Palo Alto Networks, Inc., Petitioner
`v.
`Finjan, Inc., Patent Owner
`-----------------------
`IPR2015-01979
`----------------------
`U.S. Patent No. 8,141,154
`
`IPR2016-00919 (filed by Symantec Corp.) is joined with this proceeding
`
`Petitioner’s Oral Argument Demonstratives
`
`December 15, 2016
`
`1
`
`
`v.
`Finjan, Inc., Patent Owner
`-----------------------
`IPR2015-01979
`----------------------
`U.S. Patent No. 8,141,154
`
`IPR2016-00919 (filed by Symantec Corp.) is joined with this proceeding
`
`Petitioner’s Oral Argument Demonstratives
`
`December 15, 2016
`
`1
`
`
`
`Overview of Argument
`
`I. Overview of ‘154 patent
`II. Summary of the state of the art
`III. Sirer was readily available to the interested public
`IV. Claim construction: the BRI of “content” is “code”
`V. The instituted claims are obvious
`VI. The estoppel statute is inapplicable to PAN’s IPRs
`VII.Finjan’s motions to exclude evidence should be denied
`
`IPR2015-01979
`
`2
`
`
`
`Overview of ‘154 patent
`
`• The ’154 patent is directed at inspecting function call input variables for
`potentially malicious behavior to guard against malware. (See Ex. 1001
`Abstract)
`
`• Independent claims recite:
`- Static analysis (i.e., wrapping original function with substitute function)
`- Dynamic analysis (i.e., checking run-time values in the code)
`- Transmitting input variables for inspection at remote security computer
`- Invoking original function if security computer indicates it is safe
`(Paper 2 at 6-8; Ex. 1002 at ¶¶ 57-62)
`
`IPR2015-01979
`
`3
`
`
`
`Exemplary Claim 1 of the ‘154 Patent
`
`IPR2015-01979
`
`Ex. 1001 Claim 1.
`
`4
`
`
`
`Transmitters, receivers, and code inspectors were in prior art
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at Fig. 1.
`
`5
`
`
`
`Gateway and desktop security applications were known
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at 1:43-46.
`
`6
`
`
`
`Run-time analysis of function calls was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at 3:17-23.
`
`7
`
`
`
`Undisputed that wrapping functions to detect dynamically
`generated malicious code was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40.
`
`8
`
`
`
`Undisputed that wrapping functions to detect dynamically
`generated malicious code was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40, Ex. 1015 at 22; Ex. 1011 at 4.
`
`9
`
`
`
`Sole alleged point of novelty:
`inspecting input at remote computer
`
`• The sole point of novelty of the claimed invention lies in
`distributing the dynamic (run-time) inspection of the input
`variables to a remote computer. (Paper 2 at 1, citing Ex. 1001 at
`4:15-26.)
`
`IPR2015-01979
`
`Ex. 1001 at 4:15-26.
`10
`
`
`
`Sirer (Ex. 1004) is Prior Art
`
`Sirer (Ex. 1004) is Prior Art
`
`
`
`11
`
`
`
`Evidence of the publication and public availability of
`Sirer is clear, convincing, and unrebutted
`
`• Finjan does not dispute that
`• Sirer was published in the ACM Operating Systems Review
`• ACM Operating Systems Review is an established, respected
`academic journal
`• The University of Washington Engineering Library subscribed to
`ACM Operating Systems Review and received the journal that
`contained the Sirer article
`• ACM Operating Systems Review was publicly available in the
`University of Washington Engineering Library
`Inspec research database indexed ACM Operating Systems
`Review articles
`• Finjan only disputes public availability, but evidence overwhelmingly
`shows Sirer was available and was accessed
`
`•
`
`IPR2015-01979
`
`Ex. 1036, DeSart Declaration; Ex. 2006, DeSart Dep. Trans.;
`Paper 35, Petitioner’s Reply, at 2-5.
`
`12
`
`
`
`Declaration from Head of UW Eng’g Library confirms publication
`
`IPR2015-01979
`
`Ex. 1036
`
`13
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer in 2000
`
`IPR2015-01979
`
`Ex. 1036
`
`14
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer in ACM
`Operating Systems Review journal received by UW Eng’g Library
`
`IPR2015-01979
`
`Ex. 1036 Ex. A
`
`15
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer
`
`IPR2015-01979
`
`Ex. 1036 Ex. A
`
`16
`
`
`
`DeSart testimony confirms Sirer was available to the public on the
`shelf in alphabetical order or by searching catalog for journal
`
`• At UW Engineering Library, ACM Operating Systems Review journal
`was on the shelf in alphabetical order by title of journal and in library’s
`catalog
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. at 10:13-18.
`
`17
`
`
`
`DeSart testimony confirms Sirer was indexed and searchable
`in the Inspec database
`
`• Sirer article was indexed and searchable in Inspec database
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. at 12:2-18.
`18
`
`
`
`U.S. Patent 6,324,685 issued in 2001 and cited Sirer—
`confirming public availability and accessibility
`
`•
`
`‘685 patent confirms that Sirer was available to the interested public in
`2001
`
`IPR2015-01979
`
`Ex. 1024
`
`19
`
`
`
`The Broadest Reasonable Interpretation of
`“Content” is “Code”
`
`20
`
`
`
`Finjan’s proposed construction of “content” is not
`the broadest reasonable interpretation
`
`• Finjan: “a data container that can be rendered by a client web browser”
`
`• PAN: “code”
`
`IPR2015-01979
`
`21
`
`
`
`Claims of the ‘154 patent do not limit meaning of “content”
`
`IPR2015-01979
`
`Ex. 1001 Claim 1.
`
`22
`
`
`
`‘154 patent specification describes “content”
`broadly and without limits
`
`IPR2015-01979
`
`Ex. 1001 at 13:47-52.
`
`23
`
`
`
`There is no disavowal of claim scope
`
`• Hill-Rom Services, Inc. v. Stryker Corp., 755 F.3d 1367 (Fed. Cir.
`2014)
`•
`“Disavowal requires that the specification or prosecution
`history make clear that the invention does not include a
`particular feature.”
`
`•
`
`i4i Partnership v. Microsoft Corp., 598 F.3d 831, 844 (Fed. Cir.
`2010)
`•
`“The specification's permissive language, ‘could be edited,’
`‘can be created,’ and ‘ability to work,’ does not clearly
`disclaim systems lacking these benefits.”
`
`IPR2015-01979
`
`24
`
`
`
`Finjan’s construction improperly excludes
`preferred embodiments
`
`• Finjan’s expert Dr. Medvidovic: EXE files, JavaScript, and VBScript do
`not need to be rendered in a Web browser
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`25
`
`
`
`Dr. Medvidovic’s sworn testimony to the Board
`
`Ex. 2002, Medvidovic Decl. ¶ 53.
`
`Ex. 2002, Medvidovic Decl. ¶ 54.
`
`26
`
`IPR2015-01979
`
`
`
`Dr. Medvidovic’s sworn testimony to the Board
`
`IPR2015-01979
`
`Ex. 2002, Medvidovic Decl. at 81.
`
`27
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`Ex. 1039, Medvidovic Decl. at 1.
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 23.
`
`28
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`Ex. 1041, Medvidovic Decl. at 1.
`
`IPR2015-01979
`
`Ex. 1041, Medvidovic Decl. at 19.
`
`29
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`IPR2015-01979
`
`Ex. 1041, Medvidovic Decl. at 23.
`
`30
`
`
`
`The Instituted Obviousness Grounds
`
`31
`
`
`
`Khazan’s libraries are “content received over a network”
`
`•
`
`If the Board construes “content” as “code,” Khazan’s libraries are
`“content received over a network”
`
`IPR2015-01979
`
`Ex. 1003.
`
`32
`
`
`
`Khazan’s libraries are “content received over a network”
`
`• Khazan broadly discloses using its system over all types of networks
`
`IPR2015-01979
`
`Ex. 1003.
`
`33
`
`
`
`Khazan’s libraries are “content received over a network”
`
`• Finjan’s expert Dr. Medvidovic admitted that libraries contain
`executable code and can be transferred over a network
`
`IPR2015-01979
`
`Ex. 1038, Medvidovic Tr. at 45:3-21.
`34
`
`
`
`The “content received over a network” limitations are obvious
`in view of Khazan’s instrumented application
`
`• Khazan’s disclosure explicitly teaches instrumenting applications
`
`IPR2015-01979
`
`Ex. 1003.
`
`35
`
`
`
`The “content received over a network” limitations are obvious in
`view of Khazan’s instrumented application
`
`• Khazan’s disclosure explicitly teaches instrumenting applications
`
`IPR2015-01979
`
`Ex. 1003.
`
`36
`
`
`
`Finjan’s expert Dr. Medvidovic ignores Khazan’s broad disclosure
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Tr. at 42:17-43:8.
`
`37
`
`
`
`Medvidovic complains that Khazan does not teach how to
`instrument applications, but enablement is not at issue in this IPR
`
`IPR2015-01979
`
`Ex. 2002, Medvidovic Decl.
`
`38
`
`
`
`Dr. Medvidovic also ignores Finjan’s admissions in this IPR that
`instrumenting applications was well known in the prior art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40, Ex. 1015 at 22-23.
`
`39
`
`
`
`Another Board panel already found what Dr. Medvidovic refuses
`to acknowledge: Khazan teaches instrumenting applications
`
`• Symantec Corp. v. The Trustees of Columbia Univ., IPR2015-00375,
`Paper 47 at 15-16 (P.T.A.B. June 30, 2016).
`
`IPR2015-01979
`
`Ex. 1043 at 15-16.
`
`40
`
`
`
`Another Board panel already found what Dr. Medvidovic refuses
`to acknowledge: Khazan teaches instrumenting applications
`
`• Symantec Corp. v. The Trustees of Columbia Univ., IPR2015-00375,
`Paper 47 at 15-16 (P.T.A.B. June 30, 2016).
`
`IPR2015-01979
`
`Ex. 1043 at 16 n.4.
`
`41
`
`
`
`Khazan’s broad disclosures render the
`“content including a call to a first function” limitations obvious
`
`• The purpose of Khazan’s malicious code analysis is to verify calls from
`an application
`
`IPR2015-01979
`
`Ex. 1003 at 20 [0067].
`
`42
`
`
`
`The “content including a call to a first function” limitations are
`obvious in view of Khazan’s call 202 and jump 204
`
`IPR2015-01979
`
`Petition at 24.
`
`43
`
`
`
`Kazan teaches that jumps, calls, and transfers
`are interchangeable
`
`IPR2015-01979
`
`Ex. 1003 at 18 [0046].
`
`44
`
`
`
`Kazan teaches that calls can be direct or indirect
`
`IPR2015-01979
`
`Ex. 1003 at 19 [0057], [0061].
`
`45
`45
`
`
`
`Finjan’s expert Dr. Medvidovic
`agrees that calls can be direct or indirect
`
`IPR2015-01979
`
`46
`Ex. 1038, Medvidovic Dep. Tr. at 32:11-23.
`
`46
`
`
`
`Finjan’s expert Dr. Goodrich testified that Khazan teaches that a
`library can include a call to a function
`
`IPR2015-01979
`
`Ex. 1047, Goodrich Dep. Tr., at 40:6-14
`
`47
`47
`
`
`
`Estoppel Arguments
`35 U.S.C. § 315(e)(1)
`Estoppel Arguments
`
`35 U.S.C. § 315(e)(1)
`
`
`
`48
`
`
`
`There is no need for the Board to reach the estoppel issue
`
`• No need for the Board to reach the estoppel issue
`• Schedules allow for issuance of final written decisions at the same
`time
`• Oral argument dates
`•
`IPR2015-01979: December 15, 2016
`•
`IPR2016-00151: January 24, 2017
`• Final written decision deadlines
`•
`IPR2015-01979: March 21, 2017 (Paper 9)
`•
`IPR2016-00151: April 20, 2017 (Paper 11)
`• No Board decision has applied estoppel to cases only weeks apart
`• Normal practice is to decide cases at the same time
`• See IPR2014-00052 and IPR2014-00053 (decided same day)
`
`IPR2015-01979
`
`49
`
`
`
`The estoppel statute does not apply to these proceedings
`
`• Estoppel statute will not apply to these proceedings
`• Oral argument in IPR2016-00151 will occur on January 24, 2017
`• Upon completion of oral argument, Board takes parties’ arguments
`under submission and decides IPR without action by Petitioner
`• Prohibition against “maintaining” a proceeding refers only to
`actions parties must take
`• CBS Interactive Inc. v. Helferich Patent Licensing, LLC, IPR2013-
`00033, Paper 118 at 2-3 (Oct. 23, 2013) (holding that by time
`proceeding reaches final oral hearing, trial is complete)
`
`IPR2015-01979
`IPR2015-01979
`
`50
`
`
`
`Even if Board concludes PAN may be estopped, the Board
`should enter final written decisions in both IPRs
`
`• The Board is not subject to estoppel
`• Progressive Casualty Insurance Co. v. Liberty Mutual Insurance
`Co., No. 2014-1466, 2015 WL 5004949, at *2 (Fed. Cir. Aug. 24,
`2015) (“by its terms [§ 325(e)(1)] does not prohibit the Board from
`reaching decisions. It limits only certain (requesting or maintaining)
`actions by a Petitioner.”)
`
`• The public interest favors decision of fully argued, submitted cases
`• Apple Inc. v. Smartflash LLC, CBM2015-00015, Paper 49 (Nov. 4,
`2015) (finding petitioner estopped, but choosing to issue FWD
`anyway despite six month gap between final written decisions
`because record was already fully developed)
`
`IPR2015-01979
`
`51
`
`
`
`The Board should enter final written decisions in both IPRs
`because Symantec will remain a petitioner
`
`•
`
`• Even if estoppel were found to apply to PAN, IPR2016-00151 will live
`on
`IPR cannot be terminated unless “no Petitioner remains in the inter
`partes review.” 35 U.S.C. § 317(a)
`• Symantec need not take any action to remain a joinder party
`• Symantec could not have raised the grounds instituted in IPR2016-
`00151 when it moved to join this case
`• Harmonix Music Systems, Inc. v. Princeton Digital Image Corp.,
`IPR2015-00271, Paper 15 at 4 (“the Petition includes a new
`challenge to both a claim not instituted in the ’635 IPR, claim 14,
`and claims instituted in the ’635 IPR, claims 5–7 and 16–18, based
`on a new combination of references considered in the ’635 IPR”)
`
`IPR2015-01979
`
`52
`
`
`
`Finjan’s arguments for estoppel are unpersuasive
`
`• Finjan fails to address the timing, public interest, or joinder issues central
`to estoppel considerations in this case
`
`• Finjan admits “petitioner estoppel is not yet ripe” (Paper 42 at 4)
`• But seeks premature application of estoppel by stay or termination
`• Estoppel only accrues after written decision (35 U.S.C. § 315(e)(1))
`
`• Finjan’s § 315(d) argument is procedurally improper and too late
`• Not raised in Preliminary Response, Response, or by motion
`
`IPR2015-01979
`
`53
`
`
`
`Finjan’s Motion to Exclude Should Be
`Denied
`
`54
`
`
`
`Finjan’s new construction of “content”
`in its Patent Owner Response relied on Dr. Medvidovic
`
`Ex. 2002, Medvidovic Decl. ¶ 53.
`
`Ex. 2002, Medvidovic Decl. ¶ 54.
`
`55
`
`IPR2015-01979
`
`
`
`Dr. Medvidovic’s Declarations (Exs. 1039-1041) in district court
`contradict Finjan’s new construction of “content”
`
`Ex. 1039, Medvidovic Decl. at 1.
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 23.
`
`56
`
`
`
`Dr. Medvidovic testified that Khazan did not enable
`instrumenting scripts or applications
`
`IPR2015-01979
`
`Ex. 1038, Medvidovic Dep. Tr. at 148:24-149:13, 151:8-16.
`
`57
`57
`
`
`
`Dr. Rubin’s Supplemental Declaration and the Nebenzahl Article
`respond to Dr. Medvidovic’s testimony
`
`IPR2015-01979
`
`Ex. 1045, Supplemental Rubin Decl. at ¶¶ 11, 14 citing Ex. 1044, Nebenzahl.
`
`58
`
`
`
`The Board granted PAN’s request to submit the DeSart Decl. (Ex.
`1036) as supplemental information and it should not be excluded
`
`IPR2015-01979
`
`Ex. 1037, June 14, 2016 Board Call Tr. at 24:5-13.
`
`59
`
`
`
`Finjan waived its argument to exclude the
`DeSart Declaration as improper new evidence
`
`• Finjan did not object to the Board’s order granting PAN’s motion to admit
`the DeSart Declaration as supplemental information, nor did Finjan ask
`the Board to reconsider its decision.
`
`IPR2015-01979
`
`Ex. 1037, June 14, 2016 Board Call Tr. at 20:11-14.
`
`60
`
`
`
`Finjan abandoned its pursuit of Dr. Sirer’s deposition
`even though the Board decided not to exclude it
`
`IPR2015-01979
`
`Ex. 2037, November 16, 2016 Board Call Tr. at 7:17-8:7.
`
`61
`
`
`
`Mr. DeSart authenticated the Sirer Article (Ex. 1004)
`
`IPR2015-01979
`
`DeSart Decl. Exhibit 1036.
`62
`
`
`
`Mr. DeSart’s testimony confirms
`the authenticity of the Sirer Article
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. At 6:19-7:8.
`
`63
`
`
`
`U.S. Patent 6,324,685—issued in 2001 and cited Sirer—
`is relevant to show public availability and accessibility
`
`IPR2015-01979
`
`Ex. 1024
`64
`
`
`
`Questions?
`
`Questions?
`
`
`
`65
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
