trials@uspto.gov
`
`571-272-7822
`
`
`
`
`
`
`IPR2015-02001, Paper No. 40
`IPR2016-00157, Paper No. 23
`February 1, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC.,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2015-02001
`Case IPR2016-001571
`Patent 8,225,408 B2
`____________
`
`Held: January 5, 2017
`____________
`
`
`
`
`
`BEFORE: THOMAS L. GIANNETTI, MIRIAM L. QUINN, and
`PATRICK M. BOUCHER, Administrative Patent Judges.
`
`The above-entitled matter came on for hearing on Thursday,
`January 5, 2017, commencing at 1:30 p.m., at the U.S. Patent and
`Trademark Office, 600 Dulany Street, Alexandria, Virginia.
`
`
`
`
`1 Case IPR2016-00157 has been consolidated with IPR2015-
`02001 (“the consolidated proceeding”). Cases IPR2016-00955
`and IPR2016-00956 have been consolidated and joined with the
`consolidated proceeding.
`
`
`
`571-272-7822
`
`
`
`
`
`
`IPR2015-02001, Paper No. 40
`IPR2016-00157, Paper No. 23
`February 1, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC.,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2015-02001
`Case IPR2016-001571
`Patent 8,225,408 B2
`____________
`
`Held: January 5, 2017
`____________
`
`
`
`
`
`BEFORE: THOMAS L. GIANNETTI, MIRIAM L. QUINN, and
`PATRICK M. BOUCHER, Administrative Patent Judges.
`
`The above-entitled matter came on for hearing on Thursday,
`January 5, 2017, commencing at 1:30 p.m., at the U.S. Patent and
`Trademark Office, 600 Dulany Street, Alexandria, Virginia.
`
`
`
`
`1 Case IPR2016-00157 has been consolidated with IPR2015-
`02001 (“the consolidated proceeding”). Cases IPR2016-00955
`and IPR2016-00956 have been consolidated and joined with the
`consolidated proceeding.
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`APPEARANCES:
`
`
`
`ON BEHALF OF THE PETITIONER:
`
`
`
`
`
`
`
`
`
`
`
`BRIAN EUTERMOSER, ESQUIRE
`ORION ARMON, ESQUIRE
`
`Cooley LLP
`380 Interlocken Crescent
`Suite 900
`Broomfield, Colorado 80021-8023
`
`JAMES HANNAH, ESQUIRE
`AAKASH JARIWALA, ESQUIRE
`SHANNON H. HEDVAT, ESQUIRE
`Kramer, Levin, Naftalis & Frankel, LLP
`990 Marsh Road
`Menlo Park, California 94025-1949
`
`
`
`
`
` 2
`
`ON BEHALF OF PATENT OWNER:
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`P R O C E E D I N G S
`- - - - -
`JUDGE GIANNETTI: So this is the second hearing
`today. This case is IPR2015-2001, which has been joined with
`case IPR2016-00157, Palo Alto Networks Inc., versus Finjan, Inc.
`This is the final hearing. I am Judge Giannetti. On the screen to
`my left is Judge Boucher. Judge Quinn is on the screen to my
`right. They are participating in this hearing remotely. And Judge
`Boucher will be presiding. So Judge Boucher.
`JUDGE BOUCHER: Thank you. Just to clarify the
`record, there are actually two other IPRs involved here as well,
`IPR2015-2001 and 2016-157 have been consolidated with Palo
`Alto Networks as the petitioner, but then there is also 2016-955
`and 956, which have been joined to these proceedings, filed by
`Blue Coat Systems. And those two have also been consolidated.
`Before we begin, I just want to remind the parties that
`the hearing is open to the public and a full transcript of it will
`become part of the record. Also please keep in mind that
`anything that is projected on the screen will not be viewable by
`me or by Judge Quinn. So when you refer to an exhibit on the
`screen, please state the slide, exhibit or page number that you are
`referring to for the record. Also I want to remind the parties that
`demonstrative exhibits are not evidence and have not been filed
`as part of the record. In this case, I haven't seen any objections
`from either side to the demonstrative exhibits.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 3
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`And I also want to remind the parties that arguments are
`limited to those that are supported by the written briefing. To the
`extent that an argument is made or evidence presented that lacks
`support in the written briefing, we will disregard it when we
`render our final written decision.
`So now if we could get appearances from the parties,
`please, beginning with the petitioner.
`MR. EUTERMOSER: Brian Eutermoser on behalf of
`petitioner, Palo Alto Networks.
`JUDGE BOUCHER: Thank you, Mr. Eutermoser. And
`for the patent owner.
`MR. HANNAH: Good afternoon, Your Honors. James
`Hannah on behalf of Finjan. And with me is Shannon Hedvat.
`JUDGE BOUCHER: And we allotted one hour to each
`side for argument. So if you want to begin, petitioner, when you
`are ready, and let us know how much time you would like to keep
`for rebuttal, and I will keep track of the time here.
`MR. EUTERMOSER: Thank you, Your Honor. I think
`we just need a minute to get the slides set up. But I would like to
`retain 20 minutes for rebuttal.
`JUDGE BOUCHER: So whenever you are ready,
`please go ahead and begin.
`MR. EUTERMOSER: Good afternoon. May it please
`the Board. In these proceedings, petitioner, Palo Alto Networks,
`respectfully requests that the Board find all independent claims
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 4
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`and certain dependent claims of the '408 patent invalid as
`obvious.
`JUDGE GIANNETTI: Mr. Eutermoser, I think you
`have to get closer to the microphone.
`MR. EUTERMOSER: Is that better?
`JUDGE GIANNETTI: That's better.
`MR. EUTERMOSER: Unless the Board directs
`otherwise, I plan to proceed through the topics shown on slide 2
`of petitioner's demonstratives in the order shown here. So I'll
`start with a quick overview of the '408 patent and then talk briefly
`about claim construction, state of the art and knowledge of a
`person of skill in the art, and then deal with the disputed claim
`limitations.
`So this case and the '408 patent is about virus detection
`using parse trees. As we'll see, Finjan didn't invent this field, and
`prior art discloses and teaches all the limitations in the claims.
`This is Figure 2 of the '408 patent shown on slide 4 of our
`demonstratives. And this outlines the three separate stages
`described in the claims of the '408 patent. It takes an incoming
`stream of code. That code is passed through a tokenizer and then
`a parser and then an analyzer, one after the other.
`And using lexical analysis to convert a data stream to a
`stream of tokens, that's what happens in the tokenizer. That
`wasn't new. Nor was using a parser to identify patterns of tokens
`that correspond to potentially malicious code. Nor was using an
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 5
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`analyzer to then detect those patterns that indicate potentially
`malicious code. And as we'll see, using parse trees in connection
`with the parser to store and analyze the tokens and patterns of
`tokens was also well known.
`Now, I just want to touch briefly on the claim
`construction issues or potential issues in this case. Petitioner
`proposed BRIs for four different claim terms, first being parse
`tree. The Board adopted patent owner's proposed construction of
`parse tree. However, the instituted claims are invalid for the
`same reasons under both the Board's and Palo Alto Network's
`constructions, which was confirmed by expert testimony from
`Dr. Rubin. And Finjan does not challenge obviousness based on
`any alleged differences between the constructions adopted by the
`Board and proposed by Palo Alto Networks.
`JUDGE BOUCHER: Are there any claim construction
`disputes at all?
`MR. EUTERMOSER: I don't believe so, in terms of the
`actual construction of the terms. The next term is instantiating a
`scanner for the specific programming language. And just as with
`parse tree, I don't believe that Finjan disputes obviousness based
`on any distinctions between the Board's construction and the
`construction proposed by Palo Alto Networks.
`JUDGE BOUCHER: What about an incoming stream
`of program code, are the parties consistent in the way they
`construe that phrase in the claims?
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 6
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`MR. EUTERMOSER: I believe so. I'm not aware of
`any disputes there. In our view, incoming stream of program
`code is exactly what it sounds like, a stream of characters or bits
`or packets that is received over a network by a computer.
`The remaining two terms, "dynamically building" and
`"dynamically detecting," aren't directly relevant to what appear to
`be the key issues in dispute in these proceedings. However, there
`is no dispute as to -- at least for purposes of this proceeding -- as
`to how those terms should be construed. The Board concluded
`consistent with Palo Alto Networks, petitioner's proposed
`construction that "dynamically building" should require that the
`building step in the claims of the '408 patent must overlap with
`the time period for the receiving step. In other words, the parse
`tree must be built, the tree must be parsed during a time period
`that overlaps with the time period during which the incoming
`stream is received.
`And there's a similar requirement, again agreed by the
`parties and adopted by the Board, for "dynamically detecting,"
`which requires that the time period during which malicious code
`is or potential exploits are detected must overlap with that period
`during which the stream is parsed and the parse tree is built.
`Now, so I want to turn next to the state of the art in
`2004 and particularly the knowledge of a person of skill in the art
`in that time period. You may be asking why is that so important
`in this case. It's important here because Finjan has made the
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 7
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`dynamically building and detecting limitations the key issues in
`this case despite the fact that there is little, in fact, almost no
`disclosure concerning those terms in the specification of the '408
`patent. It matters because Finjan's main argument is that a person
`of ordinary skill reading Chandnani would assume that each stage
`of Chandnani's detection engine processes an entire data stream
`before passing any portion of that stream on to the next stage in
`Chandnani's detection process or system.
`But this argument by the -- that patent owner makes
`assumes away basic and foundational knowledge of a person
`skilled in the art concerning how data is transmitted and received
`over a network. And as we'll see, admissions from Finjan's own
`experts, patent owner's own experts, demonstrate that this
`argument is inconsistent with how computer networks like the
`Internet actually work and how a person of ordinary skill would
`have interpreted Chandnani's teachings regarding virus detection
`as it applies to an incoming stream of code or a stream of packets
`received over the Internet.
`JUDGE BOUCHER: So as I understand it, the dispute
`between the parties seems to hinge primarily on whether or not
`Chandnani discloses these dynamic limitations that appear in the
`claims. So is it fair to say that you are relying on this knowledge
`of skill in the art to draw inferences from Chandnani as to how
`exactly that works? I mean, to what extent are you relying on the
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
` 8
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`general knowledge of one of skill in the art as opposed to express
`disclosures in Chandnani?
`MR. EUTERMOSER: Well, I don't think we are
`relying exclusively on the knowledge of one of skill in the art and
`I don't think you can separate those two. Under KSR you have to
`interpret the reference's teachings in light of the knowledge of a
`person of ordinary skill in the art. In this case there are express
`disclosures in Chandnani that make clear that the entire detection
`process has to be completed before the incoming data stream has
`been completely received at the computer. So in our view, that
`disclosure alone is enough to teach the dynamic limitations
`because if the detecting and the parsing step have to be completed
`before the code is received, that means all these time periods
`overlap, which is what the Board's constructions require.
`Now, there are other disclosures in Chandnani about
`how these individual functions work and process token by token
`or character by character that confirm that that's how Chandnani
`works and that's how one of skill in the art would have interpreted
`Chandnani. And those disclosures in Chandnani are completely
`consistent with the knowledge of a person of skill in the art
`concerning packetized networks and in general how a streaming
`flow of data is processed by a computer, specifically with respect
`to virus detection.
`So as I just mentioned, to set the table for my state of
`the art discussion here, I would like to point out that most of this
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 9
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`evidence, if not all of it, comes from admissions made by patent
`owner's own experts during depositions in this case. For
`example, Dr. Medvidovic confirmed -- I'm sorry?
`JUDGE QUINN: What slide are you on?
`MR. EUTERMOSER: I'm sorry. I'm on slide 18. I'll
`try to remember to call that out each time.
`And this slide shows that as Dr. Medvidovic admitted,
`modern computer networks both in 2004 and today are
`packet-based meaning that anything transmitted over a network is
`not transmitted as a single block of data. It's first broken into a
`series of data packets.
`Moving on to slide 19, as an example, consider a typical
`web page. The content of that web page gets fragmented into
`components that fit inside individual packets which are then
`transmitted one after the other in serial fashion between the web
`server and a client computer. The testimony here comes from
`another of patent owner's expert's, Dr. Bims.
`It's also clear --
`JUDGE BOUCHER: I know that the patent owner
`didn't object to the demonstratives, but is this testimony that you
`are referring to on these slides some of the testimony that they did
`move to exclude?
`MR. EUTERMOSER: I don't think what we've seen so
`far. I can think of one slide that we will get to that is the subject
`of their motion to exclude, I believe.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 10
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`JUDGE BOUCHER: Okay.
`MR. EUTERMOSER: And actually, thinking more
`about that, I do recall that at least as it relates to Dr. Medvidovic,
`they have moved to exclude a number of portions of his
`testimony concerning data packets and packetized networks in
`general. So there's a decent chance they have moved to exclude
`portions that I'm presenting now.
`JUDGE GIANNETTI: They have moved to exclude
`their own expert's testimony?
`MR. EUTERMOSER: That's correct. And again, in
`our view, these are admissions from a party opponent. And I'm
`happy to address our response to their motion now. I planned to
`do that on rebuttal.
`JUDGE GIANNETTI: Let's hear from them first. I'm
`interested in that.
`MR. EUTERMOSER: It sounds like you are asking to
`leave that aside and deal with it on rebuttal?
`JUDGE GIANNETTI: Yes, the exclusion issue. You
`can continue. I just wanted to clarify that.
`MR. EUTERMOSER: Sure. So as I mentioned, a
`person of skill in the art knew how packetized data networks
`work, knew how a web page gets fragmented into multiple
`packets before being transferred over a network and knew how to
`process those packets as they pass through a network and get
`received by a computer. A fundamental piece of network-based
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 11
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`communications is -- I think marshalling is one of the terms
`Dr. Medvidovic used -- but relates to the process of packing and
`unpacking a larger piece of content in a series of packets.
`Now, in the context of the '408 patent, I'm now looking
`at slide 21, which shows Figure 2 of the '408 patent. What this
`means for purposes of the claimed invention is that each packet in
`an incoming data stream or each byte or character within each
`packet has to pass sequentially through the various stages or
`components that are claimed in the invention. So again, you see
`the byte source here on the left side of Figure 2. That is the
`incoming stream at least for purposes of the independent claims.
`That feeds directly into the tokenizer. The output of the tokenizer
`is fed into the parser. The output of the parser is then fed into the
`analyzer which detects the presence of potential exploits using the
`claim language. Again, the fact that this must happen
`sequentially, basic understanding of a person of skill in the art
`and confirmed by Dr. Medvidovic on cross-examination.
`JUDGE BOUCHER: So there was an argument in the
`briefing, I think, that the patent owner made that at least in some
`instances it might not be possible to do a full analysis on a
`packet-by-packet basis. I think one of the examples they used
`was detecting the language. Do you agree that there are instances
`in which it may not be possible to detect the language without
`receiving the entire stream first?
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
` 12
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`MR. EUTERMOSER: I don't. At least not that I'm
`aware of. And that's the piece that I'm about to get into now.
`And this, again, is confirmed by testimony from patent owner's
`own experts. The script languages, which is what both patents
`deal with at least on some level. JavaScript, I believe, is
`disclosed by Chandnani, and the '408 patent deals with script
`language viruses as well -- or excuse me, script language analysis
`or exploits.
`JavaScript in particular is specifically used to embed
`active content in web pages. That's as true today as it was in
`2004. The data packets that make up a web page often contain
`both include HTML code which essentially defines the page as
`well as embedded scripts which might perform some function,
`including JavaScript. And you may have JavaScript, for
`example, embedded with HTML within a packet or a group of
`packets.
`Now, those scripts include tags that identify the script
`language. And those tags are sufficient to identify the script
`language used. So it wouldn't be necessary to receive and process
`an entire data stream. Far from it. A tag that identifies HTML or
`JavaScript, example, would exist within a single packet or a
`group of packets that could be at the beginning of the stream and
`then would tell the computer receiving the remainder of the
`stream what language followed in the subsequent packets.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
` 13
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`I'm looking at slide 24 which sets forth some of the
`testimony of Dr. Medvidovic essentially confirming this fact. It
`was well known in the art that all that was necessary to identify a
`particular programming language was a particular tag, which
`again did not require processing of an entire incoming data
`stream.
`
`JUDGE BOUCHER: Didn't he also testify that you
`wouldn't necessarily have the tags in some of these packets?
`MR. EUTERMOSER: I don't recall that testimony
`specifically. I will agree, I think, if I understand your question,
`that every packet doesn't necessarily contain a tag that indicates
`the language, which again, the tag may specify the language of
`other packets that follow, at least potentially.
`JUDGE BOUCHER: Okay. But there's always going
`to be a tag?
`MR. EUTERMOSER: In every packet?
`JUDGE BOUCHER: No, but at least at the beginning
`of every stream?
`MR. EUTERMOSER: That's my understanding at least
`according to things like HTML and JavaScript and other script
`languages that I'm familiar with. As of 2004, there was going to
`be a tag that identified the language used in the data stream.
`JUDGE BOUCHER: Okay. Thanks.
`MR. EUTERMOSER: I don't want to overstate, but I
`am reasonably certain that's true with respect to web-based
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 14
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`content, for example, the content of a web page that's gets
`communicated as a series of packets.
`And again, you have here on slide 25, Dr. Medvidovic
`confirming that a packet payload might stay HTML 4.0 as the doc
`type, and that would indicated to the receiving computer that the
`incoming code was HTML.
`JUDGE BOUCHER: But none of this is in Chandnani,
`
`right?
`
`MR. EUTERMOSER: Well, Chandnani refers to
`determining the script language used in the incoming data stream.
`It doesn't talk about exactly how or at least it doesn't talk on the
`level of packets about examining a single packet to determine the
`language used in that stream. It takes, I think, a higher level view
`of how to process the incoming code.
`JUDGE BOUCHER: But this argument that tags would
`be sufficient to identify the language, that's all based in the
`knowledge of one of skill in the art. There's no express disclosure
`in Chandnani to support this; is that correct?
`MR. EUTERMOSER: Well, what Chandnani describes
`is identifying a program language by performing lexical analysis
`of the incoming stream or performing an analysis step on the data
`stream. And our argument is that what that would mean to one of
`skill in the art and the only way to perform that analysis is on a
`packet-by-packet basis and looking to the script tag to identify the
`language.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 15
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`Well, let me back up for a second. Our position is that
`Chandnani discloses performing that step, that lexical analysis
`step to identify the language on a stream of data. Patent owner
`argues that what that means, and this is an assumption they make,
`not based on a disclosure in Chandnani, they say that the only
`way you could possibly identify the script language used in an
`incoming data stream is to process an entire stream of data. So
`patent owner is treating the stream as this discrete object that
`must be processed in its entirety. Our point here is that that
`interpretation again is unsupported by anything in Chandnani and
`also inconsistent with the knowledge of one of skill in the art with
`respect to how network-based communications work and how
`script languages are identified in particular.
`Now, one other point that's relevant to the dynamically
`building and detecting limitations, a person of skill in the art in
`2004 recognized that it was always going to be a goal of
`increasing processing speed and reducing delay. That's always
`been true at least as long as there's been network-based
`communications like the Internet. In 2004 that was probably
`more true than it is today because you are going to see more delay
`as data gets processed across a lower bandwidth than we have
`now.
`
`Dr. Medvidovic, I'm looking at slide 28, he just
`confirmed that speed is important and always has been important
`when you are processing an incoming stream and trying to
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 16
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`identify potential computer viruses, because that activity often
`happens in realtime, meaning as the data is being received and
`while a user is waiting to view a web page, for example.
`Now, Dr. Bims --
`JUDGE BOUCHER: But he also testified, didn't he,
`that increasing speed can come with trade-offs in other
`objectives. I don't know that it's fair to characterize his testimony
`as saying that, I don't know, speed is some kind of overarching
`goal, is it?
`MR. EUTERMOSER: I think it is fair to characterize
`that as his testimony. I agree that he testified that there are other
`goals and there are trade-offs. Specifically I think he referred to
`accuracy as being a goal. And sometimes accuracy can be at
`odds with speed. But it was always a goal to speed up processing
`or reduce delay. Now, how you do that without sacrificing
`accuracy, I think, is a challenge. But in terms of the overall or
`overarching goal of data processing and computer programming
`in general to reduce latency, I don't think there's much dispute as
`to that fact.
`Now, patent owner's other expert, Dr. Bims, he, in fact,
`confirmed that essentially it would have been obvious to process
`an incoming data stream dynamically as that term has been
`construed by the Board. Now, he testified, as you'll see here at
`slide 29, and I'm referring to Exhibit 1065 at page 30, lines 40
`through 15. This is Dr. Bims' testimony on cross-examination.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 17
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`He testified that a person of ordinary skill would understand that
`techniques such as detecting as well as analyzing the parse tree
`nodes would take place as the program code is being downloaded
`and that potentially exploits can be identified before the entire
`web page content has been streamed to the computer.
`So what he's saying is that a person of ordinary skill
`would recognize based on nothing more than the need to process
`an incoming data stream in real time and the goal of reducing
`user-perceptible delay, that was enough for a person of ordinary
`skill to recognize that you would perform an entire detection
`process, which in the case of Chandnani and the '408 patent
`would include the tokenizing, parsing, detecting or analysis steps.
`You would do all of that before the file had even arrived at the
`computer.
`JUDGE GIANNETTI: Counsel, what is petitioner's
`contention as to who a person of ordinary skill is?
`MR. EUTERMOSER: I'm sorry?
`JUDGE GIANNETTI: Who is a person of ordinary
`skill for this case?
`MR. EUTERMOSER: I think our position is that it's
`someone with at least a bachelor's degree in computer science or
`related field and two or three years experience. I believe both
`sides are close and may disagree as to two to four years of
`experience. But I think both sides would agree it's somebody
`with some experience.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 18
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`
`JUDGE GIANNETTI: A general background in
`computer science would be enough?
`MR. EUTERMOSER: I've got it here. A person of
`ordinary skill held a bachelor's degree or the equivalent in
`computer science and three to four years of additional experience
`in the field of computer security. So I think it's fair to say that at
`least a degree and some experience in the fields relating to
`computer science. And again, in our view, processing an
`incoming data stream over a network in 2004 was fundamental to
`that field. I don't think there's much dispute as to that fact.
`JUDGE BOUCHER: So why is the speed important
`here? Is the argument that because speed is important, one of
`skill in the art would have known from Chandnani to do it on a
`packet-by-packet basis rather than wait for the entire stream to
`arrive and then do the analysis?
`MR. EUTERMOSER: There's no dispute that you have
`to process the incoming stream on a packet-by-packet basis. The
`question and the dispute between the parties is whether
`Chandnani teaches processing every packet in an incoming data
`stream by one stage of a particular detection method before you
`pass any of those packets on to the next stage. And the point is
`that given the need to speed up processing or reduce delay, there
`is no reason a person of skill in the art would even consider
`waiting for every packet in a data stream to arrive, particularly
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
` 19
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`where the computer wouldn't necessarily know when that stream
`was going to end, before proceeding with the processing.
`JUDGE GIANNETTI: Unless you had to do that in
`order to accomplish the task. Unless you had to -- if parsing
`required that you look at more than one packet, then you would
`have to wait until you had enough packets to make the parsing
`meaningful to performance; is that correct?
`MR. EUTERMOSER: That may be true. But that
`doesn't imply that even if you do need more than one packet to
`perform the parsing step, it doesn't imply that you wait until you
`receive the entire stream. Again, there's nothing in Chandnani
`that teaches that would necessarily be the case. This argument
`comes from patent owner saying that, well, it would be necessary
`to process an entire stream, the entire data stream as a whole to
`determine the language before moving on to the next step.
`Our point is that's just not the case. It wasn't the case in
`2004. And given the motivation of one of skill in the art to speed
`up processing and virus detection specifically so you could
`identify threats before the file is saved at the computer, that there
`is no way -- there is no reason that one of skill in the art would
`have interpreted Chandnani as teaching that you perform that at
`any stage on an entire stream before proceeding to the next stage.
`JUDGE BOUCHER: My impression, and I'm curious
`whether or not you think it's a fair characterization, is that the
`petitioner came up with an argument based on Chandnani and
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 20
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`then Kolawa and Walls, but primarily based on Chandnani. And
`then patent owner came back and pointed out some potential
`ambiguities in the disclosure there. And to try to patch those up
`in reply, the petitioner has now relied on the knowledge of one of
`skill in the art. Is that a fair characterization of what this
`argument is?
`MR. EUTERMOSER: I don't believe so. I think the
`patent owner raised an argument in its patent owner response that,
`again, is inconsistent with what is basic and fundamental about
`how network and stream-based communications work. Again,
`Chandnani discloses expressly that its entire detection method
`should be performed before the data stream is even resident on
`the computer, which teaches the dynamically limitations by itself.
`And I can pull that up now.
`JUDGE BOUCHER: So I guess fundamentally I'm
`wondering why are we talking about this stuff in such detail if we
`are relying on the express disclosure of Chandnani?
`MR. EUTERMOSER: Well, I think Chandnani doesn't
`go into this level of detail because it was assumed by one of skill
`in the art that this is how you would process an incoming data
`stream. Again, this is all rebutting patent owner's argument that
`Chandnani says something it doesn't say. Again, Chandnani just
`says that you perform multiple operations in succession on the
`data stream. Patent owner argues that that means you have you
`have to process the entire data stream before passing the stream
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 21
`
`
`
`
`
`
`
`Case IPR2015-02001
`Patent 8,225,408 B2
`
`from one stage to the next. And this argument is just to
`demonstrate that that is fundamentally at odds with the
`knowledge of one of skill in the art.
`JUDGE BOUCHER: Okay. So all of this is essentially
`rebuttal. So let's look at what Chandnani actually discloses, then.
`MR. EUTERMOSER: Certainly. So what we have up
`on the screen is from Chandnani, Exhibit 1003. This is on
`page 14 at column 9, lines 12 through 16. And what this is
`saying is that if you look at the highlighted portion, the script
`language virus detection methodologies which are disclosed
`throughout Chandnani may be performed on a file or a data
`stream received by the computer through a network before the
`file is stored, copied, executed, open on the computer. So what
`this is saying is that Chandnani's detection method, which again,
`includes tokenizing, parsing and detecting malicious code, that
`entire process can be performed either on a file, which is one
`embodiment, or on a data stream received over a network. And
`that entire detection process can be completed, entirely performed
`before the file is stored
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
