Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 1 of 20
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre cr kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`kramerlevin.com
`HANNAH LEE (State Bar No. 253197)
`hlee@kramerievin.com
`MICHAEL H. LEE (State Bar. No. 264592)
`mh lee(a)kramerlevin.com
`KRAMER LEVIN NAFTALIS
`& FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752 -1700
`Facsimile: (650) 752 -1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN FRANCISCO DIVISION
`
`FINJAN, INC., a Delaware Corporation,
`
`Case No.: 5:13 -cv- 02298 -HSG
`
`Plaintiff,
`
`v.
`
`SYMANTEC CORP., a Delaware Corporation,
`
`Defendant.
`
`DECLARATION OF NENAD
`MEDVIDOVIC IN SUPPORT OF
`PLAINTIFF FINJAN, INC.'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`Date:
`June 11, 2015
`Time:
`2:00 p.m.
`Place: Courtroom 15 - 18th Floor
`Before: Hon. Haywood S. Gilliam Jr.
`
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`A Jr EXHIBIT 3
`Deponent
`DatetSMRptr.-
`
`W W W DEPOBOORCOM
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 2 of 20
`
`I, Nenad Medvidovie, declare:
`
`1
`
`1.
`
`I make this Declaration based upon my own personal knowledge, information, and
`
`belief, and I would and could competently testify to the matters set forth herein if called upon to do so.
`
`Qualifications
`I received a Bachelor of Science ( "BS ") degree, Summa Cum Laude, from Arizona
`
`2.
`
`State University's Computer Science and Engineering department.
`
`3.
`
`I received a Master of Science ( "MS ") degree from the University of California at
`
`Irvine's Information and Computer Science department.
`
`4.
`
`I received a Doctor of Philosophy ( "PhD ") degree from the University of California at
`
`Irvine's Information and Computer Science department. My dissertation was entitled, "Architecture -
`
`Based Specification -Time Software Evolution."
`
`5.
`
`I am employed by the University of Southern California ( "USC ") as a faculty member
`
`in the Computer Science Department, and have been since January 1999. I currently hold the title of
`
`Professor with tenure. Between January 2009 and January 2013, I served as the Director of the Center
`
`for Systems and Software Engineering at USC. Since July 2011, I have served as my Department's
`
`Associate Chair for PhD Affairs.
`
`6.
`
`I am very familiar with and have substantial expertise in the area of software systems
`
`development / software engineering, software architecture, software design, and distributed systems.
`
`7.
`
`I have over twenty years of research experience that has spanned a wide range of issues
`
`pertaining to large, complex, distributed software systems. This research has included security and
`
`trust as significant components. As one example, my research has resulted in a new technique that
`
`deploys a software system on a set of distributed computers in a manner that optimizes that system's
`
`"non- functional" characteristics, including efficiency, scalability, resource consumption, reliability, as
`
`well as security. As another example, motivated by the frequent vulnerability of distributed systems to
`
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`1
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 3 of 20
`
`malicious adversaries, I have developed, published, and eventually patented a novel technique for
`
`ensuring system security and data privacy in open computer networks. I have co- authored a widely
`
`adopted textbook on software system architectures, in which several chapters deal with the issue of
`
`security and one entire chapter is specifically dedicated to security and trust.
`
`Materials Reviewed
`1 have reviewed in detail U.S. Patent Nos. 6,154,844 ( "the `844 Patent "); 7,613,926
`
`8.
`
`( "the `926 Patent "); 7,757,996 ( "the `996 Patent "); 7,757,289 ( "the `289 Patent "); 7,930,299 ( "the `299
`
`Patent "); 8,015,182 ( "the `182 Patent "); 8,141,154 ( "the `154 Patent "); and 8,667,494 ( "the `494
`
`Patent ") (collectively "Finjan Patents "). I have also reviewed the prosecution history of the Finjan
`
`Patents.
`
`9.
`
`I understand that I am submitting this Declaration to assist the Court in determining the
`
`proper construction of certain terms used in the claims in the Finjan Patents. I have reviewed the Joint
`
`Claim Construction and Pre -Hearing Statement Pursuant to Patent Local Rule 4 -3, which I understand
`
`was submitted jointly by Finjan and Symantec and sets forth their respective proposed claim
`
`construction and support thereof. I have also reviewed the terms that I understand were selected by
`
`Finjan and Symantec for construction.
`
`Construction of the Terms
`I have reviewed Finjan's and Symantec's proposed constructions for the terms in the
`
`10.
`
`claims of the Finjan Patents. My understanding of a person of skill in the art is a person with a
`
`bachelor's degree in computer science or related field, and either (1) two or more years of industry
`
`experience and /or (2) an advanced degree in computer science or related field.
`
`11.
`
`I understand that Finjan and /or Symantec have disputes regarding the constructions for
`
`the claims terms listed below.
`
`2
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 4 of 20
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`a) Construction of the Terms of the `844 Patent
`L Downloadable
`Claim Term
`
`Downloadable
`
`Finjan's Proposed
`Construction
`an executable application
`program, which is a
`downloaded from a
`source computer and run
`on the destination
`computer
`
`Symantec's Proposed
`Construction
`mobile code that is
`requested by an ongoing
`process and downloaded
`from a source computer
`to a destination computer
`for automatic execution
`
`12.
`
`Based on my professional experience, a person of ordinary skill in the art reading the
`
`specification would understand the term "Downloadable" to mean "an executable application program,
`
`which is a downloaded from a source computer and run on the destination computer." Indeed, the term
`
`"Downloadable is expressly defined in the `844 Patent specification as well as in related patents. See
`
``844 Patent at Col. 1, II. 44-47 ( "A Downloadable is an executable application program, which is
`
`downloaded from a source computer and run on the destination computer. "); U.S. Patent No. 6,092,194
`
`(the "194 Patent ") at Col. 1, 11. 44-47; U.S. Patent No. 6,804,780 (the '780 Patent ") at Col. 1, II. 50-
`
`53. In my opinion, the `844 Patent specification's explicit definition is consistent with how a person of
`
`ordinary skill in the art at that time would understand "Downloadable" to mean.
`
`13.
`
`Furthermore, Symantec's proposed construction imports limitations into Downloadable
`
`that is not supported by the `844 Patent specification or the prosecution history. First, Symantec
`
`introduces the term "mobile code," a term that is not in the `844 Patent specification and is a term that
`
`requires construction. While, "mobile code" is mentioned in the prosecution history of the `194 Patent,
`
`in my opinion, it does not redefine what is explicitly defined in the specification of the `844 Patent.
`
`14.
`
`Second, Symantec imports the requirement that every "Downloadable" is "requested by
`
`an ongoing process." Here, Symantec conflates an example of a Downloadable and applies it to every
`
`type of Downloadable to restrict its definition. The specification of the `844 Patent states "A
`
`3
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 5 of 20
`
`Downloadable is typically requested by an ongoing process such as by an Internet browser or web
`
`client." `844 Patent at Col. 1, II. 47 -49. In my opinion, a person of ordinary skill in the art would
`
`understand that "Downloadable" is not limited to being only "requested by an ongoing process"
`
`because the sentence states "typically" which is non -limiting.
`
`15.
`
`Third, Symantec imports the limitation "for automatic execution." In my opinion,
`
`nothing in the `844 Patent specification or prosecution history requires the Downloadable be
`
`automatically executed. Indeed, there is nothing the specification of the `844 Patent that discusses,
`
`much less requires, that the Downloadable being automatically executed.
`
`ii. Means for Receiving a Downloadable
`Finjan's Proposed
`Claim Term
`Construction
`Governed by 35 U.S.C.
`§ 112(6):
`
`means for receiving a Downloadable
`
`Function: receiving a
`Downloadable
`
`Structure:
`Downloadable file
`interceptor
`
`Symantec's Proposed
`Construction
`means -plus- function
`under § 112(6):
`
`Function: receiving a
`Downloadable
`Structure: indefinite for
`failure to disclose
`corresponding
`structure /algorithm
`
`16.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand that the element "means for receiving a Downloadable" describes an element with the
`
`function of "receiving a Downloadable," as unambiguously stated in the claim. A person of ordinary
`
`skill in that art would easily be able to ascertain this is the function associated with this element
`
`because the claim sets forth a clear function with reasonable certainty. Specifically, the function is
`
`found after the "for" clause in the claim term.
`
`17.
`
`I understand that in order to determine the proper function for the claim term, a person
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`of skill in the art must look to the specification to find the structure that performs the function recited
`
`28
`
`4
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 6 of 20
`
`in the claim. Based on my professional experience, a person of ordinary skill in the art would
`
`understand that the `844 Patent discloses that the function of "receiving a Downloadable" is performed
`
`by the structure of a "Downloadable file interceptor." The `844 Patent discloses that "[m]ethod 700
`
`begins with the Downloadable file interceptor 505 in step 705 receiving a Downloadable file" and
`
`"[t]he generic protection engine 500 includes a Downloadable file interceptor 505 for intercepting
`
`incoming Downloadables (i.e., Downloadable files) for inspection...." `844 Patent, Col. 9, II. 21-
`
`22;Col. 7, 11.44 -46. As shown from these passages, the `844 Patent discloses that the structure for
`
`intercepting an incoming Downloadable is a Downloadable file interceptor. Thus, there is no
`
`ambiguity and a person of skill in the art would be reasonably certain that the structure disclosed in the
`
``844 Patent as performing the recited function is a "Downloadable file interceptor."
`
`18.
`
`A person of ordinary skill in the art would be able to determine the proper function and
`
`structure of this element with a reasonable certainty when the claim is read in light of the specification
`
`and prosecution history. Therefore, I disagree with Symantec's assertion that the element is indefinite.
`
`iii. Means for Generating a First Downloadable Security Profile that Identifies
`Suspicious Code in the Received Downloadable
`Finjan's Proposed
`Claim Term.
`Construction
`Governed by 35 U.S.C.
`§ 112(6):
`Function: generating a
`first Downloadable
`security profile that
`identifies suspicious code
`in the received
`Downloadable
`
`Symantec's Proposed
`Construction
`means -plus- function
`under § 112(6):
`
`Function: generating a
`first Downloadable
`security profile that
`identifies suspicious code
`in the received
`Downloadable
`Structure: a processor
`programmed to perform
`the algorithm disclosed
`at col. 5, lines 42 -45 and
`col. 9, lines 20 -42 of
`U.S. Patent No.
`6,092,194
`
`means for generating a first
`Downloadable security profile that
`identifies suspicious code in the received
`Downloadable
`
`Structure: content
`inspection engine
`
`5
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 7 of 20
`
`19.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand that the element "means for generating a first Downloadable security profile that identifies
`
`suspicious code in the received Downloadable" describes an element with the function of "generating a
`
`first Downloadable security profile that identifies suspicious code in the received Downloadable." The
`
`claim language unambiguously states the proper function and person of ordinary skill in that art would
`
`easily ascertain this is the function associated with this element because the claim sets forth a clear
`
`function with reasonable certainty. Like the previous means- plus -function element, the function is
`
`recited in the claim after the "for" clause.
`
`20.
`
`Because this is another means -plus -function term, I understand that one of skill must
`
`look to the specification to determine the proper structure of the recited function. Based on my
`
`professional experience, a person of ordinary skill in the art would understand that the `844 Patent
`
`discloses that the function of "generating a first Downloadable security profile that identifies
`
`suspicious code in the received Downloadable" is performed by the structure of "content inspection
`
`engine."
`
`21.
`
`The function and algorithm for the content inspection engine structure is discussed
`
`throughout the specification, in flow charts, and diagrams of the `844 Patent. `844 Patent, Abstract;
`
`Col. 2, 11. 39-41; Col. 4,11.35 -58; Col. 8, II. 17 -36; Col. 9, I. 19 -Col. 10, 1.24; Col. 7, II. 62 -63; Col. 4,
`
`II. 4-7; Figs. 1 -7. The `844 Patent states that the content inspection engine:
`
`"generates and attaches a Downloadable ID to the Downloadable"
`
`"preferably [] computes a digital hash of the complete Downloadable code"
`
`"prefetches all components embodied in or identified by the code for Downloadable ID
`
`generation"
`
`6
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 8 of 20
`
`"may retrieve all components listed in the .INF file for an ActiveXTM control to
`
`compute a Downloadable ID"
`
`"the content inspection engine 525 and the content inspection engine 160 each may
`
`include the code scanner 325 of [U.S. Patent No. 6,092,194]"
`
``844 Patent at Col. 4, Il. 35 -58; Col. 8, II. 17 -36.
`
`22.
`
`The `844 Patent discloses that "a content inspection engine [] uses a set of rules to
`
`generate a Downloadable security profile corresponding to a Downloadable" and "a local content
`
`inspection engine 525 generates a [Downloadable security profile]" `844 Patent, Abstract, Col. 7, Il.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`62 -63; see also Col. 2, II. 39-42 ( "The system may also include a content inspection engine for
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`generating a Downloadable security profile for the Downloadable if the first Downloadable security
`
`profile data is not trustworthy. "). The specification further states "[t]he content inspection engine 525
`
`in step 750 generates a DSP (or DSPs) for the received Downloadable as described above with
`
`reference to FIGS. 1 -6." Id. at Col. 9, I. 19 -Col. 10, 1.24. Further establishing that the content
`
`inspection engine is the correct structure is that the `844 Patent identifies that the Downloadable
`
`security profile "preferably includes a list of potentially hostile or suspicious computer operations,"
`
`and may include the "respective arguments of these operations" which matches the language in the
`
`claims of identifying suspicious code in the Downloadable. `844 Patent, Col. 4, II. 4-7.
`
`23.
`
`As shown from these passages, a person of ordinary skill in the art would understand
`
`with reasonable certainty that the structure that performs the function of "generating a first
`
`Downloadable security profile that identifies suspicious code in the received Downloadable" is the
`
`"content inspection engine." Symantec's proposed structure fails to account for the content inspection
`
`engine described in the `844 Patent, which is described in the specification as "generat[ing] a
`
`Downloadable security profile corresponding to a Downloadable." `844 Patent, Abstract, Col. 7, Il.
`
`7
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -1-15G
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 9 of 20
`
`62 -63; see also Col. 2, II. 38 -41. In my opinion, Symantec improperly ignores the language of the `844
`
`Patent specification and therefore I agree with Finjan's construction.
`
`iv. Means for Linking the First Downloadable Security Profile to the Downloadable
`Before a Web Server Makes the Downloadable Available to Web Clients
`Finjan's Proposed
`Claim Term
`Symantec's Proposed
`Construction
`Construction
`means for linking the first Downloadable Governed by 35 U.S.C.
`means -plus- function
`security profile to the Downloadable
`under § 112, ¶ 6
`§ 112(6):
`before a web server makes the
`Downloadable available to web clients
`
`Function: linking the
`Function: linking the
`first Downloadable
`first Downloadable
`security profile to the
`security profile to the
`Downloadable before a
`Downloadable before a
`web server makes the
`web server makes the
`Downloadable available Downloadable available
`to web clients
`to web clients
`
`Structure: content
`inspection engine
`
`Corresponding
`structure: a processor
`programmed to perform
`the algorithm of steps
`630 and 645 disclosed at
`Fig. 6, col. 8, lines 65 -67,
`col. 6, lines 13 -24, and
`col. 5, lines 3 -13
`
`24.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand that "means for linking the first Downloadable security profile to the Downloadable before
`
`a web server makes the Downloadable available to web clients" describes an element with the function
`
`of "linking the first Downloadable security profile to the Downloadable before a web server makes the
`
`Downloadable available to web clients." As with the previous means -plus- function elements, the
`
`claim unambiguously states that the function in this element is found after the "for" clause. Thus, a
`
`person of ordinary skill in that art would easily be able to ascertain the function associated with this
`
`element with reasonable certainty by reading the claim language.
`
`8
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 10 of 20
`
`25.
`
`It is my understanding that once the function is identified, one of skill in the art must
`
`look to the specification in order to determine the proper structure for performing the function. Based
`
`on my professional experience, a person of ordinary skill in the art would understand that the `844
`
`Patent discloses that the function of "linking the first Downloadable security profile to the
`
`Downloadable before a web server makes the Downloadable available to web clients" is performed by
`
`the structure of the "content inspection engine." As stated above, function and algorithm for the
`
`content inspection engine structure is discussed throughout the specification, in flow charts, and
`
`diagrams of the `844 Patent. See e.g., `844 Patent, Abstract; Col. 2,11.3 -11; Col. 4, II. 35 -58; Col. 8, ll.
`
`17 -36; Col. 9,1. 19 -Col. 10, I.24; Col. 7, II. 62 -63; Col. 4, 11. 4-7; Figs. 1 -7.
`
`26.
`
`Generally, when users enter a URL into their browser, a request is sent to the URL's
`
`web server, which provides requested web pages. The `844 Patent discloses scenarios where a web
`
`server provides web pages to web clients that request web content. `844 Patent at Col. 5, 1. 5 -13; Col.
`
`10, 1.24 -65. The `844 Patent also explains that such content may include hostile Downloadables. `844
`
`Patent at Col. 5, 1. 5 -13. In order to provide protection against hostile Downloadables, the `844 Patent
`
`discloses a content inspection engine that will generate a Downloadable security profile for such
`
`content. `844 Patent at Col. 4, I. 35 -57. The `844 Patent further describes that "[t]he first content
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`inspection engine may link to the Downloadable" and the security profile. `844 Patent, Abstract; see
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`also id. at Col. 2, II. 3 -11; Col. 3, I.66 -Col. 4, 1.4; Col. 8, 11.49 -51; Col. 6, 11. 18 -21. The specification
`
`explains that such "linking" is used to indicate an association between the Downloadable and the DSP"
`
`and provides numerous examples, including "the DSP 215 can be stored in the network system 100,
`
`and alternatively a pointer to the DSP 215 can be attached to the signed inspected Downloadable." See
`
`icl. Such linking can provide protection against malicious Downloadables because the system has
`
`26
`
`generated a profile for the Downloadable. `844 Patent at Col. 3, I. 2 -7. Such linking can also create
`
`27
`
`28
`
`9
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 11 of 20
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`efficiencies because the system avoids the need to generate Downloadable security profiles for
`
`previously inspected content. `844 Patent at Col. 3, I. 2-7. Because the `844 Patent discloses that the
`
`content inspection engine generates and links security profiles to Downloadables, the proper structure
`
`for this function is the content inspection engine.
`
`27.
`
`Further, Figure 6 of the `844 Patent is a "flowchart illustrating a method for attaching a
`
`Downloadable security profile to a Downloadable in accordance with the present invention." The
`
`flowchart specifically diagrams the linking of the Downloadable security profile to the Downloadable.
`
`Id. at Fig. 6; Col. 3, 11.21 -23. Thus, there is sufficient description in the `844 Patent specification to
`
`disclose the algorithm of the structure "content inspection engine."
`
`28.
`
`As shown from these passages, a person of ordinary skill in the art would understand
`
`with reasonable certainty that the structure that performs the function of "linking the first
`
`Downloadable security profile to the Downloadable before a web server makes the Downloadable
`
`available to web clients" is the "content inspection engine." Symantec's proposed structure fails to
`
`account for the plain text of the `844 Patent specification, which states "the content inspection engine
`
`links the Downloadable security profile to the Downloadable." `844 Patent, CoI. 2, 11.3 -11; see also
`
`id. at Abstract; Col. 3, 1. 66 -Col. 4, I.4; Col. 8, 11.49 -51.; Col. 6, 11. 18 -21. In my opinion, Symantec
`
`improperly ignores the language of the `844 Patent specification and therefore I agree with Finjan's
`
`construction.
`
`b) Construction of the Terms of the `926 Patent and `494 Patent
`
`L Database
`
`Claim Term
`
`database
`
`Finjan's Proposed
`Construction
`a collection of
`interrelated data
`organized according to a
`database schema to
`
`Symantec's Proposed
`Construction
`organized collection of
`data
`
`10
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 12 of 20
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`serve one or more
`applications
`
`29.
`
`Based on my professional experience, a person of ordinary skill in the art would
`
`understand the meaning of the term "database" consistently with the commonly understood definition
`
`of the term. The readily understood meaning of "database" is "a collection of interrelated data
`
`organized according to a database schema to serve one or more applications." There is nothing in the
`
`intrinsic record of the asserted patents which require a departure from this commonly understood
`
`meaning, in fact, this construction describes how the specification uses the term.
`
`30.
`
`A person of ordinary skill in the art would understand that the term "database" as used
`
`in the `926 and `494 Patents to mean "a collection of interrelated data organized according to a
`
`database schema to serve one or more application." A database refers to structured data organized for
`
`use and retrieval for other applications. The "database schema" of a database describes how the data
`
`stored within the database is organized. For example, the `926 Patent states that "[a]ny suitable
`
`explicit or referencing list, database or other storage structure(s) or storage structure configuration(s)
`
`can also be utilized to implement a suitable user /device based protection scheme...or other desired
`
`protection schema." `926 Patent, Col. 16, 11. 51 -55 (emphasis added). A schema allows other
`
`applications to use a database to access this data. The 926 and `494 Patents describe this when it states
`
`that "[t]he security program 255 operates in conjunction with the security database 240, which includes
`
`security policies 305, known Downloadables 307, known Certificates 309 and Downloadable Security
`
`Profile (DSP) data 310 corresponding to the known Downloadables 307." `780 Patent, Col. 4, II. 23-
`
`27.1 The `926 and `494 Patents further provide that the DSP data 310 stored in the security database
`
`240 is used by other applications, for example, "[i]f the DSP data 310 of the received Downloadable is
`
`known, the code scanner 325 retrieves and forwards the information to the ACL comparator 330."
`
`The `780 Patent is incorporated by reference by the `926 and `494 Patents.
`
`11
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 13 of 20
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
``780 Patent, Col. 5, II. 48-52. This is just one example of how the `926 and `494 Patents describe a
`
`database that actively uses structured data in a manner for storing and retrieving security profiles for
`
`Downloadable that is consistent with the normally understood meaning of the term.
`
`31.
`
`I disagree with Symantec's proposed construction because it is inconsistent with the
`
`common understanding of the term. "Organized" is an ambiguous term that can have wide and varied
`
`meaning. For example, a system's core "dump" is organized and has a kind of structure, but it would
`
`not be considered a database by those of skill in the art. In my opinion, Symantec's proposed
`
`construction is incorrect because it is not how a person of ordinary skill in the art would understand the
`
`term in light of the specification.
`
`32.
`
`In addition, I understand that Symantec has equated a `log file" with a database in
`
`previous submissions between the parties. In my opinion, this is not the proper definition of a database
`
`and it supports the need to construe this term consistent with the definition understood by those of skill
`
`in the art. A person of ordinary skill in the art would understand that a simple log file is not a database
`
`because it is not structured like a database. In practice, one would typically use a log file to record the
`
`results of an operation or a series of operations that a software system executes during some time
`
`period. A database, on the other hand, is a structured software component that allows user and other
`
`software components to store and retrieve data in an efficient manner.
`
`33. Moreover, the `494 Patent distinguishes between a log file and a database
`
`demonstrating that they are not the same thing. For example, the `494 Patent describes logging results
`
`for a human to review in an event log, distinct from the security database used for storage and access
`
`by other component of the system. The `494 Patent states that "the logical engine 333 forwards a
`
`status report to the record -keeping engine 335, which stores the reports in event log 245 in the data
`
`storage device for subsequent review, for example, by the MIS director." `780 Patent, Col. 7, Il. 16 -20.
`
`12
`MEDVIDOVIC DECL. ISO FINJAN'S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`CASE NO. 13 -CV- 02298 -HSG
`
`Palo Alto Networks, Inc. - Exhibit 1040
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015-01979
`
`

`
`Case 3:14 -cv- 02998 -HSG Document 72 -1 Filed 04/20/15 Page 14 of 20
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`This shows that any understanding of database should be distinct from a log file because the patent
`
`uses the terms to represent different aspects of the system. Accordingly, to distinguish between a log
`
`file and a database, it is my opinion that Finjan's construction of a database as "a collection of
`
`interrelated data organized according to a database schema to serve one or more applications" is
`
`appropriate.
`
`c) Construction of the Ternis of the `289 and `154 Patents
`i. Protecting a Computer from Dynamically Generated Malicious Content
`Finjan's Proposed
`Symantec's Proposed
`Claim Term
`Construction
`Construction
`Preamble is limiting.
`No construction
`necessary of preamble.
`protecting a computer
`If construed, plain and
`from malicious content
`ordinary meaning
`that is generated at run -
`should apply.
`time
`
`protecting a computer from dynamically
`generated malicious content
`
`34.
`
`Based on my professional experence, a person of ordinary skill in the art would
`
`understand the meaning of the term "protecting a computer from dynamically generated malicious
`
`content" as the term is used in the claims of the `289 and `154 Patents. As such, no construction is
`
`necessary.
`
`35.
`
`As the specification explains, many anti -virus solutions at the time focused on reactive
`
`solutions to static malicious content, i.e., they could only prevent attacks against content that were
`
`already known and did not change. See e.g., `289 Patent at Col. 1, II. 13 -33. The `289 and `154
`
`Patents are focused on dynamic