Paper 50
`Trials@uspto.gov
`571-272-7822 Entered: April 11, 2017
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC. and
`BLUE COAT SYSTEMS LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2016-001591
`Patent 8,677,494 B2
`____________
`
`
`
`Before ZHENYU YANG, CHARLES J. BOUDREAU, and
`SHEILA F. McSHANE, Administrative Patent Judges.
`
`BOUDREAU, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`
`
`
`
`
`1 Case IPR2016-01174 has been joined with the instant proceeding.
`
`
`Trials@uspto.gov
`571-272-7822 Entered: April 11, 2017
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`PALO ALTO NETWORKS, INC. and
`BLUE COAT SYSTEMS LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________
`
`Case IPR2016-001591
`Patent 8,677,494 B2
`____________
`
`
`
`Before ZHENYU YANG, CHARLES J. BOUDREAU, and
`SHEILA F. McSHANE, Administrative Patent Judges.
`
`BOUDREAU, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`
`
`
`
`
`1 Case IPR2016-01174 has been joined with the instant proceeding.
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`I. INTRODUCTION
`Palo Alto Networks, Inc. and Blue Coat Systems, Inc., now known as
`Blue Coat Systems LLC,2 (collectively, “Petitioner”) filed petitions
`requesting inter partes review of certain claims of U.S. Patent
`No. 8,677,494 B2 (Ex. 1001, “the ’494 patent”). Paper 2 (“Petition” or
`“Pet.”; requesting review of claims 1–18 of the ’494 patent); see also
`IPR2016-01174, Paper 2 (requesting review of claims 1–6 and 10–15 of the
`’494 patent).
`Based on the information provided in the Petition, and in
`consideration of the Preliminary Response (Paper 6; “Prelim. Resp.”) of
`Patent Owner, Finjan, Inc., we instituted a trial pursuant to 35 U.S.C.
`§ 314(a) with respect to claims 1–6 and 10–15 and subsequently joined Case
`IPR2016-01174 with the instant case. Paper 8 (“Decision on Institution” or
`“Dec. on Inst.”); see also Paper 20 (copy of decision instituting inter partes
`review in Case IPR2016-01174 and granting motion for joinder; also filed as
`IPR2016-01174, Paper 8).
`After institution, Patent Owner filed a Request for Rehearing Pursuant
`to 37 C.F.R. §§ 42.71(c) and 42.71(d) (Paper 11), challenging our decision
`to institute trial, and we issued a Decision Denying Patent Owner’s Request
`for Rehearing (Paper 13, “Rehearing Decision” or “Reh’g Dec.”).
`Thereafter, Patent Owner filed a Response (Paper 17 (“PO Resp.”)), and
`Petitioner filed a Reply (Paper 26, “Pet. Reply”). Petitioner proffered
`Declarations of Aviel D. Rubin, Ph.D. (Ex. 1002), Eugene Spafford, Ph.D.
`
`
`2 See Paper 30, 1. Blue Coat Systems LLC identifies Symantec Corp. as a
`real party in interest in this proceeding. Paper 39.
`
`2
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`(Ex. 1061), and John Hawes (Ex. 1088) with its Petition; and Supplemental
`Declarations of Dr. Rubin (Ex. 1090) and Mr. Hawes (Ex. 1089) with its
`Reply. Patent Owner proffered Declarations of Nenad Medvidovic, Ph.D.
`(Ex. 2011) and S.H. Michael Kim (Ex. 2012) with its Response. Also,
`deposition transcripts were filed for Michael T. Goodrich, Ph.D. (Ex. 1098),
`Mr. Kim (Ex. 1099), Dr. Medvidovic (Ex. 1100), Mr. Hawes (Ex. 2014),
`Dr. Rubin (Ex. 2015), and Jack W. Davidson, Ph.D., a witness proffered by
`the petitioner in related Case IPR2015-01892 (Ex. 2016).
`Petitioner moves to exclude certain paragraphs of Dr. Medvidovic’s
`Declaration and certain of Patent Owner’s Exhibits. Paper 31. Patent
`Owner filed an Opposition (Paper 43) to Petitioner’s Motion to Exclude, and
`Petitioner filed a Reply (Paper 47).
`Patent Owner also moves to exclude certain of Petitioner’s Exhibits
`and portions of Petitioner’s Reply. Paper 35. Petitioner filed a Response
`(Paper 42) to Patent Owner’s Motion to Exclude, and Patent Owner filed a
`Reply (Paper 48).
`Patent Owner additionally filed an identification of arguments alleged
`to exceed the proper scope of Petitioner’s Reply (Paper 32), to which
`Petitioner filed a response (Paper 40). Patent Owner further filed a Motion
`for Observations on the cross-examination of Mr. Hawes (Paper 34), and
`Petitioner filed a response thereto (Paper 41); and Patent Owner filed a
`Motion for Entry of the Default Protective Order and to Seal Certain
`Exhibits under 37 C.F.R. §§ 42.14 and 42.54 (Paper 45).
`An oral hearing was held on February 16, 2017; a transcript of the
`hearing is included in the record (Paper 49, “Tr.”).
`
`3
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`We have jurisdiction under 35 U.S.C. § 6. This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73.
`For the reasons that follow, we determine that Petitioner has shown by a
`preponderance of the evidence that claims 1, 2, and 6 of the ʼ494 patent are
`unpatentable, but that Petitioner has not shown by a preponderance of the
`evidence that claims 3–5 and 10–15 of the ’494 patent are unpatentable.
`We also dismiss as moot Petitioner’s Motion to Exclude;
`dismiss-in-part and deny-in-part Patent Owner’s Motion to Exclude; and
`grant Patent Owner’s Motion for Entry of the Default Protective Order and
`to Seal.
`
`II. BACKGROUND
`
`A. Related Proceedings
`The parties identify six district court actions involving the ’494 patent:
`Finjan, Inc. v. Sophos, Inc., No. 3:14-cv-01197 (N.D. Cal. 2014) (“the
`Sophos litigation”); Finjan, Inc. v. Websense, Inc., No. 14-cv-01353
`(N.D. Cal. 2014) (“the Websense litigation”); Finjan, Inc. v. Symantec
`Corp., No. 3:14-cv-02998 (N.D. Cal. 2014); Finjan, Inc. v. Palo Alto
`Networks, Inc., No. 3:14-cv-04908 (N.D. Cal. 2014); Finjan, Inc. v. Blue
`Coat Systems, Inc., No. 5:15-cv-03295 (N.D. Cal. 2015) (“the Blue Coat
`litigation”); and Finjan, Inc. v. Cisco Systems Inc., No. 3:17-cv-00072
`(N.D. Cal. 2017). Pet. 2; Paper 5, 1; PO Resp. 57; Paper 37, 1.
`The ’494 patent was also the subject of an inter partes review in
`Symantec Corp. v. Finjan, Inc., Case IPR2015-01892 (“the Symantec 1892
`IPR”), to which Blue Coat Systems, Inc. v. Finjan, Inc., Case
`IPR2016-00890, was joined; and was the subject of denied petitions for inter
`partes review in Sophos Inc. v. Finjan, Inc., Case IPR2015-01022, Symantec
`
`4
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Corp. v. Finjan, Inc., Case IPR2015-01897, and Blue Coat Systems, Inc. v.
`Finjan, Inc., Case IPR2016-01443. We previously issued a Final Written
`Decision in the Symantec 1892 IPR, in which we determined, as in the
`instant proceeding, that claims 1, 2, and 6 of the ’494 patent are
`unpatentable. See IPR2015-01892, slip op. at 66 (PTAB Mar. 15, 2017)
`(Paper 58) (Symantec Final Written Dec.).
`
`B. The ’494 Patent
`The ’494 patent, entitled “Malicious Mobile Code Runtime
`Monitoring System and Methods,” issued March 18, 2014, from U.S. Patent
`Application No. 13/290,708 (“the ’708 application”), filed November 7,
`2011. Ex. 1001, [21], [22], [45], [54].
`The ’494 patent describes protection systems and methods “capable of
`protecting a personal computer (‘PC’) or other persistently or even
`intermittently network accessible devices or processes from harmful,
`undesirable, suspicious or other ‘malicious’ operations that might otherwise
`be effectuated by remotely operable code.” Ex. 1001, 2:51–56. “[R]emotely
`operable code that is protectable against can include,” for example,
`“downloadable application programs, Trojan horses and program code
`groupings, as well as software ‘components’, such as Java™ applets,
`ActiveX™ controls, JavaScript™/Visual Basic scripts, add-ins, etc., among
`others.” Id. at 2:59–64.
`
`C. Priority Date of the ’494 Patent
`On its face, the ’494 patent purports to claim priority from nine earlier
`applications: (1) U.S. Provisional Application No. 60/030,639 (“the ’639
`provisional”), filed November 8, 1996; (2) U.S. Patent Application No.
`08/790,097, filed January 29, 1997, and issued as U.S. Patent No. 6,167,520
`
`5
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`(“the ’520 patent”); (3) U.S. Patent Application No. 08/964,388 (“the ’388
`application”), filed November 6, 1997, and issued as U.S. Patent No.
`6,092,194 (Ex. 1013, “the ’194 patent”); (4) U.S. Patent Application
`No. 09/539,667 (“the ’667 application”), filed March 30, 2000, and issued as
`U.S. Patent No. 6,804,780 (Ex. 2004, “the ’780 patent”); (5) U.S. Patent
`Application No. 09/551,302, filed April 18, 2000; (6) U.S. Provisional
`Patent Application No. 60/205,591, filed May 17, 2000; (7) U.S. Patent
`Application No. 09/861,229 (“the ’229 application”), filed May 17, 2001,
`and issued as U.S. Patent No. 7,058,822 B2 (Ex. 1016, “the ’822 patent”);
`(8) U.S. Patent Application No. 11/370,114 (“the ’114 application”), filed
`March 7, 2006; and (9) U.S. Patent Application No. 12/471,942 (“the ’942
`application”), filed May 26, 2009. Ex. 1001, [63].
`In the Petition, Petitioner asserted that claims 1, 3–6, 9, 10, 12–15,
`and 18 of the ’494 patent are entitled only to the March 30, 2000, filing date
`of the ’667 application; that claims 2 and 11 are entitled only to the May 26,
`2009, filing date of the ’942 application; and that claims 7, 8, 16, and 17 are
`entitled only to the March 7, 2006,3 filing date of the ’114 application.
`Pet. 13–19. Petitioner’s argument regarding the first of these groups of
`claims was, essentially, that: (1) there was a break in the priority chain due
`to a failure of the ’494 patent’s great-grandparent ’822 patent to claim
`priority from or include any reference to the ’520 and ’194 patents or the
`’097 and ’388 applications from which those patents respectively issued;
`(2) as a result of that break, the ’494 patent’s “grandparent ’926 [patent]
`cannot claim priority earlier than the date of the earliest date of an
`
`3 This date is repeatedly misstated in the Petition as May 7, 2006. Pet. 6, 13,
`14.
`
`6
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`application on the face of its parent, the ’822 patent: March 30, 2000”; and
`(3) “[i]n turn, the ʼ494 [patent]—which depends on the ’926 [patent]’s
`priority—has the same priority date limitation.” Id. at 15–16. Petitioner
`acknowledged that Patent Owner later filed a “Petition to Accept
`Unintentionally Delayed Priority Claim Under 37 C.F.R. 1.78” (“Priority
`Petition”) during reexamination of the ’822 patent, requesting amendment to
`include references to the ’520 and ’194 patents, and that the Office granted
`the Priority Petition and issued a Corrected Filing Receipt including the
`priority claim to the previously omitted applications in July 2014. Pet. 16;
`Ex. 1017, 1–3 (Reexamination Control No. 90/013,017, Decision mailed
`July 25, 2014, at 1–3); Ex. 3005, 1 (Reexamination Control No. 90/013,017,
`Corrected Filing Receipt dated July 24, 2014, at 1). Nonetheless, Petitioner
`contended, because the Examiner in the reexamination later concluded that
`certain claims of the ’822 patent are entitled to a priority date no earlier than
`May 17, 2000, because no certificate of correction had been published, and
`because the reexamination of the ’822 patent had not completed and was on
`appeal after all petitioned claims in the ’822 patent were rejected as invalid,
`the Priority Petition is ineffectual with respect to the ’494 patent’s
`entitlement to the benefit of the November 6, 1997 filing date of the
`’388 application. Pet. 16.
`In the Decision on Institution, we agreed with Petitioner that the
`’494 patent was not entitled to claim the benefit of the November 8, 1996,
`filing date of the ’639 provisional or the January 29, 1997, filing date of the
`’092 application, but concluded, notwithstanding Petitioner’s arguments,
`that each of the claims is entitled to the priority date of the November 6,
`
`7
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`1997, filing date of the ’388 application. Dec. on Inst. 11–13. As we
`explained,
`Petitioner cites no authority for the proposition that a granted
`petition to accept an unintentionally delayed priority claim is
`effective only upon issuance of a certificate of correction or
`reexamination certificate, and not upon grant of the petition. In
`any event, as Patent Owner points out in its Preliminary
`Response, the Board reversed the rejection of all appealed claims
`in the reexamination of the ’822 patent (see Ex. 2007) and a
`reexamination certificate was issued by the Office on February
`16, 2016 (Ex. 2009). Prelim. Resp. 18.
`Notably, however, . . . [a]s Petitioner points out, the
`earliest priority document cited on the face of the ’926 patent
`through which the ’494 claims priority is the ’194 patent (see Pet.
`18), and there is no indication in the record that the ’926 patent,
`or the ’114 application, from which it issued, was ever the subject
`of a petition to accept a delayed priority claim to either the ’639
`provisional or the ’097 application.
`Id. at 12–13.
`Although Patent Owner argues in the Patent Owner Response that it
`“maintains that the ’494 Patent is entitled to the November 8, 1996 priority
`date established by Provisional Patent Application No. 60/030,639” (PO
`Resp. 15 n.7), it does not provide any additional explanation or cite any
`evidence in support of that conclusory argument, and does not otherwise
`challenge our determination that the ’494 patent is not entitled to claim the
`benefit of any filing date earlier than November 6, 1997.
`For its part, Petitioner did not request reconsideration of our
`determination regarding the priority date or challenge that determination in
`its Reply, but raised again at the oral hearing its argument that the proper
`priority date for the challenged claims is March 30, 2000. Tr. 6:13–13:1.
`Petitioner contends, in essence, that the correction of the priority date of the
`
`8
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`’822 patent was not effective until the issuance of a reexamination certificate
`on February 16, 2016, and that, because that was after Patent Owner sued
`Petitioner Palo Alto Networks, Inc. in November 2014 and the Petition was
`filed in November 2015, the correction does not benefit the ’494 patent. Id.
`at 6:21–7:19. According to Petitioner, “the statute governing certificates of
`correction as well as the regulations on this issue do not allow this type of
`correction to have retroactive effect, and because the IPR in this case was
`filed prior to the issuance of the reexamination certificate, that certificate has
`no effect here.” Id. at 8:5–9. Petitioner contends, more particularly, that
`“[o]n the face of section 255 it states that a certificate of correction is only
`effective for causes thereafter arising, and that language has been interpreted
`by the Federal Circuit in the H.-W. Tech. case.” Id. at 8:16–19 (citing
`35 U.S.C. § 255 and H-W Technology, L.C. v. Overstock.com, Inc., 758 F.3d
`1329 (Fed. Cir. 2014)).
`Having considered the full trial record, we remain persuaded that each
`of the challenged claims is entitled to an effective filing date of November 6,
`1997. As we explained in our Decision on Institution, we understand Patent
`Owner’s delayed priority claim to have been effective upon the Office’s
`grant of the Priority Petition and Issuance of Corrected Filing Receipt on
`July 25, 2014 (Ex. 1017, 1–3; Ex. 3005, 1), rather than upon the issuance of
`the Reexamination Certificate confirming the patentability of the claims of
`the ’822 patent (Ex. 2009). See Dec. on Inst. 11–12. Petitioner does not
`point to, and we are not aware of, any authority suggesting that a granted
`petition to correct priority date requires, in addition, the issuance of either a
`certificate of correction or a reexamination certificate before becoming
`effective. Despite Petitioner’s representation at the oral hearing that H-W
`
`9
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Technology involved correction of a priority date (Tr. 9:2–7), we note that
`that case instead involved a certificate of correction to add a missing
`limitation to a patent claim and, thus, is not on point here. See H-W Tech.,
`758 F.3d at 1331, 1334. Accordingly, we conclude that each of the
`challenged claims is entitled to the benefit of the November 6, 1997, filing
`date of the ’388 application.
`
`D. Illustrative Challenged Claims
`Of the challenged claims, claims 1 and 10 are independent. Those
`claims are illustrative and are reproduced below:
`1. A computer-based method, comprising the steps of:
`receiving an incoming Downloadable;
`deriving security profile data for the Downloadable,
`including a list of suspicious computer operations that may be
`attempted by the Downloadable; and
`storing the Downloadable security profile data in a database.
`
`10. A system for managing Downloadables, comprising:
`a receiver for receiving an incoming Downloadable;
`a Downloadable scanner coupled with said receiver, for
`deriving security profile data for the Downloadable, including a
`list of suspicious computer operations that may be attempted by
`the Downloadable; and
`a database manager coupled with said Downloadable
`scanner, for storing the Downloadable security profile data in a
`database.
`
`Ex. 1001, 21:19–25, 22:7–16. Each of challenged claims 2–6 depends
`directly from claim 1; and each of challenged claims 11–15 depends directly
`from claim 10. Id. at 21:26–37, 22:17–30.
`
`10
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`E. Instituted Grounds of Unpatentability
`The Petition asserted six grounds of unpatentability. Pet. 5. We
`instituted trial in this case on the following two grounds:
`
`Claims
`
`1, 2, 6, 10, 11, and 15
`
`3–5 and 12–14
`
`Basis
`
`§ 103
`
`§ 103
`
`Reference(s)
`
`Swimmer4
`
`Swimmer and Martin5
`
`Dec. on Inst. 34.
`
`III. ANALYSIS
`
`A. Claim Construction
`The ’494 patent expired no later than January 29, 2017. See Paper 38,
`1 (Patent Owner representing that January 29, 2017, was the expiration date
`of the ’494 patent and that Petitioner does not dispute that date). In an inter
`partes review, we construe claims of an expired patent according to the
`standard applied by the district courts. See In re Rambus Inc., 694 F.3d 42,
`46 (Fed. Cir. 2012). Specifically, because the expired claims of a patent are
`not subject to amendment, we apply the principles set forth in Phillips v.
`AWH Corp., 415 F.3d 1303, 1312–17 (Fed. Cir. 2005) (en banc). Under that
`
`
`4 Morton Swimmer et al., Dynamic Detection and Classification of
`Computer Viruses Using General Behaviour Patterns, Virus Bull. Conf. 75
`(Sept. 1995) (Ex. 1006, “Swimmer”).
`5 David M. Martin, Jr. et al., Blocking Java Applets at the Firewall, Proc.
`1997 Symp. on Network & Distributed Sys. Sec. (©1997) (Ex. 1047,
`“Martin”). We note that Martin states on its face that it is from the
`proceedings of a symposium held February 10–11, 1997 (Ex. 1047, 1), but
`that the record copy of Martin bears a date stamp of June 5, 1998 (id. at 3),
`does not indicate a publication date, and merely has a 1997 copyright date
`(id. at 1).
`
`11
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`standard, the words of a claim are generally given their ordinary and
`customary meaning, which is the meaning the term would have to a person
`of ordinary skill at the time of the invention, in the context of the entire
`patent including the specification. See Phillips, 415 F.3d at 1312–13. Only
`those terms in controversy need to be construed, and only to the extent
`necessary to resolve the controversy. See Vivid Techs., Inc. v. Am. Sci. &
`Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999).
`Petitioner proposed constructions in the Petition for three claim terms:
`(1) “Downloadable security profile data,” as “information related to whether
`executing a downloadable is a security risk”; (2) “database,” as “a collection
`of interrelated data organized according to a database schema to serve one or
`more applications”; and (3) “Downloadable,” as “an executable application
`program, which is downloaded from a source computer and run on the
`destination computer.” Pet. 19–23. In the Decision on Institution, we noted
`that Patent Owner in its Preliminary Response challenged only Petitioner’s
`proposal with respect to the first of these terms. Dec. on Inst. 6 (citing
`Prelim. Resp. 9–12). Upon consideration of the parties’ respective
`arguments, we adopted the parties’ agreed constructions of “database” and
`“Downloadable,” and we also agreed with Patent Owner that, in view of the
`parties’ agreed interpretation of the term “Downloadable,” there was no need
`to separately construe the term “Downloadable security profile data.” Id. at
`7–8. We also determined that no other claim terms required express
`construction for purposes of the Decision on Institution. Id. at 8.
`In the Patent Owner Response, Patent Owner agrees with our
`determinations on claim construction in the Decision on Institution. PO
`Resp. 8–11. Petitioner also does not challenge those determinations in its
`
`12
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Reply. Although our claim construction analysis in the Decision on
`Institution was rendered under the “broadest reasonable interpretation”
`standard applicable to unexpired patents (see 37 C.F.R. § 42.100(b)), we
`discern no reason to deviate from our previous determinations here.6
`
`B. Obviousness Grounds
`We have reviewed the Petition, Patent Owner Response, and
`Petitioner’s Reply, as well as the relevant evidence discussed therein. For
`the reasons that follow, we determine that Petitioner has shown by a
`preponderance of the evidence that claims 1, 2, and 6 of the ’494 patent are
`unpatentable under 35 U.S.C. § 103(a) over Swimmer.
`
`1. Principles of Law
`A patent claim is unpatentable under 35 U.S.C. § 103(a) if the
`differences between the claimed subject matter and the prior art are “such
`that the subject matter as a whole would have been obvious at the time the
`invention was made to a person having ordinary skill in the art to which said
`subject matter pertains.” KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406
`(2007). The question of obviousness is resolved on the basis of underlying
`factual determinations, including (1) the scope and content of the prior art;
`(2) any differences between the claimed subject matter and the prior art;
`(3) the level of skill in the art; and (4) objective evidence of nonobviousness,
`i.e., secondary considerations such as commercial success, long felt but
`
`
`6 We note that our adopted construction of “database” mirrors the district
`court’s express construction of that term in the Sophos litigation and that
`we also adopted the same construction in the Symantec 1892 IPR. See
`Ex. 2001, 3 (Finjan, Inc. v. Sophos, Inc., No. 14-cv-01197 (N.D. Cal. 2014),
`Claim Construction Order at 3); Symantec, slip op. at 16.
`
`13
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`unsolved needs, and failure of others. Graham v. John Deere Co., 383 U.S.
`1, 17–18 (1966).
`To prevail in an inter partes review, a petitioner must prove the
`unpatentability of the challenged claims by a preponderance of the evidence.
`35 U.S.C. § 316(e); 37 C.F.R. § 42.1(d). “[T]he petitioner has the burden
`from the onset to show with particularity why the patent it challenges is
`unpatentable.” Harmonic Inc. v. Avid Tech., Inc., 815 F.3d 1356, 1363 (Fed.
`Cir. 2016) (citing 35 U.S.C. § 312(a)(3) (requiring inter partes review
`petitions to identify “with particularity . . . the evidence that supports the
`grounds for the challenge to each claim”)). The burden of persuasion never
`shifts to Patent Owner. See Dynamic Drinkware, LLC v. Nat’l Graphics,
`Inc., 800 F.3d 1375, 1378 (Fed. Cir. 2015) (discussing the burden of proof in
`inter partes review). Furthermore, Petitioner cannot satisfy its burden of
`proving obviousness by employing “mere conclusory statements.” In re
`Magnum Oil Tools Int’l, Ltd., 829 F.3d 1364, 1380 (Fed. Cir. 2016).
`We analyze the instituted ground of unpatentability in accordance
`with the above-stated principles.
`
`2. Level of Ordinary Skill in the Art
`In determining whether an invention would have been obvious at the
`time it was made, 35 U.S.C. § 103 requires us to resolve the level of
`ordinary skill in the pertinent art at the time of the invention. Graham,
`383 U.S. at 17. “The importance of resolving the level of ordinary skill in
`the art lies in the necessity of maintaining objectivity in the obviousness
`inquiry.” Ryko Mfg. Co. v. Nu-Star, Inc., 950 F.2d 714, 718 (Fed. Cir.
`1991). The person of ordinary skill in the art is a hypothetical person who is
`presumed to have known the relevant art at the time of the invention. In re
`
`14
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`GPAC, Inc., 57 F.3d 1573, 1579 (Fed. Cir. 1995). Factors that may be
`considered in determining the level of ordinary skill in the art include, but
`are not limited to, the types of problems encountered in the art, the
`sophistication of the technology, and educational level of active workers in
`the field. Id. In a given case, one or more factors may predominate. Id.
`Generally, it is easier to establish obviousness under a higher level of
`ordinary skill in the art. Innovention Toys, LLC v. MGA Entm’t, Inc.,
`637 F.3d 1314, 1323 (Fed. Cir. 2011) (“A less sophisticated level of skill
`generally favors a determination of nonobviousness, . . . while a higher level
`of skill favors the reverse.”).
`Petitioner’s declarant, Dr. Rubin, opines that a person of ordinary skill
`at the time of the ’494 patent would have had a bachelor’s degree or the
`equivalent in computer science (or related academic fields) and three to four
`years of additional experience in the field of computer security, or
`equivalent work experience. Ex. 1002 ¶ 21. According to Dr. Rubin, “[t]his
`definition . . . would not change whether the time of the alleged invention is
`deemed to be 1996, 2000, or 2006.” Id.
`Patent Owner’s declarant, Dr. Medvidovic, opines that the person of
`ordinary skill in the art in the field of the ’494 patent would be someone with
`a bachelor’s degree in computer science or a related field and “either (1) two
`or more years of industry experience and/or (2) an advanced degree in
`computer science or related field.” Ex. 2011 ¶ 37. Nonetheless,
`Dr. Medvidovic acknowledges Dr. Rubin’s opinion as to the relevant level
`of skill and further opines that the opinions stated in his declaration would
`be the same if rendered from the perspective of the person of ordinary skill
`in the art set forth by Dr. Rubin. Id. ¶¶ 39–40 (citing Ex. 1002 ¶ 21).
`
`15
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`We determine that the differences in the declarants’ assertions are
`negligible and that both assessments are consistent with the ’494 patent and
`the referenced prior art. For the purposes of the analysis below, we adopt
`Dr. Medvidovic’s assessment but note that the factual findings and legal
`conclusions set forth below would not have differed had we adopted
`Dr. Rubin’s assessment.
`
`3. Scope and Content of the Prior Art
`a. Overview of Swimmer
`Swimmer is generally directed to a system, referred to as the “Virus
`Intrusion Detection Expert System” (“VIDES”), that is described as “a
`prototype for an automatic analysis system for computer viruses.” Ex. 1006,
`1, 2. In Swimmer’s prototype, an emulator is used to monitor the system
`activity of a virtual computer, but Swimmer also states that “VIDES could
`conceivably be used outside the virus lab to detect viruses in a real
`environment” and that “[o]ne possibility is to use it as a type of firewall for
`programs entering a protected network.” Id. at 1, 13.
`In general, Swimmer discloses that sets of rules are used to detect
`viruses and extract details of their behavior. Ex. 1006, 1–7. Swimmer
`provides a model of virus attack strategy and discloses that virus-specific
`rules can be generated and translated into a rule-based language (“RUles-
`baSed Sequence Evaluation Language,” or “RUSSEL”). Id. at 4–7. For
`example, based on assumptions about the behavior of disk operating system
`(DOS) viruses, Swimmer identifies two possible infection strategies:
`(1) writing to the beginning of a file (BOF) without a previous read to the
`same location, and (2) reading to BOF followed by a writing to BOF, with or
`without intervening reads and writes. Id. at 5–6.
`
`16
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Swimmer discloses that VIDES collects system activity data and
`creates a set of audit records having a specified format for analysis by a tool
`referred to as “Advanced Security audit trail Analysis on uniX” (“ASAX”).
`Ex. 1006, 1, 9. ASAX is described as an expert system that analyzes the
`data produced by the VIDES emulator, using RUSSEL to identify the virus
`attack. Id. at 1, 4, 10–13. Swimmer also discloses that ASAX provides a
`filter that reduces the number of audit records to only relevant, higher-level
`records. Id. at 6–7. In particular, a “first ASAX system reads the raw audit
`trail, converts it into generic data, and pipes its output as a [Normalized
`Audit Data Format] NADF file for further processing,” and “[u]sing ASAX
`as a filter allows [for] reduc[tion in] the complexity of maintaining the
`system while not sacrificing any power.” Id. at 7, 12. The audit records
`identify, among other things, DOS functions requested by the analyzed
`program, the register/memory values used in calls to the DOS functions, and
`register/memory values returned by the function calls. Id. at 1, 7, 9.
`Swimmer explains that each VIDES audit record has the format <code
`segment, RecType, StartTime, EndTime, function number, arg (...), ret (...)>,
`where code segment is the address in memory of the executable image of the
`program; function number is the number of the DOS function requested by
`the program; arg (...) is a list of register/memory values used in the call to a
`DOS function; ret (...) is a list of register/memory values as returned by the
`function call; RecType is the type of the record; and StartTime and EndTime
`are the time stamp of action start and end, respectively. Ex. 1006, 9.
`An example of an excerpt from an audit trail is provided in Figure 3 of
`Swimmer, reproduced below.
`
`17
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`
`
`Figure 3, above, is described by Swimmer as an excerpt from an audit trail
`for the Vienna virus, provided as a human-readable representation of a
`binary NADF file and omitting certain fields (apparently, StartTime and
`EndTime) for clarity and brevity. Ex. 1006, 9–10.
`On its face, Swimmer includes the following header: “VIRUS
`BULLETIN CONFERENCE, SEPTEMBER 1995.” Ex. 1006, 1; see also
`id. at 3, 5, 7, 9, 11, 13 (including the same header). Along with the Petition,
`Petitioner introduced a declaration of Mr. John Hawes, Chief of Operations
`at Virus Bulletin. Ex. 1088. Mr. Hawes declares that, according to Virus
`Bulletin’s business records maintained in the ordinary course of business,
`Swimmer was published by Virus Bulletin to all 163 attendees of the Virus
`Bulletin International Conference in Boston in September 1995, and the
`conference proceedings book containing Swimmer was subsequently made
`available for private sale to individuals by Virus Bulletin. Id. ¶ 3.
`Mr. Hawes also declares that Exhibit A attached to his declaration is a true
`and correct copy of Swimmer as published by Virus Bulletin in 1995. Id.
`¶ 4.
`
`18
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`b. Overview of Martin
`Martin “explores the problem of protecting a site on the Internet
`against hostile external Java applets while allowing trusts internal applets to
`run.” Ex. 1047, 5. According to Martin, “[f]laws in the design and
`implementation of Java-enabled browsers have repeatedly been discovered,”
`and “[t]hese vulnerabilities can allow Java applets to erase files, leak
`sensitive information, and corrupt a user’s environment.” Id. Martin
`discloses a firewall architecture that includes a secured proxy host to which
`all relevant data packets are forwarded before being permitted to pass
`through the firewall. Id. at 6–7. The proxy host can employ any of several
`different techniques or a combination of those techniques to identify Java
`applets so they can be blocked at the firewall. Id. at 11–13. For example,
`the proxy can scan incoming content for <applet> tags, for the “4-byte hex
`signature CA, FE, BA, BE” required by the Java Virtual Machine
`Specification for all Java class files to begin, or for a file name ending in
`“.class” or “.zip.” Id. at 12–13.
`Martin further discloses that, “[a]lthough we are primarily concerned
`with Java Applets, it should be emphasized that Netscape’s Javascript and
`Microsoft’s ActiveX—the other popular portable-executable formats—
`deliver the executable i
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
