Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 1 of 21 PageID #: 5943
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF DELAWARE
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`Plaintiff,
`
`Defendants.
`
`
`
`
`
`C.A. No. 18-1519 (MN)
`
`FINJAN, INC.,
`
`
`
`
`
`RAPID7, INC., et al.,
`
`
`
`
`
`v.
`
`
`
`
`
`
`
`MEMORANDUM ORDER
`
`At Wilmington this 5th day of February 2020:
`
`IT IS HEREBY ORDERED that the claim terms of U.S. Patent Nos. 8,677,494
`
`
`
`
`
`
`
`
`(“’494 Patent”), 8,079,086 (“’086 Patent”), 7,975,305 (“’305 Patent”), and 7,613,918
`
`(“’918 Patent”) with agreed-upon constructions are construed as follows (see D.I. 116 at
`
`Exhibit 1):
`
`1.
`
`2.
`
`3.
`
`4.
`
`5.
`
`6.
`
`“Downloadable[s]” means “an executable application program, which is
`downloaded from a source computer and run on a destination computer”
`(’494 Patent, claim 10; ’086 Patent, claims 1, 17, 41, & 42);
`
`“Destination computer” means “separate computer receiving the [appended
`downloadable / Downloadable and a representation of the Downloadable
`security profile data]” (’086 Patent, claims 1, 17, 24, 41, & 42);
`
`“Database” means “a collection of interrelated data organized according to
`a database schema to serve one or more applications” (’494 Patent, claim
`10; ’305 Patent, claims 1, 13, & 25; ’086 Patent, claims 41 & 42);
`
`“Parse tree” means “a hierarchical structure of interconnected nodes built
`from scanned content” (‘408 Patent, claims 1, 22, & 35);
`
`“Code-A” means “potentially malicious executable code” (’918 Patent,
`claims, 1, 12, 22, 28, & 33);
`
`“Code-B” means “executable wrapper code” (’918 Patent, claims 1, 22, 28,
`& 33);
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 2 of 21 PageID #: 5944
`
`7.
`
`8.
`
`“Code-C” means “combined code” (’918 Patent, claims 1, 12, 22, 28, &
`33); and
`
`“Security context” means “an environment in which a software application
`is run, which may limit resources that the application is permitted to access
`or operations that the application is permitted to perform” (’918 Patent,
`claims 1, 12, 22, 28, & 33).
`
`
`
`Further, as announced at the hearing on January 22, 2020, IT IS HEREBY ORDERED that
`
`the disputed claim terms of the ’494 Patent, ’086 Patent, ’305 Patent, ’918 Patent, and U.S. Patent
`
`Nos. 8,141,154 (“’154 Patent”) and 8,225,408 (“’408 Patent”) are construed as follows:
`
`1.
`
`2.
`
`3.
`
`4.
`
`5.
`
`6.
`
`7.
`
`8.
`
`9.
`
`“Downloadable scanner” means “software that decomposes code using
`conventional parsing techniques to identify suspicious patterns or
`suspicious computer operations” (’494 Patent, claim 10; ’086 Patent, claim
`24);
`
`“list of suspicious computer operations [that may be attempted by]” means
`“list of computer operations derived from a received Downloadable that are
`deemed hostile or potentially hostile” (’494 Patent, claim 10; ’086 Patent,
`claims 1, 17, 24, 41, & 42);
`
`“appended Downloadable” means “downloadable with a representation of
`the Downloadable security profile data attached” (’086 Patent, claim 1);
`
`“first function” / “second function” shall have its plain and ordinary
`meaning and no construction is necessary (’154 Patent, claims 1, 4, 6, &
`10);
`
`“content processor” means “a processor that processes content” (’154
`Patent, claims 1 & 6);
`
`“a call to a first function” means “a statement or instruction in the content,
`the execution of which causes the function to provide a service” (’154
`Patent, claims 1, 4, 6, & 10);
`
`“a rule-based content scanner” means “a scanner that is able to adapt itself
`dynamically to scan a specific type of content” (’305 Patent, claim 1);
`
`“patterns of types of tokens” means “patterns of categories of tokens” (’305
`Patent, claims 1, 13, & 25);
`
`“scanner” means “a scanner that is able to adapt itself dynamically to scan
`a specific type of content” (’408 Patent, claims 1 & 22);
`
`2
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 3 of 21 PageID #: 5945
`
`10.
`
`11.
`
`12.
`
`13.
`
`14.
`
`15.
`
`16.
`
`“parser rules” means “patterns of tokens that form syntactical constructs of
`program code” (’408 Patent, claims 1 & 22);
`
`“dynamically building” shall have its plain and ordinary meaning, “non-
`static building” (’408 Patent, claims 1, 22, 29, & 35);
`
`“dynamically detecting” shall have its plain and ordinary meaning, “non-
`static detecting” (’408 Patent, claims 1, 22, 29, & 35);
`
`“incoming stream of program code” shall have its plain and ordinary
`meaning (’408 Patent, claims 1, 22, 29, & 35);
`
`“instantiating, by the computer, a scanner for the specific programming
`language / instantiating a scanner for the specific programming language”
`means “generating or requesting a scanner that can scan the specific
`programming language” (’408 Patent, claims 1 & 22);
`
`“executable wrapper code / wrapper executable code” means “executable
`code that wraps another executable” (’918 Patent, claims 1, 12, 22, 28, &
`33);
`
`“computer account(s)” shall have its plain and ordinary meaning, “computer
`account(s)” (’918 Patent, claims, 1, 12, 22, 28, & 33);
`
`17.
`
`“combining” / “combine” shall have its plain and ordinary meaning (’918
`Patent, claim 1).
`
`The parties briefed the issues (see D.I. 76) and submitted an appendix that included briefing
`
`and orders from numerous related cases and proceedings (see D.I. 77). The parties also submitted
`
`a Joint Claim Construction Chart containing intrinsic evidence (see D.I. 55-58). The Court
`
`carefully reviewed all submissions in connection with the parties’ contentions regarding the
`
`disputed claim terms, heard oral argument (see D.I. 118, 121), and applied the following legal
`
`standards in reaching its decision.
`
`LEGAL STANDARDS
`
`“[T]he ultimate question of the proper construction of the patent [is] a question of law,”
`
`although subsidiary fact-finding is sometimes necessary. Teva Pharms. USA, Inc. v. Sandoz, Inc.,
`
`574 U.S. 318, 325-27 (2015). “[T]he words of a claim are generally given their ordinary and
`
`3
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 4 of 21 PageID #: 5946
`
`customary meaning [which is] the meaning that the term would have to a person of ordinary skill
`
`in the art in question at the time of the invention, i.e., as of the effective filing date of the patent
`
`application.” Phillips v. AWH Corp., 415 F.3d 1303, 1312-13 (Fed. Cir. 2005) (en banc) (internal
`
`citations and quotation marks omitted). Although “the claims themselves provide substantial
`
`guidance as to the meaning of particular claim terms,” the context of the surrounding words of the
`
`claim also must be considered. Id. at 1314. “[T]he ordinary meaning of a claim term is its meaning
`
`to the ordinary artisan after reading the entire patent.” Id. at 1321 (internal quotation marks
`
`omitted).
`
`The patent specification “is always highly relevant to the claim construction analysis . . .
`
`[as] it is the single best guide to the meaning of a disputed term.” Vitronics Corp. v. Conceptronic,
`
`Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996). It is also possible that “the specification may reveal a
`
`special definition given to a claim term by the patentee that differs from the meaning it would
`
`otherwise possess. In such cases, the inventor’s lexicography governs.” Phillips, 415 F.3d at
`
`1316. “Even when the specification describes only a single embodiment, [however,] the claims of
`
`the patent will not be read restrictively unless the patentee has demonstrated a clear intention to
`
`limit the claim scope using words or expressions of manifest exclusion or restriction.” Hill-Rom
`
`Servs., Inc. v. Stryker Corp., 755 F.3d 1367, 1372 (Fed. Cir. 2014) (internal quotation marks
`
`omitted) (quoting Liebel-Flarsheim Co. v. Medrad, Inc., 358 F.3d 898, 906 (Fed. Cir. 2004)).
`
`In addition to the specification, a court “should also consider the patent’s prosecution
`
`history, if it is in evidence.” Markman v. Westview Instruments, Inc., 52 F.3d 967, 980 (Fed. Cir.
`
`1995) (en banc), aff’d, 517 U.S. 370 (1996). The prosecution history, which is “intrinsic evidence,
`
`. . . consists of the complete record of the proceedings before the [Patent and Trademark Office]
`
`and includes the prior art cited during the examination of the patent.” Phillips, 415 F.3d at 1317.
`
`4
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 5 of 21 PageID #: 5947
`
`“[T]he prosecution history can often inform the meaning of the claim language by demonstrating
`
`how the inventor understood the invention and whether the inventor limited the invention in the
`
`course of prosecution, making the claim scope narrower than it would otherwise be.” Id.
`
`In some cases, courts “will need to look beyond the patent’s intrinsic evidence and to
`
`consult extrinsic evidence in order to understand, for example, the background science or the
`
`meaning of a term in the relevant art during the relevant time period.” Teva, 574 U.S. at 331.
`
`Extrinsic evidence “consists of all evidence external to the patent and prosecution history,
`
`including expert and inventor testimony, dictionaries, and learned treatises.” Markman, 52 F.3d
`
`at 980. Expert testimony can be useful “to ensure that the court’s understanding of the technical
`
`aspects of the patent is consistent with that of a person of skill in the art, or to establish that a
`
`particular term in the patent or the prior art has a particular meaning in the pertinent field.”
`
`Phillips, 415 F.3d at 1318. Nonetheless, courts must not lose sight of the fact that “expert reports
`
`and testimony [are] generated at the time of and for the purpose of litigation and thus can suffer
`
`from bias that is not present in intrinsic evidence.” Id. Overall, although extrinsic evidence “may
`
`be useful to the court,” it is “less reliable” than intrinsic evidence, and its consideration “is unlikely
`
`to result in a reliable interpretation of patent claim scope unless considered in the context of the
`
`intrinsic evidence.” Id. at 1318-19. Where the intrinsic record unambiguously describes the scope
`
`of the patented invention, reliance on any extrinsic evidence is improper. See Pitney Bowes, Inc.
`
`v. Hewlett-Packard Co., 182 F.3d 1298, 1308 (Fed. Cir. 1999) (citing Vitronics, 90 F.3d at 1583).
`
`I.
`
`THE COURT’S RULING
`
`The Court’s rulings regarding the disputed claim terms of the ’494, ’086, ’305, ’918, ’154,
`
`and ’408 Patents were announced from the bench at the hearing as follows:
`
`Before we start[], I wanted to give you my rulings on terms that we
`argued last week. So in this case, we have six patents and nineteen
`
`5
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 6 of 21 PageID #: 5948
`
`disputed terms. We heard argument on nine disputed terms in four
`of the patents last week [– U.S. Patent Nos. 8,677,494 (“’494
`Patent”), 8,079,086 (“’086 Patent”), 8,141,154 (“’154 Patent”), and
`7,613,918 (“’918 Patent”) –] and will hear argument on the
`remaining terms here today. I did see your letter this morning, that
`you were withdrawing the terms “function type” in the ’305 Patent
`and “analyzer rules” in the ’408 Patent. Thank you for that. I
`appreciate the efforts.
`
`. . . [First,] I want to rule on the nine disputes addressed last week.
`I will not be issuing a written opinion, but I will issue an order
`stating my rulings. I want to emphasize before I announce my
`decisions that while I am not issuing a written opinion, we have
`followed a full and thorough process before making the decisions I
`am about to state. I have reviewed each of the patents in dispute.
`There was full briefing on each of the disputed terms. There was an
`extensive appendix that included briefing and orders from numerous
`related cases and proceedings and there was argument here last
`week. All of that has been carefully considered.
`
`Now as to my rulings. I am not going to read into the record my
`understanding of claim construction law generally. I have a legal
`standard section that I have included in earlier opinions, including
`recently in Waters Corporation v. Agilent Technologies, Inc.,
`C.A. No. 18-1450. I incorporate that law and adopt it into my ruling
`today and will also set it out in the order that I issue.
`
`As to the person of skill in the art, neither party has asserted that
`there are any relevant differences in their proposed definitions of a
`person of ordinary skill in the art that would be relevant to these
`proceedings.
`
`Now the disputed terms:
`
`The first term is “Downloadable scanner” in claim 10 of the ’494
`Patent and claim 24 of the ’086 Patent. Plaintiff asserts that the term
`should have its ordinary meaning, which it states is “scanner for
`scanning Downloadables.” Defendants construe the term to mean
`“software that decomposes code using conventional parsing
`techniques to identify suspicious patterns or suspicion computer
`operations.”
`
`There are two differences in their constructions. At argument last
`week, Plaintiff agreed
`that
`the claimed
`scanner
`scans
`
`6
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 7 of 21 PageID #: 5949
`
`identify suspicion patterns or suspicious
`to
`Downloadables
`computer operations. In fact, language to that effect is included in
`claim 10 already and the concept is included in claim 24. And
`Plaintiff acquiesced to including that language in the term
`“Downloadable scanner” in the prior Cisco case. Thus, the dispute
`here appears to be over whether the scanner “decomposes code
`using conventional parsing techniques.”
`
`Here, I will agree with Defendants and construe the term to mean
`“software that decomposes code using conventional parsing
`techniques to identify suspicious patterns or suspicious computer
`operations.” The Federal Circuit previously addressed this term,
`stating that “[t]he Downloadable scanner in claim 10 is a code
`scanner that generates the DSP data by decomposing the code using
`conventional parsing techniques. The code scanner identifies
`suspicious computer operations in the Downloadable code and lists
`them as DSP data. Finally, the DSP data for the Downloadable is
`stored in a database.” [Palo Alto Networks, Inc. v. Finjan, Inc.,
`777 F. App’x 501, 503 (Fed. Cir. 2019).] It is the first sentence of
`that holding that Defendants rely on for their construction.
`
`Plaintiff says that those statements are merely background and do
`not address the issue here. I disagree that those are merely
`background or are irrelevant. Although the Federal Circuit did not
`set forth its reasoning, it stated what the “Downloadable scanner” is
`and relied on that in upholding the PTAB decision that the claims at
`issue were not unpatentable over the prior art.
`
`Moreover, Plaintiff’s position is that anything that meets the
`language following “Downloadable scanner” in claim 10 is a
`“scanner.” During the PTAB proceedings, the PTAB rejected that
`position. The Petitioner had argued that the prior art had an emulator
`that carried out the same function as the scanner in claim 10. The
`PTAB found that “the fact that [the prior art’s] emulator might serve
`the recited function of ‘deriving the security profile data for the
`Downloadable’. . . does not establish that a person of ordinary skill
`in the art would understand it to teach or suggest a ‘scanner.’” The
`Federal Circuit affirmed this, effectively rejecting the position
`Plaintiff offers here. [Id. at 505-06.]
`
`And the Federal Circuit’s statements are supported by the intrinsic
`evidence. The written descriptions of the ’494 Patent and the
`’086 Patent do not include disclosure of a “Downloadable scanner,”
`but the ’194 Patent specification is incorporated by reference in the
`
`7
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 8 of 21 PageID #: 5950
`
`’494 Patent and discloses a “code scanner.” [’194 Patent at col. 7,
`l. 55.] The same is true of the ’086 Patent. [’086 Patent at col. 2, ll.
`5-11.] At column 5, lines 42 through 48, the ’194 Patent explains
`“the code scanner 325 uses conventional parsing techniques to
`decompose the code (including all prefetched components) of the
`Downloadable into the DSP data 310.” It then continues, stating
`that the code scanner may generate DSP data that includes
`suspicious computer operations and that a code scanner “may search
`the code for any pattern, which is undesirable or suggests that the
`code was written by a hacker.” [’194 Patent at col. 5, ll. 50-57.]
`Similarly, the code scanner is referenced in column 9 of the
`’194 Patent.
`
`Plaintiff says that these are simply embodiments, but they are the
`only embodiments disclosed in the patent.
`
`Finjan asserts that the proposed construction cannot be correct
`because the ’494 and ’086 Patents have examples of Downloadables
`that are
`in “machine
`language,” which
`is “not
`typically
`‘decompose[d] using conventional parsing techniques.’” For that,
`Finjan cites to the Abstract of the two patents as well as claims of
`those patents. Finjan, however, fails to explain or support that
`assertion - relying solely on one sentence of conclusory attorney
`argument in their brief that does not negate my conclusion that my
`construction is supported by the intrinsic evidence.
`
`The second term is “list of suspicious computer operations [that may
`be attempted by]” in claim 10 of the ’494 Patent and claims 1, 17,
`24, 41, and 42 of the ’086 Patent. Plaintiff construe[s] this term to
`mean “list of computer operations that are deemed hostile or
`potentially hostile.” Defendants construe it to mean “list of
`computer operations in a received Downloadable that are deemed
`hostile or potentially hostile.”
`
`The crux of this dispute is Defendants’ proposed addition of the
`words “in a received Downloadable.” In particular, the issue is
`whether the “suspicious computer operations” to be included on the
`list must be operations found within the Downloadable as opposed
`to derived from the Downloadable.
`
`Here I agree with Plaintiff that the list must only be derived from
`data in the Downloadable.
`
`8
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 9 of 21 PageID #: 5951
`
`So, I will construe it to mean “list of computer operations derived
`from a received Downloadable that are deemed hostile or potentially
`hostile.”
`
`This [is] supported by the intrinsic evidence. First, the claim
`language itself. It requires deriving security data for the
`Downloadable, including the list that is at issue. The language
`requires that this list include operations that the Downloadable may
`perform, but it does not specify that those operations must all be
`found in the Downloadable rather than, for example, operations that
`are known to be used by a given source that has been identified for
`the received Downloadable.
`
`Additionally, nothing in the specification of the ’494 or ’086 Patents
`or the ’194 Patent requires the operations to be in the Downloadable.
`At argument, there was discussion of the two lists referenced in the
`’194 Patent. But there is no real dispute that the list referenced in
`the claims is the “short list.”
`
`Additionally, the ’194 specification supports this construction. For
`example, the Downloadable security profile data, which includes the
`list at issue, is derived specifically for the Downloadable received.
`The specification says that the Downloadable’s derived security
`profile data can then be compared against “the access control list,”
`which “contains criteria indicating whether to pass or fail the
`Downloadable.” [See ’194 Patent at col. 6, ll. 13-20.] While this
`pass-fail step is not itself recited or reached in claim 10, it illustrates
`that the “list of suspicious computer operations” generated is limited
`to a specific Downloadable - the one received. It doesn’t, however,
`require that the list be operations found in the Downloadable – just
`that they be derived from it.
`
`And there are additional statements in the specification, such as the
`discussion of “known Downloadables” in column 4[, lines 29-40,]
`of the ’194 Patent, that suggest information about the operations a
`Downloadable may perform may come from other attributes, such
`as whether they were previously received or their source. [See also
`’194 Patent at col. 6, ll. 37-47.]
`
`The third term is “appended Downloadable” in claim 1 of the ’086
`Patent. Plaintiff construes this term to have its “plain and ordinary
`meaning, which is ‘a Downloadable with data attached to it.’”
`Defendants construe
`it
`to mean “a Downloadable with a
`
`9
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 10 of 21 PageID #: 5952
`
`representation of the Downloadable security profile data attached to
`the end of the Downloadable.”
`
`There are two differences in language proposed, but the dispute here
`really is whether the “to the end” language proposed by Defendants
`is appropriate.
`
`This dispute turns on the meaning of the word “append” and whether
`that requires attachment anywhere or attachment “to the end.” Here
`I construe this term to mean a “Downloadable with a representation
`of the Downloadable security profile data attached.” To be clear,
`the attachment need not be at the end.
`
`Initially, I note that the patent does not use the word “append” in the
`written description. That word only appears in the claims.
`
`The parties have each submitted proposed dictionary definitions of
`“append.” Some require attachment at the end and some do not.
`Given that at least one of these definitions defines “append” to mean
`“attach” or “affix” without requiring the attachment be at the end[,
`see Append, Webster’s Pocket Computer Dictionary of the English
`Language (New Revised ed. 1997) (“append: To add, as a
`supplement.”),] I will not read that limitation into the term absent
`clear intent by the patentee to do so or disclaimer.
`
`Here, I do not find any such intent or clear disclaimer. Indeed, it
`appears that the specification of the ’086 Patent includes an
`embodiment in which the security profile data is sequenced before
`the Downloadable in the appended file - and thus it is not necessarily
`attached at the end. [’086 Patent at col. 11, ll. 16-26 (“by
`concatenating, within sandboxed package 340, MPC 341 for
`delivery to a Downloadable-destination first, followed by protection
`policies 342 and Downloadable 343”).]
`
`The fourth term is “first function” / “second function” in claims 1,
`4, 6, and 10 of the ’154 Patent. Plaintiff asserts that this term should
`have its plain and ordinary meaning and no construction is
`necessary. Defendants construe the term to mean “substitute
`function/original function, which is different than the first function.”
`
`The parties’ dispute concerning this term is whether the “first
`function” and “second function” can be the same function.
`
`This term has been the subject of more than one prior decision. And
`different courts have come out different ways. I, however, am going
`
`10
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 11 of 21 PageID #: 5953
`
`to construe it according to its ordinary meaning. To be clear, I do
`not construe it to require that the first and second functions be
`different.
`
`This is supported by the intrinsic evidence. There is nothing in the
`claims of the ’154 Patent that requires the two functions to be
`different - or precludes the two from using the same function.
`
`Defendants rely on the specification language that describes the
`“original” and “substitute” functions and says that “[t]o enable the
`client computer to pass function inputs to the security computer and
`suspend processing of content pending replies from the security
`computer, the present invention operates by replacing original
`function calls with substitute function calls within the content, at a
`gateway computer, prior to the content being received at the client
`computer.” [’154 Patent at col. 4, ll. 55-60.]
`
`Defendants contend that the specification would not have described
`the functions as “original” and “substitute” functions if those
`functions were identical.
`
`But other related patents use the terms “original” and “substitute” in
`the claims and the ’154 Patent does not. And other places in the
`’154 Patent refer generally to the “first function” and “second
`function” without referencing “substitute” or “original” function.
`[See, e.g., ’154 Patent at col. 7, ll. 32-43.]
`
`Defendants also point to the Federal Circuit’s decision in Palo Alto
`Networks, but I do not read that decision as being inconsistent with
`Plaintiff’s proposal. The Federal Circuit noted that “each [claim]
`recit[es] a system or software program that executes a substitute
`function. The substitute function inspects the input to an original
`function to determine if executing the original function with the
`input violates a security policy.” The “‘first function’ is the
`inspection step in which the content is assessed for safety, and the
`‘second function’ is when, having been deemed safe, the content is
`actually run.” [Palo Alto Networks, Inc. v. Finjan, Inc., 752 F.
`App’x 1017, 1018 (Fed. Cir. 2018).]
`
`Although it does use the terms “substitute” and “original,” I do not
`read those statements as requiring that the first and second
`function[s] be different.
`
`11
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 12 of 21 PageID #: 5954
`
`Accordingly, I conclude that the specification does not support
`Defendants’ argument that the first and second functions must be
`different. The term’s plain and ordinary meaning governs, and no
`construction is necessary. [See Phillips, 415 F.3d at 1312 (“[T]he
`words of a claim are generally given their ordinary and customary
`meaning.”).]
`
`Next, the fifth term, is “content processor” in claims 1 and 6 of the
`’154 Patent. Plaintiff asserts the term should have its plain and
`ordinary meaning, i.e., “a processor that processes content.”
`Defendants construe the term to mean “a processor that processes
`modified content.”
`
`The dispute is over the addition of the [word] “modified” in
`Defendants’ construction. Initially, I note that multiple courts have
`already construed this term to be governed by its plain and ordinary
`meaning – though none of those courts addressed the addition of the
`word “modified” that Defendants argue for here. [See e.g., Finjan,
`Inc. v. Proofpoint, Inc., No. 4:13-cv-05808-HSG, Dkt. No. 267, at
`18 (N.D. Cal. Dec. 3, 2015) (“[T]he term [‘content processor’] does
`not require any construction beyond its plain and ordinary
`meaning.”); Finjan, Inc. v. Symantec Corp., No. 4:14-cv-02998-
`HSG, Dkt. No. 170, at 18 (N.D. Cal. Feb. 10, 2017) (“Accordingly,
`the Court finds that ‘content processor’ should be given its plain and
`ordinary meaning . . . .”); Finjan, Inc. v. Bitdefender Inc., No. 4:17-
`cv-04790-HSG, Dkt. No. 101, at 21 (N.D. Cal. Feb. 14, 2019) (“In
`turn, the Court again finds that no construction is necessary for this
`term and that ‘content processor’ has sufficiently specific structure
`based on the claim language and specification.”).]
`
`Defendants’ argument is based largely on the same arguments it
`made in connection with the “first function” and “second function”
`terms. They argue that the Federal Circuit stated that asserted claims
`of the ’154 Patent “recit[e] a system or software program that
`executes a substitute function,” which is the claimed “first
`function.” [Palo Alto Networks, 752 F. App’x at 2018.] They assert
`that this call to a substitute function only exists after the original
`content is modified at a gateway device to include it. [’154 Patent
`at col. 9, ll. 13-28 (“Content modifier 265 preferably modifies
`original content received by gateway computer 205, and produces
`modified content, which includes a layer of protection to combat
`dynamically generated malicious code.”).] Thus, Defendants argue
`that the claimed “content” received by the claimed “content
`
`12
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 13 of 21 PageID #: 5955
`
`processor” is necessarily modified content since the claims require
`it to “includ[e] a call to a first function.”
`
`[Defendants’] argument boils down to stating that the content must
`be modified because the first and second function[s] must be
`different. I have, however, already rejected that position.
`
`In addition, I note that near the end of prosecution, Finjan [amended]
`claim 2 to remove the reference to “modified” content, because there
`was no antecedent basis for “modified content.” [October 5, 2011
`Amendment and Response to Office Action at 138.] And claims of
`the ’289 Patent include an express requirement that the content is
`modified. [See, e.g., ’289 Patent at cl. 2 (“modifying the content”);
`id. at cl. 10 (“transmitting the modified content”).] The inclusion of
`this limitation in ’289 Patent claims confirms it should not be read
`into the claims of the ’154 Patent that do not include (and, in fact,
`removed) this limitation. [See Andersen Corp. v. Fiber Composites,
`LLC, 474 F.3d 1361, 1369 (Fed. Cir. 2007).]
`
`The sixth term is “a call to a first function” in claims 1, 4, 6, and 10
`of the ’154 Patent. Plaintiff originally asserted that it has its plain
`and ordinary meaning, which is “a call to a first function.”
`Defendants construe it to mean “a statement or instruction in the
`content, the execution of which causes the function to provide a
`service.” During the argument last week, Plaintiff agreed to
`Defendants’ proposed construction. I will
`thus adopt
`that
`construction.
`
`The seventh term is “executable wrapper code” and “wrapper
`executable code” in claims 1, 12, 22, 28, and 33 of the ’918 Patent.
`Plaintiff asserts this term should have its plain and ordinary
`meaning, that is, “code that wraps an executable.” Defendants assert
`the term means “standalone executable file including appropriate
`computer account instructions and the byte address of potentially
`malicious executable code to be embedded therein.”
`
`I will construe it to mean “executable code that wraps another
`executable.”
`
`This construction is supported by the claim language itself. The
`parties agree that the two iterations of this term, i.e., “executable
`wrapper code” and “wrapper executable code,” mean the same
`thing. The plain words of “wrapper executable code” refer to
`executable code that serves as a wrapper.
`
`13
`
`

`

`Case 1:18-cv-01519-MN Document 123 Filed 02/05/20 Page 14 of 21 PageID #: 5956
`
`This construction is also supported by the specification. The only
`reference to what this wrapper code is refers to it as an executable.
`The specification states: “CODE-B is preferably a standalone
`executable file, which includes appropriate computer instructions to
`initiate a new process using a specified user/group computer account
`name.” [’918 Patent at col. 7, ll. 63-66.] I recognize that that is in
`a preferred embodiment, but that embodiment refers to standalone
`executable code. I am not reading in standalone from the
`embodiment. But in light of the clear claim language, and the lack
`of embodiments in which the wrapper code is not executable, I will
`construe the term to mean “executable code that wraps another
`executable.”
`
`The eighth term is “computer account(s)” in claims 1, 12, 22, 28,
`and 33 of the ’918 Patent. Here again, Plaintiff asserts “plain and
`ordinary meaning, which is ‘computer account(s).’” Defendants
`assert that this term means “user accounts for logging in to a specific
`client computer.”
`
`Plaintiff asserts that the term is “a well-known term that people use
`every day” and, thus, there is no reason to depart from this plain and
`ordinary meaning in the absence of lexicography or a clear
`disclaimer. [See D.I. 76 at 68 (citing Thorner v. Sony Comput.
`Entm’t America LLC, 669 F.3d 1362, 1365-66 (Fed. Cir. 2012)).]
`
`Defendants assert that during prosecution, in the December 23, 2008
`Amendment, Plaintiff gave an express definition for this term in
`overcoming a prior art rejection. Specifically, the patentee stated
`that “the computer accounts of the claimed invention are user
`accounts for logging in to a specific client computer, such as the
`“system,” “restricted user” and “YBITZHAK” accounts. They then
`distinguished accounts in the prior art that were set up for “logging
`in to server computers.” [Id. at 22.]
`
`I do not read this language to be a definition that restricts the
`computer accounts to only one computer. And I do not find it to be
`a clear and unambiguous disavowal of accounts that may be
`available on different computers. Thus, I will give this term