UNITED STATES PATENT AND TRADEMARK OFFICE
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`
`PALO ALTO NETWORKS, INC.
`Petitioner,
`v.
`FINJAN, INC.,
`Finjan
`
`
`Inter Partes Review No. 2015-01979
`Patent 8,141,154
`_____________________________________________________________
`
`PETITIONER’S REPLY
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`TABLE OF CONTENTS
`
`I.
`II.
`
`Page
`INTRODUCTION .......................................................................................... 1
`SIRER WAS PUBLISHED MORE THAN FIVE YEARS BEFORE
`THE ’154 PATENT’S PRIORITY DATE ..................................................... 2
`III. THE BROADEST REASONABLE CONSTRUCTION OF
`“CONTENT” IS CODE .................................................................................. 5
`A.
`The claims do not support Finjan’s construction ................................. 6
`B.
`The specification supports interpreting “content” as “code” ............... 6
`C.
`Extrinsic evidence supports Petitioner’s proposed construction
`of “content” .......................................................................................... 7
`IV. GROUNDS 1 AND 2: KHAZAN IN COMBINATION WITH SIRER
`RENDER ALL BUT THE “MODIFIED INPUT VARIABLE”
`LIMITATION OF THE ASSERTED CLAIMS OBVIOUS ......................... 8
`A. Khazan renders obvious “content received over a network”
`(Claims 1, 4, 6, and 10) ........................................................................ 8
`1.
`Khazan’s libraries are “content received over a network” ........ 9
`2.
`The “content received over a network” limitations are
`obvious in view of Khazan’s instrumented application ........... 10
`a.
`Khazan teaches receiving an application over a
`network .......................................................................... 11
`B. Khazan renders obvious “the content including a call to a first
`function” (Claims 1, 4, 6, and 10) ...................................................... 12
`1.
`The teachings of Sirer and Khazan render obvious “the
`content including a call to a first function” .............................. 13
`“The call including an input” limitation is obvious in view of
`Khazan (claims 1 and 4) ..................................................................... 14
`1.
`Detours is additional evidence that Khazan teaches the
`“call including an input” .......................................................... 15
`D. Khazan discloses invoking a second function with the input
`“only if a security computer indicates that such invocation is
`safe” (claims 1 and 4) ......................................................................... 15
`
`C.
`
`
`
`
`
`-i-
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`TABLE OF CONTENTS
`(continued)
`
`Page
`
`1.
`
`Khazan and Sirer render obvious transmitting input
`“when the first function is invoked” ........................................ 16
`The receiver elements (claims 1 and 4) are obvious in view of
`Khazan and Sirer ................................................................................ 17
`Khazan and Sirer “suspend[] processing of the content after
`said processor transmits the input to the security computer”
`(claim 2).............................................................................................. 18
`G. Khazan “resumes processing of the content after said receiver
`receives the indicator from the security computer” (claim 2) ............ 19
`It was obvious to combine Khazan and Sirer ..................................... 19
`H.
`V. KHAZAN IN COMBINATION WITH SIRER AND BEN-NATAN
`RENDERS OBVIOUS CLAIMS 6-8, 10, AND 11 ..................................... 21
`A.
`The “modified input variable” limitations of claims 6 and 10
`are obvious ......................................................................................... 21
`B. A person of ordinary skill would have been motivated to
`combine Ben-Natan with Khazan and Sirer ....................................... 21
`VI. FINJAN’S SECONDARY CONSIDERATIONS EVIDENCE
`SHOULD BE GIVEN NO WEIGHT ........................................................... 23
`A.
`Finjan fails to establish a nexus between commercial success
`and the challenged claims .................................................................. 23
`Finjan’s other secondary indicia evidence lacks evidentiary
`support ................................................................................................ 25
`VII. CONCLUSION ............................................................................................. 26
`
`E.
`
`F.
`
`B.
`
`
`
`
`
`-ii-
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`TABLE OF AUTHORITIES
`
`Page
`
`Cases
`In re Antor Media Corp.,
`689 F.3d 1282 (Fed. Cir. 2012) .................................................................... 10, 24
`Apple, Inc. v. Ameranth, Inc.,
`CBM2015-00080, Paper 44 (P.T.A.B. Aug. 26, 2016) .......................... 23, 24, 25
`In re Baird,
`16 F.3d 380 (Fed. Cir. 1994) ........................................................................ 13, 15
`Blue Belt Techs, Inc. v. All-of-Innovation Gmbh,
`Case IPR2015-00765, Paper 35 (P.T.A.B. July 26, 2016) ................................. 20
`In re Burhans,
`154 F.2d 690, 69 USPQ 330 (C.C.P.A. 1946) .................................................... 19
`In re Cronyn,
`890 F.2d 1158 (Fed. Cir 1989) ......................................................................... 4, 5
`Cuozzo Speed Techs., LLC v. Lee,
`136 S. Ct. 2131 (2016) .......................................................................................... 5
`Ecolab, Inc. v. FMC Corp.,
`569 F.3d 1335 (Fed. Cir. 2009) .......................................................................... 20
`In re Etter,
`756 F.2d 852 (Fed. Cir. 1985) (en banc) ............................................................ 22
`Facebook, Inc. v. Software Rights Archive, LLC,
`IPR2013-00479, Paper 54 (P.T.A.B. Feb. 2, 2015) ............................................ 24
`Ford Motor Co. v. Versata Development Group, Inc.,
`IPR2016-01016, Paper 11 (P.T.A.B. Sept. 27, 2016)........................................... 4
`GraftTech Int’l Holdings, Inc. v. Laird Techs., Inc.,
`2016 WL 3357427, *4-5 (Fed. Cir. June 17, 2016)............................................ 25
`
`
`
`-iii-
`
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`TABLE OF AUTHORITIES
`(continued)
`
`Page
`
`In re Hall,
`781 F.2d 897 (Fed. Cir. 1986) .............................................................................. 4
`Hewlett–Packard Co. v. Mustek Sys., Inc.,
`340 F.3d 1314 (Fed. Cir. 2003) .......................................................................... 16
`Hill-Rom Services, Inc. v. Stryker Corp.,
`755 F.3d 1367 (Fed. Cir. 2014) ............................................................................ 6
`i4i Partnership v. Microsoft Corp.,
`598 F.3d 831 (Fed. Cir. 2010) .............................................................................. 7
`IBM Corp. v. Intellectual Ventures II LLC,
`IPR2014-00681, Paper 11 (P.T.A.B. Oct. 30, 2014) ............................................ 3
`Johns Manville Corp. v. Knauf Insulation, Inc.,
`IPR2015-01402, Paper 45 (P.T.A.B. Oct. 19, 2016) .......................................... 11
`In re Lister,
`583 F.3d 1307 (Fed. Cir. 2009) .................................................................... 2, 4, 5
`Malico, Inc. v. Cooler Master USA Inc.,
`594 Fed. Appx. 621 (Fed. Cir. 2014) .................................................................. 11
`MBO Labs., Inc. v. Becton, Dickinson & Co.,
`474 F.3d 1323 (Fed. Cir. 2007) ............................................................................ 7
`Microsoft Corp. v. Bradium Techs. LLC,
`IPR2016-00448, Paper No. 9 (P.T.A.B. July 25, 2016) ....................................... 4
`PAN v. Finjan, Inc.,
`IPR2015-01974, Paper 22 (Aug. 9, 2016) .......................................................... 25
`In re Paulsen,
`30 F.3d 1475 (Fed. Cir. 1994) ............................................................................ 23
`
`
`
`
`
`-iv-
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`TABLE OF AUTHORITIES
`(continued)
`
`Page
`
`Phillips v. AWH Corp.,
`415 F.3d 1303 (Fed. Cir. 2005) (en banc) .................................................... 6, 7, 8
`In re Ratti,
`270 F.2d 810 (C.C.P.A. 1959) ............................................................................ 20
`Symantec Corp. v. The Trustees of Columbia Univ.,
`Case IPR2015-00375, Paper 47 (P.T.A.B. June 30, 2016) ................................ 11
`Universal Remote Control, Inc. v. Universal Elecs. Inc.,
`IPR2014-01106, Paper 49 (P.T.A.B. Dec. 15, 2015) ......................................... 23
`Statutes
`35 U.S.C. § 102(b) ..................................................................................................... 5
`35 U.S.C. § 102(b) ..................................................................................................... 1
`Other Authorities
`37 C.F.R. § 42.65(a) ................................................................................................. 25
`
`
`
`
`
`
`-v-
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`PETITIONER’S REVISED EXHIBIT LIST
`
`Exhibit
`Description
`No.
`1001 U.S. Patent No. 8,141,154 (“the ’154 patent”)
`1002 Declaration of Dr. Aviel Rubin
`1003 U.S. Patent Publication No. 2005/0108562 (“Khazan”)
`Emin Gün Sirer, et al., “Design and Implementation of a Distributed
`1004
`Virtual Machine for Networked Computers” (Dec. 5, 1999) (“Sirer”)
`1005 U.S. Patent No. 7,437,362 (“Ben-Natan”)
`1006 File History of United States Patent No. 8,141,154
`1007 Curriculum Vitae of Dr. Aviel Rubin
`1008 Declaration of Emin Gün Sirer
`1009 U.S. Patent No. 5,983,348 (“Ji”)
`1010 U.S. Patent Publication No. 2001/0005889 (“Albrecht”)
`Ajay Chander, et al., “Mobile Code Security by Java Bytecode
`1011
`Instrumentation” (June 12-14, 2001) (“Chander”)
`Galen Hunt, et al., “Detours: Binary Interception of Win32 Functions”
`1012
`(July 1999) (“Hunt”)
`1013 Microsoft Computer Dictionary, Fifth Ed. (2002)
`3Com, “3C90x and 3C90xB NICs Technical Reference” (Aug. 1998)
`1014
`David E. Evans, “Policy-Directed Code Safety” (Oct. 19, 1999)
`1015
`(“Evans”)
`David K. Gifford, “Weighted Voting for Replicated Data” (1979)
`(“Gifford”)
`Andrew D. Birrell, et al., “Grapevine: An Exercise in Distributed
`Computing” (Apr. 1982) (“Birrell”)
`Jennifer G. Steiner, et al., “Kerberos: An Authentication Service for
`1018
`Open Network Systems” (Jan. 12, 1988) (“Steiner”)
`1019 F-Secure Anti-Virus for Firewalls 6.20
`Jeff A. McConnell, “Content Vectoring Protocol with Checkpoint and
`1020
`Interscan Viruswall” (Mar. 4, 2002) (“McConnell”)
`
`1016
`
`1017
`
`
`
`-vi-
`
`
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`1027
`
`1026
`
`Exhibit
`Description
`No.
`1021 U.S. Patent No. 7,207,065 (“Chess”)
`Sun Microsystems, “Sun ONE Portal Server 3.0 Rewriter Configuration
`1022
`and Management Guide” (Sept. 13, 2002)
`Algis Rudys & Dan S. Wallach, “Enforcing Java Run-Time Properties
`1023
`Using Bytecode Rewriting” (2002) (“Rudys”)
`1024 U.S. Patent No. 6,324,685 (“Balassanian”)
`John Lewis, et al., “Java Software Solutions, Foundations of Program
`1025
`Design” (1998) (“Lewis”)
`Larry L. Peterson, et al., “Computer Networks, A Systems Approach”
`(“Peterson”)
`Waldemar Horwat, “JavaScript 2.0: Evolving a Language for Evolving
`Systems” (2001) (“Horwat”)
`Daniel A. Reed, et al., “Scalable Performance Analysis: The Pablo
`1028
`Performance Analysis Environment” (1993) (“Reed”)
`1029 Que Corporation, “C Programming Guide 2nd Edition” (1985)
`1030 Herbert Schildt, “C++ from the Ground Up” (1994) (“Schildt”)
`1031 Virus Bulletin (Nov. 1991)
`1032 Dmitry O. Gryaznov, “Scanners of the Year 2000: Heuristics” (Sept.
`1995)
`1033 R. Srinivasan, Request for Comments: 1831, ROC: Remote Procedure
`Call Protocol Specification, Version 2, (August 1995)
`1034 Dan Raywood, Press Release - M86 Security completes acquisition of
`Finjan (Nov. 3, 2009)
`1035 Gerard Le Lann, “Distributed Systems – Towards a Formal Approach,”
`Information Processing (1977)
`1036 Declaration of Mel DeSart
`1037 Transcript of Telephone Conference on June 14, 2016
`1038 Deposition Transcript of Nenad Medvidovic taken on October 21, 2016
`1039 Declaration of Nenad Medvidovic In Support of Plaintiff Finjan, Inc.’s
`Opening Claim Construction Brief, in Finjan, Inc. v. Websense, Inc.,
`Case No. 13-cv-04398-BLF (Exhibit 2 to Deposition of Nenad
`Medvidovic, taken October 21, 2016)
`
`vii
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`
`Exhibit
`Description
`No.
`1040 Declaration of Nenad Medvidovic In Support of Plaintiff Finjan, Inc.’s
`Opening Claim Construction Brief, in Finjan, Inc. v. Symantec Corp.,
`Case No. 5:13-cv-02298-HSG (Exhibit 3 to Deposition of Nenad
`Medvidovic, taken October 21, 2016)
`1041 Declaration of Nenad Medvidovic In Support of Plaintiff Finjan, Inc.’s
`Opening Claim Construction Brief, in Finjan, Inc. v. Proofpoint, Inc.
`and Armorize Technologies, Inc., Case No. 13-cv-04398-BLF (Exhibit 4
`to Deposition of Nenad Medvidovic, taken October 21, 2016)
`1042 Massachusetts Institute of Technology Bio of Dr. Roger I. Khazan
`1043 Final Written Decision dated June 30, 2016 (Paper 47), in Symantec
`Corp. v. The Trustees of Columbia University in the City of New York,
`IPR2015-00375
`1044 Danny Nebenzahl, et al., “Install-time Vaccination of Windows
`Executables to Defend Against Stack Smashing Attacks” (November 4,
`2003) (“Nebenzahl”)
`1045 Supplemental Declaration of Aviel D. Rubin In Support of Petitioner’s
`Reply
`
`
`viii
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`INTRODUCTION
`I.
`Finjan’s Response fails to identify any persuasive reason why claims 1-8,
`
`10, or 11 of the ’154 Patent are not invalid in light of the teachings of Khazan,
`
`Sirer, and Ben-Natan.
`
`Finjan’s first argument, that Sirer is not a printed publication, hinges on the
`
`assertion that an article in a respected academic journal was not adequately
`
`distributed to the public, despite the fact that the article’s author confirmed its
`
`publication, the journal was indexed in a popular online database, and displayed in
`
`the reading room at the University of Washington Engineering Library and indexed
`
`into its collection. The evidence of publication is consistent, uncontradicted, and
`
`compellingly establishes that Sirer is prior art under 35 U.S.C. § 102(b).
`
`Finjan next attempts to save the challenged claims by limiting their scope to
`
`Internet content. The ’154 patent and the challenged claims are not so limited.
`
`Finjan argues that “content” means “a data container that can be rendered by a web
`
`browser,” but this construction is not supported by the intrinsic record and it
`
`disobeys Federal Circuit precedent. The proposed construction is also directly
`
`contradicted by Finjan’s expert testimony in district court proceedings. (Ex. 1038
`
`at 5-6 (14:9-18:13); Ex. 1039 at 16-17.) The broadest reasonable interpretation of
`
`1
`
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`“content” is “code.” When the proper construction of “content” is applied, many of
`
`Finjan’s non-obviousness arguments fail.
`
`Third, Finjan attempts to distinguish Khazan by characterizing Khazan’s
`
`teachings as limited to its preferred embodiment of instrumenting Win32 DLLs.
`
`This line of argument fails in light of Khazan’s broad disclosure. Khazan describes
`
`a system for malicious code detection that is “generally applicable for use with any
`
`one of a variety of different types of binary and machine-executable programs, as
`
`well as script programs, command programs, and the like.” (Ex. 1003 at 25,
`
`[0114], at 26 [0118].) Finjan’s mistaken characterization of the scope of Khazan’s
`
`teachings is undercut by its own expert, who admitted (as he must) that Khazan’s
`
`disclosures go beyond the scope of the WIN32 DLL embodiment. (Ex. 1038 at 11-
`
`14 (39:7-53:10).)
`
`For each of these reasons, which are explained more fully below, the Board
`
`should find that claims 1-8, 10, and 11 of the ’154 Patent are invalid as obvious.
`
`II.
`
`SIRER WAS PUBLISHED MORE THAN FIVE YEARS BEFORE THE ’154
`PATENT’S PRIORITY DATE
`Public accessibility is determined on a “case-by-case basis based on the
`
`‘facts and circumstances surrounding the reference’s disclosure to members of the
`
`public.’” In re Lister, 583 F.3d 1307, 1311 (Fed. Cir. 2009). The evidence shows
`
`that Sirer was published in December 1999 and catalogued and indexed in the
`
`2
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`University of Washington Engineering Library in early 2000. A sworn declaration
`
`from the article’s co-author states that Sirer was “published within the United
`
`States in or before December 1999.” (Ex. 1008.) Mr. Sirer’s testimony is
`
`corroborated by both the copyright date on the face of Sirer1 (Ex. 1004; Ex. 1036
`
`at 3-6; Ex. 2002 at 15 n.1.), and the testimony of Mr. DeSart. (Ex. 1036 at 1, Ex.
`
`2006 at 3 (10:2-12:18), at 4 (15:13-20).)
`
`Finjan does not dispute Sirer’s late 1999 publication date, or offer any
`
`evidence contradicting Sirer’s public availability. Finjan only challenges the
`
`sufficiency of Petitioner’s evidence. (Response at 7-10.) Finjan claims that
`
`someone looking for Sirer would have had to know that the article was published
`
`in the Operating Systems Review journal, but it is wrong. In addition to the
`
`University of Washington Engineering Library’s index, Sirer was indexed by
`
`article title in the Inspec computer science database. (Ex. 2006 at 3 (12:2-18), at 4
`
`(15:13-20).) Sirer’s title is related to its subject matter and an interested person
`
`would have found it using reasonable diligence by searching for the key words in
`
`
`
` 1
`
` A copyright date can be probative evidence of publication. See, e.g., IBM Corp. v.
`
`Intellectual Ventures II LLC, IPR2014-00681, Paper 11, at 13-14 (P.T.A.B.
`
`Oct. 30, 2014).
`
`3
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`its title. (Ex. 1004 at 1); see In re Cronyn, 890 F.2d 1158, 1161 (Fed. Cir 1989)
`
`(indexing by subject supported a finding of public availability). Sirer was also
`
`publicly displayed in an area of the University of Washington Engineering Library
`
`reserved for the most heavily used items in February 2000. (Ex. 1036 at ¶3; Ex
`
`2006 at 9 (33:5-20).) This evidence is alone sufficient to show public availability.2
`
`See In re Hall, 781 F.2d 897, 898, 899–90 (Fed. Cir. 1986) (dissertation shelved in
`
`the stacks and indexed in the catalog at a library was a printed publication); see
`
`also Microsoft Corp. v. Bradium Techs. LLC, IPR2016-00448, Paper No. 9, at 14
`
`(P.T.A.B. July 25, 2016).
`
`The evidence also shows that Sirer was publicly accessed by at least the
`
`applicants for Patent No. 6,324,685 (“’685 patent”), who cited Sirer in an
`
`information disclosure statement. (Response at 9.) The ’685 patent cites the same
`
`author, title, location, journal title, and edition number as the article submitted by
`
`Petitioner. (Compare Ex. 1024 at 2 with Ex. 2004 at 1.) Finjan’s reliance on In re
`
`
`
` 2
`
` To Petitioner’s knowledge, there is only one case where the Board found that a
`
`published journal article was not a printed publication. That case involved
`
`contradictory evidence not present here. Ford Motor Co. v. Versata Development
`
`Group, Inc., IPR2016-01016, Paper 11, at 4-7 (P.T.A.B. Sept. 27, 2016).
`
`4
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`Lister to argue that a citation in an IDS is not evidence of public availability is
`
`misplaced. (Response at 9); In re Lister, 583 F.3d 1307, 1317 (Fed. Cir. 2009). In
`
`Lister there was no evidence that anyone other than the author accessed the
`
`manuscript at issue. Id. at 1309-11, 1316-17. The citation to Sirer is evidence that
`
`the article was accessed by the interested public prior to 2001 and corroborates
`
`Petitioner’s other evidence.
`
`Finally, Finjan’s argument that subject matter indexing is “a prerequisite to
`
`demonstrate public availability” is incorrect. (Response at 10.) Public availability
`
`is determined on a case-by-case basis and the facts that resulted in a finding that
`
`prior art was not adequately indexed or catalogued in In re Cronyn are not present
`
`in this case. (Ex. 1004 at 1; Ex. 1006; Ex. 1036 at 1-6; Ex. 2006 at 2 (6:17-7:8), at
`
`3 (10:2-11:12, 11:24-12:18); Ex. 1024 at 2); cf. In re Cronyn, 890 F.2d at 1161.
`
`The evidence of publication is consistent, and it shows that Sirer was
`
`publicly available in early 2000. Sirer is prior art under 35 U.S.C. § 102(b).
`
`III. THE BROADEST REASONABLE CONSTRUCTION OF “CONTENT” IS CODE
`Considering the claims, specification, and extrinsic evidence, the broadest
`
`reasonable interpretation of “content” in the ’154 patent is “code.” Cuozzo Speed
`
`Techs., LLC v. Lee, 136 S. Ct. 2131, 2146 (2016). Finjan’s construction of
`
`5
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`“content” as “a data container that can be rendered by a client web browser” is
`
`unsupported by evidence or the law.
`
`A. The claims do not support Finjan’s construction
`The challenged claims do not limit “content” to that which can by rendered
`
`by a web browser. Finjan’s assertions otherwise are belied by the language of the
`
`claims. (Ex. 1001 at 15 (claims 1-4, 6, 10)); Phillips v. AWH Corp., 415 F.3d 1303,
`
`1312 (Fed. Cir. 2005) (en banc).
`
`The specification supports interpreting “content” as “code”
`B.
`The patent specification supports Petitioner’s construction of “content” to
`
`mean “code.” Phillips, 415 F.3d at 1315. The ’154 specification teaches that the
`
`claimed content “may be in the form of an HTML web page, an XML document, a
`
`Java applet, an EXE file, JavaScript, VBScript, an ActiveX Control, or any such
`
`data container that can be rendered by a client web browser.” (Ex. 1001 at 13:49-
`
`52 (emphasis added).) These files types are all examples of code.
`
`Finjan inexplicably treats the specification’s non-limiting language as a
`
`“clear disavowal” of claim scope. (See Ex. 1001 at 13:49-52, 2:64-3:2, 8:47-51
`
`(“content may be in the form”).) Finjan’s interpretation of the specification is
`
`contrary to Federal Circuit precedent. See Hill-Rom Services, Inc. v. Stryker Corp.,
`
`755 F.3d 1367 (Fed. Cir. 2014) (“Disavowal requires that the specification or
`
`prosecution history make clear that the invention does not include a particular
`
`6
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`feature.”) (internal citations omitted). Claims should not be limited to an
`
`embodiment disclosed in the specification even when only one embodiment is
`
`disclosed. Id. at 1371-72. The specification shows that the applicants intended to
`
`cover additional content types that are not listed. (See Ex. 1001 at 13:49-52, 2:64-
`
`3:2, 8:47-51 (“content may be …”).); i4i Partnership v. Microsoft Corp., 598 F.3d
`
`831, 844 (Fed. Cir. 2010) (“[t]he specification's permissive language, ‘could be
`
`edited,’ ‘can be created,’ and ‘ability to work,’ does not clearly disclaim systems
`
`lacking these benefits.”).
`
`Even if the meaning of “content” was limited to the specific file types listed
`
`in the ’154 patent, those examples include code that is not necessarily rendered by
`
`a Web browser. EXE files, JavaScript, and VBScript do not need to be rendered in
`
`a Web browser. ((Ex. 1001 at 12:49-52; Ex. 1039 at 17.) Interpreting a claim to
`
`exclude a preferred embodiment is rarely correct, see MBO Labs., Inc. v. Becton,
`
`Dickinson & Co., 474 F.3d 1323, 1333 (Fed. Cir. 2007), and unwarranted here.
`
`C. Extrinsic evidence supports Petitioner’s proposed construction of
`“content”
`Petitioner’s expert, Dr. Rubin, testified that “in the context of the ’154
`
`patent, content means code.” (Ex. 2005 at 20 (80:11-23)); Phillips, 415 F.3d at
`
`1318. Additionally, at least three sworn declarations in other cases involving the
`
`’154 patent from Finjan’s expert, Dr. Medvidovic, contradict Finjan’s proposed
`
`7
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`construction here. Under the narrower Phillips standard, Dr. Medvidovic testified
`
`that “content” in the challenged ’154 claims was not limited to content capable of
`
`being processed by a web browser. (Ex. 1039 at 17 (“[T]here is no requirement
`
`that scripts must be rendered in a web browser.”); Ex. 1041 at 19-20 (“[T]here is
`
`nothing in the specification or file history that would limit the term “content
`
`processor” to a web browser.”).) Dr. Medvidovic’s testimony in this case is entitled
`
`to no weight because it is contradicted by his prior sworn testimony and the
`
`intrinsic record. (Compare Ex. 2002 at ¶¶53-54 with Ex. 1039 at 17-18; Ex. 1040
`
`at 15-16; Ex. 1041 at 19-20; Ex. 1038 at 5-6 (14:9-18:13).)
`
`IV. GROUNDS 1 AND 2: KHAZAN IN COMBINATION WITH SIRER RENDER ALL
`BUT THE “MODIFIED INPUT VARIABLE” LIMITATION OF THE ASSERTED
`CLAIMS OBVIOUS
`The broad teachings of Khazan and Sirer render every limitation of the
`
`challenged claims but “modified input variable” obvious.3
`
`A. Khazan renders obvious “content received over a network”
`(Claims 1, 4, 6, and 10)
`When the broadest reasonable interpretation of “content” is applied, there is
`
`no dispute that Khazan teaches receiving content (instrumented libraries) over a
`
`
`
` 3
`
` Ben-Natan, discloses the “modified input variable” limitation of ’154 patent
`
`claims 6 and 10. (Section V below.)
`
`8
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`network. Even if Finjan’s proposed construction of “content” is adopted, it would
`
`have been obvious in view of Khazan to receive an instrumented application
`
`(content) over a network.
`
`1. Khazan’s libraries are “content received over a network”
`Finjan does not dispute that Khazan’s instrumented libraries can be received
`
`over a network. (Response at 20-21.) If the broadest reasonable interpretation of
`
`“content” is applied, the “content received over a network” limitations of
`
`challenged claims 1, 4, 6, and 10 are met by Khazan’s instrumented libraries.
`
`(Petition at 19-20; Ex. 1002 at ¶¶71, 79; Ex. 1003 at 28 (claims 34, 35), at 17,
`
`[0029-30], [0032], at 18, [0043], at 10 (Fig. 1 (Khazan teaches hosts and a storage
`
`system connected by a network)).)
`
`Finjan’s argument that a DLL must be resident in the computer’s file system
`
`and cannot be “received over a network” only distinguishes kernel32.dll—one type
`
`of library in Khazan—from the ’154 patent. (Response at 22.) Not all libraries
`
`must be “resident in the file system of the client computer before they can be
`
`executed,” as Finjan alleges. (Ex. 1003 at 26 [0118] (“[O]ther bodies of code, such
`
`as different types of libraries (memory loaded, rom- or flash-resident, and disk) …
`
`may also be instrumented and used in connection with the techniques described
`
`herein.”), at 19 [0062]; Ex. 1038 at 12-13 (44:23-46:5).)
`
`9
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`In addition, the challenged claims only require that “content” be “received”;
`
`there is no limitation preventing the content from being “received” and stored in a
`
`host file system before processing. (Response at 22; see, e.g., Ex. 1001 at 15,
`
`(claim 1).) Accordingly, Khazan’s instrumented libraries render obvious the
`
`“content received over a network” limitations of the challenged claims.
`
`2.
`
`The “content received over a network” limitations are
`obvious in view of Khazan’s instrumented application
`Khazan’s instrumentation technique can also be applied to both compiled
`
`and high-level applications: “the instrumentation technique described in one
`
`embodiment herein modifies the memory loaded copy of the application and
`
`associated libraries.” (Ex. 1003 at 21 [0075] (emphasis added), at 25-26, [114],
`
`[0118], at 21 [0079]; Ex. 1004 at 3-4 § 2.2 (Detours can be used to modify any
`
`Win32 binary and is not limited to libraries).)
`
`Finjan’s expert does not contest that Khazan discloses instrumenting an
`
`application. (Ex. 1038 at 11-12 (40:6-44:21).) Instead, Dr. Medvidovic testified
`
`that, in his opinion, Khazan does not enable instrumenting applications. (Id.) But
`
`the teachings of prior art are presumptively enabling. In re Antor Media Corp., 689
`
`F.3d 1282, 1287-88 (Fed. Cir. 2012) (“[B]oth claimed and unclaimed materials
`
`disclosed in a patent are presumptively enabling . . . .”). A different Board panel
`
`already found that Khazan teaches instrumenting applications. (Ex. 1043,
`
`10
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`Symantec Corp. v. The Trustees of Columbia Univ., IPR2015-00375, Paper 47 at
`
`15-16 (P.T.A.B. June 30, 2016).) Moreover, it was Finjan’s burden to show that
`
`Khazan’s teaching of instrumenting applications is not enabled, and Finjan neither
`
`made that argument nor met its burden. See Johns Manville Corp. v. Knauf
`
`Insulation, Inc., IPR2015-01402, Paper 45, at 13-16 (P.T.A.B. Oct. 19, 2016)
`
`(observing that patent owner bears the burden to show that prior art is not enabled).
`
`Additionally, persons of ordinary skill would have understood how to
`
`instrument an application based on Khazan’s specific references to Microsoft
`
`Detours and the IDA Pro disassembler. (Ex. 1045 at ¶¶1-15; Ex. 1003 at 21 [0075],
`
`at 25-26, [0114], [0118];); see Malico, Inc. v. Cooler Master USA Inc., 594 Fed.
`
`Appx. 621, 626 (Fed. Cir. 2014) (obviousness can be shown even where the prior
`
`art does not disclose each element of the challenged patent). In addition to binary
`
`applications, Khazan teaches instrumenting script applications. (Ex. 1003 at
`
`[0114].) Dr. Rubin explains that it would have been obvious to instrument such
`
`applications because they are written in human readable text, making it easy to
`
`identify function calls and insert wrapper functions. (Ex. 1002 at ¶¶ 50, 70, 40-53.)
`
`a. Khazan teaches receiving an application over a
`network
`Khazan describes a system where hosts communicate over a network. (Ex.
`
`1003 at [0029], Fig. 1, at 20 [0072]; at 17 [0032].) Khazan’s claim 35 recites that
`
`11
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`an instrumented binary is “obtained from at least one of: a data storage system and
`
`a host other than a host on which said application is executed.” (Ex. 1003 at 14
`
`(claim 34.) Khazan’s techniques may be used “with any one of a variety of
`
`different types of binary and machine-executable programs, as well as script
`
`programs, command programs, and the like.” (Ex. 1003 at 25 [0114].) In light of
`
`these two teachings, Khazan teaches receiving an application over a network.
`
`B. Khazan renders obvious “the content including a call to a first
`function” (Claims 1, 4, 6, and 10)
`Khazan’s call to API_A (202) is intercepted and transferred to the wrapper
`
`function via jump (204). (Ex. 1003 at 22 [0083] (“API_A includes a transfer or
`
`jump instruction to the wrapper of stub function.”).) The call 202 and jump 204
`
`meet the “call to a first function” limitation. (Ex. 1003 at 9, (Fig. 7); Ex. 2005 at 21
`
`(83:11-19) (a jump can be a call “[w]hen you call a function that involves jumping
`
`to the location in memory where that function code is.”).) The jump command
`
`disclosed by Khazan includes the call API_A (202), including return address, and
`
`is therefore a call. (Ex. 1003 at 22 [0084] (“Within the pre-monitoring portion of
`
`the wrapper function, the intercepted call is verified.”); see also id. at [0083-87].)
`
`Indeed, the purpose of Khazan’s dynamic malicious code analysis is to verify the
`
`call from the application. If the call was not included in the jump to the wrapper
`
`function, the call could not be verified. (Ex. 1003 at 20 [0067] (“[T]he dynamic
`
`12
`
`

`
`Petitioner’s Reply
`IPR2015-01979
`analyzer … performs run time validation of the application’s run time behavior
`
`characterized by the target calls being monitored.”); Ex. 2005 at 52 (207:8-11).)
`
`Khazan also teaches that jumps, calls, and transfers are interchangeable, and
`
`that a call can be direct or indirect. (Ex. 1003 at [0046] (“[T]he application
`
`executable 102 may include a jump instruction, a call instruction, or other types of
`
`instructions transferring control from the application….”), at 19 [0061], at 20
`
`[0064]; see also Ex. 1038 at 9 (32:11-33:4).) Based on these broad teachings,
`
`Khazan renders “call to a first function” obvious. See In re Baird, 16 F.3d 380, 383
`
`(Fed. Cir. 1994) (A “reference must be considered not only for what it expressly
`
`teaches, but also for what it fairly suggests.”).
`
`1.
`
`The teachings of Sirer and Khazan render obvious “the
`content including a call to a first function”
`Sirer inserts calls to the remote security service during instrumentation.
`
`(Petition at 20-21; Ex. 1004 at 6 (“The security service … inserting calls to the
`
`enforcement m