Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 1 of 31
`
`RYAN R. SMITH (SBN 229323)
`rsmith@wsgr.com
`CHRISTOPHER D. MAYS (SBN 266510)
`cmays@wsgr.com
`WILSON SONSINI GOODRICH & ROSATI
`Professional Corporation
`650 Page Mill Road
`Palo Alto, CA 94304-1050
`Telephone: (650) 493-9300
`Facsimile: (650) 493-6811
`
`EDWARD G. POPLAWSKI (SBN 113590)
`epoplawski@wsgr.com
`OLIVIA M. KIM (SBN 228382)
`okim@wsgr.com
`TALIN GORDNIA (SBN 274213)
`tgordnia@wsgr.com
`STEPHANIE C. CHENG (SBN 319856)
`stephanie.cheng@wsgr.com
`WILSON SONSINI GOODRICH & ROSATI
`Professional Corporation
`633 West Fifth Street, Suite 1550
`Los Angeles, CA 90071
`Telephone: (323) 210-2900
`Facsimile: (866) 974-7329
`
`Attorneys for Defendant
`QUALYS INC.
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`OAKLAND DIVISION
`
`CASE NO.: 4:18-cv-07229-YGR (TSH)
`
`DEFENDANT QUALYS INC.’S
`NOTICE OF CROSS-MOTION AND
`CROSS-MOTION FOR SUMMARY
`JUDGMENT AND OPPOSITION TO
`PLAINTIFF FINJAN LLC’S MOTION
`FOR SUMMARY JUDGMENT
`
`Judge: Hon. Yvonne Gonzalez
`Rogers
`Date: July 6, 2021
`Time: 2:00 P.M.
`Location: Courtroom 1, 4th Floor1
`
`)))))))))))))))
`
`FINJAN LLC
`
`Plaintiff,
`
`v.
`
`QUALYS INC.,
`
`Defendant.
`
`1 Per the Court’s Notice regarding Civil Law and Motion Calendars and its Order at D.I. 48,
`hearings are via Zoom videoconference.
`
`CASE NO. 4:18-cv-07229-YGR
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 2 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`TABLE OF CONTENTS
`
`PAGE
`
`I.
`
`II.
`
`INTRODUCTION ............................................................................................................... 1
`
`PARTIAL SUMMARY JUDGMENT OF NONINFRINGEMENT .................................. 2
`
`A.
`
`B.
`
`Factual Background ................................................................................................. 2
`
`The Accused Qualys Scanner Products Do Not Infringe the ’408 Patent ............... 3
`
`1.
`
`2.
`
`3.
`
`The Same Computer Does Not Perform Each Claimed Step ...................... 3
`
`Qualys Does Not Indicate “potential exploits” ........................................... 6
`
`a.
`
`b.
`
`The ’408 Patent Covers Behavioral Analysis, Not Signature-
`Based Analysis ................................................................................ 7
`
`Qualys’s Products Perform Only Signature-Based Analysis
`That Is Not Covered By the ’408 Patent. ........................................ 9
`
`Qualys Does Not Perform “Dynamically Building” While
`“Receiving The Incoming Stream” ........................................................... 10
`
`C.
`
`Qualys Does Not Infringe the ’844 and ’494 Patents. ........................................... 13
`
`III.
`
`PARTIAL SUMMARY JUDGMENT OF NO DAMAGES ............................................ 16
`
`A.
`
`B.
`
`Required Notice of Infringement for Patent Damages .......................................... 16
`
`Finjan Cannot Recover Damages Because It Failed to Provide Sufficient
`Notice Prior to Patent Expiration .......................................................................... 17
`
`IV.
`
`OPPOSITION TO FINJAN’S MOTION FOR SUMMARY JUDGMENT ..................... 19
`
`A.
`
`DSAVT is Admissible Prior Art. .......................................................................... 19
`
`1.
`
`2.
`
`Qualys Will Show at Trial That DSAVT Is Authentic and
`Admissible. ................................................................................................ 19
`
`Finjan Is Not Entitled to S.J. About Whether DSAVT Is Prior Art. ......... 21
`
`B.
`
`Mounji and Thomson Are Admissible Prior Art ................................................... 23
`
`1.
`
`2.
`
`3.
`
`Authenticity of Mounji and Thomson ....................................................... 23
`
`Public Accessibility of Mounji .................................................................. 24
`
`Public Accessibility of Thomson .............................................................. 25
`
`V.
`
`CONCLUSION ................................................................................................................. 25
`
`CASE NO. 4:18-cv-07229-YGR
`
`i
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 3 of 31
`
`TABLE OF AUTHORITIES
`
`PAGE(S)
`
`CASES
`Abbott Diabetes Care Inc. v. Roche Diagnostics Corp., C04- 02123MJJ, 2007 WL
`1239220 (N.D. Cal. Apr. 27, 2007) ..................................................................................... 4
`Amazon.com, Inc. v. Barnesandnoble.com, Inc., 239 F.3d 1343 (Fed. Cir. 2001) ....................... 10
`American Medical Sys., Inc. v. Medical Eng’g Corp., 6 F.3d 1523 (Fed. Cir. 1993) ................... 16
`Amsted Indus. Inc. v. Buckeye Steel Castings Co., 24 F.3d 178 (Fed. Cir. 1994) ......................... 16
`Arctic Cat Inc. v. Bombardier Rec. Prods., 876 F.3d 1350 (Fed. Cir. 2017) .......................... 16, 17
`Arista Networks, Inc. v. Cisco Sys., Inc., No. 16-CV-00923-BLF, 2017 WL
`6102804 (N.D. Cal. Oct. 10, 2017) ..................................................................................... 4
`Aylus Networks, Inc. v. Apple Inc., 856 F. 3d 1353 (Fed. Cir. 2017) .............................................. 9
`Bruckelmyer v. Ground Heaters, Inc., 445 F.3d 1374 (Fed. Cir. 2006)........................................ 21
`Chrimar Sys. v. Ruckus Wireless, Inc., No. 16-cv-00186-SI, 2020 U.S. Dist. LEXIS
`136656 (N.D. Cal. July 31, 2020) ............................................................................... 18, 19
`Erhart v. Bofi Holding, Inc., 445 F. Supp. 3d 831 (S.D. Cal. 2020) ....................................... 20, 24
`Finjan v. Eset, LLC, 17-cv-183-CAB-BGS, 2019 U.S. Dist. LEXIS 179296 (S.D.
`Cal. Oct. 16, 2019) ............................................................................................................ 18
`Finjan v. Juniper, 387 F. Supp. 3d 1004 (N.D. Cal. 2019) ..................................................... 17, 20
`Finjan, Inc. v. Blue Coat Systems, Inc., 879 F. 3d 1299 (Fed. Cir. 2019) .................................... 13
`Fresenius Medical Care Holdings, Inc. v. Baxter Int’l, Inc., No. C 03-1431 SBA,
`2006 WL 1330001 (N.D. Cal. May 15, 2006) ............................................................ 20, 24
`Funai Elec. Co. v. Daewoo Elecs. Corp., 616 F.3d 1357 (Fed. Cir. 2010) ............................. 17, 18
`Maxwell v. J. Baker, Inc., 86 F.3d 1098 (Fed. Cir. 1996) ............................................................. 16
`Nike Inc. v. Wal-Mart Stores, Inc., 138 F.3d 1437 (Fed. Cir. 1998) ............................................. 16
`Omega Eng’g, Inc. v. Raytek Corp., 334 F.3d 1314 (Fed. Cir. 2003) ............................................. 8
`Oyeniran v. Holder, 672 F.3d 800 (9th Cir. 2012) .......................................................................... 4
`Siemens Medical Sys. v. Nuclear Cardiology Sys., 945 F. Supp. 1421 (D. Colo.
`1996) .................................................................................................................................... 4
`SRI Int’l, Inc. v. Internet Sec. Sys., Inc., 511 F.3d 1186 (Fed. Cir. 2008) ..................................... 21
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CASE NO. 4:18-cv-07229-YGR
`
`ii
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 4 of 31
`
`STATUTES & RULES
`35 U.S.C. § 102 ............................................................................................................................. 21
`35 U.S.C. § 287 ....................................................................................................................... 16, 17
`Fed. R. Evid. 901 ......................................................................................................... 19, 20, 23, 24
`Fed. R. Evid. 803 ..................................................................................................................... 20, 24
`
`Finjan
`
`Qualys
`
`Fact
`
`A.F.
`
`TABLE OF ABBREVIATIONS
`
`Plaintiff Finjan LLC (f/k/a Finjan Inc.)
`
`Defendant Qualys, Inc.
`
`Fact identified in Qualys’s Statement of Undisputed Material Facts in
`Support of Cross-Motion, filed concurrently herewith
`
`Additional Fact identified in Qualys’s Responsive Separate Statement of
`Undisputed Material Facts, filed concurrently herewith
`
`Mays Decl.
`
`Declaration of Christopher Mays, filed concurrently herewith
`
`Hall-Ellis Decl. Declaration of Dr. Sylvia D. Hall-Ellis, filed concurrently herewith
`
`Stubblebine
`Decl.
`
`’408 Patent
`
`’844 Patent
`
`Declaration of Dr. Stuart Stubblebine, filed concurrently herewith
`
`U.S. Patent No. 8,225,408 [Mays Decl., Ex. 1]
`
`U.S. Patent No. 6,154,844 [Mays Decl., Ex. 2]
`
`’494 Patent
`U.S. Patent No. 8,677,494 [Mays Decl., Ex. 3]
`Medvidovic Rpt. Excerpts of Expert Report of Nenad Medvidović, Ph.D., dated Dec. 1,
`2020 [Mays Decl., Ex. 4]
`Medvidovic Tr. Excerpts of the Deposition Transcript of Nenad Medvidovic, Ph.D. taken
`Feb. 28, 2021 [Mays Decl., Ex. 12]
`
`Medvidovic IPR
`Decl.
`
`Declaration of Nenad Medvidovic, Ph.D., Case No. IPR2015-2001 (June
`21, 2016) [Mays Decl., Ex. 16]
`
`Cole Rpt.
`
`Excerpts of Opening Expert Report of Eric Cole, Ph.D., dated Dec. 1, 2020
`[Mays Decl., Ex. 6]
`
`Hall-Ellis Tr.
`
`Excerpts of Deposition Transcript of Syvlia Hall-Ellis, Ph.D., taken Mar.
`1, 2021 [Mays Decl., Ex. 38]
`Stubblebine Tr. Excerpts of Deposition Transcript of Stuart Stubblebine, Ph.D., taken Mar.
`5, 2021 [Mays Decl., Ex. 36]
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CASE NO. 4:18-cv-07229-YGR
`
`iii
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 5 of 31
`
`Cole Tr.
`
`Excerpts of the Deposition Transcript of Eric Cole, Ph.D. taken Mar. 2, 2021
`[Mays Decl., Ex. 9]
`
`Bachwani Tr.
`
`Excerpts of the Deposition Transcript of Dilip Bachwani taken Sept 18, 2020
`[Mays Decl., Ex. 22]
`
`Kruse Tr.
`
`Excerpts of the Deposition Transcript of Holger Kruse taken Sept. 14, 2020
`[Mays Decl., Ex. 19]
`
`Goodrich Rpt.
`
`Excerpts of the Expert Report of Michael Goodrich Ph.D., dated Jan. 12,
`2021 [Mays Decl., Ex. 10]
`
`Goodrich Tr.
`
`Excerpts of the Deposition Transcript of Michael Goodrich Ph.D., taken
`Feb. 26, 2021 [Mays Decl., Ex. 15]
`
`Goodrich Blue
`Coat Rpt.
`
`Excerpts of the Rebuttal Expert Report of Michael Goodrich, Ph.D. in the
`Finjan v. Blue Coat Case No. 15-cv-03295-BLF-SVK, dated Apr. 21, 2017
`[Mays Decl., Ex. 13]
`
`Goodrich Rapid7
`Rpt.
`
`Excerpts of the Rebuttal Expert Report of Michael T. Goodrich, Ph.D. in the
`Finjan v. Rapid7 Case, No. 18-cv-01519-MN, dated July 31, 2020 [Mays
`Decl., Ex. 14]
`
`Goodrich
`Sonicwall Rpt.
`
`Sonicwall Order
`
`’494 IPR
`
`’844 IPR
`Merriam-
`Webster
`Dictionary
`Microsoft
`Computer
`Dictionary
`Medvidovic
`10/28/16 Tr.
`
`Excerpts of the Rebuttal Expert Report of Michael T. Goodrich, Ph.D. in the
`Finjan v. Sonicwall Case, No. 17-cv-04467-BLF, dated Oct. 9, 2020 [Mays
`Decl., Ex. 30]
`Order Granting in Part and Denying In Part Defendant’s Motion For Partial
`Summary Judgment, No. 17-cv-04467-BLF, D.I. 320 (Mar. 5, 2021)
`[Mays Decl., Ex. 11]
`Patent Owner’s Response, Case No. IPR2015-01892 (June 21, 2016)
`[Mays Decl., Ex. 31]
`Patent Owner’s Response, Case No. IPR2019-00026 (July 2, 2019) [Mays
`Decl., Ex. 32]
`
`Excerpts of 1997 Merriam-Webster Dictionary [Mays Decl., Ex. 24]
`
`Excerpts of Microsoft Computer Dictionary [Mays Decl., Ex. 8]
`
`Excerpts of the Deposition Transcript of Nenad Medvidovic, Ph.D. taken
`Oct. 28, 2016 [Mays Decl., Ex.17]
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CASE NO. 4:18-cv-07229-YGR
`
`iv
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 6 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`I.
`
`NOTICE OF CROSS-MOTION AND CROSS-MOTION
`PLEASE TAKE NOTICE that on July 6, 2021 at 2:00 P.M., or as soon thereafter as this
`matter may be heard before Judge Gonzalez Rogers of the United States District Court for the
`Northern District of California in Courtroom 1, 4th Floor, of 1301 Clay Street in Oakland,
`California,1 Qualys will and hereby moves the Court for summary judgment that the ’408, ’844,
`and ’494 Patents are not infringed and summary judgment of no damages for the ’844 and ’494
`Patents due to insufficient notice. The cross-motion is based on this notice of cross-motion and
`supporting memorandum of points and authorities, supporting declaration and exhibits, Qualys’s
`Statement of Undisputed Material Facts, and such other written or oral argument as may be
`presented at or before the time this motion is deemed submitted by the Court. Qualys’s Opposition
`to Finjan’s Motion for Summary Judgment (D.I. 192) is included herein.
`MEMORANDUM OF POINTS AND AUTHORITIES
`INTRODUCTION
`Qualys seeks partial summary judgment on the ground that the ’408, ’844, and ’494 Patents
`are not infringed and there are no damages for the ’844 and ’494 Patents due to insufficient notice
`of infringement. Regarding the ’408 Patent, the Court should grant summary judgment of no
`infringement for three independent reasons: (1) the asserted claims require that a single computer
`perform three temporally overlapping steps, yet Finjan improperly accuses multiple distinct
`scanners and Qualys’s cloud platform of collectively performing these steps; (2) Finjan disclaimed
`signature-based pattern matching to avoid invalidating prior art in an inter partes review
`proceeding, but now accuses Qualys’ signature-based pattern matching of infringement; and (3)
`the claims of the ’408 Patent require three temporally overlapping steps (“receiving,” “dynamically
`building,” and “dynamically detecting”), but Finjan puts forth no evidence that a computer
`performs the steps concurrently.
`As to the ’844 and ’494 Patents, there is no evidence that any aspect of the accused Qualys
`Scanner receives a “Downloadable” as defined by the parties’ agreed-upon construction. Even if
`Qualys had infringed, Finjan cannot recover damages for the ’844 and ’494 Patents since Finjan
`did not provide Qualys with sufficient notice of infringement until after both patents had expired.
`
`CASE NO. 4:18-cv-07229-YGR
`
`1
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 7 of 31
`
`Qualys also opposes Finjan’s motion for summary judgment regarding the prior art status
`of three references. Qualys has proffered evidence, in the form of two experts’ opinions, that these
`references were each publicly available and locatable by persons of ordinary skill in the art
`exercising reasonable diligence before the applicable priority date. There is, at minimum, a
`genuine factual dispute regarding the prior art status of these references.
`II.
`PARTIAL SUMMARY JUDGMENT OF NONINFRINGEMENT2
`A.
`Factual Background
`Qualys provides an Internet-based cloud platform (the “Qualys Cloud Platform”) for
`customers to scan devices on their local networks for vulnerabilities. Qualys receives metadata
`from its client’s systems to assess for vulnerabilities. These vulnerability checks are often as simple
`as checking whether the client’s computer being scanned has the most up-to-date software
`installed. These checks are important because outdated software may possess known security
`flaws. Qualys checks for vulnerabilities in two alternative ways: First, Qualys provides scanners
`that are deployed either within the customer’s internal network or on the Internet. Ex. 4
`(Medvidovic Rpt.), ¶¶ 96-98. Second, Qualys collects data by using a Cloud Agent (“CA”), which
`is a piece of software that is installed directly on endpoint devices “to simply capture the version
`numbers and other metadata about the operating system and installed applications and send[] the
`data to the platform for analysis and reporting.” Ex. 6 (Cole Rpt.) ¶ 159 (quoting from Ex. 7
`QUALYS00325126). Qualys Cloud Platform includes a variety of optional subscriptions:
`Vulnerability Management (VM), Policy Compliance (PC), and Web Application Scanning
`(WAS). Ex. 6 (Cole Rpt.) ¶¶ 338, 371, 1230, 1263. At a high level, VM scans customers’ devices
`to discover any vulnerabilities, such as outdated software, PC looks at whether those devices are
`violating any company policies (e.g., password formatting requirements), and WAS checks web
`servers for vulnerabilities or misconfigurations specific to web applications. Id. at ¶¶ 264-278.
`
`2 Finjan asserts claims 1, 3-8, 22, 23, and 35 of the ’408 Patent; claims 1, 4-8, 11, 15-17, 41,
`and 43 of the ’844 Patent; claims 10-16, and 18 of the ’494 Patent; and claim 17 of the ’731
`Patent. This motion seeks summary judgment of all claims except for claim 15 of the ’844 and
`claim 17 of the ’731 Patent. Facts 1, 16, and 19.
`
`CASE NO. 4:18-cv-07229-YGR
`
`2
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 8 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`B.
`
`The Accused Qualys Scanner Products Do Not Infringe the ’408 Patent
`1.
`The Same Computer Does Not Perform Each Claimed Step
`The ’408 Patent, is generally directed to a method for scanning content received by a
`computer and analyzing that content by dynamically building parse trees to determine the existence
`of malicious code. Figure 2 of the ’408 Patent depicts a preferred embodiment where a “byte
`source” is received as an incoming stream from the source of the content being scanned. The
`incoming data is tokenized and then the tokens are placed within a parse tree for subsequent
`analysis. Each asserted claim of the ’408 Patent (claims 1, 3-8, and 22, 23, and 35) requires that
`all claimed steps be performed by or located within the same computer. Specifically, claims 1 and
`23 recite “a computer-processor based” method wherein one step is “receiving by a computer”3
`and subsequent steps are performed “by the computer” recited in the receiving step. Ex. 1 (’408
`Patent) at 19:45-20:7 (claim 1) and 22:1-27 (claim 23); see also id. at 21:42-67 (claim 22) and
`24:7-31 (claim 35) (both claims reciting “program code for causing a computer to perform” each
`of the recited steps); Fact 2.4
`To satisfy the claims, therefore, the same computer that receives an incoming stream of
`code must also perform each of the additional recited steps. Yet, Finjan makes no such allegations.
`As discussed below, Finjan’s infringement allegations are that a first “computer” (either a Qualys
`scanner or cloud agent) performs some of the claimed steps while other “computers” (such as
`different scanners, cloud agents, or Qualys’ cloud platform servers), perform the rest. This is
`incorrect as a matter of claim construction. While “a computer” can mean one or more computers,
`
`3 Qualys filed a Renewed Motion to Strike Portions of Medvidovic’s Expert Report. D.I. 194.
`To the extent that the Court grants the motion, Finjan would be left with no remaining evidence
`that Qualys infringes the “receiving” step required by each asserted claim of the ’408 Patent.
`Summary judgment is appropriate for this additional reason.
`4 The claims use the term “computer” consistently with contemporaneous technical
`dictionaries, such as the 2002 edition of the Microsoft Computer dictionary (repeatedly relied on
`by Finjan’s expert Dr. Goodrich to construe terms regarding the ’408 Patent), which defines a
`“computer” as “any device [singular] capable of processing information to produce a desired
`result.” See Ex. 8 (Microsoft Computer Dictionary) at 118; see also Ex. 9 (Cole Tr.) at 50:12-16
`(“Q. And a web client would be a separate computer from the web server typically, right?
`[objection omitted] A. In this example in the time frame 2009, I will -- I would agree with that
`statement.”), Id at 65:18-21(“Q. … [W]hat were you referring to by ‘a computer’? A. A computer
`is a machine [singular] that has an operating system, performs operations, performs activity.”); see
`also Ex. 10 (Goodrich Rpt.) at ¶¶ 74, 79, 101, 140; Fact 3.
`
`CASE NO. 4:18-cv-07229-YGR
`
`3
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 9 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`each of the one or more computers must perform the recited steps attributed to that computer.
`This is not the first time that Finjan has attempted to skirt the plain language of the ’408
`Patent. In Finjan v. Sonicwall, Finjan similarly accused a defendant of infringing the ’408 Patent
`based on a theory involving multiple discrete computing devices. Fact 4. The Sonicwall court
`grappled with the question of “with respect to the ’408 Patent, can the receiving, determining,
`instantiating, identifying, dynamically building, dynamically detecting, and indicating be
`performed by different computers?” Ex. 11 (Sonicwall Order) at p.20, ll.10-11; Fact 4. The
`Sonicwall court found “as a matter of law that the recited steps in claims 1 and 22 of the ’408
`Patent must be performed by the same computer.” Id. at 24 (emphasis added); Fact 5. On that
`basis, it entered summary judgment of no infringement as to the ’408 Patent. Id.
`Finjan is therefore collaterally estopped from disputing that the ’408 Patent must be
`performed by the same computer. Indeed, the claim construction issue is “identical in both
`proceedings” and in view of the Sonicwall court’s summary judgement opinion, “the issue was
`actually litigated and decided,” “there was a full and fair opportunity to litigate the issue”, and “the
`issue was necessary to decide the merits.’” Arista Networks, Inc. v. Cisco Sys., Inc., No. 16-CV-
`00923-BLF, 2017 WL 6102804, at *11 (N.D. Cal. Oct. 10, 2017) (quoting Oyeniran v. Holder,
`672 F.3d 800, 806 (9th Cir. 2012)). Under Ninth Circuit law, a summary judgment order satisfies
`the requirement of a “final judgment” for the purpose of collateral estoppel, regardless of whether
`it is appealable yet. Abbott Diabetes Care Inc. v. Roche Diagnostics Corp., C04- 02123MJJ, 2007
`WL 1239220, at *12 (N.D. Cal. Apr. 27, 2007); Siemens Medical Sys. v. Nuclear Cardiology Sys.,
`945 F. Supp. 1421 (D. Colo. 1996).
`Even if Finjan isn’t barred by collateral estoppel, this Court should nevertheless find that
`the steps of the ’408 Patent must be performed on a single computer. Finjan’s theory that some
`steps are performed on one Qualys scanner while other steps are performed by a different device
`like a Qualys server in the cloud belies the plain language and structure of the claims. As noted by
`Judge Freeman in Sonicwall, the issue was squarely addressed by the Federal Circuit in Unwired
`Planet L.L.C. v. Google, Inc., where the claims recited “a server node” performing certain steps.
`The Federal Circuit found that each “server node” (a computer) must perform each one of the
`
`CASE NO. 4:18-cv-07229-YGR
`
`4
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 10 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`claimed functions. 660 F. App’x 974 (Fed. Cir. 2016).
`Finjan falls far short of proving that Qualys performs the claimed steps of the ’408 Patent
`on a single computer. Indeed, Medvidovic’s report opines that the various claimed steps
`(“receiving,” “dynamically building,” and dynamically detecting”) are performed by unspecified
`portions of “Qualys’s cloud platform.” See, e.g., Ex. 4 (Medvidovic Rpt.) at ¶¶ 185, 262, 302.5 But
`“Qualys cloud platform” comprises multiple different computers, including scanners deployed in
`a customer’s network, cloud agent software installed on customer endpoint devices, and servers
`operated by Qualys at various locations throughout the world. See, e.g., id. at ¶¶ 88-107; Fact 6.
`Finjan’s expert report lacked any opinion that a single computer performs the steps of the ’408
`Patent. See id. at ¶¶ 196 (the computer is the “scanner engine”), 205 (“the computer” is the “WAS
`scanner”), 235 (the computer is “the server associated with the Cloud Agent”), 309 (the computer
`is “multiple scanner appliances in parallel”), 333 (“the computer” can be “the backend computer
`present [that] prepares reports to present to the user identifying the potential vulnerabilities.”).
`At his deposition, Medvidovic initially testified that the computer on which the “parse tree
`is generated during the scan” was at “a level of detail below” what he had analyzed. Ex. 12
`(Medvidovic Tr.) at 212:12-18. In other words, Dr. Medvidovic did not know where the various
`steps of the ’408 Patent are allegedly performed. Later, Medvidovic clarified that at least portions
`of the “dynamically building” and/or “dynamically detecting” were—in his opinion—performed
`by a Qualys server. Ex. 12 (Medvidovic Tr.) at 214:14-22 (“Q. [W]hen the XML data arrives at
`the Qualys server, is it already in a parse tree or does the server create the parse tree? A. I think
`when the XML data arrives at the server in the specific instantiation that you're discussing, the
`data itself is not processed to that point yet. In other words, it’s just being reported and it’s actually
`processed on the server….”); 215:5-23 (Q. Then once the byte stream is sent over to the server,
`then the server creates the parse tree in your view, right? A. Whatever code is running on the
`server, as I said, scan.php, at least parts of this, quite likely would run on the server … Based on
`everything that I've read, it doesn't sound like that kind of functionality is relegated to the customer,
`
`5 While not agreeing Medvidovic’s product groupings, Qualys uses them for purposes of this
`motion.
`
`CASE NO. 4:18-cv-07229-YGR
`
`5
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 11 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`and it’s rather on Qualy’s own end.”) (emphasis added).
`At his deposition, Medvidovic was pressed to reconcile his infringement opinions with the
`plain language of the ’408 Patent requiring that the steps be performed on a “computer.” Faced
`with the fundamental deficiency of his analysis, Medvidovic testified that the computer recited by
`the claims of the ’408 Patent “would be portions of the Qualys server, portions of the scanner,
`portions of the cloud agent.” Ex. 12 (Medvidovic Tr.) at 230:14-19.6 Elsewhere, Medvidovic
`testified that the claimed computer is “whatever would be processed or accomplished in the context
`of the entire claim element,” and could include multiple “processors [i.e. devices] from what
`you’re calling the customer’s machine and also procedure processors from Qualys’s own cloud
`platform.” See id. at 81:19-82:7; 83:2-84:6 (opining that “the computer” is “the collection of
`processors and other peripherals [i.e. devices]”); 86:3-22 (opining that “the computer” “may
`involve hardware or processors that are owned by Qualys’s customers”). By this admission,
`Medvidovic has not shown that all steps of the ’408 Patent were performed on a single computer.
`To the extent that he has shown anything, it is that the allegedly infringing functions are spread-
`out among multiple distinct devices like Qualys scanners (which may reside within a customer’s
`network), Qualys’ cloud (which is located at Qualys or a third-party datacenter) and in some cases
`customer computers (which run cloud agent software).
`In summary, the claims of the ’408 Patent require that each step is performed on the same
`computer and Finjan is collaterally estopped from arguing otherwise. To the extent Finjan has any
`evidence as to where the steps are performed, the evidence shows that the steps are performed on
`multiple different computers, including cloud agents, scanners, and servers within Qualys’s cloud.
`Summary judgment is appropriate.
`2.
`Qualys Does Not Indicate “potential exploits”
`The asserted claims of the ’408 Patent each require “dynamically detecting … [patterns or
`combinations] of nodes in the parse tree which are indicators of potential exploits” and “indicating,
`by the computer, the presence of potential exploits within the incoming stream.” Ex. 1 (’408
`
`6 Finjan’s other technical expert, Dr. Cole, agrees that a “scanner” is itself a “computer.” Ex.
`9 (Cole Tr.) at 150:7-9 (“Q … And the appliance would be the computer, right? A That is
`correct.”).
`
`CASE NO. 4:18-cv-07229-YGR
`
`6
`
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 12 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Patent) at 20:1-7, 21:62-67, 22:20-27, and 24:24-31; Fact 7. Both of Finjan’s technical experts
`regarding the ’408 Patent have stressed the importance of this limitation in distinguishing prior art,
`and both have stated that signature-based pattern matching—the type of analysis performed by
`Qualys’s products—cannot satisfy this limitation.
`a.
`The ’408 Patent Covers Behavioral Analysis, Not Signature-
`Based Analysis
`First, Finjan’s technical expert on prior art to the ’408 Patent, Goodrich, specifically opined
`that “indicating the presence of potential exploits within the incoming stream” cannot be satisfied
`by signature-based scanning techniques. Goodrich himself stated “Signature scanning is not
`looking for the presents of exploits; it is looking to match a file.” See Ex. 13 (Goodrich Blue Coat
`Rpt.) at ¶ 208; see also id. at ¶ 135 (opinion that “it is not sufficient to look for specific signatures”
`to satisfy the ’408 Patent’s “indicators of potential exploits” limitation). Goodrich opined that the
`’408 Patent covers “behavior-based analysis,” but not signature-based analysis. See id. at ¶¶ 74,
`136, 176, 208; see also Ex. 14 (Goodrich Rapid7 Rpt.) at ¶¶ 292 (opining that signature-based
`pattern matching does not teach “instantiating” limitation of ’408 claims); 310 (signature scanning
`“does not teach or render obvious indicating, by the computer, the presence of potential exploits
`within the incoming stream”). Goodrich reaffirmed these statements at his deposition in this case.
`See Ex. 15 (Goodrich Tr.) at 99:14-100:8 (testifying that the ’408 Patent is “not about traditional
`signature scanning” and “traditional signature scanning was well known in the prior art”).
`Second, in defending the ’408 Patent’s validity in an IPR proceeding before the Patent
`Office, Finjan’s technical expert on alleged infringement, Medvidovic, offered a sworn declaration
`asserting that a “key feature that distinguishes the ’408 Patent from the prior art is its focus on
`detecting exploits ‘being portions of program code that are malicious,’ rather than simply
`recognizing previously known malware.” Ex. 16 (Medvidovic IPR Decl.) ¶ 49 (emphasis added);
`Fact 8. Like Goodrich, Medvidovic distinguished the “token pattern match” technique of the prior
`art:
`
`[The prior art’s] token pattern match, used to detect “viral code,” does not
`require that the pattern to be matched correspond to an exploit or any other
`malicious code. Rather, it is only important that the pattern faithfully
`identify the code being scanned as corresponding to code that was
`previously sampled. On the other hand, the scanning techniques disclosed in
`the ‘408 Patent, facilitate the “zero-day” recognition of malicious code, even
`7
`CASE NO. 4:18-cv-07229-YGR
`CROSS-MOTION FOR SUMMARY JUDGMENT AND
`OPP’N TO SUMMARY JUDGMENT MOTION
`
`

`

`Case 4:18-cv-07229-YGR Document 195 Filed 05/10/21 Page 13 of 31
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17