`571-272-7822
`
`
`Paper 51
`Entered: March 15, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC. and SYMANTEC CORP.,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2016-001511
`Patent 8,141,154 B2
`
`____________
`
`
`
`Before, THOMAS L. GIANNETTI, MIRIAM L. QUINN, and
`PATRICK M. BOUCHER, Administrative Patent Judges.
`
`QUINN, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`
`
`
`
`1 This case is joined with IPR2016-01071. Paper 21 (“Decision on
`Institution of Inter Partes Review and Grant of Motion for Joinder,” filed by
`Symantec Corp.).
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Palo Alto Networks, Inc. and Symantec Corp. (collectively
`
`“Petitioner”) each have filed petitions to institute inter partes review of
`claims 112 of U.S. Patent No. 8,141,154 B2 (“the ’154 patent”) pursuant to
`35 U.S.C. § 311319. Paper 2 (“Pet.”); IPR2016-01071, Paper 1. In
`response to the petition filed by Palo Alto Networks, Inc. (Paper 2), Finjan,
`Inc. (“Patent Owner”) filed a Preliminary Response. Paper 8 (“Prelim.
`Resp.”). Upon consideration of the Petition and the Preliminary Response,
`we instituted trial as to challenged claims, 1–8, 10 and 11. Paper 10
`(“Dec.”).
`
`Subsequently, we reviewed and granted Symantec Corp.’s petition,
`which sought review of the same claims of the ’154 patent. IPR2016-01071,
`Paper 1. With its petition, Symantec Corp. filed a motion requesting to join
`IPR2016-01071 with this proceeding, and we granted the motion. Paper 21.
`Upon granting the motion, we terminated Case IPR2016-01071, and ordered
`consolidation of all Petitioner filings in this proceeding. Id. at 45.
`During trial, Patent Owner filed a Patent Owner Response (Paper 19,
`“PO Resp.”); and Petitioner filed a Reply (Paper 32, “Reply”). Patent
`Owner also filed a Motion for Observations of the December 20, 2016,
`cross-examination of Petitioner’s declarant, Dr. Aviel Rubin. Paper 40.
`Petitioner responded to Patent Owner’s Motion for Observations. Paper 43.
`Both parties also filed Motions to Exclude. Paper 38 (“Pet. Mot. to
`Exclude”); Paper 39 (“PO Mot. to Exclude”). Both parties filed Oppositions
`and Replies concerning the Motions to Exclude. Papers 42, 44, 45, 46. An
`oral hearing was held on January 24, 2017.2
`
`
`2 A transcript of the oral hearing is entered in the record as Paper 49 (“Tr.”).
`
`2
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`We have jurisdiction under 35 U.S.C. § 6(c). This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a). For the reasons discussed
`herein, and in view of the record in this trial, we determine that Petitioner
`has not shown by a preponderance of the evidence that claims 18, 10, and
`11 of the ’154 patent are unpatentable.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies the ’154 patent as the subject of various district
`court cases filed in the U.S. District Court for the Northern District of
`California and District of Delaware. Pet. 42. Petitioner also states that
`petitions for inter partes review have been filed regarding other related
`patents. Id. The ’154 patent is also the subject of another inter partes
`review: IPR2015-01979 (and IPR2016-00919, joined therewith). In
`IPR2015-01979, we issue a Final Written Decision, under 35 U.S.C.
`§ 318 (a), concurrently with the instant Final Written Decision.
`
`B. FINAL WRITTEN DECISION IN IPR2015-01979
`
`The parties have briefed whether estoppel under 35 U.S.C.
`§ 315 (e)(1) affects our ability to render a Final Written Decision in this
`proceeding. See Papers 30, 31. As stated above, IPR2015-01979 is also
`directed to the ’154 patent, and considers the same claims challenged in the
`instant proceeding. Because we issue final written decisions in both
`proceedings concurrently, we need not decide what effect, if any, the
`estoppel provisions of § 315 (e)(1) have on our ability to render this
`decision.
`
`3
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`C. INSTITUTED GROUNDS
`
`We instituted inter partes review of claims 18, 10, and 11 (“the
`challenged claims”) based on Petitioner’s challenge of those claims as
`unpatentable under 35 U.S.C. § 103(a) over Ross.3 Petitioner supports its
`contentions of unpatentability with a declaration from Dr. Aviel Rubin. Ex.
`1002 (“Rubin Declaration”). Patent Owner proffers a declaration from Dr.
`Nenad Medvidovic as evidence in support for its contentions. Ex. 2035
`(“Medvidovic Declaration”). The cross-examinations of Dr. Rubin and Dr.
`Medvidovic are in the record as Exhibits 2012 and 1011, respectively.
`
`D. THE ’154 PATENT (EX. 1001)
`
`The ’154 patent relates to computer security and, more particularly, to
`systems and methods for protecting computers against malicious code such
`as computer viruses. Ex. 1001, 1:79, 8:3840. The ’154 patent identifies
`the components of one embodiment of the system as follows: a gateway
`computer, a client computer, and a security computer. Id. at 8:4547. The
`gateway computer receives content from a network, such as the Internet,
`over a communication channel. Id. at 8:4748. “Such content may be in the
`form of HTML pages, XML documents, Java applets and other such web
`content that is generally rendered by a web browser.” Id. at 8:4851. A
`content modifier modifies original content received by the gateway
`computer and produces modified content that includes a layer of protection
`to combat dynamically generated malicious code. Id. at 9:1316.
`
`
`3 Patent Application Pub. No. US 2007/0113282 A1 (Exhibit 1003)
`(“Ross”).
`
`4
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`E. ILLUSTRATIVE CLAIM
`
`Challenged claims 1, 4, 6, and 10 are independent, and illustrative
`claim 1 is reproduced below.
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`
`a content processor (i) for processing content received
`over a network, the content including a call to a first function,
`and the call including an input, and (ii) for invoking a second
`function with the input, only if a security computer indicates
`that such invocation is safe;
`
`a transmitter for transmitting the input to the security
`computer for inspection, when the first function is invoked; and
`
`a receiver for receiving an indicator from the security
`computer whether it is safe to invoke the second function with
`the input.
`
`
`II. ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`In an inter partes review, claim terms in an unexpired patent are
`interpreted according to their broadest reasonable construction in light of the
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b);
`Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2142–46 (2016).
`Consistent with that standard, claim terms also are given their ordinary and
`customary meaning, as would be understood by one of ordinary skill in the
`art in the context of the entire disclosure. See In re Translogic Tech., Inc.,
`504 F.3d 1249, 1257 (Fed. Cir. 2007). There are, however, two exceptions
`to that rule: “1) when a patentee sets out a definition and acts as his own
`lexicographer,” and “2) when the patentee disavows the full scope of a claim
`
`5
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`term either in the specification or during prosecution.” See Thorner v. Sony
`Computer Entm’t Am. LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).
`If an inventor acts as his or her own lexicographer, the definition must
`be set forth in the specification with reasonable clarity, deliberateness, and
`precision. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243,
`1249 (Fed. Cir. 1998). Although it is improper to read a limitation from the
`specification into the claims, In re Van Geuns, 988 F.2d 1181, 1184 (Fed.
`Cir. 1993), claims still must be read in view of the specification of which
`they are a part. Microsoft Corp. v. Multi-Tech Sys., Inc., 357 F.3d 1340,
`1347 (Fed. Cir. 2004).
`In our Decision on Institution, we did not construe expressly any
`claim terms. Dec. 45. In its papers, Patent Owner argues distinctions from
`the prior art that hinge on whether the term “call to a first function” is
`different from “invoking” the first function. PO Resp. 2223 (“Ross teaches
`a technique in which received content does not include a call to a first
`function. In contrast, Ross’ technique involves invoking a hook function . . .
`without the content including a call to the hook function.” (emphasis in
`original)).
`
`“call to a first function”
`The term “call to a first function” is recited in all challenged claims.
`The arguments presented regarding this limitation turn on the scope of the
`word “call.” Specifically, Patent Owner argues that Ross may invoke the
`“first function,” but Petitioner has not identified that Ross’s content includes
`a “call to a first function,” as required by the claims. Id. at 2021. At issue
`is to what extent the recited “call” refers to execution of the function. Dr.
`Medvidovic, Patent Owner’s expert, proffers opinions on the issue by
`
`6
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`relying on a definition of “function call” derived from the Microsoft Press
`Computer Dictionary. Ex. 2035 ¶ 57 (citing Ex. 2013). That Dictionary
`provides that a “function call” is “[a] program’s request for the services of a
`particular function.” Id.; Ex. 2013. It also explains that “[a] function call is
`coded as the name of the function along with any parameters needed for the
`function to perform its task.” Id.
`The Specification of the ’154 patent does not define the term “call to a
`first function.” But the Specification uses the phrase “function call” in
`stating that “before the client computer invokes a function call that may
`potentially dynamically generate malicious code, the client computer passes
`the input to the function to the security computer for inspection.” Ex. 1001,
`4:3842. The Specification also states that “the present invention operates
`by replacing original function calls with substitute function calls within the
`content, at a gateway computer, prior to the content being received at the
`client computer.” Id. at 4:5760. From such examples, we understand the
`Specification to use the phrase “function call” in the same sense that the
`claims recite in the phrase “call to a [] function.” That is, a “call” is part of
`the recited “content,” as a statement or instruction containing the function
`that, when executed, causes the function to provide a service. Thus, we find
`the dictionary definition of the term “function call” applicable here and
`indicative of the meaning of the term to a person of ordinary skill in the art.
`Furthermore, the dictionary definition is consistent with the
`embodiments described in the Specification. For example, one embodiment
`of the ’154 patent provides for modifying an original function call with
`“corresponding function calls Substitute_function(input,*).” Id. at 9:2124.
`That is, the specification describes that the services of the function
`
`7
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Substitute_function are being requested by the modified content.
`Furthermore, the format of the function in this particular embodiment
`identifies the name of the function and the parameters “input” and “*”. See
`also id. at 9:2628 (explaining that the “input intended for the original
`function is also passed to the substitute function, along with possible
`additional input denoted by ‘*’”). From this description we determine that
`the “call” is a statement or instruction in the content, the execution of which
`causes the function to provide a service.
`We note that this construction of “call to a first function” need not
`define the format of the instruction or statement, or further detail regarding
`its parameters. We reach this determination because the claim language
`itself requires that either the call or the function include an input. For
`example, claim 1 recites the “call including an input,” while claim 6 recites
`“the first function including an input variable.”
`Petitioner argues that a call to a function and invoking a function are
`equivalent. Tr. 26:212. Dr. Rubin further testifies that a call is “when a
`function is invoked.” Ex. 2038, 74:911; see also 74:1875:4 (testifying
`also that invoking the function name, transferring execution to the code in
`that function is a call). We do not agree with Petitioner in this regard. The
`claims recite “including a call” and “invoking” distinctly from each other.
`For example, claims 1 and 4 recite “the content including a call to a first
`function” and “when the first function is invoked.” These limitations have
`different connotations. In the first instance, the “call” (noun) is included in
`the content, and therefore points to a programmatic statement or instruction
`in the content. The second instance, “first function is invoked,” however,
`refers to the effect of the call to the function being executed, i.e., invoked.
`
`8
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`The same analysis applies regarding the language of claims 6 and 10,
`which do not recite the word “invoke.” Claims 6 and 10, for example, recite
`“the content including a call to a first function” and “when the first function
`is called.” Again, the “call” (noun) refers to a programmatic statement
`included in the content. However, “calling” is the effect of the call to the
`function being executed. Accordingly, based on the foregoing and under the
`broadest reasonable interpretation, we determine that a “call to a first
`function” means a statement or instruction in a program requesting the
`services of a particular (i.e., first) function.
`
`B. PRINCIPLES OF LAW
`
`A claim is unpatentable under 35 U.S.C. § 103(a) if the differences
`
`between the claimed subject matter and the prior art are such that the subject
`matter, as a whole, would have been obvious at the time the invention was
`made to a person having ordinary skill in the art to which said subject matter
`pertains. KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406 (2007). The
`question of obviousness is resolved on the basis of underlying factual
`determinations including: (1) the scope and content of the prior art; (2) any
`differences between the claimed subject matter and the prior art; (3) the level
`of ordinary skill in the art; and (4) objective evidence of nonobviousness.
`Graham v. John Deere Co., 383 U.S. 1, 17–18 (1966).
`
`C. THE LEVEL OF SKILL IN THE ART
`
`In determining the level of ordinary skill in the art at the time of the
`
`invention, we note that various factors may be considered, including “type of
`problems encountered in the art; prior art solutions to those problems;
`rapidity with which innovations are made; sophistication of the technology;
`
`9
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`and educational level of active workers in the field.” In re GPAC, Inc., 57
`F.3d 1573, 1579 (Fed. Cir. 1995) (citing Custom Accessories, Inc. v. Jeffrey-
`Allan Indus., Inc., 807 F.2d 955, 962 (Fed. Cir. 1986)).
`
`Petitioner asserts, through its expert Dr. Aviel Rubin, that the
`“relevant technology field for the ’154 patent is security programs, including
`content scanners for program code.” Ex. 1002 ¶ 25. Further, Dr. Rubin
`opines that a person of ordinary skill in the art would “hold a bachelor’s
`degree or the equivalent in computer science (or related academic fields) and
`three to four years of additional experience in the field of computer security,
`or equivalent work experience.” Id.
`
`Patent Owner, through its expert Dr. Nenad Medvidovic, offers a level
`of ordinary skill that is different from Petitioner’s. Ex. 2035 ¶ 35. In
`Particular, Dr. Medvidovic opines that a person of ordinary skill in the art
`would have a “bachelor’s degree in computer science or related field, and
`either (1) two or more years of industry experience and/or (2) an advanced
`degree in computer science or related field.” Id. In comparison, it appears
`that the minimum experience under Patent Owner’s proffered level of skill is
`one year less than Petitioner’s. Also, Patent Owner proffers an alternative to
`work experience, namely an advanced degree. There is no specific
`articulation regarding how the difference of one year’s experience or the
`proposed alternative of an advanced degree in lieu of experience tangibly
`affects our obviousness inquiry. Further, there is no evidence in this record
`that the differences noted above impact in any meaningful way the level of
`expertise of a person of ordinary skill in the art. Indeed, we note that Dr.
`Medvidovic’s opinions would not change if he had considered instead the
`level or ordinary skill in the art proffered by Dr. Rubin. Id. ¶ 39.
`
`10
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Accordingly, we determine that in this case no express articulation of
`
`the level of ordinary skill in the art is necessary and that the level of ordinary
`skill in the art is reflected by the prior art of record. See Okajima v.
`Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001); In re GPAC Inc., 57 F.3d
`1573, 1579 (Fed. Cir. 1995); In re Oelrich, 579 F.2d 86, 91 (CCPA 1978).
`
`
`D. OBVIOUSNESS GROUND BASED ON ROSS
`
`The Petition relies on Ross as teaching or suggesting all the
`limitations of claims 18, 10, and 11. Pet. 1437. Having reviewed the
`arguments and evidence provided by Petitioner and the arguments and
`evidence presented by Patent Owner, we determine that Petitioner has failed
`to show by a preponderance of the evidence that Ross teaches or suggests all
`the limitations of the challenged claims, and more particularly, “the content
`including a call to a first function.”
`1. Overview of Ross (Exhibit 1003)
`Ross describes one embodiment where a device receives and
`processes “data content having at least one original function call [and it]
`includes a hook script generator and a script processing engine.” Ex. 1003
`¶ 10. One such device is depicted in Figure 2 of Ross, reproduced below.
`
`11
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`
`
`Figure 2 shows a client network device (client 202) and a server
`network device (server 204) communicating with each other over
`communication network 208 to exchange information, including web
`content. Id. ¶¶ 16, 23. Figure 2 depicts web browser 224 and detection
`engine 240 at the client, but in other embodiments, detection engine 240
`may be physically located away from client 202. Id. ¶ 26. Detection
`engine 240 includes script injector 242 to intercept incoming data content
`and introduce the incoming data to script-processing engine 224. Id. “Hook
`script generator 244 creates new functions, including constructor functions,
`which replace the standard JavaScript functions.” Id.
`
`12
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`2. Discussion of Independent Claims
`Independent claim 1 is directed to a system, while claim 4 is directed
`to stored program code including functions performed by a computer device,
`where those functions track the functions recited in claim 1. Independent
`claim 6 is also directed to a system, albeit with some limitations different
`from the system of claim 1. And independent claim 10 is directed to stored
`program code including functions performed by a computer device, where
`those functions track the functions recited in claim 6. Notwithstanding their
`differences, all the independent claims recite “the content including a call to
`a first function.” We find that Ross does not disclose this limitation.
`Content Includes a Call to a First Function
`
`Petitioner asserts that the recited “content” is met by a combination of
`Ross’s web content (HTTP data) and hook functions in the hook script. Pet.
`16 (“script processing engine processes content from both the web (HTTP
`data content) and from the hook script generator (hook functions)”). The
`Petition points out that Ross’s “hook scripts and their associated inputs teach
`or suggest ‘the content including a call to a first function, and the call
`including an input,’ as recited in claim 1.” Id. Specifically, the Petition
`states that each hook script has “at least one hook function[,] where each
`hook function is configured to supersede a corresponding original function.”
`Id. at 17 (citing Ex. 1003 ¶ 38). With regard to the “call” limitation,
`Petitioner asserts that a person of ordinary skill in the art would have
`understood that the hook scripts “include a call to a first function call (i.e.,
`hook functions within a hook script).” Id. at 18 (citing Ex. 1002 ¶ 109).
`Based on these assertions, we understand Petitioner’s contention to be that
`
`13
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Ross’s description of hook functions in the hook script teaches or suggests
`the “call to a first function.”
`Patent Owner challenges these assertions by arguing that merely
`pointing to hook functions within a hook script is insufficient. PO Resp.
`2022. According to Patent Owner, Ross’s hook script includes a function,
`i.e., the hook function, but not the “call” to that function. Id. (citing Ex.
`2035 ¶¶5659). Ross, according to Patent Owner, teaches a technique
`different from the claims. Id. at 2223. Ross first calls the original
`function, which Petitioner identifies as the recited “second function,” in
`order to invoke the hook function (“first function”). Id. at 23 (citing Ex.
`1003 ¶¶ 1213). In contrast, the claims require that the content include a
`call to a first function, in order to invoke the first function first. See, e.g.,
`claim 1 (“transmitting the input to the security computer . . . when the first
`function is invoked” and “invoking a second function with the input only if a
`security computer indicates that such invocation is safe”); claim 6
`(“transmitting the input variable to a security computer . . . when the first
`function is called” “modifying the input variable if the security computer
`determines that [it is not] safe” and “calling a second function with a
`modified input variable”).
`In support of Patent Owner’s argument, Dr. Medvidovic explains that
`Ross describes the combined hook script and the original script as using an
`“assignment,” not a “call” for invoking the first function. PO Resp. 2324
`(citing Ex. 2035 ¶61). We credit this testimony. Ross illustrates in Figure 4,
`reproduced below, a combined script, which shows more detail regarding
`how Ross formulates the hook script and the included hook function. See
`Ex. 1003, Fig. 4.
`
`14
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`
`
`Figure 4 illustrates combined script 402 including hook script 404 and
`original script 302. Id. Dr. Medvidovic identifies the hook function in hook
`script 404 as “function HookedActiveXObject(objname).” Ex. 2035 ¶ 61.
`The combined script does not include a call to the function
`“HookedActiveXObject.” Instead, as Dr. Medvidovic explains, Ross’s hook
`script includes a call to the original function, not the hook function, as
`shown below in Patent Owner’s annotated Figure 4.
`
`15
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`
`
`The annotated Figure 4 of Ross, above, annotates Ross’s script by
`pointing out: (1) in brackets, that a group of instructions comprise the
`function “Hooked ActiveXObject(objname);” and (2) that the body of the
`function is the “Hook Function.” See PO Resp. 23. The annotations also
`show that the instruction “Req=new
`ActiveXObject(“Microsoft.XMLHTTP”)” is the “Call to Original Function.”
`Id. Dr. Medvidovic explains that the call to “new
`ActiveXObject(“Microsoft.XMLHTTP”) indirectly invokes “function
`HookedActiveXObject,” using Ross’s assignment technique. See Ex. 2035
`¶ 61. Ross’s description of the hook functions confirms this technique. For
`example, Ross states that “[t]he hook function corresponding to the data
`content original function is executed when the original function is called.”
`
`16
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Ex. 1003, Abstract; see also ¶ 13 (“executing a hook function when a
`corresponding original function is called in the data content”). Ross further
`states that the “hook function is configured to supersede a corresponding
`original function.” Id. ¶¶ 1012.
`Although we have explained that the first invocation in Ross is not of
`the first function, the issue is not simply whether Ross executes or processes
`the first function first, before the second function. The issue is whether the
`content in Ross includes a “call to a first function,” as claimed. We find that
`Ross does not.
`Patent Owner’s explanation of Ross is consistent with Ross’s
`description of how the hook script is generated and processed. Ross’s hook
`script generator creates new functions to replace the original functions, such
`as the JavaScript function embedded in a web page. Id. ¶ 26. When the web
`page is received, the script filter injects “the JavaScript that hooks the
`critical functions and methods before any other HTML in a loading page.”
`Id. ¶ 29. To implement these “hooks,” Ross states that it replaces the
`original function with a new replacement function or that it substitutes an
`original function with a filtered function by instantiating a “hooked” process.
`Id. ¶¶ 33, 34. These statements of “replacement” and “substitution,”
`however, refer to how the hook functions are implemented when the script
`executes. Neither of these statements explains whether a “call” to a hook
`function is included in the script. That is, the replacement or substitution
`may result in invoking the hook function, without the content actually
`including a call. And this indirect invocation—not using a call—of the
`hooked function is what Ross tends to show. For instance, Ross describes
`the method of processing the content as follows: (1) generating a hook
`
`17
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`script with a hook function; (2) loading the hook script; (3) loading the data
`content having the original function; and (4) executing a hook function when
`a corresponding original function is called in the data content. Id. ¶ 38.
`Thus, the hook function is loaded before anything else is loaded in
`order to define the hook function and to effectuate the replacement. The
`replacement, or the method of superseding, is accomplished by the
`assignment that results from the use of the instruction
`ActiveXObject=HookedActiveXObject. As Dr. Medvidovic explains, by
`way of assignment of ActiveXObject (original function) to
`HookedActiveXObject (substitute or first function), a call to the original
`function indirectly invokes the substitute or first function. See Ex. 1011,
`10:2013:21. This understanding is further confirmed by Ross’s description
`of the hook functions, as stated above, and when it refers to them as “new
`objects that will be used as replacements when the appropriate constructor
`is invoked.” Ex. 1003 ¶ 35 (emphasis added).
`In sum, Ross’s content does not include a “call to a first function”
`because the hook function is not directly called. There is no instruction or
`statement in the hook script that requests the service of the hook function.
`See also Ex. 2043 at 88:1116 (Dr. Rubin, Petitioner’s expert, testifying that
`“in the pseudocode in figure 4 [of Ross] there’s no explicit call to a hooked
`function.”). The hook function is invoked only when the call to the original
`function in the data content, which has been assigned via the hook script to a
`hook function, is executed. See id. (“These hooks are installed before any
`other script on the web page loads, ensuring that any script provided as a
`part of the data content 602, such as a web page, will call the new hooked
`functions.”).
`
`18
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`Petitioner unpersuasively argues in the Reply that the combined script
`shown in Figure 4 would “readily teach or suggest to a [person of ordinary
`skill in the art] that the act of having a hook function supersede a call to an
`original function can be achieved via a call to a hook function within the
`hook script.” Reply 1011 (citing the reply Declaration of Dr. Aviel Rubin,
`Ex. 1005 ¶ 3). We are not persuaded by this testimony. The testimony
`relies on an interpretation of Ross that we find erroneous. For instance, Dr.
`Rubin opines that paragraph 31 of Ross supports the contention that one way
`to ensure the hook script function is processed first would be to include a
`call to the hook function within the hook script. Ex. 1005 ¶¶ 46. As
`explained above, we find that Ross’s description of processing the hook
`script in paragraph 31 does not teach including a call to the hook function.
`Disclosing that the hook script and original script codes may be injected into
`the script processing engine by any means, Ross refers to the order of
`processing the hook function, not whether the script may include other
`instructions, such as a call to the hook function. As stated above, Ross
`teaches assigning the original function to the hooked function. In that
`manner, Ross invokes indirectly the hook function without any need to
`include a call to that hook function.
`Additional Arguments in Petitioner’s Reply
`
`Expanding on the issue of whether Ross includes a call to a first
`function, Petitioner argues that it would have been obvious for a person of
`ordinary skill in the art to include in the hook script a call to the hook
`function to ensure that the hook function is processed first. Reply 11.
`Petitioner proffers additional argument that the script shown in Figure 4 of
`Ross suggests including a call to a first function where the code states
`
`19
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`“Security checks go here.” Reply 1113. In particular, Petitioner now
`argues that it would have been obvious to implement the security checks by
`calling a separate hook function within the hook script. Id. at 13. That is,
`instead of calling the hook function “HookedActiveXObject,” Petitioner
`contends that it would have been obvious to include another hook function
`within the function “HookedActiveXObject.” Id. In support, of this
`contention, Petitioner asserts that there is no dispute on this issue, citing to a
`second declaration of Dr. Rubin filed with the Reply and to testimony of Dr.
`Medvidovic alleged to be in agreement. Id. Dr. Rubin also provides
`additional declaration testimony purporting to show how to edit the
`pseudocode shown in Figure 4 of Ross to include a call to the hooked
`function. See Ex. 1005 ¶¶ 710.
`Patent Owner argued at the hearing that Petitioner’s argument and the
`supporting testimony from Dr. Rubin is outside the scope of a proper reply.
`Tr. 66:1913. Therefore, the issue before us is whether the additional
`arguments Petitioner presents in the Reply exceed the appropriate scope of a
`reply. See 37 C.F.R. § 42.23 (b) (“A reply may only respond to arguments
`raised in the corresponding opposition or patent owner response.”). In
`particular, we focus on whether it is appropriate to consider the argument
`that it would have been obvious to include a call to a first function within
`either the “Security checks go here” portion or the hooked script/hook
`function.
`
`To determine whether we should consider the argument, our Trial
`Practice Guide points out that,
`[w]hile replies can help crystalize issues for decision, a
`reply that raises a new issue or belatedly presents
`evidence will not be considered and may be returned.
`
`20
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`The Board will not attempt to sort proper from improper
`portions of the reply. Examples of indications that a
`new issue has been raised in a reply include new
`evidence necessary to make out a prima facie case for
`the patentability or unpatentability of an original or
`proposed substitute claim, and new evidence that could
`have been presented in a prior filing.
`
`Trial Practice Guide, 77 Fed. Reg. at 48767; see also Belden Inc. v. Berk-Tek
`LLC, 805 F.3d 1064, 1080 (Fed. Cir., 2015) (discussing that a patent owner
`“is undoubtedly entitled to notice of and fair opportunity to meet the grounds
`of rejection.”). With these guidelines in mind, we are persuaded that the
`above-identified argument in the Reply should not be considered