Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 1 of 24
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialkana,kramerlevin. com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@lcramerlevin.com
`KRAMER LEVIN NAFTALIS & FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752 -1700
`Facsimile: (650) 752 -1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`FINJAN, INC., a Delaware Corporation,
`
`Case No.: 13 -CV- 04398 -BLF
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Plaintiff,
`
`v.
`
`WEBSENSE, INC., a Delaware Corporation,
`
`Defendant.
`
`DECLARATION OF NENAD
`MEDVIDOVIC IN SUPPORT OF
`PLAINTIFF FINJAN, INC.'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`Date:
`Time:
`Courtroom:
`Judge:
`
`November 21, 2014
`9:00 a.m.
`Courtroom 3, 5th Floor
`Hon. Beth Labson Freeman
`
`A n EXHIBIT a-
`$4491:.v movie-
`Deponent
`Date (CIa)Rptr.
`
`www.nsCBCOX.COM
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 2 of 24
`
`I, Nenad Medvidovic, declare:
`
`1.
`
`I make this Declaration based upon my own personal knowledge, information, and
`
`belief, and I would and could competently testify to the matters set forth herein if called upon to do so.
`
`Qualifications
`
`2.
`
`I received a Bachelor of Science ("BS") degree, Summa Cum Laude, from Arizona
`
`State University's Computer Science and Engineering department.
`
`3.
`
`I received a Master of Science ( "MS ") degree from the University of California at
`
`Irvine's Information and Computer Science department.
`
`4.
`
`I received a Doctor of Philosophy ( "PhD ") degree from the University of California at
`
`Irvine's Information and Computer Science department. My dissertation was entitled, "Architecture -
`
`Based Specification -Time Software Evolution."
`
`5.
`
`I am employed by the University of Southern California ( "USC ") as a faculty member
`
`in the Computer Science Department, and have been since January 1999. I currently hold the title of
`
`Professor with tenure. Between January 2009 and January 2013, I served as the Director of the Center
`
`for Systems and Software Engineering at USC. Since July 2011, I have served as my Department's
`
`Associate Chair for PhD Affairs.
`
`6.
`
`I am very familiar with and have substantial expertise in the area of software systems
`
`development / software engineering, software architecture, software design, and distributed systems.
`
`7.
`
`I have over twenty years of research experience that has spanned a wide range of issues
`
`pertaining to large, complex, distributed software systems. This research has included security and
`
`trust as significant components. As one example, my research has resulted in a new technique that
`
`deploys a software system on a set of distributed computers in a manner that optimizes that system's
`
`"non- functional" characteristics, including efficiency, scalability, resource consumption, reliability, as
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`1
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 3 of 24
`
`well as security. As another example, motivated by the frequent vulnerability of distributed systems to
`
`malicious adversaries, I have developed, published, and eventually patented a novel technique for
`
`ensuring system security and data privacy in open computer networks. I have co- authored a widely
`
`adopted textbook on software system architectures, in which several chapters deal with the issue of
`
`security and one entire chapter is specifically dedicated to security and trust.
`
`Materials Reviewed
`
`8.
`
`I have reviewed in detail U.S. Patent Nos. 7,058,822 ( "the `822 Patent "); 7,647,633
`
`( "the `633 Patent "); 8,141,154 ( "the `154 Patent "); 8,225,408 ( "the `408 Patent "); and 8,677,494 ( "the
`
``494 Patent ") (collectively "Finjan Patents "). I have also reviewed the prosecution history of the
`
`Finjan Patents.
`
`9.
`
`I understand that I am submitting this Declaration to assist the Court in determining the
`
`proper construction of certain terms used in the claims in the Finjan Patents. I have reviewed the Joint
`
`Claim Construction and Pre -Hearing Statement Pursuant to Patent Local Rule 4 -3, which I understand
`
`Finjan and Websense jointly submitted and set forth their respective proposed claim construction and
`
`support therefore. I have also reviewed the terms that understand were selected by Finjan and
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`Websense for construction.
`
`19
`
`Construction of the Terms
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`10.
`
`I have reviewed Finjan's and Websense's proposed constructions for the terms in the
`
`claims of the Finjan Patents. I agree with Finjan that many of the terms for which Websense provides
`
`a construction do not need construction because a person of ordinary skill in the art would readily
`
`understand the terms. My understanding of a person of skill in the art is a person with a bachelor's
`
`degree in computer science or related field, and either (1) two or more years of industry experience
`
`26
`
`and /or (2) an advanced degree in computer science or related field.
`
`27
`
`28
`
`2
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14. Page 4 of 24
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Construction of the Terms of the `822 Patent and `633 Patent
`
`11.
`
`I address the terms for the `822 Patent and `633 Patent together, as the patents are
`
`related and share a specification. I understand that Finjan and/or Websense have disputes regarding
`
`the constructions for the claims terms listed in the tables below:
`
`i.
`
`information- destination of the downloadable- information
`
`Claim Term
`
`information- destination of the
`downloadable- information
`(`822 and `633 Patents)
`
`Finjan's Proposed
`Construction
`No construction
`necessary
`
`Websense's Proposed
`Construction
`client
`
`12.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the term "information- destination of the downloadable- information" as this
`
`term is used in the claims of the `822 and `633 Patents and in view of the `822 and `633 Patents. The
`
`terms are self -describing and include no specialized language. The "information- destination of the
`
`downloadable- information" is just that, the destination where the downloadable- information is going.
`
`As such, a person of skill in the art, or a layperson, understands the term and it needs no construction.
`
`13.
`
`I disagree with Websense's proposed construction. Websense's proposed construction
`
`is unnecessary and limits the meaning of the claims. For example, the `822 and `633 Patent use the
`
`term "client" throughout the specification, but also use the term "information- destination," indicating
`
`that the terms were not identical. Furthermore, a person of skill in the art understands that the term
`"client" is used in relationship with the term "server " -as in a client -server relationship. See 822
`
`Patent, Col. 6, 11. 59 -63. However, the claims where this term occurs in do not use the term "server,"
`
`creating ambiguity if Websense's proposed construction of "client" is adopted for this term. See Claim
`
`1 of the `822 Patent. The `822 and `633 Patents state that there are a number of different additional
`
`configurations possible, including peer -to -peer, routers, proxy servers, networks, converters, gateways,
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`3
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 5 of 24
`
`services, network reconfigurations elements in accordance with the particular application. See `822
`
`Patent, Col. 6,1. 65 -Col. 7, I. 2.
`
`14.
`
`Furthermore, the patent also describes that the "information- destination" can be server
`
`in some contexts, stating, "[a]dditional server /information- destination device security or other
`
`protection is also enabled ...." `633 Patent, Col. 2, 11. 55 -57. Construing "information- destination" to
`
`be a client, would then eliminate these examples disclosed in the specification. The'822 and `633
`
`Patents also provide a broad understanding in the Abstract of the system being protected, stating that
`
`"[p]rotection systems and methods provide for protecting one or more personal computers ( "PCs ")
`
`and /or other intermittently, or persistently network accessible devices or processes from undesirable or
`
`otherwise malicious operations." `633 Patent, Abstract. This example shows that a broad
`
`understanding of the "information- destination" is appropriate, as each of the devices listed can be a
`
`client, server or other network device depending on the requirements of the system.
`
`ii.
`
`mobile protection code
`
`Claim Term
`
`mobile protection code
`(`822 and `633 Patents)
`
`Finjan's Proposed
`Construction
`code capable of
`monitoring or
`intercepting
`potentially
`malicious code
`
`Websense's Proposed
`Construction
`runtime code for
`detecting, preventing,
`or modifying
`malicious mobile code
`operations without
`modifying the mobile
`code
`
`15.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the term "mobile protection code" in view of the specification of the `822
`
`and `633 Patents as "code capable of monitoring or intercepting potentially malicious code." While
`
`mobile protection code is not a term typically used in the art, the meaning of the term is described in
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`the `822 and `633 Patents. The `822 and `633 Patents describe mobile protection code as protecting
`
`27
`
`28
`
`4
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 6 of 24
`
`computers and systems from malicious code by monitoring or intercepting it. For example, the `822
`
`and `633 Patents state that: "[t]he sandboxed package includes mobile protection code ... for causing
`
`one or more predetermined malicious operations or operation combinations of a Downloadable to be
`
`monitored or otherwise intercepted." `822 Patent, Col. 3, 11. 6 -10; `633 Patent, Col. 3, 11. 7 -11.
`
`Finjan's proposed construction is correct because it requires the intercepting to be of "potentially
`
`malicious code," consistent with the purpose of the mobile protection code for protection and security.
`
`See `822 and `633 Patents, Abstract ( "[p]rotection systems and methods provide for protecting one or
`
`more personal computers ( "PCs ") and /or other intermittently or persistently network accessible devices
`
`or processes from undesirable or otherwise malicious operations ... "). As shown, mobile protection
`
`code is properly defined as "code capable of monitoring or intercepting potentially malicious code,"
`
`and this is the definition that one of ordinary skill in the art would apply.
`
`16.
`
`.I disagree with Websense's proposed construction for this term. First, Websense's
`
`proposed construction incorrectly adds the requirement that MPC be "runtime code" to the
`
`construction. While MPC can operate at "runtime," MPC can be statically created on a separate
`
`gateway or computer before any executable is run. `822 Patent, Col. 10, 11. 52 -54; Col. 20,11. 21 -32.
`
`17. Websense's proposed construction states that it is "without modifying the mobile code."
`
`However, this is contrary to the intrinsic record where the mobile code is modified in several
`
`examples. The specification specifically discloses examples where the executable code is modified in
`
`order for the MPC to protect the computer. For example, the `822 Patent teaches that a server receives
`
`Downloadable that includes executable code. `822 Patent, Col. 2, 1. 37 -Col. 4, 1. 40. In order to
`
`protect the destination from harm, the server modifies the executable code with the MPC and delivers
`
`the modified Downloadable as a single protected package to the destination. The destination is
`
`protected because the MPC will prevent and /or intercept harmful operations and stop them from
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`5
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 7 of 24
`
`executing. The `822 and `633 Patents also disclose that the import address table (known at the "IAT ")
`
`is "modified so that any call to an API can be redirected to a function within the MPC." `822 Patent,
`
`Col. 18,11. 1 -3.
`
`Claim Term
`
`determining executable code terms
`
`determining whether the downloadable-
`information includes executable code
`(`822 Patent)
`
`Finjan's Proposed
`Construction
`No construction
`necessary
`
`determining, by the computer, whether the No construction
`downloadable- information includes
`necessary
`executable code
`(`633 Patent)
`
`Websense's Proposed
`Construction
`parsing the entire
`downloadable and
`actively analyzing the
`result for indicators of
`binary information and
`patterns of executable
`code
`parsing the entire
`downloadable and
`actively analyzing the
`result for indicators of
`binary information and
`patterns of executable
`code
`
`18.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the phrases "determining whether the downloadable- information includes
`
`executable code" and "determining, by the computer, whether the downloadable- information includes
`
`executable code" as these phrases are used in the claims of the `822 and `633 Patents and in view of
`
`the `822 and `633 Patents. In fact, a layperson would easily understand the phrases based on their
`
`plain language. Importantly, the claim language explicitly does not limit the determination to a
`
`specific embodiment and allows for a broad range of techniques to determine whether the
`
`downloadable- information includes executable content.
`
`19.
`
`I disagree with Websense's proposed construction for these phrases. The phrases have
`
`a clear meaning and Websense's proposed constructions are unnecessary. First, it is inappropriate that
`
`Websense changes the term "downloadable- information" to " downloadable." "Downloadable-
`
`6
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 8 of 24
`
`information" is code not yet been detected as a "Downloadable," and what the specification refers to as
`
`a "potential -Downloadable." The "determining" steps in the claims of the `822 Patent and `633 Patent
`
`determine if the "downloadable- information" has executable code and is therefore a "Downloadable."
`
`See `822 Patent, Col. 5, 11. 34 -39 ( "Embodiments provide, within one or more `servers' ... for
`
`receiving downloadable- information and detecting whether the downloadable- information includes one
`
`or more instances of executable code. "); see also `822 Patent, Col. 12,11. 18 -22 ( "Detection engine 402
`
`includes code detector 421, which receives a potential -Downloadable and determines ... whether the
`
`potential -Downloadable includes executable code and is thus a `detected -Downloadable. "').
`
`Websense's proposed construction eliminates this aspect of the claim by changing "downloadable-
`
`information" to "downloadable."
`
`20.
`
`The `822 and `633 Patents disclose parsing as a technique for determining whether
`
`content such as downloadable- information includes executable code, but is not required to be the sole
`
`technique. For example, claim 12 of the `633 Patent is a dependent claim which requires the content
`
`inspection engine to use a parser to parse the downloadable- information for determining whether one
`
`or more downloadable- information elements of the downloadable- information correspond with
`
`executable code elements. This necessarily implies that the independent claim could use other
`
`techniques besides a parser to determine whether the downloadable includes executable code.
`
`Furthermore, the `822 and `633 Patents describes in Figure l0A detecting if the potential -
`
`downloadable (downloadable- information) has executable code without parsing the downloadable-
`
`information. Sée `822 Patent, Col. 19, 11. 44 -48 ( "In step 1001, the protection engine determines
`
`whether the potential -Downloadable indicates an executable file type, for example, by comparing one
`
`or more included file headers for file type indicators (e.g. extensions or other descriptors) ").
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`7
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 9 of 24
`
`21.
`
`Furthermore, Websense's proposed construction requires the unnecessary limitation that
`
`the "entire" downloadable- information be parsed, that it "actively analyze the result" and for
`
`"indicators of binary information and patterns of executable code." The claim language and
`
`description provided in the specification do not require these limitations. First, it would not make
`
`sense to parse the "entire" downloadable- information in certain contexts. For example, part of a
`
`downloadable- information is likely to be data or other non -executable content that would not be parsed
`
`or otherwise analyzed. This is described in the specification of the `633 Patent, where only the "file
`
`header" of the downloadable- information is analyzed to determine if there is executable code. `822
`
`Patent, Col. 15, 11. 5 -9 ( "File type detector 502 receives and determines whether the potential -
`
`Downloadable (likely) is or includes executable file type. File- reader 502 can, for example, be
`
`configured to analyze a received potential -Downloadable for a file header, which is typically included
`
`... "); id., Col. 16, 11. 31 -34 ( "Regarding the remaining detection engine elements illustrated in FIG.5,
`
`where content analysis is utilized, parser 502 can also provide a Downloadable or portions thereof to
`
`content detector 505. "). Second, it is unclear what "actively analyzing" means in this context, and as
`
`discussed with the limitation "entire," it would not make sense to parse the entire downloadable-
`
`information. Websense is taking a term that has a clear meaning and redefining it using a term -
`
`"actively analyzing" -that does not have a clear meaning. Third, Websense's proposed construction
`
`seems to require both looking at indicators of binary information and patterns of executable code.
`
`Websense's definition limits the term to detecting indicators of binary information. This is contrary to
`
`the examples described in the specification. For example, Figure 5 shows a Binary Detector, Pattern
`
`Detector and Other within the Content Detector:
`
`8
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`I
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 10 of 24
`
`502
`
`N
`Parser -y-
`
`File Type
`Detector
`
`Content
`Detector
`
`le
`
`I
`
`Pattern
`
`Detector Iv 551 505
`Detector N 552
`Other V\
`
`553
`
`22.
`
`The specification states, "Content detector 505 can then provide one or more content
`
`analyses. Binary detector 551, for example, performs detection of binary information; pattern detector
`
`552 further analyzes the Downloadable for patterns indicating executable code, or other detectors can
`
`also be utilized." `822 Patent, Col. 16, 11. 34 -39. Thus, the Content Detector can use "indictors of
`
`binary information" but it could also not use Binary Detector.
`
`23.
`
`I also disagree with Websense's proposed construction because it reads out the ability
`
`of the system to determine whether there is executable code when the code is combined, compressed,
`
`or otherwise encoded. Websense has equated "downloadable- information" with "downloadable,"
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`while "downloadable- information" is understood to be broader and includes situations when it is
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`unknown whether the "downloadable- information" includes executable code.
`
`iv.
`
`indicates a level of downloadable- information characteristic and executable
`code characteristic correspondence
`
`Claim Term
`
`indicates a level of downloadable-
`information characteristic and executable
`code characteristic correspondence
`(`822 Patent)
`
`Finjan's Proposed
`Construction
`Plain and ordinary
`meaning. To the
`extent a construction
`is required, "a level"
`should be construed
`as "an amount."
`
`Websense's Proposed
`Construction
`Indefinite
`
`9
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 11 of 24
`
`24.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the phrase "indicates a level of downloadable- information characteristic and
`
`executable code characteristic correspondence" as this is used in the claims of the `822 Patent and in
`
`view of the '822 Patent. This understanding would be that phrase describes a level, or amount, of
`
`correspondence between characteristics of the downloaded -information and the characteristics that are
`
`understood to be typical in one or more types of executable code. This is demonstrated in the
`
`specification which includes Figure 4 for determining if the downloadable- information includes
`
`executable code using the Detection Engine 402 that uses inspection parameters 422
`
`25.
`
`The inspection parameters are further described in Figure 6a of the `822 Patent, to
`
`include several different types of parameters that can be used (611 -632), some that are general (601)
`
`and some that are specific to the information- destination (602):
`
`601 {
`
`602 {
`
`Executable File Parameters
`
`Executable Code Parameters
`Pattern Parameters
`User Parameters
`System Parameters
`General Parameters
`Interface Parameters
`
`Other
`
`611
`612
`613
`
`621
`
`622
`623
`631
`632
`
`26.
`
`Furthermore, the majority of this claim language is used in other claims, such as claim 1
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`in the `822 Patent. See `822 Patent, Claim 1 (reciting "a correspondence is detected between a
`
`28
`
`10
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 12 of 24
`
`downloadable- information characteristic and at least one respective executable code characteristic. ")
`
`The tern "level" simply refers to the "amount" of correspondence between characteristics of the
`
`downloaded information and the characteristics typical of executable code. This understanding is
`
`further shown in the use of the term "level" within the specification of the `822 Patent, which states
`
`that determining whether "the potential -Downloadable more likely includes executable code (e.g. via
`
`weighted comparison of the results with a suitable level indicating the inclusion or exclusion of
`
`executable code)." `822 Patent, Col. 19, 11. 64 -67 (emphasis added). This usage demonstrates the
`
`meaning and usages of the term and shows that a suitable synonym is "amount." As such, a person of
`
`ordinary skill in the art would understand and be able to apply this claim language.
`
`v.
`
`Receiving, by the computer, one or more executable code characteristics of
`executable code that is capable of being executed by the information -
`destination
`
`Claim Term
`
`receiving, by the computer, one or more
`executable code characteristics of
`executable code that is capable of being
`executed by the information- destination
`(`633 Patent)
`
`Websense's Proposed
`Construction
`Indefinite
`
`Finjan's Proposed
`Construction
`Plain and ordinary
`meaning. To the
`extent a construction
`is required,
`"executable code
`characteristics"
`should be construed
`as "executable code
`parameters"
`
`27.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the phrase "receiving, by the computer, one or more executable code
`
`characteristics of executable code that is capable of being executed by the information- destination" as
`
`this is used in the claims of the `633 Patent and in view of the `633 Patent. The phrase describes
`
`receiving characteristics related to executable code by the "information- destination" component of the
`
`system. As such, a person of ordinary skill in the art would understand and be able to apply this claim
`
`language.
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`11
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 13 of 24
`
`28.
`
`From claim 11 of the `633 Patent, on which claim 7 depends, we know that "the
`
`computer" recited is the same computer that is determining whether the "downloadable- information"
`
`includes executable code (see also Detection Engine 402 in Figure 4 above). The computer receives a
`
`set of characteristics that describe executable code that is actually able to be executed by the
`
`information -destination to which the information will go and can be seen in 602 of Figure 6a
`
`(reproduced above). This claim term describes a situation where the eventual destination of the
`
`information changes the characteristics that are looked for to determine if there is executable code. For
`
`example, different characteristics may be used if the information- destination is an Apple Macintosh
`
`computer, as opposed to a Windows PC or a Linux computer. The characteristics for executable code
`
`specification to the destination are described in the specification:
`
`Executable parameters 601 comprise, in accordance with the above
`type parameters 611, executable code
`examples, executable
`file
`parameters 612 and code pattern parameters 613 (including known
`indicators header /code
`executable file type
`indicators and patterns
`respectively, where code patterns are utilized). Use parameters 602
`further comprise user parameters 621, system parameters 622 and general
`parameters 623 corresponding to one or more users, user classifications,
`user -system correspondences or destination system, device or processes,
`etc. (e.g. for generating corresponding MPCs /policies, providing other
`protection, etc.). The remaining parameters include interface parameters
`631 for providing MPC /policy (or further) configurability in accordance
`with a particular device or for enabling communication with a device user
`(see below), and other parameters 632.
`
``633 Patent, Col. 16, 11. 50 -64 (emphasis added).
`
`Data fetcher 501 provides for retrieving a potential -Downloadable or
`portions thereof stored in buffer 407 or parameters from storage 404, and
`communicates such information or parameters to parser 502. Parser 502
`receives a potential -Downloadable or portions thereof from data fetcher
`
`1. A computer processor -based method, comprising: receiving, by a computer, downloadable-
`information; determining, by the computer, whether the downloadable- information includes
`executable code; and based upon the determination, transmitting from the computer mobile protection
`code to at least one information- destination of the downloadable- information, if the downloadable-
`information is determined to include executable code.
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`12
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 14 of 24
`
`501 and isolates potential -Downloadable elements, such as file headers,
`for use by further processing
`source, destination, certificates, etc.
`elements.
`
``633 Patent, Col. 14, 11. 50 -57 (emphasis added).
`
`In this example, the aforementioned detection processor is also included as
`pre- detection processor or, more particularly, a configurable file inflator
`504. File inflator 504 provides for opening or "inflating" compressed files
`in accordance with a compressed file type received from file type detector
`503 and corresponding file opening parameters received from data fetcher
`501. Where a compressed file (e.g. a meta file) includes nested file type
`information not otherwise reliably provided in an overall file header or
`other information, inflator 504 returns such information to parser 502.
`File inflator 504 also provides any now -accessible included executables to
`to be separately
`control 506 where one or more included files are
`packaged with an MPC or policies.
`
`'633 Patent, Col. 15,11.21 -33 (emphasis added).
`
`29.
`
`The `633 Patent discloses that these can be at least received from the security system
`
`408, as shown in Figure 4:
`
`Detection Engine
`
`inspecU Parent 22 421
`-L
`
`Code Detector
`
`4
`
`1.
`
`._J.
`Pod cy/
`t Authentication
`Reader.
`Analyzer
`
`408
`""-Stik
`
`402
`
`fv
`
`Security/
`Authentication rer
`Policies
`
`47
`482 I 481
`
`..y
`
`403 f
`As such, a person of ordinary skill in the art would understand and be able to apply this
`
`'
`
`30.
`
`claim language. While a person of ordinary skill in the art understands the term "executable code
`
`characteristics," they would also understand that the term to be the same as "executable code
`
`parameters." This understanding is consistent with the use of the term "executable code
`
`characteristics" in the patent, which are synonymous with "executable code parameters." As such, a
`
`person of ordinary skill in the art understands the meaning of the phrase.
`
`13
`
`DECLARATION OF NENAD MEDVIDOVIC IN SUPPORT OF
`FINJAN'S OPENING CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -cv- 04398 -BLF
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1039
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 5:13 -cv- 04398 -BLF Document 105 -8 Filed 09/23/14 Page 15 of 24
`
`Construction of the Terms of the `154 Patent
`
`31.
`
`I understand that Finjan and/or