`UNITED STATES PATENT AND TRADEMARK OFFICE
`__________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`___________________
`
`CISCO SYSTEMS, INC.,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`____________________
`
`Case IPR2018-00391
`Patent 7,647,633
`
`__________________________________________________________
`
`PATENT OWNER’S SUR-REPLY TO PETITIONER’S REPLY
`
`
`
`

`

` 
`
`I.
` 
`
`II.
` 
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`TABLE OF CONTENTS
`
`Page
`
`Introduction ...................................................................................................... 1 
`
`Claim Construction .......................................................................................... 2 
`
`A. 
`
`B. 
`
`Finjan’s Proposed Constructions Are Timely ....................................... 2 
`
`Finjan’s Proposed Constructions Are Correct....................................... 2 
`
`1. 
`
`2. 
`
`3. 
`
`“downloadable-information” ...................................................... 3 
`
`“information re-communicator/monitor” .................................... 5 
`
`“determining… whether the downloadable-information
`includes executable code” ........................................................... 7 
`
`
`
`  The Challenged Claims Are Patentable ........................................................... 9 III.
`
`A. 
`
`B. 
`
`C. 
`
`Petitioner Has Not Met Its Burden to Show That Hanson
`Discloses “receiving downloadable-information” ................................ 9 
`
`Petitioner Did Not Meet Its Burden to Show That Hanson in
`View of Hypponen Discloses an “information re-
`communicator” .................................................................................... 12 
`
`Petitioner Did Not Meet Its Burden to Show That Hanson
`Discloses “providing a system”........................................................... 13 
`
`D.  Hanson Modifies Its Executable Code and Fails to Enable the
`Claim 14 .............................................................................................. 14 
`
`E. 
`
`Petitioner’s Arguments Regarding Factual Issues Identified by
`the Board In the Institution Decision Violate 37 C.F.R.
`§ 42.23(b) ............................................................................................ 18 
`
`1. 
`
`2. 
`
`Finjan Did Not Waive Its Claim Construction Position ........... 18 
`
`Petitioner Improperly “Replies” to Arguments Not
`Raised in the POR ..................................................................... 19 
`
`- i -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`3. 
`
`4. 
`
`If The Board Considers Petitioner’s Arguments It Should
`Consider Finjan’s Arguments ................................................... 22 
`
`The Institution Decision Correctly Found Insufficient
`Evidence to Demonstrate the Unpatentability of Claims
`1-4, 8, 11, 12, and 13 ................................................................ 23 
`
`F. 
`
`Petitioner Did Not Submit a Statement of Material Facts .................. 26 
`
`IV.
`
`  CONCLUSION .............................................................................................. 27 
`
`
`
`- ii -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`TABLE OF AUTHORITIES
`
` Page(s)
`
`Federal Cases
`
`Beachcombers v. Wildewood Creative Prods., Inc.,
`31 F.3d 1154 (Fed. Cir. 1994) .............................................................................. 7
`
`Belden Inc. v. Berk-Tek LLC.,
`805 F.3d 1064 (Fed. Cir. 2015) .......................................................................... 20
`
`Google Inc. v. Grandeye Ltd.,
`IPR2013-00547, Paper 34 (P.T.A.B. Nov. 25, 2014) ........................................... 2
`
`Intelligent Bio-Systems v. Illumina Cambridge, Ltd.,
`821 F.3d 1359 (Fed. Cir. 2016) .......................................................................... 21
`
`In re Magnum Oil Tools Int’l, Ltd.,
`829 F.3d 1364 (Fed. Cir. 2016) .......................................................................... 20
`
`In re NuVasive, Inc.,
`842 F.3d 1376 (Fed. Cir. 2016) .......................................................................... 20
`
`Phillips v. AWH Corp.,
`415 F.3d 1303, 1317 (Fed. Cir. 2005)) ................................................................. 8
`
`SAS Institute, Inc. v. Complementsoft, LLC,
`825 F.3d 1341 (Fed. Cir. 2016) .......................................................................... 19
`
`Regulations
`
`37 C.F.R. § 42.23 ..................................................................................... 1, 18, 19, 23
`
`37 C.F.R. § 42.104 ............................................................................................... 7, 21
`
`37 C.F.R. § 42.107 ................................................................................................... 20
`
`37 C.F.R. § 42.120 ................................................................................................... 20
`
`
`
`- i -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`PATENT OWNER’S EXHIBIT LIST
`
`
`
`Description
`
`Exhibit-2001 Decision on Appeal, Ex Parte FINJAN, INC., Appeal 2016-
`004279, Reexamination Control No. 90/013,016, dated June 29,
`2016.
`
`Exhibit-2002 Final Written Decision, Palo Alto Networks, Inc. v. Finjan, Inc.,
`Case No. IPR2015-01974, Paper 49, filed March 16, 2017.
`
`Exhibit-2003 Decision - Partial Institution of Inter Partes Review - Palo Alto
`Networks, Inc. v. Finjan, Inc., Case No. IPR2015-01974, Paper 7,
`filed March 29, 2016.
`
`Exhibit-2004 U.S. Patent No. 5,983,348 (“Ji”).
`
`Exhibit-2005 Eva Chen “Poison Java” IEEE Spectrum (1999).
`
`Exhibit-2006
`
`Insik Shin, et al., “Java Bytecode Modification and Applet
`Security” (1998).
`
`Exhibit-2007 Declaration of James Hannah in Support of Patent Owner’s
`Preliminary Response, Cisco Systems, Inc. v. Finjan, Inc.,
`IPR2018-00391.
`
`Declaration of Dr. Nenad Medvidovic.
`
`Exhibit-2008
`
`Exhibit-2009 JavaTM 2: The Complete Reference, Third Ed., 1999 (excerpts).
`
`Exhibit-2010 Just Java, 1996 (excerpts).
`
`Exhibit-2011 Deposition Transcript of Dr. Paul Clark.
`
`Exhibit-2012 Declaration of Phil Hartstein.
`(PROTECTIVE ORDER MATERIAL)
`
`- i -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`
`Description
`
`Exhibit-2013 Finjan Holdings, Inc. Form 8-K, dated September 24, 2014.
`
`Exhibit-2014 Finjan Holdings, Inc. Form 8-K, dated April 7, 2015
`
`Exhibit-2015 Finjan Holdings, Inc. Form 8-K, dated May 14, 2015
`
`Exhibit-2016 Finjan Holdings, Inc. Form 8-K, dated November 15, 2015
`
`Exhibit-2017 Finjan Holdings, Inc. Form 8-K, dated December 30, 2015
`
`Exhibit-2018 Finjan Holdings, Inc. Form 8-K, dated May 20, 2016
`
`Exhibit-2019 Finjan Holdings, Inc. Form 8-K, dated March 15, 2018
`
`Exhibit-2020 Gartner report - Magic Quadrant for Secure Email Gateways,
`dated July 2, 2013
`
`Exhibit-2021 Gartner report - Magic Quadrant for Secure Email Gateways,
`dated June 29, 2015
`
`Exhibit-2022 Gartner report - Magic Quadrant for Endpoint Protection
`Platforms, dated January 24, 2018
`
`Exhibit-2023  Proofpoint, Inc. Form 10-K, for fiscal year ended December 31,
`2014
`
`Exhibit-2024 Proofpoint, Inc. Form 10-K, for fiscal year ended December 31,
`2015
`
`Exhibit-2025 Press Release - Proofpoint Announces Fourth Quarter and Full
`Year 2015 Financial Results, dated January 28, 2016
`
`Exhibit-2026 Proposed Protective Order
`
`Exhibit-2027 RESERVED
`
`Exhibit-2028 RESERVED
`
`Exhibit-2029 RESERVED
`
`- ii -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`
`Description
`
`Exhibit-2030 Finjan, Inc. v. Websense, Inc., Case No. 13-cv-04398 (N.D. Cal.),
`Appendix B (‘633 Patent Claim Chart) to Plaintiff Finjan, Inc.’s
`Disclosure of Asserted Claims and Infringement Contentions,
`dated February 28, 2014
`
`Exhibit-2031 Websense, Inc. brochure - Triton APX (2015)
`
`Exhibit-2032 RESERVED
`
`Exhibit-2033 RESERVED
`
`Exhibit-2034 RESERVED
`
`Exhibit-2035 Websense, Inc. Revenue and Financial Data, available at
`http://www.hoovers.com/company-
`information/cs/revenuefinancial.websense_inc.89ee9262879a5b6
`5.html
`
`- iii -
`
`

`

`
`I.
`
`INTRODUCTION
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`The challenged claims are patentable because Hanson in view of Hypponen
`
`does not disclose “receiving downloadable-information” or an “information re-
`
`communicator,” as the terms are properly construed. Notably, the constructions
`
`proposed for these claim terms are supported by the testimony of both parties’
`
`experts, while Petitioner’s attorney argument in opposition mischaracterizes the
`
`portions of the ‘633 Patent relied upon.
`
`Petitioner does not challenge the Board’s construction of the term
`
`“executable code” from IPR2015-01974, which was adopted in this proceeding.
`
`Institution Decision at 10. Claim 14 is patentable under this construction because
`
`Petitioner’s Reply fails to demonstrate that Hanson teaches that its executable code
`
`“undergoes no modification” or that Hanson’s disclosure would enable a POSA to
`
`make and use the computer program product of claim 14. Id.
`
`Finally, a significant portion of Petitioner’s Reply violates 37 C.F.R.
`
`§ 42.23(b) because Petitioner’s arguments regarding “Factual Issues Identified by
`
`the Board In The Institution Decision” admittedly do not respond to arguments
`
`raised in the Patent Owner Response. See Reply at 17-24. To the extent that the
`
`Board entertains Petitioner’s Reply arguments and evidence that do not comply
`
`with 37 C.F.R. § 42.23(b), the Board should also consider Finjan’s Sur-Reply
`
`arguments that address Petitioner’s out-of-scope arguments.
`
`- 1 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
` CLAIM CONSTRUCTION
`II.
`A.
`Finjan’s Proposed Constructions Are Timely
`Petitioner faults Finjan for proposing claim construction arguments for the
`
`terms “downloadable-information” and “information re-communicator/information
`
`monitor,” which “Finjan did not raise in its Patent Owner Preliminary Response
`
`(POPR).” Reply at 1; see also id. at 3-4. However, the law is clear that claim
`
`construction positions taken for the first time in a Patent Owner Response (“POR”)
`
`are not “belated.” Google Inc. v. Grandeye Ltd., IPR2013-00547, Paper 34 at 13
`
`n.3 (P.T.A.B. Nov. 25, 2014). Notably, the constructions proposed for these claim
`
`terms are supported by the intrinsic evidence and the testimony of both parties’
`
`experts, while Petitioner’s attorney argument in opposition mischaracterizes the
`
`portions of the ‘633 Patent relied upon.
`
`Finjan’s Proposed Constructions Are Correct
`
`B.
`Petitioner discusses three claim terms in its Reply, “Downloadable-
`
`information,” “Information re-communicator/monitor,” and “determining…
`
`whether the downloadable-information includes executable code.” See Reply at 3-
`
`7. With respect to the first two terms, Petitioner argues against the constructions
`
`for “downloadable-information” and “information re-communicator/monitor” that
`
`its expert advanced during cross-examination. See POR at 11-12 (citing Clark Tr.
`
`- 2 -
`
`

`

`at 44:20-45:6 and Clark Tr. at 13:3-19).1 With respect to the third term, Petitioner
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`does not argue that the Board’s construction was wrong but instead argues that the
`
`prior art meets an unarticulated “plain and ordinary meaning” of the term and (2)
`
`mischaracterizes an argument Finjan made in a district court case to suggest that
`
`Finjan is elsewhere taking a position contrary to the Board’s construction. See
`
`Reply at 5-7. It is not.
`
`“downloadable-information”
`
`1.
`The term “downloadable-information” means “information which is
`
`downloaded from a source computer which may or may not include executable
`
`code.” POR at 10. This construction follows directly from the agreed-upon
`
`definition of Downloadable, i.e. “an executable application program, which is
`
`downloaded from a source computer and run on the destination computer” and the
`
`fact that “a Downloadable is downloadable-information ‘found to include
`
`executable code.’” Id. Petitioner does not address these arguments in its Reply.
`
`Petitioner also (incredibly) ignores and contradicts the opinion of its own expert,
`
`who explicitly opined that “downloadable information includes data that can be
`
`downloaded and that may or may not include executable code” and that the term
`
`
`1 Tellingly, although Dr. Clark prepared a rebuttal declaration, he did not address
`
`these claim terms.
`
`- 3 -
`
`

`

`download means “generally to retrieve something from a server” (i.e. a source
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`computer). POR at 11 (citing Clark Tr. at 44:20-45:6)(emphasis added).
`
`Rather than pointing out any flaws in Finjan’s and its own expert’s
`
`arguments, Petitioner cites two portions of the specification out of context in an
`
`attempt to support its overbroad construction of “downloadable-information” as
`
`“received information.” Reply at 3-4. As a preliminary matter, Petitioner’s
`
`overbroad construction improperly reads the word “downloadable” out of
`
`“downloadable-information” and cannot therefore be correct. Moreover, when
`
`read in context, the portions of the specification reinforce the connection between
`
`the terms “downloadable-information” and “Downloadable,” which undisputedly
`
`means “an executable application program, which is downloaded from a source
`
`computer and run on the destination computer.” See ‘633 Patent at 5:34-39, 9:18-
`
`24.
`
`Petitioner also incorrectly argues that “none of the embodiments illustrated
`
`in the ‘633 Patent identify a source for the downloadable.” Reply at 3. This
`
`assertion is simply wrong, as the ‘633 Patent specifically discloses receiving
`
`downloadable information from a source computer, such as resource servers 1-N of
`
`FIG. 1. See ‘633 Patent at 5:63-64.
`
`- 4 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`Accordingly, “downloadable-information” means “information which is
`
`downloaded from a source computer which may or may not include executable
`
`code.”
`
`2.
`
`“information re-communicator/monitor”
`
`The term “information re-communicator” means “a computing device that
`
`receives downloadable-information from an external network and then sends it on
`
`to its destination.” POR at 11. As with the preceding term, Petitioner does not
`
`attempt to rebut Finjan’s arguments or address its own expert’s explanation that
`
`supports Finjan’s position and contradicts Petitioner’s. See Reply at 4-5.
`
`Instead of addressing the arguments and evidence put forth in the POR,
`
`Petitioner argues that the proposed construction “is not supported by the claims”
`
`(an argument which Petitioner does not further explain or develop) and “is
`
`inconsistent with the broad use of the terms in the specification, and is found in
`
`some (but not all) embodiments in the specification.” Id. at 4. However, the
`
`portion of the specification that allegedly supports Petitioner’s argument actually
`
`supports Finjan’s proposed construction. In particular, Petitioner cites 7:43-62 of
`
`the ‘633 Patent in an attempt to support its contention that a user-device can be a
`
`re-communicator. Id. Contrary to Petitioner’s argument, that portion of the
`
`specification only states that “a user device operating as a firewall/server,” can
`
`be considered a re-communicator when it is enabled “for servicing one or more
`
`- 5 -
`
`

`

`further inter-connected devices or processes or interconnected levels of
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`devices or processes.” ‘633 Patent at 7:47-54.
`
`That portion further states that user devices not operating as a firewall/server
`
`and which are merely “capable of receiving and initiating or otherwise hosting a
`
`mobile code execution” are considered “information-destination[s]” as they are not
`
`performing firewall/server functions. Id. at 7:58-62. The user devices illustrated
`
`in Fig. 1c, which receive MPC and a Downloadable from a Corporate Server are
`
`thus information destinations, not information re-communicators:
`
`
`
`‘633 Patent, Fig. 1c. In other words, and contrary to Petitioner’s argument,
`
`FIG. 1c illustrates a Corporate Server (an information re-communicator) receiving
`
`downloadable-information (D) from an external network and re-communicating
`
`- 6 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`the detected Downloadable (D), along with mobile protection code (MPC) to a user
`
`device. Id. These disclosures therefore support Finjan’s position, not Petitioner’s.
`
`Because the ‘633 Patent describes an “information monitor” as a component
`
`of an “information re-communicator,” the arguments presented above apply to the
`
`term “information monitor.” See POR at 14-15 (citing ‘633 Patent at 2:58-66 and
`
`Medvidovic Decl., ¶ 53). Petitioner does not dispute this fact.
`
`3.
`
`“determining… whether the downloadable-information
`includes executable code”
`
`As a preliminary matter, Petitioner has yet to take a position on the meaning
`
`of this term in abrogation of its duty under 37 C.F.R. § 42.104(b)(3). Indeed,
`
`Petitioner gives no indication of what that “plain and ordinary meaning” is, how it
`
`does or does not differ from the construction already adopted by the Board in this
`
`case and IPR2015-01974, or why the intrinsic record supports its construction.
`
`Reply at 6.
`
`Questions of anticipation and obviousness are two-step inquiries involving
`
`(1) the proper interpretation of the claims and (2) determining whether the
`
`limitations of the claims are met by the prior art. Beachcombers v. Wildewood
`
`Creative Prods., Inc., 31 F.3d 1154, 1160 (Fed. Cir. 1994). Petitioner’s argument
`
`regarding the “plain and ordinary meaning” of this term improperly collapses these
`
`two steps together, requesting that the Board find claims of an issued patent
`
`unpatentable over some arbitrary and unarticulated construction of the claims.
`
`- 7 -
`
`

`

`Moreover, rather than argue that the intrinsic record supports an articulated
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`position on the meaning of this term, Petitioner relies on misleadingly
`
`characterized extrinsic evidence, which is contrary to law because it has not
`
`shown or even argued that the term is ambiguous in view of the intrinsic evidence.
`
`See Phillips v. AWH Corp., 415 F.3d 1303, 1317, 1319 (Fed. Cir. 2005) (holding
`
`that if the intrinsic evidence resolves the meaning of a disputed claim term,
`
`reliance on extrinsic evidence is improper).
`
`Nevertheless, and contrary to Petitioner’s argument, Finjan has not
`
`“abandoned [its] position,” and its position in the Juniper litigation is not
`
`“inconsistent” with and does not “directly refut[e]” the Board’s prior construction.
`
`Reply at 18. In the Juniper litigation, Finjan did argue that this term should be
`
`accorded its “plain and ordinary meaning” based on the issues present in that case.
`
`See Ex. 1026. However, Finjan did not object to Juniper’s proposed construction
`
`on the basis of the construction involving “distinguishing between two alternative
`
`possibilities” or that one of those alternative possibilities was that “executable code
`
`is not included in the downloadable-information.” Reply at 5.
`
`Rather, Finjan’s objection to Juniper’s construction was that it did not
`
`account for all of the embodiments in the specification. Finjan noted that the term
`
`was “broad enough to describe detecting content that is likely to be of an
`
`executable type that can carry executable content.” Ex. 1026 at 12 (emphasis
`
`- 8 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`added). In other words, the plain language and the claims support Finjan’s position
`
`that the term “determining… whether” requires distinguishing between the two
`
`alternative possibilities, but that determining that “executable code is included in
`
`the downloadable-information” includes “looking at indicators to show that the file
`
`is likely to have executable code.” Id. Thus, Finjan’s argument in the Juniper
`
`litigation addresses this particular issue that Juniper raised in that case.
`
`Notably, however, the dispute between Finjan and Juniper over the meaning
`
`of this claim term is distinct and unrelated to the issue alive in this case. There, the
`
`issue is whether “determining… whether the downloadable-information includes
`
`executable code” is broad enough such that one of the alternative possibilities
`
`includes “looking at indicators to show that the file is likely to have executable
`
`code.” Id. (emphasis added). Here, the dispute between the parties is whether one
`
`of the possibilities is that “executable code is not included in the downloadable-
`
`information.”
`
` THE CHALLENGED CLAIMS ARE PATENTABLE
`III.
`A.
`Petitioner Has Not Met Its Burden to Show That Hanson
`Discloses “receiving downloadable-information”
`
`Petitioner first asserts that “Finjan attacks disclosure of Hanson that the
`
`Petition did not use” and that “[t]he Petition’s invalidity analysis relied on
`
`Hanson’s disclosure of data packet [sic] coming from the servers and going to the
`
`- 9 -
`
`

`

`client.” Reply at 8. This assertion is incorrect and appears calculated to mislead
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`the Board into finding that Finjan avoided addressing Petitioner’s argument:
`
`For purposes of clarity and brevity, this Petition applies Hanson to the
`challenged claims only based on the operation of the bastion server on
`data packets coming from the servers and going to the client (though
`the teaching of Hanson with respect to the opposite direction
`would equally apply).
`
`Petition at 39; see also id. at 45 (“Hanson describes that the bastion server
`
`(computer) receives data packets (downloadable-information) from the internal
`
`servers and from the client.”)(emphasis added). Replying to Petitioner’s
`
`assertions, Finjan demonstrated that Hanson does not disclose “receiving
`
`downloadable-information” regardless of which direction Hanson’s packets are
`
`moving.
`
`Petitioner responds to “Finjan’s first argument that Hanson does not include
`
`receiving downloadable-information” by stating that this argument is “directed to
`
`packets going in the opposite direction from the Petition’s analysis.” Reply at 8.
`
`As shown above, Petitioner did assert in the Petition that Hanson disclosed this
`
`element in view of Hanson’s disclosure that “the bastion server (computer)
`
`receives data packets (downloadable-information) from the internal servers and
`
`from the client.” Petition at 45 (emphasis added). Based on Petitioner’s Reply, it
`
`is now clear that this argument has been withdrawn. Reply at 8.
`
`- 10 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`Petitioner then incorrectly argues that “Finjan’s second argument fails to
`
`even apply its proposed construction of ‘downloadable-information.’” Reply at 9
`
`(emphasis added). In fact, Finjan’s arguments explaining why “reply data packets
`
`received at the bastion from a server are not downloadable-information” do apply
`
`the proposed construction. POR at 24. Finjan demonstrated that “Hanson
`
`specifically refers to reply packets as ‘outgoing data packets,’” not “information
`
`which is downloaded from a source computer which may or may not include
`
`executable code.” Id. at 10, 24 (emphasis added).
`
`As Dr. Medvidovic explained, “[b]ecause the bastion server is on the server-
`
`side of the external network that separates the server and the client, data packets
`
`received at the bastion from a server are not downloadable-information.” POR at
`
`24 (citing Medvidovic Decl., ¶ 66)(emphasis added). Dr. Medvidovic further
`
`explained that because Hanson’s bastion server only receives “outgoing data
`
`packets” rather than “downloadable-information,” its services are useless to the
`
`client computer. Id. (“[E]ven in the case that bastion adds a “‘security.class’
`
`program” or “‘security.ocx’ program” to the outgoing data packets, the bastion
`
`provides no assurance to the client because the client has no way of knowing
`
`whether it can trust the bastion and/or its security programs.”)).
`
`Rather than addressing or rebutting this argument, Petitioner argues that the
`
`proposed construction “requires only that the information be ‘downloaded from a
`
`- 11 -
`
`

`

`source computer’” and that “server 20… is a ‘source computer.’” Reply at 9.
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`However, Petitioner does not (and cannot) argue that the “outgoing data packets”
`
`received at the bastion server from server 20 are downloaded because, from the
`
`point of view of the client, which is only aware of the bastion server’s IP address
`
`and only directly communicates with the bastion server, the bastion server is the
`
`source computer. See Hanson at 8 (describing a client request being directed to a
`
`bastion server); id. at 10 (describing the bastion server sending an “outgoing data
`
`packet” to the client).
`
`Thus, the Board should find each of the challenged claims patentable
`
`because Hanson does not disclose “receiving…downloadable information.”
`
`B.
`
`Petitioner Did Not Meet Its Burden to Show That Hanson in View
`of Hypponen Discloses an “information re-communicator”
`
`In the POR, Finjan argued that “Hanson in view of Hypponen does not
`
`disclose an ‘information recommunicator,’ an ‘information monitor,’ or ‘means for
`
`receiving downloadable-information.’” POR at 25. Aside from arguing that both
`
`experts in this case are mistaken about the meaning of the term “information re-
`
`communicator,” Petitioner’s only rejoinder is this conclusory statement:
`
`As with the ID, it is unnecessary for the Board to construe the term
`here because
`the cited prior art discloses
`information
`re-
`communicator/monitor under any reasonable interpretation.
`
`Reply at 5.
`
`- 12 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`In its discussion of claim 14, Petitioner responds only to Finjan’s arguments
`
`regarding Hanson’s modification of executable code and Hanson’s non-
`
`enablement. See id. at 10-17. Petitioner ignores Finjan’s argument that claims 2,
`
`3, 8, and 11-14 are patentable in view of the fact that Hanson’s bastion server is
`
`not an information re-communicator because (1) it “does not ‘receive[]
`
`downloadable-information from an external network and then sends it on to its
`
`destination” and (2) that “[a]ny reply packets received at the bastion server are
`
`received from an internal rather than an external network.” POR at 25-26.
`
`Because it is undisputed that Hanson and Hypponen do not disclose an
`
`“information re-communicator” or an “information monitor” under the
`
`construction espoused by both parties’ experts, the Board should find claims 2, 3,
`
`8, and 11-14 patentable.
`
`C.
`
`Petitioner Did Not Meet Its Burden to Show That Hanson
`Discloses “providing a system”
`
`In the POR, Finjan argued that Hanson does not disclose “providing a
`
`system, wherein the system comprises distinct software modules, and wherein the
`
`distinct software modules comprise an information re-communicator and a mobile
`
`code executor.” Id. at 34. Petitioner does not address this argument, so the Board
`
`should find claim 14 patentable for at least that reason.
`
`- 13 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`D. Hanson Modifies Its Executable Code and Fails to Enable the
`Claim 14
`
`Petitioner argues that Hanson “expressly discloses that the downloaded
`
`executable code is not modified.” Reply at 11. However, Petitioner points to no
`
`such express disclosure, arguing instead that Finjan asks Petitioner to prove a
`
`negative and inserting its own parentheticals to suggest that Hanson discloses what
`
`it does not. Id.. at 12 (“Specifically, Hanson discloses that the security program is
`
`attached to ‘an ActiveX program destined for a client or server’, and confirms that
`
`it is this received program (without modification) that is run at the destination.”)
`
`(emphasis added).
`
`Contrary to Petitioner’s position, a POSA reading Hanson would understand
`
`that its technique involves modifying executable code because an applet would not
`
`invoke Hanson’s “security.class” unless it was modified to invoke the class. POR
`
`at 32-33. Petitioner’s rejoinder—that “a POSA knew how to write an applet that
`
`would call a program (such as security.class) to implement the method described in
`
`Hanson”—only reinforces this point. Reply at 15. As Dr. Medvidovic testified
`
`during his deposition, if a POSA wrote a program in the first instance to invoke
`
`“security.class” then security.class would not be considered “mobile protection
`
`code” but rather just part of the applet itself:
`
`If the applet was written specifically to work with that security.class,
`you would not be able to -- you would not have to change the code,
`
`- 14 -
`
`

`

`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`but then, also, you would never be able to invoke that applet without
`security.class. The two would be the applet. So security.class would
`not be some other piece of code; it would actually be part of the
`applet.”).
`
`Ex. 1028 at 75:6-13. On the other hand, if security.class is mapped to the claimed
`
`“mobile protection code,” Dr. Medvidovic opined that the applet would have to be
`
`modified to invoke that class. Id. at 71:12-20.
`
`Nevertheless, to the extent that the Board finds Hanson’s non-disclosure of
`
`this claim element sufficient to suggest to a POSA non-modification of executable
`
`code, Hanson does not enable one of ordinary skill in the art to make and use the
`
`claimed invention. As argued in the POR, Dr. Medvidovic explained that
`
`Hanson’s vague disclosure “raises more questions than it answers.” POR at 29
`
`(citing Medvidovic Decl., ¶¶ 73-74). Petitioner does not answer these questions.
`
`With respect to Finjan’s argument that “Hanson does not explain at least (1)
`
`how the security program is ‘attached’ or ‘tagged’ to a data packet,” (id.) Petitioner
`
`cites but does not attempt to rebut or dispute Dr. Medvidovic’s testimony that
`
`“Hansen is completely wrong about how it characterizes data packets.” Reply at
`
`15. In other words, Finjan argued that Hanson’s disclosure of “tagging” or
`
`“attaching” a security program to a packet is nonsensical, and Petitioner did not
`
`argue otherwise. Instead, Petitioner cites to Dr. Clark’s deposition testimony to
`
`suggest that “[a] POSA understood that tagging means simply associating the
`
`- 15 -
`
`

`

`security.class program with the applet.” Reply at 16. Dr. Clark did not make such
`
`Patent Owner’s Sur-Reply
`IPR2018-00391 (U.S. Patent No. 7,647,633)
`
`
`a statement and Petitioner’s characterization of his testimony does not address Dr.
`
`Medvidovic’s testimony regarding the fact that Hanson is wrong that “data packets
`
`either are or can include programs.” Compare Ex. 1027 (Clark Tr.) at 69:2-14 with
`
`Ex. 1028 (Medvidovic Tr.) at 58:24-59:13.
`
`Petitioner also cites to the specification of the ‘633 Patent itself to argue that
`
`“one well-known method for attaching mobile protection code to downloadable-
`
`information is ‘concatenation.’” Reply at 16. But Petitioner cites no admission in
`
`the ‘633 Patent that this technique was “well-known” such that its disclosure
`
`should be considered part of the knowledge that a POSA would bring to reading
`
`Hanson. Similarly, Petitioner’s citation to Dr. Medvidovic’s cross-examination
`
`testimony fails to establish that it was “well-known technique to transfer two
`
`things such as the security program and the executable code as a pair when sending
`
`packets.” Id. Rather, Dr. Medvidovic only testified that the meaning of the word
`
`concatenation is “well-known in the art.” See Ex. 1028 at 55:21-56:8.
`
`Further, for several reasons Petitioner’s citation to Dr. Clark’s new
`
`testimony regarding the new Senator reference (Ex. 1025) fails to establish that “it
`
`was well known in the art to package downloadables (whether having executable
`
`code or not) with executable code for enforcing some policy applicable to the
`
`downloadable.” Reply at 17. In fact, Senator does not disclose packaging
`
`- 16 -
`
`

`

`anything with a D