Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 1 of 27
`
`
`
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`HANNAH LEE (State Bar No. 253197)
`hlee@kramerlevin.com
`KRAMER LEVIN NAFTALIS
`& FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`FINJAN, INC., a Delaware Corporation,
`
`
`
`
`
`
`Plaintiff,
`
`v.
`
`SAN JOSE DIVISION
`
`
`Case No.: 15-cv-3295-BLF-SVK
`
`PLAINTIFF FINJAN, INC.’S
`OPPOSITION TO BLUE COAT’S RULE
`50(A) MOTION FOR JUDGMENT AS A
`MATTER OF LAW
`
`
`
`
`BLUE COAT SYSTEMS, LLC, a Delaware
`Corporation,
`
`
`
`
`Defendant.
`
`
`
`
`
`
`
`
`
`__________________________________________________________________________________
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`CASE NO. 15-cv-03295-BLF-SVK
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 2 of 27
`
`TABLE OF CONTENTS
`
`Page
`
`INTRODUCTION ........................................................................................................................ 1
`
`FINJAN PRESENTED SUBSTANTIAL EVIDENCE OF BLUE COAT’S
`INFRINGEMENT OF THE ASSERTED CLAIMS .................................................................... 1
`
`A.
`
`B.
`
`C.
`
`D.
`
`E.
`
`F.
`
`G.
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally
`and Under the Doctrine of Equivalents, Claim 15 of the ‘844 Patent. ............................. 1
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally
`and Under The Doctrine of Equivalents, Claim 10 of the ‘494 Patent. ............................ 4
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally
`and Under The Doctrine of Equivalents, Claim 1 of the ‘731 Patent ............................... 5
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally
`and Under The Doctrine of Equivalents, Claim 1 of the ‘968 Patent ............................... 6
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes Claim 22
`of the ‘408 Patent. ............................................................................................................. 7
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally
`and Under The Doctrine of Equivalents, Claims 1 and 10 of the ‘621
`Patent................................................................................................................................. 9
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes The ‘844,
`‘494, ‘731, ‘968 and ‘621 Patents Under The Doctrine of Equivalents. ........................ 10
`
`FINJAN PRESENTED SUBSTANTIAL EVIDENCE OF BLUE COAT’S WILLFUL
`INFRINGEMENT....................................................................................................................... 11
`
`FINJAN PRESENTED SUBSTANTIAL EVIDENCE SUPPORTING DAMAGES
`FOR BLUE COAT’S INFRINGEMENT OF THE ASSERTED CLAIMS ............................... 12
`
`A.
`
`B.
`
`C.
`
`Finjan Presented Substantial Evidence to Support Damages Based on
`Worldwide Users of GIN. ............................................................................................... 12
`
`Blue Coat Failed to Present Substantial Evidence of Government Sales. ...................... 15
`
`Finjan Presented Substantial Evidence to Support an Award of Reasonable
`Royalties. ........................................................................................................................ 16
`
`CONCLUSION ........................................................................................................................... 22
`
`
`
`I.
`
`II.
`
`III.
`
`IV.
`
`V.
`
`
`
`i
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 3 of 27
`
`TABLE OF AUTHORITIES
`
`
`
`Page(s)
`
`
`
`Cases
`
`Bell v. Clackamus County,
`341 F.3d 858 (9th Cir. 2003) .............................................................................................................. 1
`
`Card-Monroe Corp. v. Tuftco Corp.,
`No. 1:14-cv-292, 2017 WL 3841878 (E.D. Tenn. Sept. 1, 2017)..................................................... 13
`
`CNET Networks, Inc. v. Etilize, Inc.,
`528 F. Supp. 2d 985 (N.D. Cal. 2007) ........................................................................................ 12, 14
`
`Erie Eng’d Prods., Inc. v. Wayne Integrated Techs., Corp.,
`No. CV 03-3776, 2005 WL 6582921 (E.D.N.Y. July 29, 2005) ...................................................... 15
`
`Goulds’ Mfg. Co. v. Cowing,
`105 U.S. 253 (1881) .......................................................................................................................... 13
`
`i4i Ltd. P’ship v. Microsoft Corp.,
`598 F.3d 831 (Fed. Cir. 2010), aff’d 564 U.S. 91 (2011) ................................................................. 12
`
`Informatica Corp. v. Business Objects Data Integration, Inc.,
`No. C 02-03378 EDL, 2007 WL 2344962 (N.D. Cal. Aug. 16, 2007) ............................................... 1
`
`Larson v. U.S.,
`26 Cl. Ct. 365 (1992) ........................................................................................................................ 15
`
`Microsoft Corp. v. AT&T Corp.,
`127 S.Ct. 1746 (2007) ................................................................................................................. 13, 14
`
`NTP, Inc. v. Research In Motion, Ltd.,
`418 F.3d 1282 (Fed. Cir. 2005)......................................................................................................... 14
`
`Parker Beach Restoration, Inc. v. U.S.,
`58 Fed. Cl. 126 (2003) ...................................................................................................................... 15
`
`Railroad Dynamics, Inc. v. A. Stuki Co.,
`727 F.2d 1506 (Fed. Cir. 1984)......................................................................................................... 13
`
`Sevenson Envtl. Servs., Inc. v. Shaw Envtl., Inc.,
`477 F.3d 1361 (Fed. Cir. 2007)......................................................................................................... 15
`
`Stryker Corp. v. Zimmer, Inc.,
`837 F.3d 1268 (Fed. Cir. 2016)......................................................................................................... 12
`
`ii
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 4 of 27
`
`
`
`Statutes
`
`28 U.S.C. § 1498 ..................................................................................................................................... 15
`
`35 U.S.C. § 271(f) ................................................................................................................................... 14
`
`35 U.S.C. § 284 ....................................................................................................................................... 16
`
`Other Authorities
`
`Federal Rule of Civil Procedure Rule 50(a) ........................................................................... 1, 11, 15, 22
`
`
`
`iii
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 5 of 27
`
`
`
`I.
`
`INTRODUCTION
`Finjan, Inc. (“Finjan”) presented substantial evidence to support its claims of infringement and
`
`damages during its case, including sworn testimony on the stand from numerous fact and expert
`
`witnesses, deposition testimony of Blue Coat Systems LLC’s (“Blue Coat”) employees, source code
`
`testing of the accused products, and numerous Finjan and Blue Coat documents that were admitted into
`
`evidence. Blue Coat disagrees with the evidence that Finjan presented in its case, but its disagreement
`
`is not enough to prove that “as a matter of law” Finjan did not present substantial evidence to support
`
`its claims. Under Federal Rule of Civil Procedure Rule 50(a), when the evidence is viewed “in the
`
`light most favorable” to Finjan and “all reasonable inferences” are drawn in its favor, the Court should
`
`deny Blue Coat’s motion for judgment as a matter of law (“Motion”). Bell v. Clackamus County, 341
`
`F.3d 858, 865 (9th Cir. 2003); Informatica Corp. v. Business Objects Data Integration, Inc., No. C 02-
`03378 EDL, 2007 WL 2344962, at *1 (N.D. Cal. Aug. 16, 2007).1
`
`II.
`
`FINJAN PRESENTED SUBSTANTIAL EVIDENCE OF BLUE COAT’S
`INFRINGEMENT OF THE ASSERTED CLAIMS
`
`A.
`
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally and
`Under the Doctrine of Equivalents, Claim 15 of the ‘844 Patent.
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 15 of
`
`the ‘844 Patent, both literally and under the doctrine of equivalents. See generally Trial Tr. at 469:16-
`
`539:9, 560:9-23, 565:14-591:9, 603:18-605:11; PTX-49; PTX-105; PTX-211; PTX-216; PTX-290;
`
`PTX-295; PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564; PTX-575; PTX-1025; PTX-
`
`1274; JTX-3001; JTX-3043; JTX-3050; and JTX-3060. Blue Coat’s assertions otherwise lack merit.
`
`First, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product
`
`generates a Downloadable security profile in accordance with the Court’s claim construction. Trial Tr.
`
`at 514:18-515:3, 517:11-537:13. Dr. Cole supported his opinion that GIN/WebPulse generates a
`
`Downloadable security profile that “identifies code in the received Downloadable that performs hostile
`
`or potentially hostile operations” with substantial evidence, including the testimony of Blue Coat
`
`1 Finjan incorporates by reference the arguments and evidence set forth in its (i) Motion for Judgment
`as a Matter of Law Pursuant to Fed. R. Civ. P. 50(a) (Dkt. No. 423) and (ii) oral opposition to Blue
`Coat’s motion for JMOL regarding doctrine of equivalents.
`1
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 6 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`engineers and multiple Blue Coat documents. Trial Tr. at 518:3-519:12 (citing deposition testimony of
`
`Blue Coat’s engineer, Mr. Andersen); PTX368 (Blue Coat’s MAA Center Guide “so Blue Coat’s own
`
`document is showing you that it generates, it looks for and attracts these suspicious operations which
`
`forms [sic] the security profile . . . the suspicious operations map back to the code that actually
`
`performs those suspicious functions” (see Trial Tr. at 519:13-521:16)); PTX564 (describing Dr. Cole’s
`
`testing of the MAA and the summary that the MAA generated discussing suspicious operations,
`
`including “contains compressed section of code” (see Trail Tr. at 521:17-522:24)); PTX499
`
`(describing static analysis of code and creation of security profile (see Trial Tr. at 423:12-425:15));
`
`PTX-1025 at 862 (source code describing the suspicious code and operations identified in the security
`
`profile (see Trial Tr. at 525:16-527:7)); PTX-427 (MAA Report showing security profile with list of
`
`suspicious operations and code (see Trial Tr. at 527:9-529:8)). Dr. Cole identified specific examples
`
`of the specific code identified, such as obfuscated Javascript: Eval method, JavaScript: from CharCode
`
`method; malware-specific code, Javascript: Unescape function (PTX-575) and identified in Blue
`
`Coat’s source code where GIN identifies code within PDFs (PTX-1025; PTX-427).
`
`Blue Coat’s entire argument is premised on its improper misquotation of the trial transcript,
`
`wherein Blue Coat omits the portions of Dr. Cole’s trial testimony where he explains that suspicious
`
`code and suspicious operations are not the same thing, but rather that “suspicious operations map back
`
`to the code that actually performs those suspicious operations.” Trial Tr. at 521:11-16; see also Trial
`
`Tr. at 582:13-25 (“Q. So then you opinion is that suspicious operations and suspicious code are the
`
`same thing; right? A. No. Suspicious operations are produced by suspicious code Q. So you
`
`recognize that there’s a difference between suspicious operations and suspicious code; right? A. Yes,
`
`but they’re both relating to doing the same operations. So if I go in and read a file or do obfuscation,
`
`there could be different code that does that, but that code [] represents that’s a suspicious operation”).
`
`In addition, Blue Coat failed to rebut the evidence Finjan presented. Blue Coat’s non-
`
`infringement expert, Dr. Nielson admits that MAA generates reports that identify suspicious
`
`operations, functions, and behavior, but simply disagrees that identifying behavior is not the same as
`
`identifying code. Trial Tr. at 1618:16-18, 1626:8-11. On cross-examination, however, Dr. Nielson
`
`2
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 7 of 27
`
`
`
`admitted that MAA does identify code, including Javascript Unescape and Eval code, and admitted
`
`that Dr. Cole went through his testing and identified where in Blue Coat’s source code he located the
`
`exact code functions he testified about. Trial Tr. at 1770:11-1771:16, 1772:4-10, 1772:23-1773:1.
`
`Thus, Finjan presented substantial and unrebutted evidence that Blue Coat’s GIN/WebPulse product
`
`satisfies this limitation of Claim 15 of the ‘844 Patent.
`
`Second, Finjan presented substantial evidence—including expert testimony from Dr. Cole, Blue
`
`Coat documents and source code, and product testing—that Blue Coat’s accused GIN/WebPulse
`
`product performs the limitation of “linking the first Downloadable security profile to the
`
`Downloadable before a web server makes the Downloadable available to web clients.” See e.g., PTX-
`
`564 (“the way [linking] is done is by taking a fingerprint or a cryptographic hash of that file which
`
`both SHA and MD5 are hashes, and that’s linking those together. So that has now links that
`
`downloadable to that security profile” (see Trial Tr. at 522:2-523:7)); PTX-427 (MAA Report showing
`
`linking hashes to the Downloadable (see Trial Tr. at 527:13-528:8)); Trial Tr. at 528:9-529:8
`
`(explaining operation of Blue Coat’s MAA engines, FRS service and dynamo database and how
`
`security profile is linked before Downloadable made available to web client); JTX-3050 (architectural
`
`document demonstrating that FRS queries the Dynamo database that was populated by the MAA’s in
`
`order to make a decision before the web content is made available to the client” (see Trial Tr. at 529:9-
`
`530:17)); PTX-49 (discussing blocking of threats before they reach the client computer (see Trial Tr. at
`
`532:19-533:25); Trial Tr. at 532:19-533:25 (Dr. Cole’s product testing confirmed content blocked
`
`before it was made available to the client); PTX-423 (“real-time decision” means decision regarding
`
`content made as the content comes in in real time and before the content is made available to a client
`
`(see Trial Tr. at 534:1-535:11). Blue Coat failed to rebut the substantial evidence Finjan presented
`
`regarding this limitation. Blue Coat’s non-infringement expert, Dr. Nielson, simply disagreed with
`
`Dr. Cole, but did not mark a single document to support his opinion that this limitation is not met.
`
`Finally, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product
`
`infringes Claim 15 of the 844 Patent under the doctrine of equivalents (as described below).
`
`3
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 8 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`
`B.
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally and
`Under The Doctrine of Equivalents, Claim 10 of the ‘494 Patent.
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 10 of
`
`the ‘494 Patent, both literally and under the doctrine of equivalents. See generally Trial Tr. at 469:16–
`
`496:21, 540:18–560:8, 565:14-605:11; PTX-49; PTX-105; PTX-211; PTX-216; PTX-290; PTX-295;
`
`PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564; PTX-575; PTX-1025; JTX-3001; JTX-
`
`3043; JTX-3050; JTX-3060.
`
`Finjan presented substantial evidence demonstrating that GIN/WebPulse satisfies Element 2 of
`
`Claim 10 of the ‘494 Patent, which is the only limitation Blue Coat disputes, requiring “a
`
`Downloadable scanner coupled with said receiver, for deriving security profile data for the
`
`Downloadable, including a list of suspicious computer operations that may be attempted by the
`
`Downloadable.” Finjan presented substantial evidence—including expert testimony from Dr. Cole,
`
`Blue Coat documents and Blue Coat source code— that GIN/WebPulse contains a scanner for deriving
`
`security profile information from downloadables, including a list of suspicious operations. Trial Tr. at
`
`546:14-552:17; PTX-211 (showing that YARA looks for suspicious operations (see Trial Tr. at
`
`546:23-548:6)); PTX-516 (YARA rules source code confirming YARA looks for suspicious operations
`
`such as Javascript obfuscation and identifies the specific code and operations being looked for (see
`
`Trial Tr. at 548:12-550:21)); JTX-3060 (Cookie2 security profile with list of all suspicious operations
`
`found within a file and concatenated string of the labels of the YARA rules that were fired (see Trial
`
`Tr. at 550:22-552:17)). Thus, contrary to Blue Coat’s assertion, Finjan presented substantial evidence
`
`identifying where in the YARA rules operations and code were identified, for example VBS_create
`
`rules and code (PTX-516); identification of riles that identify code and operations (PTX-516); where
`
`operations of Javascript inject code into the system (PTX-516); and Javascript obfuscation and
`
`associated code (PTX-516).
`
`Blue Coat’s non-infringement expert, Dr. Nielson, failed to offer a single document to support
`
`his disagreement with the substantial evidence Finjan offered. Moreover, on cross-examination, Dr.
`
`Nielson conceded that functions such as Javascript eval, among others, are suspicious operations. Trial
`
`4
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 9 of 27
`
`
`
`Tr. at 1770:12-21. He further admitted that evidence of Javascript eval or unescape operations is
`
`evidence that there was also Javascript eval or unescape code. Trial Tr. at 1771:14-16; 1772:8-14.
`
`Finally, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product
`
`combination infringes Claim 10 of the ‘494 Patent under the doctrine of equivalents (as described
`
`below).
`
`
`
`C.
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally and
`Under The Doctrine of Equivalents, Claim 1 of the ‘731 Patent
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 1 of the
`
`‘731 Patent, both literally and under the doctrine of equivalents. See generally Trial Tr. at 618:8-24,
`
`624:21-24, 625:19-640:19, 640:20-647:3, 640:20-737:11; JTX-3003; PTX-360; JTX-3003; JTX-3048;
`
`JTX-3120; PTX-575; PTX-426; PTX-1025 at 1215; PTX-1025 at 1036; PTX-1025 at 1355; PTX-352;
`
`JTX-3037; PTX-426; PTX-295; PTX-1025 at 530; PTX-1025 at 1795; PTX-1025 at 2252-53; PTX-
`
`565; PTX-579; PTX-563; PTX-331.
`
`Blue Coat only disputes the security policy cache limitation of Element 4 of Claim 1 of the
`
`‘731 Patent. Finjan presented substantial evidence—including Blue Coat documents, source code,
`
`witness testimony, expert testimony and testing of the Accused Products—demonstrating that Blue
`
`Coat’s ASG with MAA combination contain the required “security policy cache for storing security
`
`policies for intranet computers within the intranet, the security policies each including a list of
`
`restrictions for files that are transmitted to a corresponding subset of the intranet computers.” In
`
`particular, Finjan presented evidence that the ASG’s security policy cache is the policy repository or
`
`policy container in the ASG. Trial Tr. at 727:9-734:4, 735:4-737:11; PTX-565; PTX-579; PTX-563;
`
`PTX-331; PTX-1278; see also generally Trial Tr. at 618:8-24, 624:21-24, 625:19-640:19, 640:20-
`
`737:11. Contrary to Blue Coat’s assertion, Dr. Mitzenmacher specifically testified regarding his
`
`testing of the accused ASG with MAA products and how it demonstrated the installation process that
`
`compiles a security policy file and places it into a security file cache. Trial Tr. at 728:13-734:4. In
`
`addition to presenting Blue Coat documents to support his opinion (see, e.g., PTX-579; PTX-331), Dr.
`
`Mitzenmacher also presented the testimony of Blue Coat’s engineer, Mr. Maxted, that refers to the
`
`5
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 10 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`policy repository and the storage of administrator-written policies that can be used at run-time. Trial
`
`Tr. at 733:7-19. Blue Coat challenged only Element 4 of Claim 1 of the ‘731 Patent with nothing but
`
`the unsupported opinion of Dr. Nielson, who did not cite any exhibits, witness testimony, source code
`
`or product testing to support his opinion.
`
`Finally, Finjan presented substantial evidence that Blue Coat’s accused ASG with MAA
`
`product combination infringes Claim 1 of the ‘731 Patent under the doctrine of equivalents (as
`
`described below).
`
`D.
`
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally and
`Under The Doctrine of Equivalents, Claim 1 of the ‘968 Patent
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 1 of the
`
`‘968 Patent, both literally and under the doctrine of equivalents. See generally Trial Tr. at 738:17-
`
`760:17; JTX-3002; JTX-3037; PTX-522; JTX-3036; PTX-3048; PTX-571; PTX-563; PTX-1025 at
`
`1650. There is no merit to Blue Coat’s argument that Finjan failed to present substantial evidence that
`
`Blue Coat’s accused ASG with MAA products contain a policy index that satisfies the first and third
`
`limitations of Claim 1 of the ‘968 Patent. Finjan presented substantial evidence, including Blue Coat’s
`
`own documents and testimony from Blue Coat’s engineers, demonstrating that policy tickets, which
`
`are the accused policy index, store allowability decisions. PTX-522 (depicting where allowability
`
`decisions stored in the policy ticket (see Trial Tr. at 747:1-749:21); JTX-3036 (discussing maintaining
`
`policy decisions (see Trial Tr. at 749:22-751:3)); Trial Tr. at 751:4-752:16 (Nova Dep. Testimony) (Q.
`
`So these are the policy tickets that store the allowability decisions? A. That’s correct); PTX-1277
`
`(Sorgic Dep. Testimony) (Q. So a policy ticket can be used to keep policy decisions; correct? A. To
`
`keep policy decision for the duration of the transaction, yes.”); Trial Tr. at 757:20-758:11 (Maxted
`
`Dep. Testimony) (Q. Would it be fair to say that the policy engine uses policy tickets to maintain
`
`policies are various checkpoints? A. It records the decisions made at specific checkpoints for use
`
`whenever the protocol agent needs to make that determination in its flow.).
`
`Blue Coat’s assertion that it is purportedly “undisputed” that a policy ticket only relates to a
`
`single policy is wrong and directly contradicted by the evidence Finjan presented at trial, including the
`
`plain language of Blue Coat’s engineers’ deposition testimony and Blue Coat’s documents. Id.; see
`6
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 11 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`also PTX-331 (stating policy files contain “policies”). Indeed, on cross-examination Dr. Nielson
`
`simply disagreed with Blue Coat’s engineer’s testimony without relying on any documents or other
`
`testimony to support his position. In addition, Blue Coat again mischaracterizes Dr. Mitzenmacher’s
`
`testimony regarding the storage of allowability determinations Dr. Mitzenmacher testified that policy
`
`tickets are saved and cached through the lifetime of a transaction, including multiple checkpoints
`
`where the policy is checked throughout the course of that transaction. Trial Tr. at 835:9- 838:7.
`
`Finally, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product
`
`infringes Claim 1 of the ‘968 Patent under the doctrine of equivalents (as described below).
`
`E.
`
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes Claim 22 of the
`‘408 Patent.
`Finjan presented substantial evidence that Blue Coat is liable for direct infringement of Claim
`
`22 of the ‘408 Patent. See generally Trial Tr. at 762:14-822:1; JTX-3005; PTX-526; JTX-3042; PTX-
`
`405; PTX-1025 at 34; PTX-1025 at 32; PTX-1025 at 106; PTX-1025 at 23; PTX-1025 at 108; PTX-
`
`1025 at 110; PTX-1025 at 36; PTX-214; PTX-1025 at 441; PTX-1025 at 1532; PTX-1025 at 443;
`
`PTX-1025 at 444; PTX-1025 at 1536; PTX-1025 at 1533; PTX-1025 at 1534; PTX-1025 at 443; PTX-
`
`1025 at 1775; PTX-1025 at 242; PTX-1025 at 450; PTX-1025 at 444; JTX-3050; PTX-513; PTX-1025
`
`at 124; PTX-1025 at 305. Blue Coat’s assertions otherwise lack merit.
`
`First, Finjan presented substantial evidence that Blue Coat’s WSS with GIN/WebPulse satisfy
`
`Element 5 of Claim 22 of the ‘408 Patent, which requires “dynamically building, while said receiving
`
`receives the incoming stream, a parse tree whose nodes represent tokens and patterns in accordance
`
`with parser rules.” In particular, Finjan presented expert testimony and Blue Cost source code
`
`establishing that the parse tree is the context structure and describing the dynamic building of
`
`hierarchical structure of nodes pursuant to the Court’s claim construction. Trial Tr. at 801:16-810:22;
`
`PTX-1025 at 1775. Contrary to Blue Coat’s assertion, Finjan presented substantial evidence in the
`
`form of Blue Coat’s source code demonstrating that Blue Coat’s pContext structure is formed as soon
`
`as a document is being received, that the processing of a document begins as content is incoming and
`
`that the pContext structure contains exploit code. Trial Tr. at 807:21-808:11; PTX-1025 at 1783; PTX-
`
`1025 at 1775; PTX-1025 at 1779. Blue Coat again grossly mischaracterizes Dr. Mitzenmacher’s trial
`7
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 12 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`testimony wherein Dr. Mitzenmacher explicitly states that initial stages of DRTR processing have
`
`already occurred ahead of a document being received by the WebPulse component, including
`
`initialization of the structure, and repeatedly disagreed with Blue Coat’s counsel incorrect suggestions
`
`regarding the process of building a process tree. Trial Tr. at 877:20-878:4 (“Q. But the document has
`
`been received by the WebPulse component; correct? A. Oh, it says the document is no in memory at
`
`the GIN component. Q. And that when the processing in the dynamic rating occurs; right? A. That’s
`
`when it occurs and—actually, I said that’s when—the initial stages have already occurred ahead of that
`
`time, including initialization of the structure showing places like the magic bytes and so on.”); see also
`
`Trial Tr. at 878:5-882:13. Moreover, Blue Coat’s argument plainly lacks merit because Dr. Nielson,
`
`on cross-examination, acknowledged that in some cases, DRTR only downloads a portion of the file.
`
`Trial Tr. at 1665:8-22.
`
`Second, Finjan presented substantial evidence that Element 3 of Claim 22 of the ‘408 Patent,
`
`which requires “instantiating a scanner for the specific programming language, in response to said
`
`determining, the scanner comprising parser rules and analyzer rules for the specific programing
`
`language, wherein the parser rules define certain patters in terms of tokens, tokens being lexical
`
`constructs for the specific programming language, and wherein the analyzer rules identify certain
`
`combinations of tokens and patterns as being indicators of corresponding exploits, exploits being
`
`portions of program code that are malicious.” In particular, Finjan presented expert testimony, Blue
`
`Coat documents and Blue Coat source code establishing that the WSS with GIN/WebPulse instantiates
`
`scanners such as a PDF scanner, an HTML scanner, and a JavaScript scanner on the incoming
`
`programing code using parser rules including such as searching for “eval”, “unescape”, “OpenAction”
`
`tokens (which are lexical constructs for specific programming language) and analyzer rules such as
`
`counting the number of suspicious tokens and incrementing particular variables within the context
`
`structure (such as nShadyJScriptCalls). Trial Tr. at 786:23-800:10; PTX-214; PTX-1025 at 441; PTX-
`
`1025 at 1532; PTX-1025 at 443; PTX-1025 at 444; PTX-1025 at 1536; PTX-1025 at 1533; PTX-1025
`
`at 1534. Dr. Nielson again disagreed that the accused combination build a parse tree, but did not
`
`present a single exhibit or portion of source code to support his opinion. Trial Tr. at 1667:4-1670:8.
`
`8
`FINJAN’S OPPOSITION TO BLUE COAT’S RULE 50(A)
`MOTION FOR JUDGMENT AS A MATTER OF LAW
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`

`

`Case 5:15-cv-03295-BLF Document 459 Filed 11/28/17 Page 13 of 27
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`
`F.
`
`Finjan Presented Substantial Evidence That Blue Coat Infringes, Literally and
`Under The Doctrine of Equivalents, Claims 1 and 10 of the ‘621 Patent.
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claims 1 and
`
`10 the ‘621 Patent, both literally and under the doctrine of equivalents. See generally Trial Tr. at
`
`892:13-924:15, 981:5-1056:4; 1087:14-1134:12; JTX-3007; PTX-423; JTX-3050; PTX-54; PTX-216;
`
`JTX-3048; PTX-199; PTX-460; PTX-293; PTX535; PTX-294; PTX-1025 at 947; PTX-1025 at 971;
`
`PTX-1025 at 1978; PTX-1025 at 1306; PTX-1025 at 1215; PTX-1025 at 2454; PTX-1025 at 2453.
`
`Blue Coat’s assertions otherwise lack merit.
`
`First, Finjan presented substantial evidence—including expert testimony from Dr. Medvidovic,
`
`Blue Coat documents and Blue Coat source code—that GIN/WebPulse contains hooks that interrupt
`
`the process