`time of the inventions. Id. As discussed above, Swimmer indicates such a need
`
`still existed at the time of that reference. Dr. Medvidovic explains that such long-
`
`felt need was also not met at the time of the ‘494 Patent application because if it
`
`had then Swimmer would not have thought a database system was impractical. Id.
`
`- 60 -
`
`