Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8644 Page 1 of 274
`
`
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`KRAMER LEVIN NAFTALIS & FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE SOUTHERN DISTRICT OF CALIFORNIA
`SAN DIEGO DIVISION
`FINJAN, INC., a Delaware Corporation,
`Case No.: 3:17-cv-00183-CAB-BGS
`
`
`PLAINTIFF FINJAN, INC.’S
`SUPPLEMENTAL INFORMATION
`IN SUPPORT OF CLAIM
`CONSTRUCTION OF THE TERM
`“DOWNLOADABLE” FOR U.S.
`PATENT NOS. 9,189,621 AND
`9,219,755
`
`
`
`
`Plaintiff,
`
`v.
`
`
`
`
`ESET, LLC, a California Limited
`Liability Corporation, and ESET SPOL.
`S.R.O., a Slovak Republic Corporation,
`
`
`Defendants.
`ESET, LLC, a California Limited
`Liability Corporation, and ESET SPOL.
`S.R.O., a Slovak Republic Corporation,
`
`
`Counterclaim-Plaintiffs,
`
`v.
`
`
`
`FINJAN, INC., a Delaware Corporation,
`
`
`
`Counterclaim-Defendant.
`
`CASE NO. 17-cv-00183-CAB-BGS
`FINJAN’S SUPP. INFORMATION RE:
`CLAIM CONSTRUCTION OF “DOWNLOADABLE”
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8645 Page 2 of 274
`
`
`
`Pursuant to the Court’s request during the claim construction hearing held on
`
`September 25 and 26, 2017, Finjan submits herewith decisions from the Patent Trial and
`Appeal Board (“PTAB”) adopting the same construction of the claim term
`“downloadable” for U.S. Patent Nos. 9,189,621 (the “‘621 Patent”) and 9,219,755 (the
`“‘755 Patent”) as Finjan proposes here. Exs. 1-2. Below is a brief discussion of these
`decisions:
`
`On March 1, 2017, third party Blue Coat Systems, Inc. (“Blue Coat”) filed
`petitions for inter partes review (“IPR”) of the ‘621 Patent (IPR2017-00995) and ‘755
`Patents (IPR2017-00997). Both the ‘621 and ‘755 Patents were expired when Blue
`Coat filed these petitions. In both of these petitions, Blue Coat proposed that the claim
`term “downloadable” should be construed as “an executable application program, which
`is downloaded from a source computer and run on a destination computer.” Ex. 3 (‘621
`Petition) at 18-19; Ex. 4 (‘755 Petition) at 21-22. Blue Coat supported this construction
`with the declaration of its expert, Dr. Bestavros, who stated: “I interpret the term
`‘downloadable,’” as used in the ‘621 and ‘755 Patents “ to include ‘an executable
`application program, which is downloaded from a source computer and run on a
`destination computer.’” Doc. No. 139-18 at ¶ 36; see also Doc. No. 139-19 at ¶ 36
`(Exs. 15-16 of Finjan’s Opening Claim Construction Brief). In its preliminary
`responses to Blue Coat’s petitions, Finjan did not dispute this construction. See
`generally, Ex. 5 at 9-16 (‘621 Response); Ex. 6 at 11 (‘755 Response).
`On September 5, 2017, the PTAB instituted the IPR for the ‘621 Patent and
`denied institution of IPR for the ‘755 Patent. In both of these decisions, the PTAB
`explained that, “[f]or claims of an expired patent, the Board’s claim interpretation
`analysis is similar to that of a district court. See In re Rambus Inc., 694 F.3d 42, 46
`(Fed. Cir. 2012).” Ex. 1 at 5; Ex. 2 at 7. The PTAB further explained:
`Claim terms are given their ordinary and customary meaning,
`as they would be understood by one of ordinary skill in the art
`
`CASE NO. 17-cv-00183-CAB-BGS
`FINJAN’S SUPP. INFORMATION RE:
`CLAIM CONSTRUCTION OF “DOWNLOADABLE”
`
`1
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8646 Page 3 of 274
`
`
`
`in question at the time of the invention. Phillips v. AWH Corp.,
`415 F.3d 1303, 1312−13 (Fed. Cir. 2005) (en banc). Although
`we construe the claims in light of the specification, limitations
`discussed in the specification may not be read into the claims.
`Intervet Inc. v. Merial Ltd., 617 F.3d 1282, 1287 (Fed. Cir.
`2010); Abbott Labs. v. Sandoz, Inc., 566 F.3d 1282, 1288 (Fed.
`Cir. 2009).
`
`Ex. 1 at 5-6; Ex. 2 at 7; see also, In re CSB-System Int’l, Inc., 832 F.3d 1335, 1341 (Fed.
`Cir. 2016) (“Even so, when an expired patent is subject to reexamination, the traditional
`Phillips construction standard attaches.”)(citing In re Rambus, 694 F.3d at 46). In both
`decisions, the PTAB construed “downloadable” as “an executable application program,
`which is downloaded from a source computer and run on a destination computer.” Ex. 1
`at 8; Ex. 2 at 10.
`As such, the PTAB adopted the same construction of the term “downloadable” in
`the ‘621 and ‘755 Patents as Finjan proposes here. In doing so, the PTAB was held to
`the same standards for claim construction as this district court. Moreover, the party
`opposing Finjan in the IPR proceedings, Blue Coat, along with Blue Coat’s expert,
`advocated for the same construction that Finjan proposes here. These PTAB decisions,
`along with the submissions by Blue Coat during these proceedings, form part of the
`intrinsic record for the ‘621 and ‘755 Patents. See, e.g., Fairfield Indus., Inc. v.
`Wireless Seismic, Inc., No. 4:14–CV–2972, 2015 WL 1034275, at *5 (S.D. Tex. Mar.
`10, 2015) (“[The PTAB’s IPR] claim construction analysis serves as further intrinsic
`evidence that [the] proposed construction is appropriate.”).
`Thus, the Court should adopt Finjan’s construction of “downloadable” consistent
`with the PTAB decisions.
`
`
`
`CASE NO. 17-cv-00183-CAB-BGS
`FINJAN’S SUPP. INFORMATION RE:
`CLAIM CONSTRUCTION OF “DOWNLOADABLE”
`
`2
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8647 Page 4 of 274
`
`
`
`
`
`
`
`DATED: September 29, 2017
`
`Respectfully submitted,
`
`By: s/ James Hannah
`
`
`Paul J. Andre (State Bar. No. 196585)
`Lisa Kobialka (State Bar No. 191404)
`James Hannah (State Bar No. 237978)
`KRAMER LEVIN NAFTALIS
` & FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`pandre@kramerlevin.com
`lkobialka@kramerlevin.com
`jhannah@kramerlevin.com
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`
`
`CASE NO. 17-cv-00183-CAB-BGS
`FINJAN’S SUPP. INFORMATION RE:
`CLAIM CONSTRUCTION OF “DOWNLOADABLE”
`
`3
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8648 Page 5 of 274
`
`
`
`
`
`EXHIBIT 1
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8649 Page 6 of 274
`
`Trials@uspto.gov
`571-272-7822
`
`
`Paper 7
`Entered: September 5, 2017
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`BLUE COAT SYSTEMS LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2017-00995
`Patent 9,189,621 B2
`
`____________
`
`
`
`Before, THOMAS L. GIANNETTI, MIRIAM L. QUINN, and SHEILA F.
`McSHANE Administrative Patent Judges.
`
`QUINN, Administrative Patent Judge.
`
`
`
`DECISION
`Institution of Inter Partes Review
`37 C.F.R. § 42.108
`
`
`
`
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8650 Page 7 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`Blue Coat Systems LLC (“Petitioner”) filed a Petition to institute inter
`partes review of claims 1, and 6−10 of U.S. Patent No. 9,189,621 B2 (“the
`’621 patent”) pursuant to 35 U.S.C. § 311−319. Paper 2 (“Pet.”). Finjan,
`Inc. (“Patent Owner”) timely filed a Preliminary Response. Paper 6
`(“Prelim. Resp.”). We have jurisdiction under 35 U.S.C. § 314.
`For the reasons that follow, we institute inter partes review.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies the ʼ621 patent as the subject matter of the district
`court case pending in the U.S. District Court for the Northern District of
`California (Case No. 5:13-cv-03295-BLF). Pet. 16.
`
`B. THE ’621 PATENT (EX. 1001)
`
`The ’621 patent is titled “Malicious Mobile Code Runtime Monitoring
`Systems and Methods.” Ex. 1001, [54]. The ’621 patent is related to many
`filed applications (id. at [63]) and incorporates by reference U.S. Patent No.
`6,480,962. Id. at 1:54−59; Ex. 1013 (“the ’962 patent”). The ’962 patent
`describes a security system, for protecting a client during runtime from
`hostile downloadables, as follows:
`A system protects a client from hostile Downloadables.
`The system includes security rules defining suspicious
`actions and security policies defining the appropriate
`responsive actions to rule violations. The system includes
`an interface for receiving incoming Downloadable and
`requests made by the Downloadable. The system still
`further includes a comparator coupled to the interface for
`examining the Downloadable, requests made by the
`Downloadable and runtime events to determine whether a
`
`2
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8651 Page 8 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`security policy has been violated, and a response engine
`coupled to the comparator for performing a violation-
`based responsive action.
`
`
`Ex. 1013, Abs. More particularly, the ’962 patent illustrates an embodiment
`of the security system in Figure 3, reproduced below.
`
`
`
`
`
`Figure 3 illustrates security system 135a including Java class
`extensions 304, each managing a respective Java class 302, and further
`including operating system probes 310, 312, 314, and 316, each recognizing
`applet instructions sent to the various operating subsystems: file system
`265, network system 270, process system 276, and memory system 280. Id.
`at 3:52−4:31. For example, a file system probe 310 recognizes an applet
`instruction sent to file system 265 and sends a message to inform event
`router 308. Id. Event router 308 forwards the message to the user via a
`Graphical User Interface (GUI), to event log 322 for recording the message
`
`3
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8652 Page 9 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`for analysis, and to runtime environment monitor 320 for determining
`whether the request violates security rule 330 stored in security database
`326. Id. at 4:20−38. Runtime environment monitor 320, upon recognition
`of a violation, informs the response engine 318 of the violation. Id. at
`50−54. Response engine 318 determines the appropriate responsive action
`to the rule 330 violation, which action may include terminating the applet.
`Id. at 4:54−59.
`
`C. ILLUSTRATIVE CLAIM
`
`Challenged claims 1 and 10 of the ’621 patent are independent.
`Illustrative claim 1 is reproduced below.
`1. A system for determining whether a downloadable is
`suspicious, comprising:
`at least one processor for accessing elements stored in at
`least one memory associated with the at least one processor for
`executing instructions associated with the elements, the
`elements including:
`a plurality of operating system probes operating
`substantially in parallel for monitoring a plurality of subsystems
`of the operating system during runtime for an event caused
`from a request made by a downloadable;
`an interrupter for interrupting processing of the request;
`a first comparator coupled to the plurality of operating
`system probes for comparing information pertaining to the
`downloadable against a predetermined security policy, wherein
`the information pertaining to the downloadable includes
`information pertaining to an operation of the downloadable and
`distinct from information pertaining to the request; and
`a response engine for performing a predetermined
`responsive action based on the comparison.
`
`Ex. 1001, 21:31−52.
`
`
`4
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8653 Page 10 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`D. ASSERTED REFERENCES AND GROUNDS OF UNPATENTABILITY
`
`Petitioner asserts three grounds of unpatentability based on the
`following references:
`1) Jaeger: Trent Jaeger et al., Building Systems that Flexibly Control
`Downloaded Executable Content, Proceedings of the Sixth
`USENIX UNIX Security Symposium (1996) (Exhibit 1005)
`(“Jaeger”);
`2) TBAV: ThunderBYTE Anti-Virus, User Manual (copyright date
`1995) (Exhibit 1006) (“TBAV”); and
`3) Arnold: U.S. Patent No. 5,440,723 (Exhibit 1007) (“Arnold”).
`The grounds identified in the Petition are as listed below (Pet. 18).
`Claims
`Basis
`Reference(s)
`1 and 10
`§ 103
`Jaeger
`6
`§ 103
`Jaeger and TBAV
`§ 103
`Jaeger and Arnold
`7−9
`
`Petitioner further relies on the Declaration of Azer Bestavros, Ph.D.,
`in support of the asserted grounds. Ex. 1002 (“Bestavros Declaration”).
`
`II. ANALYSIS
`
`A. CLAIM CONSTRUCTION
`
`The parties concur that the ’621 patent has expired. Pet. 19; Prelim.
`Resp. 9. For claims of an expired patent, the Board’s claim interpretation
`analysis is similar to that of a district court. See In re Rambus Inc., 694 F.3d
`42, 46 (Fed. Cir. 2012). Claim terms are given their ordinary and customary
`meaning, as they would be understood by one of ordinary skill in the art in
`
`5
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8654 Page 11 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`question at the time of the invention. Phillips v. AWH Corp., 415 F.3d 1303,
`1312−13 (Fed. Cir. 2005) (en banc). Although we construe the claims in
`light of the specification, limitations discussed in the specification may not
`be read into the claims. Intervet Inc. v. Merial Ltd., 617 F.3d 1282, 1287
`(Fed. Cir. 2010); Abbott Labs. v. Sandoz, Inc., 566 F.3d 1282, 1288 (Fed.
`Cir. 2009).
`Petitioner proposes construction for one term—“downloadable”: “an
`executable application program, which is downloaded from a source
`computer and run on a destination computer.” Pet. 19. Patent Owner does
`not appear to dispute that meaning. See Prelim. Resp. 1 (stating that “[t]he
`’621 Patent is generally directed to systems and methods for protecting
`client computers from malicious Downlodables, which are executable
`programs that are downloaded from a source computer and run on a
`destination computer.”).
`Patent Owner argues, however, that the following phrase, recited in
`the challenged independent claims needs construction: “a plurality of
`operating system probes operating substantially in parallel for monitoring a
`plurality of subsystems of the operating system during runtime for an event
`caused from a request made by a downloadable.” Id. at 9−17. In particular,
`Patent Owner argues that the phrase should be construed as requiring that
`the operating system probes monitor “corresponding” subsystems of the
`operating system. Id. at 13. Further, Patent Owner argues that “monitoring
`. . . for an event” means monitoring “an event at the operating system level.”
`Id. For the reasons that follow, we do not agree with Patent Owner’s
`proposed constructions, on the record before us.
`
`6
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8655 Page 12 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`Both of Patent Owner’s arguments involve reading into the claims
`limitations from the specification. It is improper to read limitations from a
`preferred embodiment into the claims absent a clear indication in the
`intrinsic record that the patentee intended the claims to be so limited.
`Liebel-Flarsheim Co. v. Medrad, Inc., 358 F.3d 898, 913 (Fed. Cir. 2004).
`At this juncture, Patent Owner has proffered no evidence in the intrinsic
`record that persuades us to adopt its proposed claim constructions.
`Furthermore, we note that, in connection with district court litigation
`concerning the related ’962 patent, Patent Owner has agreed to a
`construction for the term “operating system probe” as “an interface for
`receiving and recognizing requests before allowing the operating system to
`execute the requests.” Ex. 2001, 4; Prelim. Resp. 12.
`
`We are not persuaded by Patent Owner’s argument that the district
`court construction is consistent with its contention that each probe monitors
`a “corresponding” subsystem. Prelim. Resp. 12−13. There is no persuasive
`explanation as to how the term “operating system probe,” as described in the
`’962 patent, and claimed therein, is different than the “operating system
`probe” claimed in the ’621 patent. The ’621 patent does not describe the
`“operating system probes,” but it incorporates by reference the ’962 patent,
`which does describe the probes, as summarized above. Thus, the ’962 patent
`specification explicitly describes and claims the same probes recited in the
`’621 patent claims. The district court’s construction does not refer to any
`subsystem of the operating system. Furthermore, no language in either
`claim 1 or 10 requires that the recited probes monitor a “corresponding”
`subsystem of the operating system.
`
`7
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8656 Page 13 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`Similarly, we are not persuaded that the recited monitoring must be
`performed at the operating system level. Patent Owner does not provide
`persuasive evidence that the plain meaning of the claims requires that
`monitoring must be performed at any particular level. Neither has Patent
`Owner shown that the specification or prosecution history support such an
`interpretation. Instead, Patent Owner points out that the “operating [system]
`probes interact with the Downloadable only by observing operating system
`level events.” Prelim. Resp. 16. The claim language, therefore, is directed
`to what the operating system probes monitor, i.e., events caused from a
`request made by a downloadable, not where in the hierarchy of the
`computing environment that monitoring is performed. Accordingly, Patent
`Owner’s argument that the probes monitor an event “at the operating system
`level” is not persuasive at this time.
`Consequently, we adopt for purposes of this Decision the claim
`construction of “operating system probe” agreed to in district court by Patent
`Owner, and the undisputed construction of “downloadable.”
`Claim Term
`Construction for Purposes of this
`Decision
`an executable application program,
`which is downloaded from a source
`computer and run on a destination
`computer
`an interface for receiving and
`recognizing requests before allowing
`the operating system to execute the
`requests
`
`operating system probe
`
`downloadable
`
`
`
`8
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8657 Page 14 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`B. PETITIONER’S OVERALL CONTENTIONS
`
`Petitioner contends that all limitations of claims 1 and 10 are taught or
`suggested by Jaeger. Specifically, claims 1 and 10 require “at least one
`processor,” “a plurality of operating system probes,” “an interrupter,” “a
`comparator,” and “a response engine.” Ex. 1001, 21:35−52, 22:24−39. For
`the “processor” limitation, Petitioner points to Jaeger’s “computing base.”
`Pet. 25. For the “plurality of system probes” limitation, Petitioner points to
`Jaeger’s interpreters comprising operating system probes. Id. at 29. For the
`“interrupter” limitation, Petitioner argues that “Jaeger’s interpreters
`comprise probes that act as interrupters.” Id. at 35 (arguing that, “[a]s
`explained by Dr. Bestavros, the content’s request is interrupted while the
`interpreters authorize access to system objects”). For the “comparator”
`limitation, Petitioner points to Jaeger’s pseudocode shown in Figure 9
`(authorize procedure). Id. at 38−39. And for the “response engine”
`limitation, Petitioner argues that Jaeger’s Figure 5 “illustrates that the system
`will perform a predetermined response: executing the content.” Id. at 44
`(arguing also that Figure 8 of Jaeger shows the pseudocode for a response
`engine).
`Concerning claim 6, which recites “storing results of the comparison
`in an event log,” Petitioner asserts that TBAV discloses a utility, “TbLog,
`which is designed primarily to create log files in response to various TBAV
`alert messages.” Pet. 46 (citing Ex. 1006, 139). Petitioner also asserts that
`“storing such information in a log file was a well-established, routine
`practice when dealing with potentially malicious files.” Id. Further,
`Petitioner points out that it would have been obvious to log the results of the
`
`9
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8658 Page 15 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`Jaeger comparison. Id. at 46−47. Dr. Bestravos opines that the TbLog
`utility provides convenient logging of activity. Ex. 1002 ¶ 121.
`Concerning claims 7, 8, and 9, Petitioner asserts that Arnold discloses
`the additional limitations recited in those claims. Pet. 49−56. In particular,
`Petitioner points to Arnold’s disclosure of “alerting users to the presence of
`viruses,” and that upon detection of a virus, its signature is added to a
`database. Pet. 50−51. Further, Petitioner points out that Arnold teaches a
`“cleanup” process that “involves killing active work processes . . . and
`deleting work executables and auxiliary files from storage media.” Pet. 53
`(citing Ex. 1007 at 21:34−37). Petitioner argues that it would have been
`obvious to combine the above-identified features of Arnold with Jaeger,
`because when Jaeger’s system detects a security policy violation:
`(1) discarding the Downloadable is a traditional method for dealing
`with malicious software (Pet. 53−54);
`(2) generating alert messages has long been routine practice (Pet.
`50−51); and
`(3) recording the violation in a database allows the system to more
`easily screen out future copies and variants of the content (Pet. 51−52).
`
`C. PATENT OWNER’S ARGUMENTS
`Patent Owner focuses some of its arguments on distinguishing Jaeger
`by applying Patent Owner’s proposed constructions for the operating
`systems probe limitation. Prelim. Resp. 21−24, 27−28. Further, Patent
`Owner argues that Jaeger does not disclose a plurality of operating system
`probes. Id. at 24. Patent Owner asserts that Jaeger discloses two
`interpreters: one application-independent and another application-specific.
`
`10
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8659 Page 16 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`Id. at 24–25. But according to Patent Owner, “Petitioner readily
`acknowledges” that the application-specific interpreter does not monitor
`subsystems of the operating systems for events. Id. at 25. Thus, the
`“plurality” requirement is not met.
`With regard to the limitation “operating substantially in parallel,”
`Patent Owner contends that it would not have been obvious “to modify”
`Jaeger to do this. Id. at 26−27 (arguing that Petitioner offers no explanation
`why Jaeger uses separate probes and that Petitioner’s argument “is nothing
`more than a solution in search of a problem.”).
`Patent Owner also argues that the Petition conflates the recited
`“event” with the recited “request.” Id. at 29−30. According to Patent
`Owner, “[t]he claims require monitoring subsystems of an operating system
`for events caused from a request made by a downloadable, not using an
`interpreter to monitor the request[s] themselves.” Id. at 29−30.
`
`D. DETERMINATION OF REASONABLE LIKELIHOOD THRESHOLD
`
`Having considered the information presented in the Petition and in the
`Preliminary Response, we are persuaded that Petitioner has demonstrated a
`reasonable likelihood of prevailing on its assertion that claims 1, and 6−10
`of the ’621 patent are unpatentable over Jaeger, alone or in combination with
`TBAV and Arnold, as asserted in the Petition.
`At this juncture, the Petition reasonably maps the limitations of the
`claims to pertinent disclosures in Jaeger for claims 1 and 10. The Petition
`also reasonably maps the limitations recited in dependent claim 6 to TBAV
`and dependent claims 7, 8, and 9 to Arnold, as described above. For the
`
`11
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8660 Page 17 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`proffered combinations, we find that the Petition provides rationales that
`appear reasonable, at this juncture.
`Concerning Patent Owner’s arguments that Jaeger does not disclose a
`plurality of operating system probes operating in parallel, however, we find
`the arguments unpersuasive at this time. First, we note that, even if the
`application-independent interpreter (or browser) were the only interpreter to
`monitor certain subsystems of the operating system, we understand the
`Petition to state that the browser alone may satisfy the limitation of a
`“plurality of operating system probes” operating “in parallel.” For instance,
`Petitioner has alleged that Figure 5 of Jaeger teaches or suggests that the
`browser handles access in parallel to subsystems including “Network
`Service,” “Local Software,” and “Local File.” Pet. 31−32. We have further
`considered, and given weight to, Petitioner’s argument and evidence that
`including a plurality of probes would have been obvious because of the need
`to control the objects that can be used by content to attack the downloading
`principal in Jaeger, and that operating parallel software elements for
`handling parallel tasks was a common practice in computer science in 1996.
`Id. at 32−33 (citing Ex. 1002 ¶¶ 69, 99).
`Finally, we have reviewed Petitioner’s contentions regarding how
`Jaeger teaches or suggests “events” versus “requests,” in light of Patent
`Owner’s arguments. At this juncture, we are persuaded that the Petition
`maps reasonably each element to a corresponding feature of Jaeger that
`shows each limitation is distinct. Claims 1 and 10 recite that the operating
`system probes monitor “a plurality of subsystems of the operating system
`during runtime for an event caused from a request made by a
`downloadable.” Ex. 1001, 21:38−42, 22:28−32 (emphasis added).
`
`12
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8661 Page 18 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`Although Petitioner appears to make no distinction between the two—by
`stating that “Jaeger’s probes handle requests from the executed content (e.g.,
`‘an event caused by a downloadable’) during runtime”—Petitioner also
`states that the Jaeger interpreters receive messages corresponding to an
`event. Pet. 29−30. The event, according to the claim language, must be
`caused by a request. And the event in Jaeger, as we understand the Petition,
`may be a message that is caused by a request or instruction to access a file
`system or network services. Id. It appears, therefore, that Petitioner has
`pointed to, in Jaeger, an event and a request distinct from each other.1
`Accordingly, Patent Owner’s argument to the contrary is not persuasive at
`this time.
`
`
`III. CONCLUSION
`Petitioner has demonstrated a reasonable likelihood of prevailing in
`the contention that claims 1 and 6−10 are unpatentable as asserted in its
`grounds of unpatentability. Accordingly, we institute inter partes review.
`
`
`
`
` 1
`
` We also note that another panel of the Board has determined, with respect
`to the same “event” language recited in the ’962 patent, that Jaeger discloses
`an event (Jaeger’s accesses to system objects) that results from a request
`from a Downloadable (Jaeger’s call made by downloaded content). Ex.
`1016, 6.
`
`13
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8662 Page 19 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`
`IV. ORDER
`It is ORDERED that the Petition is granted and that inter partes
`review is instituted for claims 1 and 6−10 according to the following
`grounds; and
`Claims
`1 and 10
`6
`7−9
`
`FURTHER ORDERED that pursuant to 35 U.S.C. § 314(a), inter
`partes review of the ’621 patent is hereby instituted with trial commencing
`on the entry date of this decision, and pursuant to 35 U.S.C. § 314(c) and 37
`C.F.R. § 42.4, notice is hereby given of the institution of trial.
`
`Reference(s)
`Jaeger
`Jaeger and TBAV
`Jaeger and Arnold
`
`Basis
`§ 103
`§ 103
`§ 103
`
`14
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8663 Page 20 of 274
`
`IPR2017-00995
`Patent 9,189,621 B2
`
`PETITIONER:
`Mike Rosato (Lead Counsel)
`Andrew S. Brown
`WILSON SONSINI GOODRICH & ROSATI
`mrosato@wsgr.com
`asbrown@wsgr.com
`
`
`
`PATENT OWNER:
`
`James Hannah
`Jeffrey H. Price
`Michael Lee
`Shannon Hedvat
`KRAMER LEVIN NAFTALIS & FRANKEL LLP
`jhannah@kramerlevin.com
`jprice@kramerlevin.com
`mhlee@karamerlevin.com
`shedvat@kramerlevin.com
`
`
`
`15
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8664 Page 21 of 274
`
`
`
`
`
`EXHIBIT 2
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8665 Page 22 of 274
`
`Trials@uspto.gov
`571-272-7822
`
`
`Paper 7
`Entered: September 5, 2017
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`BLUE COAT SYSTEMS LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2017-00997
`Patent 9,219,755 B2
`
`____________
`
`
`
`Before, THOMAS L. GIANNETTI, MIRIAM L. QUINN, and SHEILA F.
`McSHANE Administrative Patent Judges.
`
`QUINN, Administrative Patent Judge.
`
`
`
`DECISION
`Denying Institution of Inter Partes Review
`37 C.F.R. § 42.108
`
`
`
`
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8666 Page 23 of 274
`
`IPR2017-00997
`Patent 9,219,755 B2
`
`
`Blue Coat Systems LLC (“Petitioner”) filed a Petition to institute inter
`partes review of claims 1−8 of U.S. Patent No. 9,219,755 B2 (“the
`’755 patent”) pursuant to 35 U.S.C. §§ 311−319. Paper 2 (“Pet.”). Finjan,
`Inc. (“Patent Owner”) timely filed a Preliminary Response. Paper 6
`(“Prelim. Resp.”). We have authority under 35 U.S.C. § 314.
`For the reasons that follow, we deny inter partes review.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies the ʼ755 patent as the subject matter of the district
`court case pending in the U.S. District Court for the Northern District of
`California (Case No. 5:15-cv-03295-BLF). Pet. 19; Paper 4, 1.
`
`B. THE ’755 PATENT (EX. 1001)
`
`The ’755 patent is titled “Malicious Mobile Code Runtime Monitoring
`Systems and Methods.” Ex. 1001, [54]. The ’755 patent is related to many
`filed applications (id. at [60]) and incorporates by reference U.S. Patent No.
`6,480,962. Id. at 1:54−59; Ex. 1013 (“the ’962 patent”). The ’962 patent
`describes a security system, for protecting a client during runtime from
`hostile downloadables, as follows:
`A system protects a client from hostile Downloadables.
`The system includes security rules defining suspicious
`actions and security policies defining the appropriate
`responsive actions to rule violations. The system includes
`an interface for receiving incoming Downloadable and
`requests made by the Downloadable. The system still
`further includes a comparator coupled to the interface for
`examining the Downloadable, requests made by the
`Downloadable and runtime events to determine whether a
`
`2
`
`

`

`Case 3:17-cv-00183-CAB-BGS Document 190 Filed 10/25/17 PageID.8667 Page 24 of 274
`
`IPR2017-00997
`Patent 9,219,755 B2
`
`
`security policy has been violated, and a response engine
`coupled to the comparator for performing a violation-
`based responsive action.
`
`
`Ex. 1013, Abs. More particularly, the ’962 patent illustrates an embodiment
`of the security system in Figure 3, reproduced below.
`
`
`
`
`
`Figure 3 illustrates security system 135a including Java class
`extensions 304, each managing a respective Java class 302, and further
`including operating system probes 310, 312, 314, and 316, each recognizing
`applet instructions sent to the various operating subsystems: file system
`265, network system 270, process system 275, and memory system 280. Id.
`at 3:52−4:31. For example, a file system probe 310 recognizes an applet
`instruction sent to file system 265 and sends a message to inform event
`router 308. Id. Event router 308 forwards the message to the user via a
`Graphical User Interface (GUI), to