`v.
`Finjan, Inc., Patent Owner
`-----------------------
`IPR2015-01979
`----------------------
`U.S. Patent No. 8,141,154
`
`IPR2016-00919 (filed by Symantec Corp.) is joined with this proceeding
`
`Petitioner’s Oral Argument Demonstratives
`
`December 15, 2016
`
`1
`
`
`
`Overview of Argument
`
`I. Overview of ‘154 patent
`II. Summary of the state of the art
`III. Sirer was readily available to the interested public
`IV. Claim construction: the BRI of “content” is “code”
`V. The instituted claims are obvious
`VI. The estoppel statute is inapplicable to PAN’s IPRs
`VII.Finjan’s motions to exclude evidence should be denied
`
`IPR2015-01979
`
`2
`
`
`
`Overview of ‘154 patent
`
`• The ’154 patent is directed at inspecting function call input variables for
`potentially malicious behavior to guard against malware. (See Ex. 1001
`Abstract)
`
`• Independent claims recite:
`- Static analysis (i.e., wrapping original function with substitute function)
`- Dynamic analysis (i.e., checking run-time values in the code)
`- Transmitting input variables for inspection at remote security computer
`- Invoking original function if security computer indicates it is safe
`(Paper 2 at 6-8; Ex. 1002 at ¶¶ 57-62)
`
`IPR2015-01979
`
`3
`
`
`
`Exemplary Claim 1 of the ‘154 Patent
`
`IPR2015-01979
`
`Ex. 1001 Claim 1.
`
`4
`
`
`
`Transmitters, receivers, and code inspectors were in prior art
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at Fig. 1.
`
`5
`
`
`
`Gateway and desktop security applications were known
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at 1:43-46.
`
`6
`
`
`
`Run-time analysis of function calls was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-9; Ex. 1001 at 3:17-23.
`
`7
`
`
`
`Undisputed that wrapping functions to detect dynamically
`generated malicious code was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40.
`
`8
`
`
`
`Undisputed that wrapping functions to detect dynamically
`generated malicious code was known in the art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40, Ex. 1015 at 22; Ex. 1011 at 4.
`
`9
`
`
`
`Sole alleged point of novelty:
`inspecting input at remote computer
`
`• The sole point of novelty of the claimed invention lies in
`distributing the dynamic (run-time) inspection of the input
`variables to a remote computer. (Paper 2 at 1, citing Ex. 1001 at
`4:15-26.)
`
`IPR2015-01979
`
`Ex. 1001 at 4:15-26.
`10
`
`
`
`Sirer (Ex. 1004) is Prior Art
`
`Sirer (Ex. 1004) is Prior Art
`
`
`
`11
`
`
`
`Evidence of the publication and public availability of
`Sirer is clear, convincing, and unrebutted
`
`• Finjan does not dispute that
`• Sirer was published in the ACM Operating Systems Review
`• ACM Operating Systems Review is an established, respected
`academic journal
`• The University of Washington Engineering Library subscribed to
`ACM Operating Systems Review and received the journal that
`contained the Sirer article
`• ACM Operating Systems Review was publicly available in the
`University of Washington Engineering Library
`Inspec research database indexed ACM Operating Systems
`Review articles
`• Finjan only disputes public availability, but evidence overwhelmingly
`shows Sirer was available and was accessed
`
`•
`
`IPR2015-01979
`
`Ex. 1036, DeSart Declaration; Ex. 2006, DeSart Dep. Trans.;
`Paper 35, Petitioner’s Reply, at 2-5.
`
`12
`
`
`
`Declaration from Head of UW Eng’g Library confirms publication
`
`IPR2015-01979
`
`Ex. 1036
`
`13
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer in 2000
`
`IPR2015-01979
`
`Ex. 1036
`
`14
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer in ACM
`Operating Systems Review journal received by UW Eng’g Library
`
`IPR2015-01979
`
`Ex. 1036 Ex. A
`
`15
`
`
`
`Declaration of Mel DeSart confirms publication of Sirer
`
`IPR2015-01979
`
`Ex. 1036 Ex. A
`
`16
`
`
`
`DeSart testimony confirms Sirer was available to the public on the
`shelf in alphabetical order or by searching catalog for journal
`
`• At UW Engineering Library, ACM Operating Systems Review journal
`was on the shelf in alphabetical order by title of journal and in library’s
`catalog
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. at 10:13-18.
`
`17
`
`
`
`DeSart testimony confirms Sirer was indexed and searchable
`in the Inspec database
`
`• Sirer article was indexed and searchable in Inspec database
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. at 12:2-18.
`18
`
`
`
`U.S. Patent 6,324,685 issued in 2001 and cited Sirer—
`confirming public availability and accessibility
`
`•
`
`‘685 patent confirms that Sirer was available to the interested public in
`2001
`
`IPR2015-01979
`
`Ex. 1024
`
`19
`
`
`
`The Broadest Reasonable Interpretation of
`“Content” is “Code”
`
`20
`
`
`
`Finjan’s proposed construction of “content” is not
`the broadest reasonable interpretation
`
`• Finjan: “a data container that can be rendered by a client web browser”
`
`• PAN: “code”
`
`IPR2015-01979
`
`21
`
`
`
`Claims of the ‘154 patent do not limit meaning of “content”
`
`IPR2015-01979
`
`Ex. 1001 Claim 1.
`
`22
`
`
`
`‘154 patent specification describes “content”
`broadly and without limits
`
`IPR2015-01979
`
`Ex. 1001 at 13:47-52.
`
`23
`
`
`
`There is no disavowal of claim scope
`
`• Hill-Rom Services, Inc. v. Stryker Corp., 755 F.3d 1367 (Fed. Cir.
`2014)
`•
`“Disavowal requires that the specification or prosecution
`history make clear that the invention does not include a
`particular feature.”
`
`•
`
`i4i Partnership v. Microsoft Corp., 598 F.3d 831, 844 (Fed. Cir.
`2010)
`•
`“The specification's permissive language, ‘could be edited,’
`‘can be created,’ and ‘ability to work,’ does not clearly
`disclaim systems lacking these benefits.”
`
`IPR2015-01979
`
`24
`
`
`
`Finjan’s construction improperly excludes
`preferred embodiments
`
`• Finjan’s expert Dr. Medvidovic: EXE files, JavaScript, and VBScript do
`not need to be rendered in a Web browser
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`25
`
`
`
`Dr. Medvidovic’s sworn testimony to the Board
`
`Ex. 2002, Medvidovic Decl. ¶ 53.
`
`Ex. 2002, Medvidovic Decl. ¶ 54.
`
`26
`
`IPR2015-01979
`
`
`
`Dr. Medvidovic’s sworn testimony to the Board
`
`IPR2015-01979
`
`Ex. 2002, Medvidovic Decl. at 81.
`
`27
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`Ex. 1039, Medvidovic Decl. at 1.
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 23.
`
`28
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`Ex. 1041, Medvidovic Decl. at 1.
`
`IPR2015-01979
`
`Ex. 1041, Medvidovic Decl. at 19.
`
`29
`
`
`
`Dr. Medvidovic’s contradictory sworn testimony in U.S. District
`Court, under the narrower Phillips claim construction standard
`
`IPR2015-01979
`
`Ex. 1041, Medvidovic Decl. at 23.
`
`30
`
`
`
`The Instituted Obviousness Grounds
`
`31
`
`
`
`Khazan’s libraries are “content received over a network”
`
`•
`
`If the Board construes “content” as “code,” Khazan’s libraries are
`“content received over a network”
`
`IPR2015-01979
`
`Ex. 1003.
`
`32
`
`
`
`Khazan’s libraries are “content received over a network”
`
`• Khazan broadly discloses using its system over all types of networks
`
`IPR2015-01979
`
`Ex. 1003.
`
`33
`
`
`
`Khazan’s libraries are “content received over a network”
`
`• Finjan’s expert Dr. Medvidovic admitted that libraries contain
`executable code and can be transferred over a network
`
`IPR2015-01979
`
`Ex. 1038, Medvidovic Tr. at 45:3-21.
`34
`
`
`
`The “content received over a network” limitations are obvious
`in view of Khazan’s instrumented application
`
`• Khazan’s disclosure explicitly teaches instrumenting applications
`
`IPR2015-01979
`
`Ex. 1003.
`
`35
`
`
`
`The “content received over a network” limitations are obvious in
`view of Khazan’s instrumented application
`
`• Khazan’s disclosure explicitly teaches instrumenting applications
`
`IPR2015-01979
`
`Ex. 1003.
`
`36
`
`
`
`Finjan’s expert Dr. Medvidovic ignores Khazan’s broad disclosure
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Tr. at 42:17-43:8.
`
`37
`
`
`
`Medvidovic complains that Khazan does not teach how to
`instrument applications, but enablement is not at issue in this IPR
`
`IPR2015-01979
`
`Ex. 2002, Medvidovic Decl.
`
`38
`
`
`
`Dr. Medvidovic also ignores Finjan’s admissions in this IPR that
`instrumenting applications was well known in the prior art
`
`IPR2015-01979
`
`Paper 2 at 6-7; Ex. 1002, Rubin Decl. ¶ 40, Ex. 1015 at 22-23.
`
`39
`
`
`
`Another Board panel already found what Dr. Medvidovic refuses
`to acknowledge: Khazan teaches instrumenting applications
`
`• Symantec Corp. v. The Trustees of Columbia Univ., IPR2015-00375,
`Paper 47 at 15-16 (P.T.A.B. June 30, 2016).
`
`IPR2015-01979
`
`Ex. 1043 at 15-16.
`
`40
`
`
`
`Another Board panel already found what Dr. Medvidovic refuses
`to acknowledge: Khazan teaches instrumenting applications
`
`• Symantec Corp. v. The Trustees of Columbia Univ., IPR2015-00375,
`Paper 47 at 15-16 (P.T.A.B. June 30, 2016).
`
`IPR2015-01979
`
`Ex. 1043 at 16 n.4.
`
`41
`
`
`
`Khazan’s broad disclosures render the
`“content including a call to a first function” limitations obvious
`
`• The purpose of Khazan’s malicious code analysis is to verify calls from
`an application
`
`IPR2015-01979
`
`Ex. 1003 at 20 [0067].
`
`42
`
`
`
`The “content including a call to a first function” limitations are
`obvious in view of Khazan’s call 202 and jump 204
`
`IPR2015-01979
`
`Petition at 24.
`
`43
`
`
`
`Kazan teaches that jumps, calls, and transfers
`are interchangeable
`
`IPR2015-01979
`
`Ex. 1003 at 18 [0046].
`
`44
`
`
`
`Kazan teaches that calls can be direct or indirect
`
`IPR2015-01979
`
`Ex. 1003 at 19 [0057], [0061].
`
`45
`45
`
`
`
`Finjan’s expert Dr. Medvidovic
`agrees that calls can be direct or indirect
`
`IPR2015-01979
`
`46
`Ex. 1038, Medvidovic Dep. Tr. at 32:11-23.
`
`46
`
`
`
`Finjan’s expert Dr. Goodrich testified that Khazan teaches that a
`library can include a call to a function
`
`IPR2015-01979
`
`Ex. 1047, Goodrich Dep. Tr., at 40:6-14
`
`47
`47
`
`
`
`Estoppel Arguments
`35 U.S.C. § 315(e)(1)
`Estoppel Arguments
`
`35 U.S.C. § 315(e)(1)
`
`
`
`48
`
`
`
`There is no need for the Board to reach the estoppel issue
`
`• No need for the Board to reach the estoppel issue
`• Schedules allow for issuance of final written decisions at the same
`time
`• Oral argument dates
`•
`IPR2015-01979: December 15, 2016
`•
`IPR2016-00151: January 24, 2017
`• Final written decision deadlines
`•
`IPR2015-01979: March 21, 2017 (Paper 9)
`•
`IPR2016-00151: April 20, 2017 (Paper 11)
`• No Board decision has applied estoppel to cases only weeks apart
`• Normal practice is to decide cases at the same time
`• See IPR2014-00052 and IPR2014-00053 (decided same day)
`
`IPR2015-01979
`
`49
`
`
`
`The estoppel statute does not apply to these proceedings
`
`• Estoppel statute will not apply to these proceedings
`• Oral argument in IPR2016-00151 will occur on January 24, 2017
`• Upon completion of oral argument, Board takes parties’ arguments
`under submission and decides IPR without action by Petitioner
`• Prohibition against “maintaining” a proceeding refers only to
`actions parties must take
`• CBS Interactive Inc. v. Helferich Patent Licensing, LLC, IPR2013-
`00033, Paper 118 at 2-3 (Oct. 23, 2013) (holding that by time
`proceeding reaches final oral hearing, trial is complete)
`
`IPR2015-01979
`IPR2015-01979
`
`50
`
`
`
`Even if Board concludes PAN may be estopped, the Board
`should enter final written decisions in both IPRs
`
`• The Board is not subject to estoppel
`• Progressive Casualty Insurance Co. v. Liberty Mutual Insurance
`Co., No. 2014-1466, 2015 WL 5004949, at *2 (Fed. Cir. Aug. 24,
`2015) (“by its terms [§ 325(e)(1)] does not prohibit the Board from
`reaching decisions. It limits only certain (requesting or maintaining)
`actions by a Petitioner.”)
`
`• The public interest favors decision of fully argued, submitted cases
`• Apple Inc. v. Smartflash LLC, CBM2015-00015, Paper 49 (Nov. 4,
`2015) (finding petitioner estopped, but choosing to issue FWD
`anyway despite six month gap between final written decisions
`because record was already fully developed)
`
`IPR2015-01979
`
`51
`
`
`
`The Board should enter final written decisions in both IPRs
`because Symantec will remain a petitioner
`
`•
`
`• Even if estoppel were found to apply to PAN, IPR2016-00151 will live
`on
`IPR cannot be terminated unless “no Petitioner remains in the inter
`partes review.” 35 U.S.C. § 317(a)
`• Symantec need not take any action to remain a joinder party
`• Symantec could not have raised the grounds instituted in IPR2016-
`00151 when it moved to join this case
`• Harmonix Music Systems, Inc. v. Princeton Digital Image Corp.,
`IPR2015-00271, Paper 15 at 4 (“the Petition includes a new
`challenge to both a claim not instituted in the ’635 IPR, claim 14,
`and claims instituted in the ’635 IPR, claims 5–7 and 16–18, based
`on a new combination of references considered in the ’635 IPR”)
`
`IPR2015-01979
`
`52
`
`
`
`Finjan’s arguments for estoppel are unpersuasive
`
`• Finjan fails to address the timing, public interest, or joinder issues central
`to estoppel considerations in this case
`
`• Finjan admits “petitioner estoppel is not yet ripe” (Paper 42 at 4)
`• But seeks premature application of estoppel by stay or termination
`• Estoppel only accrues after written decision (35 U.S.C. § 315(e)(1))
`
`• Finjan’s § 315(d) argument is procedurally improper and too late
`• Not raised in Preliminary Response, Response, or by motion
`
`IPR2015-01979
`
`53
`
`
`
`Finjan’s Motion to Exclude Should Be
`Denied
`
`54
`
`
`
`Finjan’s new construction of “content”
`in its Patent Owner Response relied on Dr. Medvidovic
`
`Ex. 2002, Medvidovic Decl. ¶ 53.
`
`Ex. 2002, Medvidovic Decl. ¶ 54.
`
`55
`
`IPR2015-01979
`
`
`
`Dr. Medvidovic’s Declarations (Exs. 1039-1041) in district court
`contradict Finjan’s new construction of “content”
`
`Ex. 1039, Medvidovic Decl. at 1.
`
`Ex. 1039, Medvidovic Decl. at 16.
`
`IPR2015-01979
`
`Ex. 1039, Medvidovic Decl. at 23.
`
`56
`
`
`
`Dr. Medvidovic testified that Khazan did not enable
`instrumenting scripts or applications
`
`IPR2015-01979
`
`Ex. 1038, Medvidovic Dep. Tr. at 148:24-149:13, 151:8-16.
`
`57
`57
`
`
`
`Dr. Rubin’s Supplemental Declaration and the Nebenzahl Article
`respond to Dr. Medvidovic’s testimony
`
`IPR2015-01979
`
`Ex. 1045, Supplemental Rubin Decl. at ¶¶ 11, 14 citing Ex. 1044, Nebenzahl.
`
`58
`
`
`
`The Board granted PAN’s request to submit the DeSart Decl. (Ex.
`1036) as supplemental information and it should not be excluded
`
`IPR2015-01979
`
`Ex. 1037, June 14, 2016 Board Call Tr. at 24:5-13.
`
`59
`
`
`
`Finjan waived its argument to exclude the
`DeSart Declaration as improper new evidence
`
`• Finjan did not object to the Board’s order granting PAN’s motion to admit
`the DeSart Declaration as supplemental information, nor did Finjan ask
`the Board to reconsider its decision.
`
`IPR2015-01979
`
`Ex. 1037, June 14, 2016 Board Call Tr. at 20:11-14.
`
`60
`
`
`
`Finjan abandoned its pursuit of Dr. Sirer’s deposition
`even though the Board decided not to exclude it
`
`IPR2015-01979
`
`Ex. 2037, November 16, 2016 Board Call Tr. at 7:17-8:7.
`
`61
`
`
`
`Mr. DeSart authenticated the Sirer Article (Ex. 1004)
`
`IPR2015-01979
`
`DeSart Decl. Exhibit 1036.
`62
`
`
`
`Mr. DeSart’s testimony confirms
`the authenticity of the Sirer Article
`
`IPR2015-01979
`
`Ex. 2006, DeSart Tr. At 6:19-7:8.
`
`63
`
`
`
`U.S. Patent 6,324,685—issued in 2001 and cited Sirer—
`is relevant to show public availability and accessibility
`
`IPR2015-01979
`
`Ex. 1024
`64
`
`
`
`Questions?
`
`Questions?
`
`
`
`65