Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Filed on behalf of Symantec Corporation
`By:
`Joseph J. Richetti
`Bryan Cave LLP
`1290 Avenue of the Americas
`New York, NY 10104
`Tel: (212) 541-2000
`Fax: (212) 541-4630
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`SYMANTEC CORP.
`Petitioner
`
`v.
`
`FINJAN, INC.
`Patent Owner
`
`Case: To Be Assigned
`U.S. Patent No. 8,141,154
`
`PETITION FOR INTER PARTES REVIEW
`PURSUANT TO 37 C.F.R. §42.100 et seq.
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`TABLE OF CONTENTS
`
`I.
`
`II.
`
`MANDATORY NOTICES (37 C.F.R. § 42.8)...............................................1
`
`GROUNDS FOR STANDING (37 C.F.R. § 42.104(a)).................................2
`
`III.
`
`IDENTIFICATION OF CHALLENGE (37 C.F.R. § 42.104(b))...................2
`
`A.
`
`B.
`
`C.
`
`D.
`
`Claims for Which Review Is Requested ...............................................2
`
`Priority Date of the ‘154 Patent.............................................................2
`
`The Specific Art on Which the Challenge Is Based..............................5
`
`The Statutory Grounds on Which the Challenge Is Based....................7
`
`IV. OVERVIEW OF THE ‘154 PATENT ............................................................7
`
`A.
`
`B.
`
`The Specification...................................................................................7
`
`The Challenged Claims .......................................................................11
`
`V.
`
`LEVEL OF ORDINARY SKILL..................................................................14
`
`VI. CLAIM CONSTRUCTIONS ........................................................................14
`
`A.
`
`“dynamically generate[d]” ..................................................................14
`
`VII. GROUNDS OF UNPATENTABILITY........................................................15
`
`A.
`
`Ground 1: Claims 1-5 are Anticipated by Ross Under 35 U.S.C. §
`102(e)...................................................................................................15
`
`1.
`
`Ross Anticipates Independent Claims 1 and 4 .........................17
`
`a.
`
`b.
`
`c.
`
`Ross discloses a system for protecting a computer
`from dynamically generated malicious content (1[P])....17
`
`Ross discloses a computer-readable storage medium
`(4[P]).................................................................................18
`
`Ross discloses [a content processor for] processing
`content received over a network, the content including
`a call to a first function including an input (1[A], 4[A])..18
`
`i
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`d.
`
`e.
`
`f.
`
`g.
`
`h.
`
`Ross discloses [a transmitter for] transmitting the
`input [to a security computer/for inspection], when the
`first function is invoked (1[C], 4[C])................................20
`
`Ross discloses suspending processing of the content
`(4[D]) ................................................................................22
`
`Ross discloses [a receiver for] receiving an indicator of
`whether it is safe to invoke a second function with the
`input (1[E1], 4[E1]) ..........................................................23
`
`Ross discloses resuming processing of the content
`after receiving the indicator (4[F]) ...................................24
`
`Ross discloses invoking the second function with the
`input only if the [security computer/indicator]
`indicates it is safe (1[B1], 4[B1]) .....................................25
`
`2.
`
`3.
`
`Ross anticipates dependent claim 2 ..........................................25
`
`Ross anticipates dependent claims 3 and 5...............................26
`
`B.
`
`Ground 2: Claims 2, 4-8, and 10-11 are rendered obvious by Ross
`under 35 U.S.C. § 103 .........................................................................27
`
`1.
`
`Ross renders obvious independent claims 4, 6, and 10 ............27
`
`a.
`
`b.
`
`c.
`
`d.
`
`e.
`
`Ross teaches limitations 4[Pre, A, B1, C, E1], 6[Pre,
`A, C], and 10[Pre, A, C]. ..................................................30
`
`Ross teaches receiving the modified input variable
`[from the security computer] (6[E2], 10 [E2]) .................30
`
`Ross teaches calling a second function with a modified
`input variable (6[E2], 10[E2]) ..........................................32
`
`Ross teaches modifying the input variable if the
`security computer determines that calling a function
`with the input variable may not be safe (6[G], 10[G])....32
`
`Ross teaches suspending and resuming processing of
`the content (4[D][F], 10[D][F])........................................33
`
`ii
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`C.
`
`D.
`
`2.
`
`3.
`
`Ross renders obvious dependent claims 2 and 7 ......................34
`
`Ross renders obvious dependent claims 5, 8, and 11 ...............35
`
`Ground 3: Claims 9 and 12 are rendered obvious by Ross in view
`of Calder under 35 U.S.C. § 103.........................................................35
`
`Ground 4: Claims 1-12 of the ‘154 Patent are obviated by Calder
`in view of Sirer under 35 U.S.C. § 103...............................................37
`
`1.
`
`Calder in view of Sirer renders obvious independent claims
`1, 4, 6, and 10............................................................................41
`
`a.
`
`b.
`
`c.
`
`d.
`
`e.
`
`f.
`
`g.
`
`Calder teaches a system for protecting a computer
`from dynamically generated malicious content (1[P],
`6[P]) ..................................................................................41
`
`Calder teaches a non-transitory computer-readable
`storage medium storing program code (4[P], 10[P]).......42
`
`Calder teaches [a content processor for] processing
`content received over a network, the content including
`a call to a first function including an input [variable]
`(1[A], 4[A], 6[A], 10[A]) .................................................43
`
`Calder in view of Sirer teaches [a transmitter for]
`transmitting the input [variable] [to a security
`computer] for inspection, when the first function is
`called (1[C], 4[C], 6[C], 10[C])........................................45
`
`Calder in view of Sirer teaches suspending and
`resuming processing of the content (4[D][F][,
`10[D][F])...........................................................................47
`
`Calder in view of Sirer teaches [a receiver for]
`receiving an indicator [from the security computer] of
`whether it is safe to invoke a second function with the
`input (1[E1], 4[E1]) ..........................................................48
`
`Calder teaches invoking the second function with the
`input [variable] only if the [indicator/security
`computer] indicates that such invocation is safe
`(1[B1], 4[B1])...................................................................50
`
`iii
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`h.
`
`i.
`
`j.
`
`Calder in view of Sirer teaches [a receiver for]
`receiving the modified input variable (6[D2], 10 [D2])...51
`
`Calder teaches calling a second function with a
`modified input variable (6[B2], 10[B2]) ..........................52
`
`Calder in view of Sirer teaches modifying the input
`variable if the security computer determines that
`calling a function with the input variable may not be
`safe (6[G], 10[G]) ............................................................53
`
`2.
`
`3.
`
`4.
`
`Calder in view of Sirer render obvious dependent claims 2
`and 7..........................................................................................53
`
`Calder in view of Sirer renders obvious dependent claims 3,
`5, 8, and 11................................................................................54
`
`Calder and Sirer render obvious dependent claims 9 and 12 ...55
`
`VIII. CONCLUSION..............................................................................................58
`
`iv
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`TABLE OF AUTHORITIES
`
`CASES
`
`In re Am. Acad. Of Sci. Tech. Ctr.,
`367 F.3d 1359 (Fed, Cir. 2004) .....................................................................12
`
`Custom Accessories, Inc. v. Jeffrey-Allan Indus., Inc.,
`807 F.2d 955 (Fed. Cir. 1986) .......................................................................11
`
`Finjan, Inc. v. Symantec Corp.
`Case No. 3:14-cv-02998-RS (N.D. CA)..........................................................1
`
`In re Yamamoto,
`740 F.2d 1569 (Fed. Cir. 1984) .....................................................................12
`
`STATUTES AND RULES
`
`35 U.S.C. § 102............................................................................................................
`
`35 U.S.C. § 102(b) .......................................................................................................
`
`35 U.S.C. § 102(e) .......................................................................................................
`
`35 U.S.C. § 103............................................................................................................
`
`37 C.F.R. § 42.8 ...........................................................................................................
`
`37 C.F.R. § 42.100(b) ..................................................................................................
`
`37 C.F.R. § 42.104(a)...................................................................................................
`
`37 C.F.R. § 42.104(b) ..................................................................................................
`
`v
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`EXHIBIT LIST
`
`Description
`U.S. Patent No. 8,141,154 to Gruzman et al.
`
`U.S. Patent Application Publication No. 2007/0113282 to
`Robert F. Ross
`
`U.S. Patent Application Publication No. 2002/0066022 to
`Brad Calder and Andrew A. Chien
`
`Design and implementation of a distributed virtual machine
`for networked computers, by Emin Gun Sirer et al., Associat-
`ed Computing Machinery, December 1999
`
`Exhibit No.
`
`Symantec 1001
`
`Symantec 1002
`
`Symantec 1003
`
`Symantec 1004
`
`Symantec 1005
`
`Declaration of Sylvia Hall-Ellis
`
`Symantec 1006
`
`CV of Sylvia Hall-Ellis
`
`Symantec 1007
`
`ACM Digital Library Portal database
`
`Symantec 1008
`
`MARC record OCLC record number 875003574
`
`Symantec 1009
`
`U.S. Patent No. 8,220,055 to Mark K. Kennedy
`
`Symantec 1010
`
`Declaration of Dr. Jack Davidson
`
`Symantec 1011
`
`CV of Dr. Jack Davidson
`
`Symantec 1012
`
`Symantec 1013
`
`Symantec 1014
`
`Symantec 1015
`
`U.S. Application No. 14/482,434 (original application claims
`priority to the ‘289 Patent)
`
`U.S. Application No. 12/174,592 (original application does
`not claim priority to ‘289 Patent)
`
`‘154 Patent (original application ford not claim priority to the
`‘289 Patent)
`
`U.S. Application No. 12/174,592 (Petition to Accept Uninten-
`tionally Delayed Claim of Priority filed on December 20,
`2011 (denied) and January 25, 2012 (granted)
`
`vi
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Symantec 1016
`
`U.S. Application No. 12/174,592 (applicants’ response and
`amendment filed on July 19, 2011)
`
`Symantec 1017
`
`Complaint for Patent Infringement, Finjan v. WebSense, Inc.
`
`Symantec 1018
`
`Scott and Davidson, “Safe Virtual Execution Using Software
`Dynamic Translation”
`
`vii
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Symantec Corporation (“Petitioner” or “Symantec”) petitions the United
`
`States Patent & Trademark Office (“PTO”) to institute an inter partes review of
`
`claims 1-12 (collectively, the “challenged claims”) of U.S. Patent No. 8,141,154 to
`
`Gruzman et al. (“the ‘154 patent”). According to PTO records, the ‘154 patent is
`
`assigned to Finjan, Inc. (“Finjan” or “Patent Owner”). A copy of the ‘154 patent is
`
`provided as Symantec Exhibit 1001.
`
`MANDATORY NOTICES (37 C.F.R. § 42.8)
`I.
`REAL PARTY IN INTEREST: The real party-in-interest of Petitioner is Sy-
`
`mantec Corporation.
`
`RELATED MATTERS: The ‘154 patent is currently involved in the following
`
`proceeding: Finjan, Inc. v. Symantec Corp., Case No. 3:14-cv-02998-RS (N.D.
`
`CA). Concurrent with the instant petition, Petitioner is also filing petitions re-
`
`questing inter partes review of U.S. Patent Nos.: 8,015,182; 7,930,299; 7,757,289;
`
`and 7,756,996, which are also involved in the foregoing proceeding.
`
`LEAD AND BACKUP COUNSEL:
`
`Lead Counsel
`Joseph J. Richetti
`Reg. No. 47,024
`BRYAN CAVE LLP
`1290 Avenue of the Americas
`New York, NY 10104
`General Tel: (212) 541-2000
`Direct Tel: (212) 541-1092
`Fax:
`(212) 541-4630
`joe.richetti@bryancave.com
`
`Backup Counsel
`Daniel A. Crowe
`Reg. No. 39,644
`BRYAN CAVE LLP
`One Metropolitan Square
`211 N. Broadway, Suite 3600
`St. Louis, MO 63102
`General Tel: (314) 259-2000
`Fax:
`(314) 259-2020
`dacrowe@bryancave.com
`
`1
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`SERVICE INFORMATION: Please direct all correspondence to the lead
`
`counsel as shown above. Petitioner consents to electronic service by email at the
`
`addresses provided above.
`
`II. GROUNDS FOR STANDING (37 C.F.R. § 42.104(a))
`
`The undersigned and Symantec certify that the ‘154 patent is available for
`
`inter partes review and Petitioner is not barred or estopped from requesting inter
`
`partes review of the challenged claims. Petitioner has not filed a civil action chal-
`
`lenging the validity of any claim of the ‘154 patent, and no complaint alleging in-
`
`fringement of the ‘154 patent was served on Petitioner more than a year before the
`
`date of this Petition. The ‘154 patent issued more than nine months prior to the fil-
`
`ing of this Petition.
`
`III.
`
`IDENTIFICATION OF CHALLENGE (37 C.F.R. § 42.104(b))
`
`Petitioner requests an Order canceling the challenged claims as unpatentable
`
`under 35 U.S.C. §§ 102 and/or 103.
`
`Claims for Which Review Is Requested
`A.
`Petitioner requests inter partes review of claims 1-12 of the ‘154 patent.
`
`B.
`
`Priority Date of the ‘154 Patent
`
`The ‘154 patent issued from U.S. Application No. 12/814,584 filed on June
`
`14, 2010. Given that the ‘154 patent was filed before March 16, 2013, the provi-
`
`sions of Pre-AIA 35 U.S.C. §§ 102 and 103 apply.
`
`2
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Almost eighteen (18) months after the ‘154 Patent issued, the patent owner
`
`petitioned the Patent Office to make a claim for priority to U.S. Application No.
`
`11/298,475 (U.S. Patent No. 7,757,289), filed on December 12, 2005. The PTO
`
`initially denied the patent owner’s petition, but ultimately granted it based in-part
`
`on the patent owner’s representation that the delay in making its priority claim was
`
`“unintentional.” The publically available information concerning the ‘154 Patent
`
`family calls into question the veracity of Patent Owner’s representation.
`
`First, it appears that certain applications in the ‘154 Patent family originally
`
`claimed priority to the ‘289 Patent, while other applications did not. See U.S. Ap-
`
`plication No. 14/482,434 (original application claims priority to the ‘289 Patent)
`
`(Ex. 1012); U.S. Application No. 12/174,592 (original application does not claim
`
`priority to ‘289 Patent) (Ex. 1013) and ‘154 Patent (original application ford not
`
`claim priority to the ‘289 Patent) (Ex. 1014). For one of the applications that did
`
`not claim priority to the ‘289 Patent, Patent Owner made yet another late claim for
`
`priority to disqualify an intervening prior art reference that was being used to reject
`
`the claims. More specifically, in U.S. Application Number 12/174,592, Patent
`
`Owner initially amended the application to include a priority claim to the ‘154 pa-
`
`tent and ‘289 patent more than three years after the time period to make such a
`
`claim had expired. See Ex. 1015, U.S. Application No. 12/174,592 (Petition to
`
`3
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Accept Unintentionally Delayed Claim of Priority filed on December 20, 2011
`
`(denied) and January 25, 2012 (granted).
`
`Patent Owner had tried to overcome a prior art rejection by making argu-
`
`ments and amending its claims, but after this failed, and a subsequent final rejec-
`
`tion was mailed, Patent Owner decided to amend the priority claim of the ‘592 ap-
`
`plication, thus allowing Patent Owner to overcome the pending rejections. See Ex.
`
`1016, U.S. Application No. 12/174,592 (applicants’ response and amendment filed
`
`on July 19, 2011). Interestingly, while Patent Owner made a late claim for priority
`
`to the ‘154 and ‘289 patents in that application, Patent Owner did not, at that time,
`
`make a claim for priority to the ‘289 patent in the ‘154 patent.
`
`Instead, Patent
`
`Owner waited another twenty-one (21) months (and four days before filing a law-
`
`suit asserting the ‘154 Patent against WebSense, Inc.) (Ex. 1017) before alleging
`
`that its late priority claim was “unintentional.” Thus, based on the publically
`
`available information, it appears Patent Owner attempted to gain extra patent term
`
`for its patents by not always making a claim for priority, but rather only doing so
`
`when needed to avoid/disqualify intervening prior art. This would be improper.1
`
`1 37 C.F.R. 1.78(a)(2)(ii): “This reference must be submitted during the pendency
`
`of the later-filed application. If the later-filed application is an application filed un-
`
`der 35 U.S.C. 111(a), this reference must also be submitted within the later of four
`
`months from the actual filing date of the later-filed application or sixteen months
`
`4
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`Here, because all of the prior art references pre-date the filing dates of both
`
`the ‘154 and ‘289 patents, the cited references are prior art even if the ‘154 patent
`
`is entitled to claim priority to the ‘289 patent. Consequently, Petitioner has drafted
`
`this Petition assuming Patent Owner is entitled to claim priority back to the filing
`
`date of the ‘289 Patent (i.e., December 12, 2005).2
`
`C.
`
`The Specific Art on Which the Challenge Is Based
`
`Each of the references cited in the Petition is prior art to the ‘154 patent,
`
`which, for the purpose of this Petition, is assumed to have an effective filing date
`
`and earliest possible priority date of December 12, 2005. The cited references are
`
`from the filing date of the prior-filed application….Except as provided in para-
`
`graph (a)(3) of this section, the failure to timely submit the reference required by
`
`35 U.S.C. 120 and paragraph (a)(2)(i) of this section is considered a waiver of any
`
`benefit under 35 U.S.C. 120,121, or 365(c) to such prior-filed application.”
`
`2 In this regard, Petitioner respectfully submits that although the initial burden rests
`
`with a petitioner to challenge a patent’s entitlement to an earlier filing date, the
`
`burden then shifts to “the patent owner [who] must [then] make a sufficient show-
`
`ing of entitlement to earlier filing date(s), in a manner that is commensurate in
`
`scope with the specific points and contentions raised by the petitioner.” Id. Here,
`
`patent owner should be required to prove that its late priority claim was truly “un-
`
`intentional.”
`
`5
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`as follows:
`
`1.
`
`U.S. Patent Application Publication No. 2007/0113282 to Robert F.
`
`Ross (“Ross,” provided as Ex. 1002) published on May 17, 2007. Ross was filled
`
`on November 17, 2005, prior to the December 12, 2005 earliest possible priority
`
`date of the ‘154 patent. Accordingly, Ross is prior art to the ‘154 patent under Pre-
`
`AIA 35 U.S.C. § 102(e).
`
`2.
`
`U.S. Patent Application Publication No. 2002/0066022 to Brad Cal-
`
`der and Andrew A. Chien (“Calder,” provided as Ex. 1003) published on May 30,
`
`2002, more than one year before the December 12, 2005 earliest possible priority
`
`date of the ‘154 patent. Accordingly, Calder is prior art to the ‘154 patent under
`
`Pre-AIA 35 U.S.C. § 102(b).
`
`3.
`
`Design and implementation of a distributed virtual machine for net-
`
`worked computers, by Emin Gun Sirer et al., Association of Computing Machin-
`
`ery, December 1999. (“Sirer,” provided as Ex. 1004). Sirer was presented at the
`
`ACM’s Symposium on Operating Systems Principles in December 1999 and was
`
`available to the public for purchase from ACM for five dollars. See, Sirer, p. 1. A
`
`declaration by Dr. Sylvia Hall-Ellis (provided as Ex. 1005), together with certain
`
`evidence discussed therein (provided as Exs. 1007 and 1008), further demonstrates
`
`that Sirer was available to the public at least by February 7, 2000. Accordingly,
`
`Sirer is a printed publication that was publicly available more than one year before
`
`6
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`the December 12, 2005 earliest possible priority date for the ‘154 patent and, there-
`
`fore, Sirer is prior art to the ‘154 patent under Pre-AIA 35 U.S.C. § 102(b).
`
`4.
`
`U.S. Patent No. 8,220,055 to Mark K. Kennedy (“Kennedy,” provided
`
`as Ex. 1009) issued on July 10, 2012. Kennedy was filed on February 6, 2004, be-
`
`fore the December 12, 2005 earliest possible priority date of the ‘154 patent. Thus,
`
`Kennedy is prior art to the ‘154 patent under Pre-AIA 35 U.S.C. § 102(e).
`
`D.
`
`The Statutory Grounds on Which the Challenge Is Based
`
`The Petition identifies four grounds of unpatentability:
`
` Ground 1: Claims 1-5 are anticipated by Ross under 35 U.S.C. § 102.
`
` Ground 2: Claims 2, 4-8, 10, and 11 are rendered obvious by Ross un-
`der 35 U.S.C. § 103.
`
` Ground 3: Claims 9 and 12 are rendered obvious under 35 U.S.C. §
`103 by Ross in view of Calder.
`
` Ground 4: Claims 1-12 are rendered obvious under 35 U.S.C. § 103
`by Calder in view of Sirer.
`
`IV. OVERVIEW OF THE ‘154 PATENT
`
`A.
`
`The Specification
`
`The ‘154 patent generally relates to “protecting a client computer from dy-
`
`namically generated malicious content.” ‘154 patent, Abstract, 1:5-22; 4:30-34,
`
`13:37-40. The ‘154 patent explains that early prior art techniques for virus detec-
`
`tion protection were “reactive,” in that they relied upon a database of known virus
`
`signatures. Id., 1:23-32, 1:54-55, FIG. 1. Following the proliferation of the Inter-
`
`7
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`net, later prior art techniques recognized that certain virus types could not be rec-
`
`ognized by signature-based scans and instead turned to “proactive” techniques
`
`such as “behavioral analysis.” Id., 1:34-64; see also Davidson Decl. ¶¶ 40-50, 54.3
`
`The ‘154 patent illustrates and discusses several prior art systems for per-
`
`forming this type of behavioral analysis that included a “gateway computer,” for
`
`receiving content and transmitting it to a “client computer.” ‘154 patent, 2:46-53,
`
`FIG. 1 (labeled “PRIOR ART”). The gateway and/or client included a “content
`
`inspector,” used to “automatically scan and parse executable content, in order to
`
`detect which computer operations the content may perform” and develop a “securi-
`
`ty profile” that was compared against a set of allowable actions (i.e., a “security
`
`policy”). Id., 1:57-2:17, FIG. 1. The client also included a “content processor” for
`
`processing content received from the gateway (e.g., “a conventional web browser,
`
`which processes Internet content.”) Id., 2:54-3:2, FIG. 1; Davidson Decl. ¶ 55.
`
`According to the ‘154 patent, however, these prior art proactive virus protec-
`
`tion systems were not able to detect dynamically generated viruses because inputs
`
`that were generated at runtime were not available to the content inspector. ‘154
`
`patent, 3:31-4:26, 4:65-5:3. As shown in FIG. 2, the ‘154 patent purports to ad-
`
`dress this alleged problem through simple and straight-forward modifications to
`
`3 The Declaration of Dr. Jack Davidson is provided as Ex. 1010. Citations to Dr.
`
`Davidson’s Declaration are provided in the form: “Davidson Decl., ¶ #.”
`
`8
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`the prior art in order to analyze inputs generated by the content processor at run
`
`time. ‘154 patent, 4:43-51, 11:63-12:14; Davidson Decl., ¶¶ 56-57 (contrasting the
`
`admitted prior art in FIG. 1 with an embodiment of the claimed system in FIG. 2).
`
`In particular, the ‘154 patent explains that the gateway computer now in-
`
`cludes a content modifier (i.e., instead of a content inspector), which “modifies
`
`original content received by gateway computer 205 … by scan[ning] the original
`
`content and identif[ying] function calls… [and then] modif[ying] selected ones of
`
`the function calls to corresponding [substitute] function calls.” ‘154 patent, 9:13-
`
`28, 13:52-62, FIGS. 3, 5. The modified content is sent to the content processor at
`
`the client computer. Id., 13:63-14:1, FIGS. 3, 5. As described in the ‘154 patent,
`
`the output of the content modifier may be a simple wrapper around the original
`
`functions, which causes the original functions to be checked at runtime before it is
`
`executed. Id., Table I; see also Davidson Decl. ¶ 58.
`
`As Dr. Davidson explains, scanning content and creating wrappers around
`
`potentially malicious functions to analyze their behavior and make security deter-
`
`9
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`minations during execution – a process often referred to as “hooking” – was well-
`
`known prior to the ‘154 patent. Id., ¶ 51-53, 59. These prior hooking techniques
`
`evaluated inputs to the original function and other state information needed to
`
`make a security decision before allowing the original function to execute. Id.
`
`According, to the ‘154 patent, however, its hooking mechanism differs from
`
`the prior art in that, when the client content processor reaches the hooked function,
`
`it transmits the inputs to a security computer for inspection. ‘154 patent, 10:63-66,
`
`4:37-60, 14:1-13. This security computer, which may be a separate computer or
`
`may be incorporated within the gateway computer, includes an “input inspector”
`
`and an “input modifier.” Id., 4:35-37, 8:45-47, 9:3-12, FIGS. 1, 2, 4. As explained
`
`in the ‘154 patent, after the input inspector inspects the inputs, the security com-
`
`puter may simply send an indication to the client of whether or not it is safe to in-
`
`voke the original function. Id., 4:51-54, 10:1-6, 10:66-11:4, 14:61-15:-7.
`
`In certain other cases, the input modifier may modify the input and return
`
`the modified input the client (i.e., to execute the original function with the modi-
`
`fied content). Id., 4:61-64, 10:6-59, 11:5-9, 12:28-13:7, 15:8-13. For example, if
`
`the original function is attempting to access a system directory, the security com-
`
`puter may modify the input to point to a different (i.e., safe) directory. As another
`
`example, if the input itself includes additional original functions that pose a securi-
`
`ty risk, the security computer may modify the input by hooking certain of these
`
`10
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`embedded functions. See also Davidson Decl., ¶ 60.
`
`Thus, the purported distinction in the ‘154 patent is merely off-loading the
`
`well-known security analysis of hooked functions to a remote system (i.e., a “secu-
`
`rity computer”). Id., ¶ 61. As explained by Dr. Davidson, this is nothing more
`
`than a simple application of distributed computing using the generic client-server
`
`architecture. For example, it was well known at the time of the ‘154 patent that off-
`
`loading processing to a server could be accomplished using techniques such as
`
`Remote Procedure Call (RPC), where a client requests a server to perform a func-
`
`tion and receives a result from the server. Id., ¶¶ 61-62.
`
`B.
`
`The Challenged Claims
`
`The text of the four challenged independent claims (1, 4, 6, and 10) is repro-
`
`duced in the chart below. For ease of reference, labels have been assigned to each
`
`limitation (with overlapping features assigned the same label), such as 1[P] which
`
`refers to the preamble of claim 1 and 10[G] which refers to the final limitation of
`
`claim 10. Other than the claim format (e.g., system, and non-transitory computer-
`
`readable storage medium), claims 1, 4, 6, and 10 are substantially similar.
`
`The only meaningful differences are that (i) claims 1 and 4 are directed to
`
`invoking an original function (i.e., “a second function”) when it is determined to be
`
`safe, whereas claims 6 and 10 are directed to calling the original function with a
`
`modified input when the original input may not be safe; and (ii) claims 4 and 10
`
`11
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`further require suspending content processing when the input is sent to the security
`
`computer and then resuming when the indication or modified input is received
`
`back.4 Accordingly, where applicable, certain of these four independent claims
`
`and/or their overlapping limitations are discussed together in the sections below.
`
`Claim 1
`[P] A system for
`protecting a com-
`puter from dynam-
`ically generated
`malicious content,
`comprising:
`
`[A] a content pro-
`cessor (i) for pro-
`cessing content re-
`ceived over a net-
`work, the content
`including a call to
`a first function,
`and the call includ-
`ing an input, and
`
`[B1] (ii) for invok-
`ing a second func-
`tion with the input,
`only if a security
`computer indicates
`that such invoca-
`tion is safe;
`[C] a transmitter
`for transmitting the
`input to the securi-
`
`Claim 4
`[P] A non-
`transitory comput-
`er-readable storage
`medium storing
`program code for
`causing a compu-
`ting device to:
`[A] process con-
`tent received over
`a network, the con-
`tent including a
`call to a first func-
`tion, and the call
`including an input;
`
`Claim 10
`[P] A non-
`transitory comput-
`er-readable storage
`medium storing
`program code for
`causing a compu-
`ting device to:
`[A] process con-
`tent received over
`a network, the con-
`tent including a
`call to a first func-
`tion, and the first
`function including
`an input variable;
`
`Claim 6
`[P] A system for
`protecting a com-
`puter from dynam-
`ically generated
`malicious content,
`comprising:
`
`[A] a content pro-
`cessor (i) for pro-
`cessing content re-
`ceived over a net-
`work, the content
`including a call to
`a first function,
`and the first func-
`tion including an
`input variable, and
`[B2] (ii) for calling
`a second function
`with a modified
`input variable;
`
`[C] transmit the
`input for inspec-
`tion, when the first
`
`[C] a transmitter
`for transmitting the
`input variable to a
`
`[C] transmit the
`input variable for
`inspection, when
`
`4 Claims 6 and 10 also recite an “input variable,” rather than simply an “input” as
`recited in claims 1 and 4. An input variable is merely one type of input (i.e., an in-
`put that is not a constant or static value). Davidson Decl., ¶ 80, fn. 4.
`
`12
`
`

`
`ty computer for in-
`spection, when the
`first function is in-
`voked; and
`
`function is in-
`voked, and
`
`[E1] a receiver for
`receiving an indi-
`cator from the se-
`curity computer
`whether it is safe
`to invoke the sec-
`ond function with
`the input.
`
`[D] suspend pro-
`cessing of the con-
`tent;
`[E1] receive an in-
`dicator of whether
`it is safe to invoke
`a second function
`with the input; and
`
`[F] resume pro-
`cessing of the con-
`tent after receiving
`the indicator, and
`
`[B1] invoke the
`second function
`with the input only
`if the indicator in-
`dicates that such
`invocation is safe.
`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`security computer
`for inspection,
`when the first
`function is called;
`and
`
`[E2] a receiver for
`receiving the mod-
`ified input variable
`from the security
`computer,
`
`the first function is
`called, and
`
`[D] suspend pro-
`cessing of the con-
`tent;
`[E2] receive a
`modified input var-
`iable; and
`
`[F] resume pro-
`cessing of the con-
`tent after receiving
`the modified input
`variable, and
`[B2] calling a sec-
`ond function with
`the modified input
`variable,
`
`[G] wherein the
`modified input var-
`iable is obtained
`by modifying the
`input variable if
`the security com-
`puter determines
`that calling a func-
`tion with the input
`variable may not
`be safe.
`
`[G] wherein the
`modified input var-
`iable is obtained
`by modifying the
`input variable if
`the inspection of
`the input variable
`indicates that call-
`ing a function with
`the input variable
`may not be safe.
`
`13
`
`

`
`Case To Be Assigned
`IPR of U.S. Patent No. 8,141,154
`
`V.
`
`LEVEL OF ORDINARY SKILL
`
`A person of ordinary skill in the art (“POSITA”) is a hypothetical person
`
`who is presumed to have known the relevant art at the time of the invention. Cus-
`
`tom Accessories, Inc. v. Jeffrey-Allan Indus., Inc., 807 F.2d 955, 962 (Fed. Cir.
`
`1986) (“The person of ordinary skill is a hypothetical person who is presumed to
`
`be aware of all the pertinent prior art.”). A POSITA at the time of the alleged in-
`
`vention of the ‘154 patent would generally have a master’s degree in computer sci-
`
`ence, computer engineering, or a similar filed, or a bachelor’s degree in computer
`
`science, computer engineering, or a similar field, with approximately two years of
`
`experience in the fields of networking and anti-malware development, computer
`
`security or equivalent work experience. Additional graduate education might sub-
`
`stitute for experience, while significant experience in the field of computer pro-
`
`gramming, networking,