Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 1 of 41
`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 1 of 41
`
`
`
`EXHIBIT 2
`EXHIBIT 2
`
`
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 2 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 1 of 40
`
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`SAN JOSE DIVISION
`
`FINJAN, INC.,
`Plaintiff,
`
`v.
`
`CISCO SYSTEMS, INC.,
`Defendant.
`
`Case No. 17-cv-00072-BLF
`
`
`ORDER CONSTRUING CLAIMS IN
`U.S. PATENT NOS. 6,154,844; 6,804,780;
`7,647,633; 8,141,154; 8,677,494
`[Re: ECF 100, 112, 127]
`
`
`
`
`
`
`
`
`
`
`Plaintiff Finjan, Inc. (“Finjan”) brings this patent infringement lawsuit against Defendant
`Cisco Systems, Inc. (“Cisco”), alleging infringement of five of Finjan’s patents directed to
`computer and network security: U.S. Patent Nos. 6,154,844 (“the ’844 patent”); 6,804,780 (“the
`
`’780 patent”); 7,647,633 (“the ’633 patent”); 8,141,154 (“the ’154 patent”); and 8,677,494 (“the
`’494 patent”) (collectively, the “Asserted Patents”). The Court held a tutorial on June 7, 2018 and
`a Markman hearing on June 15, 2018 for the purpose of construing ten disputed terms in the ’844,
`’780, ’633, ’154, and ’494 patents.
`
`I. BACKGROUND
`The Asserted Patents are directed to network security technologies that detect online
`threats from malware. Finjan asserts that Cisco’s products and services infringe the Asserted
`Patents. See generally Second. Am. Compl., ECF 55. Each patent is summarized below.
`
`A. The ’844 Patent
`The ’844 patent is titled “System and Method for Attaching a Downloadable Security
`Profile to a Downloadable” and was issued on November 28, 2000. Ex. 1 to Hannah Decl. (the
`’844 patent), ECF 100-3. This patent claims systems and methods for inspecting Downloadables
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 3 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 2 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`for suspicious code or behavior according to a set of rules and generating a profile of the results
`from the inspection. See, e.g., id. at 1:62–3:7. In some embodiments, a content inspection engine
`generates a security profile and links that profile to a Downloadable. Id. at 2:3–11. The profile
`can include certificates that are later read by a protection engine to determine whether or not to
`trust the profile. Id. at 2:20–48. By providing verifiable profiles, the claimed systems and
`methods may efficiently protect computers from hostile Downloadables. Id. at 2:61–3:7.
`
`B. The ’494 Patent
`The ’494 patent is titled “Malicious Mobile Code Runtime Monitoring System and
`Methods” and was issued on March 18, 2014. Ex. 2 to Hannah Decl. (the ’494 patent), ECF 100-
`4. The patent provides “[p]rotection systems and methods . . . for protecting one or more personal
`
`computers (“PCs”) and/or other intermittently or persistently network accessible devices or
`processes from undesirable or otherwise malicious operations . . . .” Id. at 2:51–55. To achieve
`this goal, some embodiments utilize a protection engine in order to identify executable code. Id.
`at 11:65–12:14, 12:38–47.
`
`C. The ’780 Patent
`The ’780 patent is titled “System and Method for Protecting a Computer and a Network
`From Hostile Downloadables” and was issued on October 12, 2004. Ex. 3 to Hannah Decl. (the
`’780 patent), ECF 100-5. This patent teaches the generation of a re-usable ID for downloaded
`files so that future iterations of those files can be easily identified. For instance, the patent
`discloses that an ID generator can compute an ID that identifies a Downloadable by fetching
`components of the Downloadable and performing a hashing function on the fetched components.
`See, e.g., id. at 2:12–16.
`
`D. The ’633 Patent
`The ’633 patent is titled “Malicious Mobile Code Runtime Monitoring System and
`Methods” and was issued on January 12, 2010. Ex. 4 to Hannah Decl. (the ’633 patent), ECF 100-
`6. The patent provides systems and methods for protecting devices on an internal network from
`code, applications, and/or information downloaded from the Internet that performs malicious
`operations. Id. at Abstract. At a high level, some embodiments include a protection engine that
`2
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 4 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 3 of 40
`
`resides on a network server and monitors incoming information for executable code. Id. at 2:20–
`3:4. Upon detection of executable code, the protection engine deploys a “mobile protection code”
`and protection policies to a downloadable-destination. Id. col. 3:5–21. At the destination, the
`Downloadable is executed, typically within a sandboxed environment, and malicious or potentially
`malicious operations that run or attempt to run are intercepted and neutralized by the mobile
`protection code according to set protection policies. See id. at 3:22–40.
`
`E.
`The ’154 Patent
`The ’154 patent is titled “System and Method for Inspecting Dynamically Generated
`Executable Code” and was issued on March 20, 2012. Ex. 5 to Hannah Decl. (the ’154 patent),
`ECF 100-7. The patent concerns “new behavioral analysis technology [that] affords protection
`The patent concerns “new behavioral analysis technology [that] affords protection
`against dynamically generated malicious code,” which are viruses generated at runtime. Id. at
`against dynamically generated malicious code,” which are viruses generated at runtime. Id. at
`4:32–34; see also id. at 3:32–33. In some embodiments, a gateway computer receives content
`4:32–34; see also id. at 3:32–33.
`from the internet, where the content includes a call to an original function and an input. Id. at
`5:26–32. The gateway computer modifies the received content by replacing the call to the original
`The gateway computer modifies the received content by replacing the call to the original
`function with a corresponding call to a substitute function. Id. at 5:32–35. The substitute function
`function with a corresponding call to a substitute function. Id. at 5:32–35. The substitute function
`sends the input to a security computer, which determines whether it is safe to invoke the original
`sends the input to a security computer, which determines whether it is safe to invoke the original
`function with the input at a client computer. Id. at 5:35–43. In this approach, the patent provides
`function with the input at a client computer.
`technology that protects computers from dynamically generated malicious code.
`
`II.
`
`LEGAL STANDARD
`A. General Principles
`Claim construction is a matter of law. Markman v. Westview Instruments, Inc., 517 U.S.
`
`370, 387 (1996). “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the
`invention to which the patentee is entitled the right to exclude,” Phillips v. AWH Corp., 415 F.3d
`
`1303, 1312 (Fed. Cir. 2005) (en banc) (internal citation omitted), and, as such, “[t]he appropriate
`
`starting point . . . is always with the language of the asserted claim itself,” Comark Commc’ns, Inc.
`v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998).
`
`Claim terms “are generally given their ordinary and customary meaning,” defined as “the
`meaning . . . the term would have to a person of ordinary skill in the art in question . . . as of the
`3
`
`1 2 3 4 5 6 7 8 9
`
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 5 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 4 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`effective filing date of the patent application.” Phillips, 415 F.3d at 1313 (internal citation
`
`omitted). The court reads claims in light of the specification, which is “the single best guide to the
`meaning of a disputed term.” Id. at 1315; see also Lighting Ballast Control LLC v. Philips Elecs.
`N. Am. Corp., 744 F.3d 1272, 1284-85 (Fed. Cir. 2014) (en banc). Furthermore, “the
`interpretation to be given a term can only be determined and confirmed with a full understanding
`of what the inventors actually invented and intended to envelop with the claim.” Phillips, 415
`F.3d at 1316 (quoting Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1250 (Fed.
`Cir. 1998)). The words of the claims must therefore be understood as the inventor used them, as
`such understanding is revealed by the patent and prosecution history. Id. The claim language,
`written description, and patent prosecution history thus form the intrinsic record that is most
`significant when determining the proper meaning of a disputed claim limitation. Id. at 1315–17;
`see also Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996).
`Evidence external to the patent is less significant than the intrinsic record, but the court
`may also consider such extrinsic evidence as expert and inventor testimony, dictionaries, and
`
`learned treatises “if the court deems it helpful in determining ‘the true meaning of language used
`in the patent claims.’” Philips, 415 F.3d at 1318 (quoting Markman, 52 F.3d at 980). However,
`extrinsic evidence may not be used to contradict or change the meaning of claims “in derogation
`
`of the ‘indisputable public records consisting of the claims, the specification and the prosecution
`history,’ thereby undermining the public notice function of patents.” Id. at 1319 (quoting
`Southwall Techs., Inc. v. Cardinal IG Co., 54 F.3d 1570, 1578 (Fed. Cir. 1995)).
`
`B. Means-Plus-Function Claims
`Paragraph 6 of 35 U.S.C § 112 provides for means-plus-function claiming: “An element in
`a claim for a combination may be expressed as a means . . . for performing a specified function . . .
`and such claim shall be construed to cover the corresponding structure, material, or acts described
`in the specification and equivalents thereof.”1 When a claim uses the term “means” to describe a
`
`
`1 Paragraph 6 of 35 U.S.C. § 112 was replaced with newly designated § 112(f) when the America
`Invents Act (“AIA”), Pub. L. No. 112-29, took effect on September 16, 2012. Because the
`Asserted Patents were filed before that date, the Court refers to the pre-AIA version of § 112.
`4
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 6 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 5 of 40
`
`
`
`limitation, it creates a presumption that the inventor used the term to invoke § 112 ¶ 6. Biomedino
`v. Waters Technologies, 490 F.3d 946, 950 (Fed. Cir. 2007). The “presumption can be rebutted
`when the claim, in addition to the functional language, recites structure sufficient to perform the
`claimed function in its entirety.” Id.
`If a court concludes that a claim limitation is a means-plus-function limitation, “two steps
`of claim construction remain: 1) the court must first identify the function of the limitation; and 2)
`the court must then look to the specification and identify the corresponding structure for that
`function.” Id. The claim limitation will then be construed to cover that corresponding structure
`and equivalents thereof. 35 U.S.C § 112 ¶ 6.
`
`III. AGREED CONSTRUCTIONS
`The parties agree on the construction of several terms. See Joint Claim Construction
`Statement, ECF 85. The Court accordingly approves and adopts the following constructions:
`
`Term
`Downloadable
`
`(’844 patent, claims 1, 15, 43;
`’494 patent, claim 10;
`’780 patent, claims 1, 9, 17, 18)
`Database
`
`(’494 patent, claim 10)
`
`Agreed Construction
`an executable application program, which is downloaded from
`a source computer and run on the destination computer
`
`a collection of interrelated data organized according to a
`database schema to serve one or more applications
`
`IV. DISPUTED TERMS IN THE ’844 PATENT
`The parties dispute four terms in the ’844 patent. All four terms appear in independent
`claim 43 which recites:
`43. An inspector system comprising:
`
`means for receiving a Downloadable;
`means for generating a first Downloadable security profile that identifies
`suspicious code in the received Downloadable; and
`means for linking the first Downloadable security profile to the Downloadable
`before a web server makes the Downloadable available to web clients.
`’844 patent at 14:34–42 (emphasis added). The fourth term, also emphasized above in claim 43, is
`
`5
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 7 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 6 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`“before a web server makes the Downloadable available to web clients.” That disputed term is
`recited in claims 1, 15, and 43.
`Cisco’s briefing raises a threshold issue regarding the first to third disputed terms recited in
`claim 43. Responsive Br. 1–3, ECF 112. Specifically, Cisco contends that claim 43 is directed to
`
`the “inspector 125” embodiment as opposed to the “network gateway 110” embodiment in
`the ’844 patent. Id. Finjan disagrees. Reply Br. 1–3, ECF 127. Because the parties’
`disagreement pertains to a common issue in the disputed terms, the Court addresses that issue first.
`
`Cisco argues that claim 43 is an “inspector system claim and cannot be read onto a
`network gateway” for several reasons. Cisco first contends that the preamble of claim 43 recites
`“an inspector system” and that Finjan added this word during prosecution. Responsive Br. 2
`(emphasis in original). According to Cisco, Finjan argued before the patent examiner that “the
`claims were distinct from [the] Ji [prior art reference] because Ji disclosed a network gateway
`whereas the claims are directed to an ‘inspector.’” Id. (citing Ex. 1 to Gunther Decl. (5/3/2000
`Response), ECF 112-3). On this basis, Cisco claims that Finjan manifested a clear intention to
`limit the claim scope to “inspector 125” while excluding gateway embodiments. Id. at 2–3.
`Cisco then asserts that claim 43 requires the inspector system to generate a Downloadable
`
`Security Profile (“DSP”) and link the DSP to the Downloadable before a web server makes the
`Downloadable available to web clients. Responsive Br. 3. In Cisco’s view, only the inspector 125
`is described in the specification as both “generating” and “linking” the DSP. Id. Cisco further
`asserts that the generic protection engine of the network gateway only generates the DSP and
`passes the Downloadable without linking the Downloadable to the DSP. Id. According to Cisco,
`because claim 43 recites functions that are performed only by inspector 125, the corresponding
`structure of the first to third terms must be a structure within the inspector 125. Id.
`Finjan responds that Cisco’s construction is inconsistent with decisions issued by courts
`within this District. See Reply Br. 1–3. Finjan also argues that the ’844 patent discloses
`embodiments “where the inspector is at different locations, including at the network gateway.” Id.
`at 1.
`
`After carefully reviewing the parties’ briefing and the record, the Court agrees with
`6
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 8 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 7 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Finjan’s position. First, Cisco’s reliance on the fact that the preamble of claim 43 recites
`“inspector” is unpersuasive. “[W]hen a patentee defines a structurally complete invention in the
`claim body and uses the preamble only to state a purpose or intended use for the invention, the
`preamble is not a claim limitation.” Novatek, Inc. v. Sollami Co., 559 F. App'x 1011, 1015 (Fed.
`Cir. 2014) (internal quotation marks and citation omitted). That said, “clear reliance on the
`preamble during prosecution to distinguish the claimed invention from prior art transforms the
`preamble into a claim limitation.” Catalina Mktg. Int'l, Inc. v. Coolsavings.com, Inc., 289 F.3d
`801, 808 (Fed. Cir. 2002). Here, the Court finds that the preamble of claim 43 is not a limitation.
`The body of the claim structurally defines the claimed invention. In addition, the prosecution
`
`history of the ’844 patent does not clearly show that Finjan distinguished the Ji reference by
`adding “inspector” to the preamble. Rather, Finjan emphasized that the Ji reference is
`distinguishable because it “does not teach generating [DSP] or linking the [DSP] to a
`Downloadable before the web server makes the Downloadable security profile available to web
`clients” and fails to disclose “examining an already linked [DSP] by network gateways.” See Ex.
`1 to Gunther Decl. (5/3/2000 Response) (emphasis in original). These statements do not pertain to
`the preamble. Thus, the prosecution history does not show that Finjan clearly relied on the
`preamble to limit claim 43. Catalina, 289 F.3d at 808.
`To the extent that Cisco invokes the prosecution disclaimer doctrine, its argument fails.
`Any disclaimer must be “clear and unmistakable” and cannot be “amenable to multiple reasonable
`interpretations.” Omega Eng'g, Inc, v. Raytek Corp., 334 F.3d 1314, 1325–26 (Fed. Cir. 2003).
`Here, at best, Finjan’s patent prosecution statements are ambiguous and thus do not support
`
`Cisco’s position. As such, Finjan’s statements do not show that it “clearly and unmistakabl[y]”
`disavowed “network gateway” embodiments from the claim scope. Id. In fact, other courts have
`reached the same conclusion after reviewing the prosecution history of the ’844 patent. See
`Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG, 2017 WL 550453, at *16 (N.D. Cal. Feb.
`10, 2017) (“The Court does not read this language to establish . . . that an inspector by definition
`can never be at the gateway, or to amount to a clear and unmistakable disavowal.”).
`Second, the Court is unpersuaded by Cisco’s argument that claim 43 excludes “network
`7
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 9 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 8 of 40
`
`
`
`gateway” embodiments on the grounds that the specification discloses only inspector 125 to
`“generate” and “link” the DSP. To be sure, the ’844 patent expressly discloses that content
`inspection engine 160 in the inspector 125 of Fig. 1 to both generate and link DSP to a
`Downloadable. See e.g., ’844 patent at 8:36–9:4. However, the specification also explicitly
`describes that the content inspection engine 525 which may be located at the network gateway
`generates DSP for a Downloadable and that the content inspection engine 525 is “similar to the
`content inspection engine 160 of the inspector 125.” Id. at 7:62–64, 7:67–8:2. The specification
`further explains that the content inspection engine 525 generates DSP for the received
`Downloadable as described with reference to Figs. 4 and 6, id. at 9:63–65, where it is disclosed
`that content inspection engine 160 attaches DSP, id. at 7:13–16, 8:36–9:4. Based on those
`disclosures, and in particular, given that the ’844 patent expressly describes that the content
`inspection engine 160 at the network gateway is similar to those in the inspector 125, a person of
`ordinary skill in the art would understand that the content inspection engine located at the gateway
`can link DSP to the Downloadable. The Court therefore rejects Cisco’s argument that the “linking”
`limitation in claim 43 shows that “network gateway” embodiments are excluded.
`Accordingly, the Court concludes that claim 43 covers embodiments where the inspector is
`located at the network gateway. This interpretation of claim 43 is consistent with the construction
`of other courts. Symantec, 2017 WL 550453, at *16.
`The Court now addresses the four disputed terms in the ’844 patent separately below.
`
`“means for receiving a Downloadable” (claim 43)
`
`A.
`
`Finjan’s Proposal
`Function: receiving a
`Downloadable
`
`Structure: downloadable file
`interceptor
`
`Cisco’s Proposal
`Function: receiving a
`Downloadable
`
`Structure: inspector 125 that
`is external to a network
`gateway
`There is no dispute that this term is a means-plus-function limitation and that the function
`is “receiving a Downloadable.” Opening Br. 3, ECF 100; Responsive Br. 3. The Court therefore
`adopts the function agreed by the parties.
`
`Court’s Construction
`Function: receiving a
`Downloadable
`
`Structure: downloadable file
`interceptor
`
`8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 10 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 9 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`The parties, however, dispute the structure for this limitation. Finjan argues that the proper
`structure is “downloadable file interceptor” because the ’844 patent disclose this element to
`perform “the function of receiving a Downloadable.” Opening Br. 3. Finjan points out that Judge
`Gilliam and Judge Orrick in this District determined that the proper structure is “downloadable file
`interceptor.” Id. (citing Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG, 2017 WL
`550453, at *3–4 (N.D. Cal. Feb. 10, 2017); Finjan, Inc. v. Sophos, Inc., No. 14-CV-01197-WHO,
`2015 WL 890621, at *8 (N.D. Cal. Mar. 2, 2015) (“[T]he structure for ‘means for receiving a
`Downloadable’ is unambiguous: the Downloadable file interceptor.”)).
`Cisco counters that the structure is the “inspector 125 that is external to a network
`gateway.” Responsive Br. 3. Cisco’s proposal is based on its argument that claim 43 excludes
`“network gateway” embodiments. See id. at 4. However, as discussed earlier, the Court rejects
`Cisco’s position that claim 43 does not cover “network gateway” embodiments. Thus, the Court
`finds that Cisco’s proposed structure is improper.
`The remaining issue is whether the “downloadable file interceptor” is the proper structure.
`The specification clearly discloses that the downloadable file interceptor performs the function of
`receiving a Downloadable. See, e.g., ’844 patent at 9:22–23. The parties, however, dispute the
`location of the downloadable file interceptor. Cisco contends that this structure is not part of the
`inspector 125 on the grounds that it exists only on the network gateway. Responsive Br. 3;
`Hearing Tr. 35:22–36:3, ECF 132. Thus, according to Cisco, Finjan’s proposed structure would
`exclude embodiments where the inspector is external to the network gateway. See Hearing Tr.
`36:1–3. Finjan countered that its construction “would not read out embodiments from the
`specification” because the “downloadable file interceptor can be at the inspector as well.” Id. at
`55:13–17, 55:19–56:4. For support, Finjan pointed to col. 7, line 19 to col. 8, line 2 of the
`specification, which in part states that the “content inspection engine 525 is similar to the content
`inspection engine 160 of the inspector 125.” Hearing Tr. 55:19–56:2, 57:2–57:19. On this basis,
`Finjan represented that its proposed construction does not limit claim 43 to only “network
`gateway” embodiments. See id. at 57:20–58:3.
`After reviewing the ’844 patent, the Court agrees with Finjan’s conclusion. The
`9
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 11 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 10 of 40
`
`
`
`specification describes a generic protection engine that includes the downloadable file interceptor
`for receiving incoming Downloadables. ’844 patent at 7:41–48. This generic protection engine
`includes content inspection engine 525 that is similar to the content inspection engine 160 of the
`inspector 125, which is external to the gateway as depicted in Fig. 1. Id. at 7:19–8:2. The
`specification further describes that the content inspection engine 160 receives Downloadables like
`the generic protection engine. See id. at 4:52–56 (“[T]he Downloadable ID for the Downloadable
`will be the same each time the content inspection engine 160 (or a protection engine as illustrated
`in FIG. 5) receives the same Downloadable . . . .”). Based on those disclosures, a person of
`ordinary skill in the art would understand that inspector 125 with the content inspection engine
`160 can include the structure of the downloadable file interceptor described in relation to the
`protection engine in order to receive Downloadables. Accordingly, although the ’844 patent
`expressly discusses the downloadable file interceptor in connection to embodiments pertaining to
`the network gateway or computer client (’844 patent at 7:41–44, 9:19–10:23), the Court finds that
`a person of ordinary skill in the art would understand that the downloadable file interceptor may
`be located on inspector 125.
`The Court also notes that Judge Gilliam and Judge Orrick’s claim construction orders
`determined the proper structure as the “downloadable file interceptor.” Symantec Corp., , 2017
`WL 550453, at *3–4; Sophos, 2015 WL 890621, at *8. The Court’s above conclusion is
`consistent with those orders. Thus, the Court is further persuaded that the “downloadable file
`interceptor” is the correct structure for the “means for receiving a Downloadable.” Symantec,
`2017 WL 550453, at *3 (explaining that prior claim construction orders issued in the same
`jurisdiction may receive deference). The Court finds no reason to depart from the prior claim
`construction orders.
`For the above reasons, the Court adopts Finjan’s construction.
`//
`//
`//
`
`10
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 12 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 11 of 40
`
`
`
`B.
`
`“means for generating a first Downloadable security profile that identifies
`suspicious code in the received Downloadable” (Claim 43)
`
`
`Finjan’s Proposal
`Function: generating a first
`Downloadable security
`profile that identifies
`suspicious code in the
`received Downloadable
`
`Structure: content inspection
`engine programmed to
`perform the algorithm
`disclosed at Col. 8, lines 51–
`60 of the ’844 patent
`
`Court’s Construction
`Function: generating a first
`Downloadable security profile
`that identifies suspicious code in
`the received Downloadable
`
`
`Structure: content inspection
`engine programmed to perform
`the algorithm disclosed at Col. 8,
`lines 51–60 of the ’844 patent
`
`Cisco’s Proposal
`Function: generating a first
`[Downloadable security
`profile that identifies
`suspicious code in the
`received Downloadable]2
`
`Structure: content
`inspection engine 160 of
`inspector 125 programmed
`to perform the algorithm
`disclosed at 8:49–60 of the
`’844 patent and 5:36–47,
`5:54–57, 8:23–24, 9:20–42,
`and Fig. 7 of U.S. Patent
`No. 6,092,194
`The parties do not dispute that this term is a means-plus-function limitation and that the
`function is “generating a first Downloadable security profile that identifies suspicious code in the
`received Downloadable.” Opening Br. 5; Responsive Br. 4. The Court therefore adopts the
`function agreed by the parties.
`The parties, however, diverge on the proper structure for this limitation. Finjan asserts that
`its proposed structure is correct because the structure is “taken directly from the specification of
`
`the ’844 patent as it relates to generating a [DSP].” Opening Br. 5. Finjan further asserts that
`Judge Gilliam adopted the same structure in Symantec, 2017 WL 550453, at *6–7. Opening Br.
`5–6.
`
`Cisco first responds that the proper structure should be “tied to inspector 125” but that
`Finjan’s proposal fails to do so. Responsive Br. 4. Cisco next argues that the specification of the
`’844 patent “provides almost no detail of how the content inspection engine 160 generates a DSP
`that identifies suspicious code in the received Downloadable” and that code is distinct from
`operations. Id.; see also id. n.4. Based on this assertion, Cisco contends that the Court must look
`to U.S. Patent Application No. 08/964,388 (now U.S. Patent No. 6,092, 194 (“the ’194 patent”)),
`
`
`2 Cisco states that the square brackets shown in its proposed constructions indicate that the
`bracketed phrase should be subject to the proposed construction for the respective term in the Joint
`Claim Construction Statement. Response Br. 4 n.2.
`11
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Northern District of California
`United States District Court
`
`

`

`Case 5:17-cv-04467-BLF Document 320-3 Filed 12/02/20 Page 13 of 41
`Case 5:17-cv-00072-BLF Document 134 Filed 07/23/18 Page 12 of 40
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`which the ’844 patent incorporates by reference, to construe the proper structure. Id. at 4–5.
`
`Cisco’s first contention is based on the argument that claim 43 excludes “network gateway”
`embodiments. But, again, the Court rejects Cisco’s argument that claim 43 does not cover
`“network gateway” embodiments. The Court therefore is unpersuaded by Cisco’s first contention
`that the proper structure should be tied to inspector 125.
`Regarding Cisco’s second contention, the Court is unconvinced by Cisco’s reliance on
`the ’194 patent even if that patent were properly incorporated by reference into the ’844 patent.
`The ’194 patent does not mention “content inspection engine” and the Court is unable to identify
`
`with particularity which algorithms disclosed in the ’194 patent pertain to the “content inspection
`
`engine” described in the ’844 patent. On the other hand, the ’844 patent itself sufficiently
`discloses the algorithm for the content inspection engine that performs the agreed upon function:
`
`
`As stated above, generating a DSP [by the content inspection engine]
`includes examining the Downloadable 205 (and the Downloadable
`components) for all suspicious operations that will or may be
`performed by the Downloadable, all suspicious code patterns, all
`known viruses, etc. Generating a DSP may include comparing all
`operations that will or may be performed against a list of suspicious
`operations or against a list of rules, e.g., a rules base 165.
`Accordingly, if an operation in the Downloadable 205 matches one
`of the suspicious operations or violates one of the rules, then the
`operation is listed in the DSP 215.
`
`’844 patent at 8:51–60. Similar narrative algorithms have been found to disclose sufficient
`structure. See Typhoon Touch Techs., Inc. v. Dell, Inc., 659 F.3d 1376, 1385–86 (Fed. Cir. 2011).
`As such, the Court finds that the proper algorithm is disclosed in col. 8, lines 51–60 of the ’844
`patent. Indeed, Judge Gilliam reached the same conclusion. Symantec, 2017 WL 550453, at *6–7
`(declining to rely on the ’194 patent and holding that the ’844 patent disclosed sufficient structure).
`Moreover, Cisco’s argument that Court must look to the ’194 patent on the grounds that
`
`code is distinct from operations is unavailing. Finjan’s proposed algorithm in the ’844 patent
`describes “generating a DSP includes examining the Downloadable . . . for all suspicious
`operations that will o