Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page1 of 30
`
`
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`KRAMER LEVIN NAFTALIS & FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`
`
`Case No.: 13-cv-04398-BLF
`
`PLAINTIFF FINJAN, INC.’S OPENING
`CLAIM CONSTRUCTION BRIEF
`
`November 21, 2014
`Date:
`9:00 a.m.
`Time:
`Dept.: Courtroom 3, 5th Floor
`Judge: Hon. Beth Labson Freeman
`
`FINJAN, INC., a Delaware Corporation,
`
`
`
`
`
`
`
`Plaintiff,
`
`v.
`
`
`WEBSENSE, INC., a Delaware Corporation,
`
`Defendant.
`
`
`
`
`
`
`
`
`
`
`____________________________________________________________________________________
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`Blue Coat Systems - Exhibit 1035
`
`

`
`
`
`I.
`
`II.
`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page2 of 30
`
`TABLE OF CONTENTS
`
`Page
`
`INTRODUCTION ........................................................................................................................ 1
`
`STATEMENT OF FACTS ........................................................................................................... 1
`
`A.
`
`B.
`
`Background of the Technology ......................................................................................... 1
`
`Summary of Finjan’s Patents ............................................................................................ 2
`
`1.
`
`2.
`
`3.
`
`4.
`
`‘822, ‘633 Patents ................................................................................................. 3
`
`‘154 Patent ............................................................................................................ 3
`
`‘408 Patent ............................................................................................................ 4
`
`‘494 Patent ............................................................................................................ 4
`
`III.
`
`ARGUMENT ................................................................................................................................ 4
`
`A.
`
`Finjan’s Proposed Terms .................................................................................................. 5
`
`1.
`
`2.
`
`3.
`
`Mobile Protection Code (the ‘822, ‘633 Patents) ................................................. 6
`
`Parse tree (the ‘408 Patent) ................................................................................... 8
`
`Terms Websense Asserts are Indefinite .............................................................. 11
`
`i.
`
`ii.
`
`iii.
`
`Indicates a level of downloadable-information characteristic and
`executable code characteristic correspondence (the ‘822 Patent) ........... 11
`
`Wherein the analyzer rules identify certain combinations of
`tokens and patterns (the ‘408 Patent) ...................................................... 12
`
`Receiving, by the computer, one or more executable code
`characteristics of executable code that is capable of being
`executed by the information-destination (the ‘633 Patent) ..................... 14
`
`B. Websense’s Proposed Terms for Construction ............................................................... 16
`
`1.
`
`2.
`
`3.
`
`4.
`
`Security computer (the ‘154 Patent) ................................................................... 16
`
`Dynamically generated (the ‘154 Patent) ........................................................... 18
`
`Content (the ‘154 Patent) .................................................................................... 19
`
`Information-destination of the downloadable-information (the ‘822 and
`‘633 Patents) ....................................................................................................... 21
`
`i
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page3 of 30
`
`5.
`
`Determining whether the downloadable-information include executable
`code (the ‘822 Patent) and determining, by the computer, whether the
`downloadable-information includes executable code (the ‘633 Patent) ............. 23
`
`CONCLUSION ........................................................................................................................... 25
`
`
`
`
`
`IV.
`
`
`
`ii
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page4 of 30
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`
`
`
`CASES
`
`Aventis Pharms. Inc. v. Amino Chems. Ltd.,
`715 F.3d 1363 (Fed. Cir. 2013).........................................................................................5, 16, 17, 18
`
`Finjan, Inc. v. Blue Coat Systems, Inc.,
`Case No. 4:13-cv-03999-BLF (N.D. Cal.) ..........................................................................................7
`
`Finjan, Inc. v. Secure Computing Corp.,
`626 F.3d 1197 (Fed. Cir. 2010).......................................................................................................5, 7
`
`Finjan Software Ltd. v. Secure Computing Corp.,
`Case No. 1:06-cv-00369 (D. Del. Aug. 24, 2007), Dkt. No. 108-1 ....................................................7
`
`Funai Elec. Co. v. Dawwoo Elecs. Corp.,
`616 F.3d 1357 (Fed. Cir. 2010)...........................................................................................................8
`
`Grober v. Mako Prods., Inc.,
`686 F.3d 1335 (Fed. Cir. 2012)...........................................................................................................5
`
`Hoechst Celanese Corp. v. BP Chems. Ltd.,
`78 F.3d 1575 (Fed. Cir. 1996).............................................................................................................8
`
`Markman v. Westview Instruments, Inc.,
`52 F.3d 967 (Fed. Cir. 1995)(en banc), aff’d, 517 U.S. 370 (1996) ...................................................4
`
`Nautilus, Inc. v. Biosig Instruments, Inc.,
`No. 13-369, 134 S. Ct. 2120 (2014) ..................................................................................................11
`
`Phillips v. AWH Corp.,
`415 F.3d 1303 (Fed. Cir. 2005)(en banc)......................................................................................4, 24
`
`SuperGuide Corp. v. DirecTV Enterprises, Inc.,
`358 F.3d 870 (Fed. Cir. 2004).............................................................................................................7
`
`Thorner v. Sony Computer Ent’t Am. LLC,
`669 F.3d 1362 (Fed. Cir. 2012).....................................................................................................5, 20
`
`Visto Corp. v. Sproqit Techs., Inc.,
`445 F. Supp.2d 1104 (N.D. Cal. 2006) ...............................................................................................7
`
`Vitronics Corp. v. Conceptronic, Inc.,
`90 F.3d 1576 (Fed. Cir. 1996).............................................................................................................7
`
`
`
`iii
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page5 of 30
`
`
`
`I.
`
`INTRODUCTION
`
`Through over a decade of research, Finjan developed a suite of technologies that protect against
`
`a variety of threats from the Internet. Finjan’s Patents are a reflection of its extensive development of
`
`innovative technology. While a number of companies have recognized Finjan’s innovations and
`
`licensed its intellectual property, Websense has refused to do so, even though its products employ
`
`Finjan’s patented technology. As a result, Finjan filed this action based on Websense’s infringement
`
`of five of Finjan’s Patents covering these security technologies.
`
`The claims of Finjan’s Patents are generally able to stand by themselves without reference to
`
`the intrinsic record because they are written in language that is commonly understood by those of skill
`
`in the art and define the terms in the claims themselves. As a result, most of the claim terms of
`
`Finjan’s Patents do not require construction. Finjan’s positions regarding claim construction reflect
`
`this fundamental nature of Finjan’s patents.
`
`Websense’s definitions violate a variety of claim construction tenants. Mostly notably,
`
`Websense seeks to change well-understood claim terms even though no explicit disavowal exists in the
`
`intrinsic record. Without a clear indication in the intrinsic record to limit a claim term, a well-
`
`understood term should be afforded its plain and ordinary meaning. This principle alone dictates that
`
`the terms Websense proposed for construction should not be construed.
`
`To eliminate any doubt regarding the propriety of Finjan’s positions, Finjan offers uncontested
`
`expert testimony supporting its constructions. During the claim construction discovery process,
`
`Websense’s expert offered no testimony rebutting Finjan’s claim construction positions. Websense’s
`
`expert only testified that certain terms were indefinite, but in the very same breath, admitted that all of
`
`the terms had well-understood meanings, and leaving Finjan’s expert, Dr. Medvidovic’s opinions
`
`unrebutted.
`
`II.
`
`STATEMENT OF FACTS
`A.
`In the modern era of computing, computers are constantly under attack from computer viruses
`
`Background of the Technology
`
`propagating on the Internet. Viruses have proven to be one of the most difficult, not to mention costly,
`
`1
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page6 of 30
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`problems with computers. This is particularly the case since the advent of the “always on” Internet
`
`connection, providing hackers with computers to attack 24-hours a day. Hackers have also become
`
`increasingly sophisticated in developing viruses, making them more difficult to detect with traditional
`
`signature virus scanners, which were effective until the advent of the Internet. Now, there is no “silver
`
`bullet” to protect a computer from every attack. The Internet is simply too large, viruses are changing
`
`too fast, and the hackers have become too wily at disguising viruses. Finjan’s visionary patented
`
`technology protect against a vast majority of these threats at various levels in the Internet architecture.
`B.
`Finjan developed technology that operates as network component, such as a security gateway
`
`Summary of Finjan’s Patents
`
`or part of the “cloud,” allowing a company to catch viruses before they run amok on a network. A
`
`security gateway catches viruses early because it inspects communications between an external
`
`computer or network and a protected computer or network.
`
`Finjan also pioneered new technologies to protect computers and networks by using behavior-
`
`based technology, looking at what incoming program code was intending to do, as opposed to
`
`traditional signature-based scanning. This novel technology allowed Finjan to outsmart the hackers by
`
`detecting new and unknown viruses that hackers tried to hide through obfuscation, a technique of
`
`hiding executable code so it is difficult to read and understand. While criminals continue to create
`
`viruses at an alarming rate, actual bad behavior of the virus can be detected with proper analysis using
`
`Finjan’s patented technologies. Accordingly, by targeting and analyzing the viruses’ behavior,
`
`Finjan’s patented technologies effectively stem the tide of malicious code based attacks.
`
`Five of Finjan’s patents have been asserted against Websense’s products in this case, U.S.
`
`Patent Nos. 7,058,822 (“’822 Patent”), 7,647,633 (“’633 Patent”), 6,141,154 (“’154 Patent”),
`8,225,408 (“’408 Patent”), and 8,677,494 (“’494 Patent”) (collectively “Finjan Patents”). Exs. 1-5.1
`These Finjan Patents are part of a suite of technologies for protecting computers from viruses
`
`downloaded through the Internet. The Finjan Patents describe different aspects of protection,
`
`
`1 All citations to exhibits are to exhibits attached to the Declaration of James Hannah filed herewith.
`2
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page7 of 30
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`providing computers with multiple layers of protection.
`1.
`The ‘822 and ‘633 Patents are related patents that share the same specification and generally
`
`‘822, ‘633 Patents
`
`cover protecting network connectable devices, such as computers on a network, from malicious
`
`executable code, such as viruses, that perform undesirable operations. See Exs. 1-2 (‘822 and ‘633
`
`Patents, Abstract). The patents describe a protection engine that operates within a re-communicator,
`
`such as a server or gateway computer. The protection engine intercepts information downloaded to a
`
`computer or network, and which may or may not include a virus, and determines whether the
`
`information includes executable code. Executable code is information that includes operations or
`
`actions performed by a system or computer. For example, executable code embedded in a webpage
`
`can perform operations, such as reading files, opening connections to other URLs or responding to
`
`movements of the mouse on the computer. In this example, if the information includes executable
`
`information, the protection engine can package the information with mobile protection code (“MPC”),
`
`and security policies for protection. See Exs. 1-2 (‘822 and ‘633 Patents, Fig. 3). The MPC monitors
`
`and/or intercepts potentially malicious code or operations, as would be run by a virus. Therefore, the
`
`MPC can protect against even obscured malicious operations because the behavior is analyzed, rather
`
`than verifying a known signature of the downloaded file.
`
`The ‘822 and ‘633 Patents also address when a virus is intentionally obfuscated. Ex. 1 (‘822
`
`Patent, Col. 9, ll. 14-22); Ex. 2 (‘633 Patent, Col. 9, ll. 10-24). By determining whether the
`
`downloadable-information includes executable code, the claimed invention protects against threats in
`
`obfuscated executable code because it identifies code that may perform malicious operations that are
`
`not immediately apparent. The ‘822 and ‘633 Patents include multiple tests for detecting whether the
`
`downloadable-information includes executable code. See Ex. 1 (‘822 Patent, Col. 12, ll. 18-27); Ex. 2
`
`(‘633 Patent, Col. 12, ll. 8-17).
`2.
`The ‘154 Patent relates to protecting a computer from dynamically generated executable code.
`
`‘154 Patent
`
`See Ex. 3 (‘154 Patent, Abstract). Prior systems only protected against malicious content that was
`
`3
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page8 of 30
`
`
`
`static. However, the patent describes how hackers can obfuscate content in a manner where its true
`
`nature is only revealed when dynamically generated. The ‘154 Patent provides a unique type of
`
`behavioral analysis that protects against such dynamically generated malicious content.
`3.
`The ‘408 Patent is generally directed towards scanning content to detect exploits within
`
`‘408 Patent
`
`received content using a parse tree. See Ex. 4 (‘408 Patent, Abstract). Exploits are portions of
`
`program code that are malicious. A parse tree is a technical abstract of the code that describes the
`
`received content in a manner that allows for the detection of exploits. This is beneficial because it
`
`allows multiple types of content, such as JavaScript embedded in HTML, to be scanned. See id. at
`
`Col. 1, l. 66-Col. 2, l. 2. The parse tree can be dynamically analyzed to detect exploits within the
`
`content using analyzer rules and a pattern matching engine, which identify patterns that match an
`
`exploit. See id. at Col. 2, l. 25-Col. 3, l. 6.
`4.
`The ‘494 Patent generally covers a system for receiving a downloadable and creating a profile
`
`‘494 Patent
`
`for the downloadable to be stored in a database. See Ex. 5 (‘494 Patent, Abstract). The ‘494 Patent
`
`discloses deriving a security profile for the Downloadable that includes a list of suspicious operations
`
`that may be attempted by the Downloadable. The ‘494 Patent then discloses storing the Downloadable
`
`profile in a database. Additional information about the Downloadable can also be stored in the
`
`database, such as the date and time the profile was derived and URL from which the Downloadable
`
`originated. Id. at Col. 21, ll. 26-28. The profile can be derived a number of different ways, including
`
`by disassembling the Downloadable to allow suspicious operations to be more easily detected. Id. at
`
`Col. 22, ll. 4-6.
`
`III. ARGUMENT
`
`Finjan’s constructions define the proper scope of the inventions at issue and give meaning to
`
`the claim language when the jury might otherwise misunderstand a claim term in the context of the
`
`patent. See Markman v. Westview Instruments, Inc., 52 F.3d 967, 976 (Fed. Cir. 1995)(en banc), aff’d,
`
`517 U.S. 370 (1996); see also Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005)(en
`
`4
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page9 of 30
`
`
`
`banc)(“The construction that stays true to the claim language and most naturally aligns with the
`
`patent’s description of the invention will be, in the end, the correct construction.”). Many of the claim
`
`terms are in plain English, and derive no special meaning from the patent and its prosecution history.
`
`Accordingly, they should be given their “plain and ordinary meaning” and there is no need to construe
`
`those terms. See Finjan, Inc. v. Secure Computing Corp., 626 F.3d 1197, 1207 (Fed. Cir. 2010)
`
`(rejecting argument that district court “shirked its responsibility to construe a disputed claim term by
`
`adopting ‘plain and ordinary meaning’”). In certain instances in which Websense argues a term is
`
`indefinite, Finjan proposes constructions in the alternative that demonstrate the ease in understanding
`
`the term.
`
`In contrast, Websense proposes unnecessary limitations to various terms in an attempt to
`
`support its non-infringement position, circumventing the plain language and altering the scope of the
`
`claims. See Aventis Pharms. Inc. v. Amino Chems. Ltd., 715 F.3d 1363, 1373 (Fed. Cir. 2013) (“Courts
`
`are required therefore to ‘look to the words of the claims themselves . . . to define the scope of the
`
`patented invention.’”) (citation omitted). Websense proposes overly-restrictive constructions and
`
`wholesale redefinition of claim terms despite the absence of any showing in the intrinsic record that the
`
`patentee disclaimed scope of these terms beyond their plain and ordinary meaning. Because the
`
`doctrine of prosecution disclaimer only applies to unambiguous disavowals, Websense’s attempt to
`
`import limitations into clear claim language violates fundamental claim construction law. Grober v.
`
`Mako Prods., Inc., 686 F.3d 1335 at 1341, 1342-43 (Fed. Cir. 2012) (holding that prosecution
`
`disclaimer requires unambiguous disavowal that unmistakably disclaims claim scope or meaning); see
`
`also Thorner v. Sony Computer Ent’t Am. LLC, 669 F.3d 1362, 1366-68 (Fed. Cir. 2012) (rejecting
`
`narrower construction in favor of broader plain meaning construction because the patentee did not
`
`explicitly redefine claim term). For these reasons, as explained further below, Websense’s proposed
`
`constructions should be rejected.
`A.
`The claims of the Finjan Patents, although technical, were drafted in a manner that an ordinary
`
`Finjan’s Proposed Terms
`
`5
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page10 of 30
`
`
`
`person skilled in the art2 could understand. In fact, there are only a few claim terms in the asserted
`patents that require construction given the clear drafting of the claim language.3 For these terms,
`Finjan provides constructions that are consistent with the specifications and easy for the factfinder to
`
`understand. Websense’s proposed constructions, however, contradict the specifications of Finjan’s
`
`Patents, create ambiguity, or simply misstate how a person of ordinary skill in the art would understand
`
`the claim.
`
`1.
`
`Mobile Protection Code (the ‘822, ‘633 Patents)
`
`Term in Dispute
`
`mobile protection code
`
`Websense’s Proposed
`Construction
`runtime code for
`detecting, preventing,
`or modifying malicious
`mobile code operations
`without modifying the
`mobile code
`Finjan and Websense agree that Mobile Protection Code (“MPC”) requires construction
`
`Finjan’s Proposed
`Construction
`code capable of
`monitoring or
`intercepting potentially
`malicious code
`
`because it does not have an ordinary meaning outside the context of the ‘822 and ‘633 Patents. The
`
`term is used in claims 1 and 9 of the ‘822 Patent and claims 1 and 8 of the ‘633 Patent. For example,
`
`claim 8 of the ‘633 Patent states:
`
`8. A computer processor-based system for computer security, the system
`comprising:
`…
`a protection agent engine communicatively coupled to the content
`inspection engine for causing mobile protection code (“MPC”) to be
`communicated by the computer to at least one information-destination of
`the downloadable-information,
`if
`the downloadable-information
`is
`determined to include executable code.
`‘633 Patent, Col. 21, ll. 19-32 (emphasis added).
`
`As set forth above, MPC, in the context of the ‘822 and ‘633 Patents, is code that protects a
`
`
`2 A person of ordinary skill in the art has a bachelor’s degree in computer science or related field, and
`(1) two years of industry experience and/or (2) an advanced degree in computer science or related
`field. See Declaration of Nenad Medvidovic in Support of Finjan’s Opening Claim Construction Brief
`(“Medvidovic Decl.”) ¶ 10.
`3 Finjan and Websense agreed on the proper construction of three terms used in the Finjan Patents—
`“Downloadable,” “database,” and “suspicious computer operations.” Dkt. 93.
`6
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page11 of 30
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`computer from harmful operations. While MPC is not a term often used in the art, the intrinsic record
`
`provides the proper meaning. Medvidovic Decl. at ¶ 15; Vitronics Corp. v. Conceptronic, Inc., 90 F.3d
`
`1576, 1582 (Fed. Cir. 1996) (“It is well-settled that, in interpreting an asserted claim, the court should
`
`look first to the intrinsic evidence of record, i.e., the patent itself, including the claims, the
`
`specification and, if in evidence, the prosecution history.”) (citation omitted). Finjan takes its
`
`construction straight from the specification which provides that “mobile protection code [causes] one
`
`or more predetermined malicious operations or operation combinations of a Downloadable to be
`
`monitored or otherwise intercepted.” ‘822 Patent, Col. 3, ll. 6-10. Thus, the intrinsic record fully
`
`supports Finjan’s construction.
`
`In fact, Finjan’s construction is so readily apparent from the specification, that it was adopted
`
`in a prior litigation. Finjan Software Ltd. v. Secure Computing Corp., Case No. 1:06-cv-00369 (D.
`
`Del. Aug. 24, 2007), Dkt. No. 108-1, Ex. A to Final Joint Claim Construction Chart. That previous
`
`case involving the ‘822 Patent was appealed to the Federal Circuit and the verdict upheld. Finjan, Inc.
`
`v. Secure Computing Corp., 626 F.3d 1197 (Fed. Cir. 2010). Despite the adoption of Finjan’s
`
`construction in the previous case, Websense’s proposal deviates significantly from the prior
`
`construction. Visto Corp. v. Sproqit Techs., Inc., 445 F. Supp.2d 1104, 1108-09 (N.D. Cal. 2006)
`
`(claim construction from another jurisdiction is entitled to “reasoned deference”). Finjan remained
`
`true to this understanding and has proposed this construction in subsequent litigations, such as the
`
`currently co-pending case of Finjan, Inc. v. Blue Coat Systems, Inc., Case No. 4:13-cv-03999-BLF
`
`(N.D. Cal.).
`
`Websense’s proposed construction is improper because it attempts to import the unnecessary
`
`limitation of the MPC as only being “runtime code.” SuperGuide Corp. v. DirecTV Enterprises, Inc.,
`
`358 F.3d 870, 875 (Fed. Cir. 2004) (“it is important not to import into a claim limitations that are not a
`
`part of the claim.”). There is no disclaimer supporting this limitation. Websense’s importation of the
`
`limitation “runtime code” contradicts embodiments disclosed in the ‘822 and ‘633 Patents in which the
`
`MPC is non-runtime. For example, the ‘822 Patent discloses a server that can receive a Downloadable
`
`that includes executable code. ‘822 Patent, Col. 2, l. 37-Col. 4, l. 40. In this example embodiment
`
`7
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page12 of 30
`
`
`
`provided in the patents, the server can analyze the Downloadable and package it with the MPC. Id.
`
`The single package is then sent to the destination to protect it from malicious operations. Id. In this
`
`example, the MPC is not runtime code because the server never runs it. The MPC is packaged with the
`
`incoming Downloadable and sent to the destination. Because Websense’s proposed construction
`
`excludes this preferred embodiment, its construction is improper as a matter of law. Funai Elec. Co. v.
`
`Dawwoo Elecs. Corp., 616 F.3d 1357, 1371 (Fed. Cir. 2010) (citing to Hoechst Celanese Corp. v. BP
`
`Chems. Ltd., 78 F.3d 1575, 1581 (Fed. Cir. 1996) for the proposition that “a claim construction that
`
`excludes a preferred embodiment is rarely, if ever, correct”).
`
`Websense also attempts to read in the requirement that the MPC does not modify the
`
`executable code. Nowhere in the claim or the intrinsic record is this requirement stated or implied. In
`
`fact, this requirement is inapposite to the specification, which specifically discloses examples where
`
`the MPC modifies the executable code in order for the MPC to protect the computer. For example, the
`
`‘822 Patent teaches that a server receives a Downloadable that includes executable code. Ex. 1 (‘822
`
`Patent, Col. 2, l. 37-Col. 4, l. 40). In order to protect the destination from harm, the server modifies the
`
`import address table, known as the “IAT,” of the Downloadable. Medvidovic Decl. at ¶ 17. Because
`
`Websense’s proposed construction attempts to read out this preferred embodiment, it should be
`
`rejected and the phrase should be given its plain and ordinary meaning.
`
`2.
`
`Parse tree (the ‘408 Patent)
`
`Term in Dispute
`
`parse tree
`
`Finjan’s Proposed
`Construction
`a tree data structure
`representing exploits
`in scanned content
`
`Websense’s Proposed
`Construction
`a data structure arranged in
`the form of a tree, where
`each token identified is
`represented by a node, and
`where the tree as a whole
`represents the syntactic
`structure of the incoming
`stream in the underlying
`programming language
`Finjan and Websense also agree that the Court should construe the term “parse tree,” as it is a
`
`technical term and some limited guidance from the Court would benefit the factfinder. This term is
`
`8
`__________________________________________________________________________________
`
`FINJAN’S OPENING CLAIM CONSTRUCTION BRIEF
`CASE NO. 13-cv-04398-BLF
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`
`Case5:13-cv-04398-BLF Document105 Filed09/23/14 Page13 of 30
`
`
`
`used in claims 1 and 23 of the ‘408 Patent. In one example, claim 1 of the ‘408 Patent uses “parse
`
`tree” several times as follows:
`
`1. A computer processor-based multi-lingual method for scanning
`incoming program code, comprising:
`
`…
`
`identifying, by the computer, individual tokens within the incoming
`stream;
`
`dynamically building, by the computer while said receiving receives the
`incoming stream, a parse tree whose nodes represent tokens and patterns
`in accordance with the parser rules;
`
`dynamically detecting, by the computer while said dynamically building
`builds the parse tree, combinations of nodes in the parse tree which are
`indicators of potential exploits, based on the analyzer rules; and
`
`indicating, by the computer, the presence of potential exploits within the
`incoming stream, based on said dynamically detecting.
`‘408 Patent, Col. 19, l. 45-Col. 20, l.70 (emphasis added).
`
`The proper construction of parse tree is “a tree data structure representing exploits in scanned
`
`content” because this understanding is consistent with the description in the specification. For
`
`instance, the ‘408 Patent specification states “parser 220 uses a parse tree data structure to
`
`represent scanned content.” ‘408 Patent, Col. 8, ll. 24-25. The ‘408 Patent also articulates that a
`
`parse tree is used to detect exploits. Id. at Col. 4, ll. 15-16. Specifically, the ‘408 Patent discloses
`
`scanning content, including “generating a parse tree from the identified patterns of tokens, and
`
`identifying the presence of potential exploits within the parse tree.” ‘408 Patent, Abstract
`
`(emphasis added); see also id., Col. 9, ll. 32-38 (“rules are provided to analyzer 230 for each
`
`known exploit” and that “the nodes of the parse tree also include data for analyzer rules that are
`
`matched.”). Thus, a parse tree is a tree structure that “represent[s] scanned content” because it has
`
`nodes which indicate potential exploits within the scanned content.
`
`Parse tree does not require any further construction because the self-defining claims
`
`characterize the term. For example, the claims provide that the “nodes represent tokens and
`
`patterns in accordance with the parser rules” and that “combinations of nodes in the parse tree…are
`
`9
`__________________________________________________________________________________
`
`FI