Cloudflare, Inc. and Splunk Inc.
`Petitioners
`v.
`Sable Networks, Inc.
`Patent Owner
`Case IPR2021-00909
`Patent No. 8,243,593
`
`Oral Argument
`September 7, 2022
`Petitioners’ Demonstrative Slides
`
`1
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`Cloudflare, Exhibit 1104
`
`
`Petitioners
`v.
`Sable Networks, Inc.
`Patent Owner
`Case IPR2021-00909
`Patent No. 8,243,593
`
`Oral Argument
`September 7, 2022
`Petitioners’ Demonstrative Slides
`
`1
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`Cloudflare, Exhibit 1104
`
`
`
`U.S. Patent No. 8,243,593
`
`EX1001
`
`2
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Petitioner’s Remaining Grounds of Unpatentability
`
`Ground
`2
`
`3
`
`Challenged Claims
`Independent claim 9 with dependent claims 10-13 and
`17-24, and independent claim 29 with dependent claims
`30-33 and 37-44
`Independent claim 3
`
`Prior Art
`Yung and Copeland
`
`Yung and Four-Steps
`Whitepaper
`
`Patent Owner voluntarily disclaimed claims 1, 2, 4-8, 14-16, 25-28, and 34-36
`
`3
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`Petitioners Established Reasons to
`Combine Yung and Copeland
`
`The Four-Steps Whitepaper
`Was Publicly Accessible
`
`Ground 2 Should Include
`Claims 17, 18, 37, and 38
`
`4
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung Discloses Claim 9 Except a “Badness Factor”
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Petition
`Figure 7 depicts a “method directed to
`enforcing bandwidth utilization controls
`on data flows.” EX1005, 6:35-36, Fig. 7.
`The method processes a single flow by
`identifying “a traffic class corresponding
`to the flow (214) [in red below]” and
`“enforc[ing]…bandwidth utilization
`controls on the data packet flow [in blue
`below].” Id., 24:13-18, 24:63-25:1.
`Paper 1 at 19
`
`Undisputed
`
`Yung at Fig. 7 (EX1005)
`
`5
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung Discloses Claim 9 Except a “Badness Factor”
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Petition
`Yung’s flow block stores behavioral
`attributes of flows. EX1005, 8:5-11. For
`example, Yung tracks “various
`measurement values in the control block
`object that characterize the flow (e.g., last
`packet time, packet count, byte count,
`etc.).” Id., 25:8-11. … The flow object
`may also include information about “inter-
`flow timing” and the “timing of last
`packets in the inbound and outbound
`directions, speed information, apparent
`round trip time, etc.” Id., 11:36-38, 12:4-
`6, 17:42-49.
`
`Paper 1 at 25-26
`
`Yung at Fig. 7 (EX1005)
`
`6
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung Discloses Claim 9 Except a “Badness Factor”
`
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Petition
`As shown below, in step 202, “packet
`processor 131 receives a data packet” (in
`red) and constructs a new flow block (in
`green) or retrieves an existing flow block
`(in blue). After passing the packet to the
`flow control module in 222 (in orange),
`packet processor 131 in step 224 (in
`purple) then “updates various
`measurement values in the control block
`object that characterize the flow (e.g., last
`packet time, packet count, byte count,
`etc.).” EX1005, 25:8-11.
`
`Paper 1 at 28
`
`Undisputed
`
`Yung at Fig. 7 (EX1005)
`
`7
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`* * * * *
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Copeland at 3:29-35, 7:55-58 (EX1007)
`
`8
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Petitioners’ Expert
`Copeland discloses computing a badness factor for the flow. Like Yung,
`Copeland tracks behavioral statistics about network flows, e.g., start time,
`end time, number of bytes, and packet count. EX1007, 16:44-63. Copeland
`then describes analyzing “the flow statistics [] to determine if the flow
`appears to be legitimate traffic or possible suspicious activity [and a] value,
`referred to as a ‘concern index’ is assigned to each flow that appears
`suspicious.” Id., 3:3135, 18:16-17, 26:24-26.
`
`This concern index (CI) value represents the claimed badness factor. Just as
`the badness factor in the ’593 patent is a calculated value that indicates a
`level of misbehavior attributable to a flow, Copeland’s CI value is assigned
`to the flow based on the behavior recognized by the system. For example,
`Copeland’s Figures 6 and 7 illustrate approaches to calculating the CI values
`based on an analysis of flow statistics. EX1007, FIGs. 6 and 7. Copeland
`discloses computing a badness factor for the flow.
`
`Jeffay Decl. ¶¶209-210 (EX1003)
`
`9
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Petitioners’ Expert
`Moreover, Copeland’s CI value provides an indication of whether the flow is
`exhibiting undesirable behavior. For example, Copeland notes that its CI
`value indicates whether the flow exhibits “suspicious activity” (i.e.,
`undesirable behavior). EX1007, 7:55-61. Indeed, Copeland contrasts
`“suspicious activity” with “legitimate traffic” and notes that a “probe is a
`flow that appears to have one host (a possible intruder) sending packets to
`gain information.” Id., 7:55-61; 18:4-13. Copeland’s CI value provides an
`indication of whether the flow is exhibiting undesirable behavior.
`
`A POSA would have understood that probing and network attacks are
`examples of undesirable behavior within the context of managing network
`infrastructure. Such attacks could hinder application performance or cause
`applications to fail entirely. And generally, a POSA would have understood
`that certain behaviors were more problematic and/or more indicative of
`network attacks than others. Thus, generally speaking using a gradient,
`range, or quantitative factor to describe a level of the malfeasance would
`have been recognizable to a POSA as being a useful tactic.
`Jeffay Decl. ¶¶211-212 (EX1003)
`
`10
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`Petitioner’s Expert
`Q. And is it your opinion that the concern index discussed in Copeland is an example of a badness factor?
`A. Yes, there are disclosures in Copeland of the concern index that I think would qualify as fitting within the
`examples of badness factors that are described in the ’593 patent.
`Q. Okay. And what is that based on in Copeland?
`A. Well, Copeland describes particular types of activities that it’s trying to deal with, and these include
`things like port scans and probing attacks. And I think a person of skill would understand that probing
`attacks and port scans are examples of undesirable behavior, and therefore, measures of that activity
`would qualify as a badness factor.
`Q. So badness factor is a measure of undesirable behavior?
`A. Well, what the ’593 patent discloses is that the badness factor provides an indication of whether the flow
`is exhibiting undesirable behavior. And so, for example, that’s in Column 2 of the ’593 patent at around
`line 24. And I think a person of ordinary skill in the art reading Copeland would understand that its
`concern index provides an indication as to whether or not the flow is exhibiting undesirable behavior, for
`example, for the specific cases of trying to detect probes and port scans.
`
`Jeffay Tr. at 36:16-38:2 (EX2007)
`
`11
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`’593 Patent
`
`Copeland
`
`EX1001 at 2:23-27
`
`EX1001 at 12:5-8 (claim 9)
`
`EX1007 at 3:31-35
`
`EX1007 at 3:18-20
`
`EX1007 at 4:30-33
`12
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`EX1007 at Fig. 1
`
`13
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`A “Badness Factor” Need Not Be Calculated for “Each” Flow
`
`PO’s Sur-Reply
`As to ground 2, alleged obviousness over
`Yung and Copeland, Petitioners fail to
`show by a preponderance of evidence that
`Copeland and Yung teach the calculation
`of a “badness factor” for each flow as
`recited in claims 9-13, 19-24, 29-33, and
`39-44.
`
`Paper 36 at 2 (emphasis in original)
`
`PO’s Sur-Reply
`Independent claims 9 and 29 of the ’593
`patent recite computing a “badness factor”
`for each flow. Ex. 1001 [’593 Patent] cls.
`9.2, 29.2.
`
`Paper 36 at 17 (emphasis in original)
`
`14
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`A “Badness Factor” Need Not Be Calculated for “Each” Flow
`
`PO’s Sur-Reply
`As to ground 2, alleged obviousness over
`Yung and Copeland, Petitioners fail to
`show by a preponderance of evidence that
`Copeland and Yung teach the calculation
`of a “badness factor” for each flow as
`recited in claims 9-13, 19-24, 29-33, and
`39-44.
`
`Paper 36 at 2 (emphasis in original)
`
`PO’s Sur-Reply
`Independent claims 9 and 29 of the ’593
`patent recite computing a “badness factor”
`for each flow. Ex. 1001 [’593 Patent] cls.
`9.2, 29.2.
`
`Paper 36 at 17 (emphasis in original)
`
`15
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung-Copeland Discloses Claim 9
`
`* * * * *
`
`Copeland at 3:29-35, 7:55-58 (EX1007)
`
`16
`
`
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Claim 9 and Claim 29 Are Largely Identical
`
`
`
`9. A machine implemented method for
`processing a flow, the flow comprising a
`series of information packets, the method
`comprising:
`maintaining a set of behavioral statistics
`for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`computing, based at least partially upon
`the set of behavioral statistics, a badness
`factor for the flow, wherein the badness
`factor provides an indication of whether
`the flow is exhibiting undesirable
`behavior.
`
`Jeffay Decl. ¶59 (EX1003)
`
`17
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung-Copeland Discloses Claim 29
`
`* * * * *
`
`Copeland at 3:29-35, 7:55-58 (EX1007)
`
`18
`
`
`
`
`
`29. A misbehaving flow manager
`(MFM) for processing a flow, the flow
`comprising a series of information
`packets, the MFM comprising:
`means for maintaining a set of behavioral
`statistics for the flow, wherein the set of
`behavioral statistics is updated based on
`each information packet belonging to the
`flow, as each information packet
`belonging to the flow is processed,
`regardless of the presence or absence of
`congestion; and
`means for computing, based at least
`partially upon the set of behavioral
`statistics, a badness factor for the flow,
`wherein the badness factor provides an
`indication of whether the flow is
`exhibiting undesirable behavior.
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`Petitioners Established Reasons to
`Combine Yung and Copeland
`
`The Four-Steps Whitepaper
`Was Publicly Accessible
`
`Ground 2 Should Include
`Claims 17, 18, 37, and 38
`
`19
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`A POSA Would Have Reason to Combine Yung and Copeland
`
`Petition
`A POSA would have been motivated to incorporate Copeland’s flow-based CI [concern index] value into
`Yung’s bandwidth-management device based on Yung’s express disclosure. EX1003, ¶¶196-205. Yung
`provides exemplary application-behavior-pattern-matching techniques and notes that “the application
`behavior pattern can incorporate other factors as well.” EX1005, 10:43-58, 11:59-60. A POSA would have
`been motivated to seek out “other factors” for classifying traffic. EX1003, ¶197. For example, a POSA
`would have sought to classify traffic behaving suspiciously or disruptively. Id., ¶¶198-200. Copeland’s CI
`value exemplifies a mechanism for identifying flows behaving in an undesirable fashion that would be
`employed by Yung’s device when classifying and controlling traffic. Id., ¶¶201-202.
`
`Paper 1 at 45-46
`
`Petitioners’ Expert
`Copeland’s flow-based CI [concern index] value provides one such “other factor” that would be considered
`by Yung’s device when classifying traffic. Copeland calculates the CI value based on “flow statistics” that
`are analyzed “to determine if the flow appears to be legitimate traffic or possible suspicious activity.”
`EX1007, 3:32-34. This CI value would be used as an “other factor” in Yung’s traffic classification engine
`86 when classifying data flows.
`
`Jeffay Decl. ¶197 (EX1003)
`
`20
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`A POSA Would Have Reason to Combine Yung and Copeland
`
`Petition
`A POSA would have recognized that incorporating Copeland’s flow-based CI [concern index] value would
`enhance Yung’s traffic management device’s ability to identify and control traffic having undesirable
`characteristics such as network attacks and probes. See EX1007, 8:33-44. Yung notes that “a common use
`of bandwidth management devices is to limit the bandwidth being consumed by unruly, bandwidth-
`intensive applications…and/or other unauthorized applications.” EX1005, 4:43-47. Network attacks would
`have concerned a POSA because they could disable network infrastructure and impair network
`applications. EX1003, ¶¶199-200; see also EX1030, 1:35-48. As Yung sought to preserve an efficient
`allocation of network resources, e.g., bandwidth (EX1005, 2:31-34), a POSA would have recognized that
`controlling network attacks and probes would further this goal and maintain network viability and
`application performance. EX1003, ¶200.
`
`Paper 1 at 46
`
`Petitioners’ Expert
`It is my opinion that network attacks such as the flooding attacks considered by Copeland would have
`concerned a POSA because such attacks could potentially render network infrastructure inoperable and
`severely impact the performance of network applications. … Network attacks and intrusions were a
`recognized problem during the relevant time frame. EX1030, 1:35-48. … The impact of such attacks on
`network infrastructure was a concern for network administrators. [EX1038], 23.
`
`Jeffay Decl. ¶199 (EX1003)
`
`21
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`A POSA Would Have Reason to Combine Yung and Copeland
`
`Petition
`By integrating Copeland’s flow-based CI [concern index] value, Yung’s administrator would be able to
`apply a discard policy to flows with high CI values. EX1003, ¶201; see also EX1005, 19:58-61. A POSA
`would have recognized that allowing the administrator to configure the discard policy based on a CI value
`would obviate the need for the administrator to understand the intricate nature of network attacks. EX1003,
`¶201. This would have been a desirable feature for administrators because the attack patterns were dynamic
`and evolving. Id., ¶202. Such a feature would increase the accuracy of Yung’s traffic-classification methods
`and expand the types of behavior controllable by Yung to include probing related to network attacks.
`Compare EX1005, 4:43-47 with EX1007, 8:33-37. Then such behavior could be policed and eliminated
`using Yung’s policies. EX1003, ¶201.
`
`Paper 1 at 46-47
`
`Petitioners’ Expert
`This would have been a desirable feature for administrators because the attack patterns were dynamic and
`evolving. Given this changing nature, Yung’s system could adapt through software updates to recognize
`new threats and types of behavior and incorporate these into the CI value calculation. Thus, a POSA would
`recognize that a network administrator would not have to keep up with the latest attack patterns. ….
`Jeffay Decl. ¶202 (EX1003)
`
`22
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland’s “Behavior Statistics” Are Not Limited to Packet Headers
`
`PO’s Sur-Reply
`Indeed, Copeland’s “concern index” value is
`not a behavioral attribute of a flow that
`there is any preponderant evidence that the
`POSITA would have been motivated to
`combine with Yung. Id., 26-27. Copeland’s
`“concern index” value is reflective of packet
`header information, not the behavior of a
`flow.
`
`Paper 36 at 21
`
`Petitioners’ Expert
`Finally, Copeland computes its CI [concern index] value based at least
`partially upon the set of behavioral statistics. Copeland “collects
`information about and statistics associated with each flow and stores
`this information and statistics in a database.” EX1007, 7:40-42.
`Copeland provides an exemplary flow data structure. Id., 16:44-63.
`Copeland then calculates the CI value based on these statistics. Id.,
`10:45-47 (“[T]he engine 155 associates all packets with a flow[,]
`analyzes certain statistical data and assigns a concern index value to
`abnormal activity.”) For example, in Figures 6 and 7, the “CI value” is
`determined in part based at least partially upon tracked statistics. Id.,
`FIGs. 6 and 7. For example, in Figure 6, in the context of a “Potential
`TCP Probe”…, Copeland proposes using “number of packets”…as the
`CI value.
`
`Jeffay Decl. ¶213 (EX1003)
`
`23
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland’s “Behavior Statistics” Are Not Limited to Packet Headers
`
`’593 Patent
`
`EX1001 at 7:20-29
`
`EX1001 at Fig. 4
`
`24
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`“Behavioral Statistics” Can Include Packet Header Information
`
`Yung
`
`EX1005 at 12:12-24
`
`25
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`“Behavioral Statistics” Can Include Packet Header Information
`
`Copeland at Fig. 6 (EX1007); see also id. 9:12-15 (“The transport layer protocol (TCP) header…specifies the port numbers….”)
`
`26
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`“Behavioral Statistics” Can Include Packet Header Information
`
`EX1007 at Fig. 1
`
`27
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland, Yung, and the ’593 Patent Track the Same Types of Statistics
`
`Yung
`
`Copeland
`
`EX1005 at 8:5-11
`
`’593 Patent
`
`EX1007 at 16:37-43
`
`EX1001 at 7:20-28
`
`28
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Copeland Discloses a “Badness Factor”
`
`Petitioners Established Reasons to
`Combine Yung and Copeland
`
`The Four-Steps Whitepaper
`Was Publicly Accessible
`
`Ground 2 Should Include
`Claims 17, 18, 37, and 38
`
`29
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`Yung Discloses Most of Claim 3
`
`Yung (EX1005)
`
`Undisputed
`
`30
`
`
`
`3. An article of manufacture comprising:
`a non-transitory computer-readable medium
`having stored thereon a data structure;
`a first field containing data representing a flow
`block;
`a second field containing data representing
`payload-content-agnostic behavioral statistics
`about dropped and non-dropped packets of a
`flow;
`a third field containing data representing pre-
`determined behavior threshold values;
`a fourth field containing data representing the
`results of a heuristic determination of whether
`said flow exhibits undesirable behavior
`determined by comparing said behavioral
`statistics to said pre-determined threshold
`values;
`a fifth field containing data representing at
`least one penalty to be enforced against at
`least one packet upon determination that said
`flow exhibits undesirable behavior.
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Discloses the “Second Field”
`
`Four-Steps Whitepaper at 18 (EX1006)
`
`31
`
`Undisputed
`
`
`
`3. An article of manufacture comprising:
`a non-transitory computer-readable medium
`having stored thereon a data structure;
`a first field containing data representing a flow
`block;
`a second field containing data representing
`payload-content-agnostic behavioral statistics
`about dropped and non-dropped packets of a
`flow;
`a third field containing data representing pre-
`determined behavior threshold values;
`a fourth field containing data representing the
`results of a heuristic determination of whether
`said flow exhibits undesirable behavior
`determined by comparing said behavioral
`statistics to said pre-determined threshold
`values;
`a fifth field containing data representing at
`least one penalty to be enforced against at
`least one packet upon determination that said
`flow exhibits undesirable behavior.
`
`
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was on Packeteer’s Website in March 2003
`
`Four-Steps Whitepaper
`
`Petition
`The Four-Steps Whitepaper is a true and accurate
`copy of the pdf available on the [Packeteer]
`website as of March 17, 2003, …. The Four-Steps
`Whitepaper is stamped with a URL reflecting that
`the publication was archived from the Packeteer
`website on March 17, 2003.
`
`Paper 1 at 15-16
`
`Undisputed
`
`32
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Yung
`
`Four-Steps Whitepaper
`
`EX1005
`
`EX1005 at 4:43-51
`
`EX1005 at 6:5-11
`
`33
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`Packeteer was an industry leader. A data sheet from Packeteer notes that “seventy-four percent of the
`world’s largest companies rely on Packeteer® innovation to solve their WAN application performance
`problems.” EX1031, 1. One author describes techniques for using the PacketShaper® to secure a
`university’s network. See EX1032.
`I have personally configured and deployed a PacketShaper® in a network environment. The PacketShaper®
`would have been known to a POSA in the relevant timeframe, though other similar products existed that
`provided similar functionality ….
`
`Jeffay Decl. ¶¶42-43 (EX1003)
`
`Petitioners’ Expert
`A. All I know about this document [EX1031] is what appears in the document itself, which is on the last
`page. It carriers a copyright notice of 1996 to 2006. What I’ll say, however, is that, you know,
`Packeteer…didn’t come into the marketplace in an instant, and so its existence was certainly known in
`the 2004 timeframe. And be it for the fact that it was successful or the products it made, persons of skill
`in the art knew about Packeteer in the 2004 timeframe.
`Q. And did they know about it in the 2003 timeframe?
`A. Yes.
`
`Jeffay Tr. at 47:20-48:11 (EX2007)
`
`34
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Four-Steps Whitepaper at 3 (EX1006)
`
`35
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Four-Steps Whitepaper at 4 (EX1006)
`
`36
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Four-Steps Whitepaper at 30 (EX1006)
`
`37
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`In my opinion, a POSA interested in the
`PacketShaper® could have easily found Packeteer
`whitepapers and other materials about it on the
`Packeteer website including the Four-Steps
`Whitepaper.
`*****
`In addition to my personal experience, I have also
`accessed and reviewed an archived version of the
`Packeteer website from February 2003. Several of
`the archived web pages are provided in EX1081.
`
`Supp. Jeffay Decl. ¶¶2-3 (EX1093)
`
`EX1081 at 5
`
`38
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`I accessed these archived web pages and navigated
`through them as follows: First, I accessed the
`Packeteer Home Page, which is excerpted and
`annotated below. That web page has a search box
`at the top of the screen, identified by the green
`arrow below. Beneath the search bar appears a
`link bar that includes the following nine links:
`“Home,” “What’s New,” “Products,” “Solutions,”
`“Support,” “Partners,” “Investors,” “Careers,” and
`“Company.” The link “Products” is identified
`below by an orange arrow.
`
`Supp. Jeffay Decl. ¶4 (EX1093)
`
`citing EX1081 at 5 (excerpted and annotated)
`
`39
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`The “Products” link on the Packeteer Home Page
`points to the Products Page, which is excerpted
`and annotated below. Clicking on the “Products”
`link leads to the Products Page. The Products Page
`includes a link titled “Packetshaper,” which is
`identified by a blue arrow below.
`
`Supp. Jeffay Decl. ¶5 (EX1093)
`
`citing EX1081 at 7 (excerpted and annotated)
`
`40
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`The “PacketShaper” link on the Products Page
`points to the PacketShaper Page, which is
`excerpted and annotated below. Clicking on the
`“PacketShaper” link leads to the PacketShaper
`Page. The PacketShaper Page includes a section
`titled “White Papers” that includes a link to “Four
`Steps to Application Performance,” which is
`identified by a red arrow below.
`Supp. Jeffay Decl. ¶6 (EX1093)
`
`citing EX1081 at 9 (excerpted and annotated)
`
`41
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`On the PacketShaper page, the link “Four Steps to
`Application Performance” under the heading
`“White Papers” points to a PDF of the paper “Four
`Steps to Application Performance Across the
`Network,” dated September 2002, at the following
`URL:
`https://web.archive.org/web/20030317051910/http:
`//packeteer.com/PDF_files/4steps.pdf.
`This URL is the same one reflected in EX1006 and
`the PDF file at that URL is the same as EX1006,
`i.e., the Four-Steps Whitepaper.
`Supp. Jeffay Decl. ¶7 (EX1093)
`
`42
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`Based on my review of these archived web pages,
`it is my opinion that a POSA using a web browser
`in early 2003 could have gone to the Packeteer
`Home Page, clicked on the “Products” link, and
`then clicked the “PacketShaper” link at which
`point he or she would see a link to the Four-Steps
`Whitepaper (EX1006). It would have been a
`simple matter for a POSA to locate and review that
`whitepaper.
`
`Supp. Jeffay Decl. ¶8 (EX1093)
`
`43
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Expert
`Based on my review of these archived web pages,
`it is my opinion that a POSA using a web browser
`in early 2003 could have gone to the Packeteer
`Home Page, clicked on the “Products” link, and
`then clicked the “PacketShaper” link at which
`point he or she would see a link to the Four-Steps
`Whitepaper (EX1006). It would have been a
`simple matter for a POSA to locate and review that
`whitepaper.
`
`Supp. Jeffay Decl. ¶8 (EX1093)
`
`Patent Owner’s Response
`Coalition for Affordable Drugs thus stands for the
`proposition that where, as here, a petitioner is
`relying on a document located through the use of
`the Wayback Machine as prior art, the petitioner
`has the burden to show that a POSITA would have
`navigated to a webpage with a hyperlink to the
`document and the document and the hyperlink
`would have worked such that the POSITA would
`have retrieved the document.
`
`Paper 30 at 35-36
`
`44
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`45
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Attorney
`I clicked on the version of the Packeteer website
`that was archived on November 27, 2002….
`I clicked on the “Products” link along the top of
`the menu bar….
`I clicked on the link for “PacketShaper,”….
`I clicked on the link for “Product Literature,”….
`I clicked on the link for “PacketShaper
`Technical Product Overview Four Steps to
`Application Performance,” which led to the
`URL
`https://web.archive.org/web/20030317051910/ht
`tp://packeteer.com/PDF_files/4steps.pdf, as
`shown below.
`
`Callaway Reply Decl. ¶¶3-7 (EX1097)
`
`46
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Petitioners’ Attorney
`Using the Internet Archive, I performed similar
`steps to those above to browse the Packeteer
`website (www.packeteer.com) to the Four-Steps
`Whitepaper (the version labeled “September
`2002” on the cover, as shown above) using the
`archived versions of the Packeteer website from
`the following dates:
`• September 25, 2002
`• September 29, 2002
`• November 20, 2002
`• November 27, 2002
`• November 29, 2002
`January 22, 2003
`•
`•
`January 24, 2003
`• February 16, 2003
`
`Callaway Reply Decl. ¶8 (EX1097)
`
`47
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Author of the Four-Steps Whitepaper
`When I was working for Packeteer, I wrote the
`paper entitled “Four Steps to Application
`Performance Across the Network” dated
`September 2002 (the “Four-Steps Whitepaper”)
`that is attached to this declaration. I understand
`that it has been identified as Exhibit 1006.
`
`*****
`The September 2002 version of the Four-Steps
`Whitepaper (the one that is attached to this
`declaration) was made available to the public in
`September 2002 as indicated on the cover of the
`paper.
`
`Spitzer Decl. ¶¶4-5 (EX1098)
`
`48
`
`DEMONSTRATIVE EXHIBIT - NOT EVIDENCE
`
`
`
`The Four-Steps Whitepaper Was Publicly Accessible
`
`Author of the Four-Steps Whitepaper
`Different versions of Four-Steps Whitepaper
`were posted on Packeteer’s website at different
`times on the PacketShaper product page.
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
