Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`
`
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`
`
`Palo Alto Networks, Inc.
`Petitioner
`
`v.
`
`Finjan, Inc.
`Patent Owner
`
`U.S. Patent No. 8,141,154
`Filing Date: June 14, 2010
`Issue Date: March 20, 2012
`
`Title: System and Method for Inspecting
`Dynamically Generated Executable Code
`
`Inter Partes Review No. 2015-01979
`
`DECLARATION OF AVIEL D. RUBIN IN SUPPORT OF PETITION FOR
`INTER PARTES REVIEW OF U.S. PATENT NO. 8,141,154
`
`
`
` Exhibit 1002 Page 1
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`
`TABLE OF CONTENTS
`
`
`Page
`
`
`I.
`
`II.
`
`III.
`
`IV.
`
`V.
`
`VI.
`
`
`
`
`
`INTRODUCTION AND QUALIFICATIONS ................................................................. 2
`A.
`Education ............................................................................................................... 2
`B.
`Career ..................................................................................................................... 2
`C.
`Publications ............................................................................................................ 6
`D.
`Curriculum Vitae ................................................................................................... 7
`E.
`Materials Considered ............................................................................................. 7
`LEGAL PRINCIPLES USED IN THE ANALYSIS ......................................................... 9
`A.
`Person Having Ordinary Skill in the Art................................................................ 9
`B.
`Prior Art ............................................................................................................... 11
`C.
`Broadest Reasonable Interpretations .................................................................... 11
`D.
`Legal Standard for Obviousness .......................................................................... 12
`BACKGROUND OF TECHNOLOGY RELATED TO THE ’154 PATENT ................ 16
`A.
`Instrumentation/Wrapping ................................................................................... 20
`B.
`Distributed Computing......................................................................................... 25
`THE ’154 PATENT ......................................................................................................... 27
`A.
`Overview of the ’154 Patent ................................................................................ 27
`B.
`The Claims of the ’154 Patent ............................................................................. 30
`OVERVIEW OF THE PRIOR ART................................................................................ 33
`A.
`Khazan ................................................................................................................. 33
`B.
`Sirer ...................................................................................................................... 37
`C.
`Ben-Natan ............................................................................................................ 39
`D.
`Khazan, Sirer, and Ben-Natan are all Similar Art ............................................... 40
`GROUNDS FOR INVALIDITY OF THE ’154 PATENT.............................................. 42
`A.
`Ground 1 .............................................................................................................. 42
`2.
`Claim 1 ..................................................................................................... 42
`a.
`Claim element 1[c] ....................................................................... 42
`b.
`Claim element 1[d] ...................................................................... 43
`c.
`Claim element 1[e] ....................................................................... 54
`
`-i-
`
`
`
` Exhibit 1002 Page 2
`
` SYMANTEC
`
`

`
`TABLE OF CONTENTS
`(continued)
`
`Page
`
`
`
`Claim element 1[f] ....................................................................... 55
`d.
`Claim element 1[g] ...................................................................... 57
`e.
`Claim element 1[h] ...................................................................... 60
`f.
`Claim element 1[j] ....................................................................... 62
`g.
`Claim 2 ..................................................................................................... 63
`a.
`Claim element 2[a] ....................................................................... 63
`Claim 3 ..................................................................................................... 65
`Claim 4 ..................................................................................................... 67
`Claim 6 ..................................................................................................... 68
`a.
`Claim element 6[e] ....................................................................... 68
`b.
`Claim element 6[f] ....................................................................... 68
`VII. CONCLUSION ................................................................................................................ 72
`
`3.
`
`4.
`5.
`6.
`
`
`
`
`
`-ii-
`
`
`
` Exhibit 1002 Page 3
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`I, Aviel Rubin, declare as follows:
`
`I have personal knowledge of the facts stated in this declaration, and could
`
`and would testify to these facts under oath if called upon to do so.
`
`I have been retained by counsel for Palo Alto Networks, Inc. (Petitioner) in
`
`this case as an expert in the relevant art. I am being compensated for my work at
`
`the rate of $688 per hour. No part of my compensation is contingent upon the
`
`outcome of this petition.
`
`I was asked to study U.S. Patent 8,141,154, its prosecution history, and the
`
`prior art and to render opinions on the obviousness or non-obviousness of the
`
`claims of the ’154 patent in light of the teachings of the prior art, as understood by
`
`a person of ordinary skill in the art in the 2005 time frame.
`
`Summary of Opinions
`
`After studying the ’154 patent, relevant excerpts of its file history, and the
`
`prior art, and considering the subject matter of the claims of the ’154 patent in light
`
`of the state of technical advancement in security programs (including content
`
`scanners for program code), in the 2005 time frame, I reached the following
`
`conclusions. Each of the claims of the ’154 patent addressed in this declaration
`
`were invalid as obvious in the 2005 time frame in light of the knowledge of skill in
`
`the art at that time and the teachings, suggestions, and motivations present in the
`
`prior art.
`
`
`
`1
`
` Exhibit 1002 Page 4
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`I.
`
`INTRODUCTION AND QUALIFICATIONS
`A. Education
`1.
`I possess the knowledge, skills, experience, training and the education
`
`to form an expert opinion and testimony in this matter. I have 22 years of
`
`experience in the field of computer science, and specifically in Internet and
`
`computer security. I received my Ph.D. in Computer Science and Engineering
`
`from the University of Michigan, Ann Arbor in 1994, with a specialty in computer
`
`security and cryptographic protocols. My thesis was entitled “Nonmonotonic
`
`Cryptographic Protocols” and concerned authentication
`
`in
`
`long-running
`
`networking operations.
`
`B. Career
`2.
`I will discuss my current position as a professor first, followed by a
`
`synopsis of my career and work from when I received my Ph.D. to the present.
`
`3.
`
`I am currently employed as Professor of Computer Science at Johns
`
`Hopkins University, where I perform research, teach graduate courses in computer
`
`science and related subjects, and supervise the research of Ph.D. candidates and
`
`other students. Courses I have taught include Security and Privacy in Computing
`
`and Advanced Topics in Computer Security. I am also the Technical Director of
`
`the Johns Hopkins University Information Security Institute, the University’s focal
`
`point for research and education in information security, assurance, and privacy.
`
`
`
`2
`
` Exhibit 1002 Page 5
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`The University, through the Information Security Institute’s leadership, has been
`
`designated as a Center of Academic Excellence in Information Assurance by the
`
`National Security Agency and leading experts in the field. The focus of my work
`
`over my career has been computer security, and my current research concentrates
`
`on systems and networking security, with special attention to software and network
`
`security.
`
`4.
`
`After receiving my Ph.D., I began working at Bellcore in its
`
`Cryptography and Network Security Research Group from 1994 to 1996. During
`
`this period I focused my work on Internet and Computer Security. While at
`
`Bellcore, I published an article titled “Blocking Java Applets at the Firewall” about
`
`the security challenges of dealing with JAVA applets and firewalls, and a system
`
`that we built to overcome those challenges.
`
`5.
`
`In 1997, I moved to AT&T Labs, Secure Systems Research
`
`Department, where I continued to focus on Internet and computer security. From
`
`1995 through 1999, in addition to my work in industry, I served as Adjunct
`
`Professor at New York University, where I taught undergraduate classes on
`
`computer, network and Internet security issues.
`
`6.
`
`I stayed in my position at AT&T until 2003, when I left to accept a
`
`full time academic position at Johns Hopkins University. The University promoted
`
`me to full professor with tenure in April, 2004.
`
`
`
`3
`
` Exhibit 1002 Page 6
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`7.
`
`I serve, or have served, on a number of technical and editorial
`
`advisory boards. For example, I served on the Editorial and Advisory Board for the
`
`International Journal of Information and Computer Security. I also served on the
`
`Editorial Board for the Journal of Privacy Technology. I have been Associate
`
`Editor of IEEE Security and Privacy Magazine, and served as Associate Editor of
`
`ACM Transactions on Internet Technology. I am currently an Associate Editor of
`
`the journal Communications of the ACM. I was an Advisory Board Member of
`
`Springer’s Information Security and Cryptography Book Series. I have served in
`
`the past as a member of the DARPA Information Science and Technology Study
`
`Group, a member of the Government Infosec Science and Technology Study
`
`Group of Malicious Code, a member of the AT&T Intellectual Property Review
`
`Team, Associate Editor of Electronic Commerce Research Journal, Co-editor of
`
`the Electronic Newsletter of the IEEE Technical Committee on Security and
`
`Privacy, a member of the board of directors of the USENIX Association, the
`
`leading academic computing systems society, and a member of the editorial board
`
`of the Bellcore Security Update Newsletter.
`
`8.
`
`I have spoken on information security and electronic privacy issues at
`
`more than 50 seminars and symposia. For example, I presented keynote addresses
`
`on the topics “Security of Electronic Voting” at Computer Security 2004 Mexico
`
`in Mexico City in May 2004; “Electronic Voting” to the Secure Trusted Systems
`
`
`
`4
`
` Exhibit 1002 Page 7
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`Consortium 5th Annual Symposium in Washington DC in December 2003;
`
`“Security Problems on the Web” to the AT&T EUA Customer conference in
`
`March, 2000; and “Security on the Internet” to the AT&T Security Workshop in
`
`June 1997. I also presented a talk about hacking devices at the TEDx conference in
`
`October, 2011.
`
`9.
`
`I was founder and President of Independent Security Evaluators (ISE),
`
`a computer security consulting firm, from 2005-2011. In that capacity, I guided
`
`ISE through the qualification as an independent testing lab for Consumer Union,
`
`which produces Consumer Reports magazine. As an independent testing lab for
`
`Consumer Union, I managed an annual project where we tested all of the popular
`
`anti-virus products. Our results were published in Consumer Reports each year for
`
`three consecutive years.
`
`10.
`
`I am currently the founder and managing partner of Harbor Labs, a
`
`software and networking consulting firm.
`
`11. As is apparent from the above description, virtually my entire
`
`professional career has been dedicated to issues relating to information and
`
`network security. Moreover, through my consulting work and my work at AT&T
`
`and Bellcore, I am familiar with the practical aspects of designing, analyzing, and
`
`deploying security applications in network environments.
`
`
`
`5
`
` Exhibit 1002 Page 8
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`C.
`12.
`
`Publications
`
`I am a named inventor on ten United States patents, all in the
`
`information security area. The patent numbers and titles as well as my co-
`
`inventors are listed on the attached curriculum vitae. (See Ex. 1007.)
`
`13.
`
`In March 2004, I was asked by the Federal Trade Commission to
`
`submit a report commenting on the viability and usefulness of a national do not e-
`
`mail registry. I submitted my report entitled “A Report to the Federal Trade
`
`Commission on Responses to Their Request For Information on Establishing a
`
`National Do Not E-mail Registry” on May 10, 2004.
`
`14.
`
`I have also testified before Congress regarding the security issues with
`
`electronic voting machines and in the United States Senate on the issue of
`
`censorship. I also testified in Congress on November 19, 2013 about security
`
`issues related to the government’s Healthcare.gov web site.
`
`15.
`
`I am author or co-author of five books regarding information security
`
`issues: Brave New Ballot, Random House, 2006; Firewalls and Internet Security
`
`(second edition), Addison Wesley, 2003; White-Hat Security Arsenal, Addison
`
`Wesley, 2001; Peer-to-Peer, O’Reilly, 2001; and Web Security Sourcebook, John
`
`Wiley & Sons, 1997. I am also the author of numerous journal and conference
`
`publications.
`
`
`
`6
`
` Exhibit 1002 Page 9
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`D. Curriculum Vitae
`Additional details of my education and employment history, recent
`
`professional service, patents, publications, and other testimony are set forth in my
`
`current curriculum vitae, attached to this declaration as Ex. 1007.
`
`E. Materials Considered
`16. My analysis is based on my experience in the computer industry since
`
`1994 including the documents I have read and authored and systems I have
`
`developed and used since then.
`
`17. Furthermore, I have reviewed the various relevant publications from
`
`the art at the time of the alleged invention and the claim charts that are included in
`
`the Petition for Inter Partes Review of the ’154 patent, to which this Declaration
`
`relates. Based on my experience as a person having ordinary skill in the art
`
`(“POSA”) at the time of the alleged invention, the references accurately
`
`characterize the state of the art at the relevant time. Specifically, I have reviewed
`
`the following:
`
`Exhibit
`Description of Document
`No.
`1001 U.S. Patent No. 8,141,154 (“the ’154 patent”)
`1003 U.S. Patent Publication No. 2005/0108562 (“Khazan”)
`Emin Gun Sirer, et al., “Design and Implementation of a Distributed
`1004
`Virtual Machine for Networked Computers” (Dec. 5, 1999) (“Sirer”)
`1005 U.S. Patent No. 7,437,362 (“Ben-Natan”)
`1006 File History of United Stated Patent No. 8,141,154
`7
`
`
`
` Exhibit 1002 Page 10
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`1016
`
`1017
`
`Exhibit
`Description of Document
`No.
`1007 Curriculum Vitae of Dr. Aviel Rubin
`1008 Declaration of Emin Gün Sirer
`1009 U.S. Patent No. 5,983,348 (“Ji”)
`1010 U.S. Patent Publication No. 2001/0005889 (“Albrecht”)
`Ajay Chander, et al., “Mobile Code Security by Java Bytecode
`1011
`Instrumentation” (June 12-14, 2001) (“Chander”)
`Galen Hunt, et al., “Detours: Binary Interception of Win32 Functions”
`1012
`(July 1999) (“Hunt”)
`1013 Microsoft Computer Dictionary, Fifth Ed. (2002)
`3Com, “3C90x and 3C90xB NICs Technical Reference” (Aug. 1998)
`1014
`David E. Evans, “Policy-Directed Code Safety” (Oct. 19, 1999)
`1015
`(“Evans”)
`David K. Gifford, “Weighted Voting for Replicated Data” (1979)
`(“Gifford”)
`Andrew D. Birrell, et al., “Grapevine: An Exercise in Distributed
`Computing” (Apr. 1982) (“Birrell”)
`Jennifer G. Steiner, et al., “Kerberos: An Authentication Service for
`1018
`Open Network Systems” (Jan. 12, 1988) (“Steiner”)
`1019 F-Secure Anti-Virus for Firewalls 6.20
`Jeff A. McConnell, “Content Vectoring Protocol with Checkpoint and
`1020
`Interscan Viruswall” (Mar. 4, 2002) (“McConnell”)
`1021 U.S. Patent No. 7,207,065 (“Chess”)
`Sun Microsystems, “Sun ONE Portal Server 3.0 Rewriter Configuration
`1022
`and Management Guide” (Sept. 13, 2002)
`Algis Rudys and Dan S. Wallach, “Enforcing Java Run-Time Properties
`1023
`Using Bytecode Rewriting” (2002) (“Rudys”)
`1024 U.S. Patent No. 6,324,685 (“Balassanian”)
`John Lewis, et al., “Java Software Solutions, Foundations of Program
`1025
`Design” (1998) (“Lewis”)
`Larry L. Peterson, et al., “Computer Networks, A Systems Approach”
`(“Peterson”)
`Waldemar Horwat, “JavaScript 2.0: Evolving a Language for Evolving
`Systems” (2001) (“Horwat”)
`
`1026
`
`1027
`
`
`
`8
`
` Exhibit 1002 Page 11
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`1033
`
`1034
`
`1035
`
`Exhibit
`Description of Document
`No.
`Daniel A. Reed, et al., “Scalable Performance Analysis: The Pablo
`1028
`Performance Analysis Environment” (1993) (“Reed”)
`1029 Que Corporation, “C Programming Guide 2nd Edition” (1985)
`1030 Herbert Schildt, “C++ from the Ground Up” (1994) (“Schildt”)
`1031 Virus Bulletin (Nov. 1991)
`Dmitry O. Gryaznov, “Scanners of the Year 2000: Heuristics” (Sept.
`1032
`1995)
`R. Srinivasan, Request for Comments: 1831, ROC: Remote Procedure
`Call Protocol Specification, Version 2, (August 1995)
`Dan Raywood, Press Release - M86 Security completes acquisition of
`Finjan (Nov. 3, 2009)
`Gerard Le Lann, “Distributed Systems – Towards a Formal Approach,”
`Information Processing (1977)
`
`
`II. LEGAL PRINCIPLES USED IN THE ANALYSIS
`18.
`I am not a patent attorney, nor have I independently researched the
`
`law on patent validity. Attorneys for the Petitioner have explained certain legal
`
`principles to me that I have relied upon in forming my opinions set forth in this
`
`report.
`
`A.
`19.
`
`Person Having Ordinary Skill in the Art
`
`I understand that I must undertake my assessment of the claims of the
`
`’154 patent from the perspective of what would have been known or understood by
`
`a POSA as of the earliest claimed priority date of the patent claim.
`
`20. Counsel has advised me that to determine the appropriate level of one
`
`of ordinary skill in the art, I may consider the following factors: (a) the types of
`
`
`
`9
`
` Exhibit 1002 Page 12
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`problems encountered by those working in the field and prior art solutions thereto;
`
`(b) the sophistication of the technology in question, and the rapidity with which
`
`innovations occur in the field; (c) the educational level of active workers in the
`
`field; and (d) the educational level of the inventor.
`
`21. The relevant technology field for the ’154 patent is security programs,
`
`including content scanners for program code. Based on this, and the four factors
`
`above, it is my opinion that a POSA would hold a bachelor’s degree or the
`
`equivalent in computer science (or related academic fields) and three to four years
`
`of additional experience in the field of computer security, or equivalent work
`
`experience. This definition of the POSA applies to the time of the alleged
`
`invention of 2005.
`
`22. Unless otherwise specified, when I mention a POSA or someone of
`
`ordinary skill, I am referring to someone with the above level of knowledge and
`
`understanding.
`
`23. Based on my experiences, I have a good understanding of the
`
`capabilities of a person of ordinary skill in the relevant field. Indeed, in addition to
`
`being a person of at least ordinary skill in the art, I have worked closely with many
`
`such persons over the course of my career, and I have regularly taught material that
`
`is fundamental to the art in my role as professor and researcher over the past 22
`
`years.
`
`
`
`10
`
` Exhibit 1002 Page 13
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`B.
`24.
`
`Prior Art
`
`I understand that the law provides categories of information that
`
`constitute prior art that may be used to anticipate or render obvious patent claims.
`
`To be prior art to a particular patent under the relevant law, a reference must have
`
`been made, known used, published, or patented, or be the subject of a patent
`
`application by another, before the priority date of the patent. I also understand that
`
`the POSA is presumed to have knowledge of the relevant prior art.
`
`25. As discussed below, I understand that the Petitioner has determined
`
`December 12, 2005 is the priority date of the ’154 patent based on the Certificate
`
`of Correction attached to the patent.
`
`C. Broadest Reasonable Interpretations
`26.
`I understand that, in Inter Partes Review, the claim terms are to be
`
`given their broadest reasonable interpretation (BRI) in light of the specification.
`
`See 37 C.F.R. § 42.100(b). In performing my analysis and rendering my opinions,
`
`I have interpreted claim terms for which the Petitioner has not proposed a BRI
`
`construction by giving them the ordinary meaning they would have to the POSA,
`
`reading the ’154 Patent with its priority date, December 12, 2005, in mind, and in
`
`light of its specification and file history.
`
`27.
`
`I understand that the Petitioner has made determinations about the
`
`broadest reasonable interpretations of several of the claim terms in the ’154
`
`
`
`11
`
` Exhibit 1002 Page 14
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`patent. I have identified these BRIs in the table below.
`
`Term
`First function
`
`Broadest Reasonable Interpretation (BRI)
`Substitute function
`
`Second function
`
`Original function
`
`Transmitter
`
`Receiver
`
`
`
`A circuit or electronic device designed to send
`electrically encoded data to another location
`A circuit or electronic device designed to accept
`data from an external communication system
`
`28. My analysis in this declaration assumes that the terms in Table 2,
`
`above, are defined using the associated BRIs. From my reading of the ’154
`
`patent, I believe that these BRIs are consistent with how one of skill in the art at
`
`the time the ’154 patent was filed would interpret the claim terms. The Petitioner
`
`has determined that the BRIs of several of the terms in the ’154 patent (e.g.,
`
`preambles) are not limiting. However, I am providing analysis in my declaration
`
`showing that even if the terms are limiting, the associated claim elements are
`
`disclosed in the prior art.
`
`D. Legal Standard for Obviousness
`29.
` I have been provided the following instruction from the Federal
`
`Circuit Bar Association Model Instructions regarding obviousness, which states
`
`in part as follows. I apply this understanding in my analysis, with the caveat that
`
`I have been informed that the Patent Office will find a patent claim invalid in
`
`inter partes review if it concludes that it is more likely than not that the claim is
`12
`
`
`
` Exhibit 1002 Page 15
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`invalid (i.e., a preponderance of the evidence standard), which is a lower burden
`
`of proof than the “clear and convincing” standard that is applied in United States
`
`district court (and described in the jury instruction below):
`
`B.4.3 Validity—The Claims
`
`4.3c OBVIOUSNESS
`
`Even though an invention may not have been identically disclosed or
`described before it was made by an inventor, in order to be patentable,
`the invention must also not have been obvious to a person of ordinary
`skill in the field of technology of the patent at the time the invention
`was made.
`
`[Alleged infringer] may establish that a patent claim is invalid by
`showing, by clear and convincing evidence, that the claimed invention
`would have been obvious to persons having ordinary skill in the art at
`the time the invention was made in the field of [insert the field of the
`invention].
`
`In determining whether a claimed invention is obvious, you must
`consider the level of ordinary skill in the field [of the invention] that
`someone would have had at the time the claimed invention was made
`[or at the critical date for art triggering a statutory bar], the scope and
`content of the prior art, and any differences between the prior art and
`the claimed invention.
`
`Keep in mind that the existence of each and every element of the
`claimed invention in the prior art does not necessarily prove
`obviousness. Most, if not all, inventions rely on building blocks of
`
`
`
`13
`
` Exhibit 1002 Page 16
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`prior art. In considering whether a claimed invention is obvious, you
`may but are not required to find obviousness if you find that at the
`time of the claimed invention [or the critical date] there was a reason
`that would have prompted a person having ordinary skill in the field
`of [the invention] to combine the known elements in a way the
`claimed invention does, taking into account such factors as (1)
`whether the claimed invention was merely the predictable result of
`using prior art elements according to their known function(s); (2)
`whether the claimed invention provides an obvious solution to a
`known problem in the relevant field; (3) whether the prior art teaches
`or suggests the desirability of combining elements claimed in the
`invention; (4) whether the prior art teaches away from combining
`elements in the claimed invention; (5) whether it would have been
`obvious to try the combinations of elements, such as when there is a
`design need or market pressure to solve a problem and there are a
`finite number of identified, predictable solutions; and (6) whether the
`change resulted more from design incentives or other market forces.
`To find it rendered the invention obvious, you must find that the prior
`art provided a reasonable expectation of success. Obvious to try is not
`sufficient in unpredictable technologies.
`
`In determining whether the claimed invention was obvious, consider
`each claim separately. Do not use hindsight, i.e., consider only what
`was known at the time of the invention [or the critical date]. . . .
`
`(Federal Circuit Bar Association Model Jury Instructions §4.3c (2010).)
`
`30.
`
`I am also informed that the United States Patent Office supplies its
`
`
`
`14
`
` Exhibit 1002 Page 17
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`examining corps with a Manual Patent Examination Procedure that provides
`
`exemplary rationales that may support a conclusion of obviousness, including:
`
`a. Combining prior art elements according to known methods to yield
`
`predictable results;
`
`b. Simple substitution of one known element for another to obtain
`
`predictable results;
`
`c. Use of known technique to improve similar devices (methods, or
`
`products) in the same way;
`
`d. Applying a known technique to a known device (method, or product)
`
`ready for improvement to yield predictable results;
`
`e. “Obvious to try” – choosing from a finite number of identified,
`
`predictable solutions, with a reasonable expectation of success;
`
`f. Known work in one field of endeavor may prompt variations of it for
`
`use in either the same field or a different one based on design
`
`incentives or other market forces if the variations are predictable to
`
`one of ordinary skill in the art;
`
`g. Some teaching, suggestion, or motivation in the prior art that would
`
`have led one of ordinary skill to modify the prior art reference or to
`
`combine prior art reference teachings to arrive at the claimed
`
`invention.
`
`
`
`15
`
` Exhibit 1002 Page 18
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`(MPEP § 2143.) I apply these principles in my analysis below.
`
`III. BACKGROUND OF TECHNOLOGY RELATED TO THE ’154 PATENT
`31. Almost all modern technology makes use of digital computers directly
`
`or indirectly. Consumers are even beginning to expect their watches to be “smart.”
`
`But all of these powerful devices would be worthless paper-weights if it were not
`
`for the instructions that automate them. These instructions are generically called
`
`“programs,” “software,” or “code.”
`
`32. The part of the computer that executes the instructions is called the
`
`processor. By design, processors generally follow the instructions given without
`
`question. This is necessary, of course, because technology developers would be
`
`frustrated if the computer refused to do what they told it to. Unfortunately, the
`
`“blind obedience” of computer processors also means that there are great risks to
`
`security. If an unauthorized individual can manage to insert his or her instructions
`
`into the processor, it will execute them no matter how damaging they are.
`
`33. Because processors are also fast and efficient, they can run millions
`
`and billions of instructions per second all day and all night. In most cases, humans
`
`do not directly monitor what the processor is doing and even if and when they do,
`
`software programs are almost always too large and cryptic for a human to easily
`
`review. And even a monitored instruction could be changed between the time it is
`
`analyzed and when it reaches the processor.
`
`
`
`16
`
` Exhibit 1002 Page 19
`
` SYMANTEC
`
`

`
`Declaration of Aviel Rubin
`Petition for Inter Partes Review of Patent No. 8,141,154
`
`34. Accordingly, humans rely on other software to monitor software. This
`
`approach is fraught will all kinds of issues, not the least of which is how to trust
`
`the monitoring software. But the biggest problem is that computer scientists have
`
`proven that it is impossible to find a general solution. What this means is that there
`
`will never be a perfect method for automatically detecting any and all harmful
`
`instructions. The practical consequence of this theoretical result is that those who
`
`create harmful instructions and those who try to stop them are in an eternal arms
`
`race.
`
`35. The concept of a virus, the most commonly recognized form of
`
`malware, was first proposed in 1983 and by 1990 there was already a mature anti-
`
`virus community composed of both academic researchers and commercial
`
`developers. (Ex. 1031.) This community had already developed numerous ways to
`
`try to protect against viruses by this timeframe, and had already created the
`
`primary means of anti-malware still used today: scanners. (See, e.g., Ex. 1009 at 1;
`
`Ex. 1019 at 11; Ex. 1012 at 1.)
`
`36. A scanner i