Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 1 of 60 PageID #: 4370
`
`UNITED STATES DISTRICT COURT
`FOR THE EASTERN DISTRICT OF TEXAS
`MARSHALL DIVISION
`
`IN RE: TAASERA LICENSING LLC,
`PATENT LITIGATION
`
`THIS DOCUMENT RELATES TO ALL
`CASES
`
`CIVIL ACTION NO. 2:22-MD-03042-JRG
`
`JURY TRIAL DEMANDED
`
`DEFENDANTS CHECK POINT SOFTWARE TECHNOLOGIES LTD., TREND
`MICRO INC., FORTINET, INC., MUSARUBRA US LLC, D/B/A TRELLIX, PALO
`ALTO NETWORKS, INC., AND CROWDSTRIKE, INC. AND CROWDSTRIKE
`HOLDINGS, INC.’S RESPONSIVE CLAIM CONSTRUCTION BRIEF
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 1
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 2 of 60 PageID #: 4371
`
`
`
`
`
`
`TABLE OF CONTENTS
`
`
`
`Page
`
`Level of Ordinary Skill in the Art ....................................................................................................1
`
`U.S. Patent No. 6,842,796................................................................................................................1
`
`1.
`
`“regular expression”/”regularly identifiable expression” (‘796 Patent, 1,
`12, 23-25) ................................................................................................................ 1
`
`U.S. Patent No. 7,673,137................................................................................................................3
`
`2.
`
`3.
`
`“if the new program is validated, permitting the new program to continue
`loading and to execute in connection with the computing device” (‘137
`Patent, 6, 13, 14, 24) ............................................................................................... 3
`
`“an execution module coupled to the detection module and operable for
`monitoring, at the operating system kernel of the computing device, the
`program in response to the trigger intercepted by the detection module”
`(‘137 Patent, Cl. 1) .................................................................................................. 5
`
`U.S. Patent No. 8,127,356................................................................................................................7
`
`4.
`
`“network administration traffic” (‘356 Patent Cls. 1, 2, 9, 10, 13, 14, 17,
`18) “[third/fourth] program instructions to determine if the packet is
`network administration traffic” (‘356 Patent Cls. 1, 9, 10, 13, 17) ........................ 7
`
`A.
`
`B.
`
`The ‘356 Patent does not disclose “adequate” structure for the claimed
`function. ...................................................................................................... 7
`
`The term “network administration traffic” is also indefinite because it does
`not have a reasonably certain meaning to a POSITA. ................................ 9
`
`U.S. Patent Nos. 8,327,441, 8,990,948, and 9,092,616 .................................................................10
`
`5.
`
`6.
`
`7.
`
`8.
`
`“attestation” (‘441 Patent Cls. 1, 2, 3, 5, 7; ‘616 Patent Cl. 1) ............................. 10
`
`“runtime” (‘616 Patent Cl. 1); “at runtime” (‘616 Patent Cl. 1) ........................... 11
`
`“a computing platform comprising a network trust agent” (‘616 Patent Cl.
`1) ........................................................................................................................... 13
`
`“receiving … a runtime execution context indicating attributes of the
`application at runtime, wherein the attributes comprise one or more
`executable file binaries of the application and loaded components of the
`application” (‘441 Patent Cls. 1, 4) ....................................................................... 14
`
`i
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 2
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 3 of 60 PageID #: 4372
`
`
`
`
`
`
`
`
`9.
`
`“a security context providing security information about the application”
`(‘441 Patent Cls. 1, 4, 5) ....................................................................................... 16
`
`10.
`
`“an application artifact” (‘441 Patent Cl. 2) ......................................................... 18
`
`11.
`
`“introspective security context” (‘441 Patent Cls. 4, 5) ........................................ 19
`
`12.
`
`20.
`
`“the application of the restriction of the user’s transaction” (‘441 Patent
`Cl. 11) ................................................................................................................... 20
`
`“which includes a network analyzer, an integrity processor, an event
`correlation matrix, a risk correlation matrix, and a trust supervisor” (‘948
`Patent Cl. 1) .......................................................................................................... 21
`
`21.
`
`“operational integrity of the application” (‘948 Patent Cl. 1) ............................... 21
`
`22.
`
`“an event correlation matrix” (‘948 Patent, Cl. 1) ................................................ 23
`
`23.
`
`“a risk correlation matrix” (‘948 Patent, Cl. 1) .................................................... 25
`
`24.
`
`“correlating, by the event and risk correlation matrix” (‘948 Patent Cl. 1) .......... 26
`
`19.
`
`“real-time” / “real time” (‘948 Patent, Cls. 1, 2) .................................................. 27
`
`U.S. Patent No. 9,071,518..............................................................................................................29
`
`19.
`
`27.
`
`“substantially real time”/ “substantially real-time data” (‘518 Patent Cls. 1,
`10, 17) ................................................................................................................... 30
`
`“initiating... at least one action”/”initiate an action” (‘518 Patent Cls. 1,
`10, 17) ................................................................................................................... 32
`
`U.S. Patent Nos. 8,819,419, 9,118,634, 9,628,453, and 9,860,251 ...............................................34
`
`13.
`
`14.
`
`15.
`
`“return URL” (‘419 Patent Cls. 1, 3, 4, 6, 7, 9, 10, 12, 13, 15, 16, 19; ‘634
`Patent Cls. 1, 3, 4, 5, 6, 8; ‘251 Patent Cls. 1-6, 8-10; ‘453 Patent Cls. 1, 5,
`6, 10-12, 16-18)..................................................................................................... 35
`
`“evaluating[, by the computer,] the URL to determine whether encryption
`of [none, part, or all of] the URL is required” (‘419 Patent Cls. 1, 4, 10,
`13; ‘634 Patent Cls. 1, 4) ...................................................................................... 36
`
`“determining whether encryption of none, part, or all of a return URL of
`the requested resource that is to be returned to a location of the resource
`request” (‘419 Patent Cl. 10) ................................................................................ 39
`
`16.
`
`“determining[, by the computer,] whether the URL of the requested
`resource is required” (‘419 Patent Cls. 2, 11; ‘634 Patent Cl. 2) .......................... 40
`
`
`
`ii
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 3
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 4 of 60 PageID #: 4373
`
`
`
`
`
`
`
`
`U.S. Patent No. 8,955,038, 9,608,997, and 9,923,918 ...................................................................41
`
`17.
`
`18.
`
`“compliance state of the endpoint” (‘038 Patent Cls. 1, 12, 23; ‘997 Patent
`Cls. 1, 11, 21; ‘918 Patent Cls. 1, 9, 17) ............................................................... 42
`
`“compliance polic[y/ies]” (‘038 Patent Cls. 1, 12, 23; ‘997 Patent Cls. 1,
`11, 21; ‘918 Patent Cls. 1, 9, 17) .......................................................................... 44
`
`
`
`
`
`
`
`
`
`
`iii
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 4
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 5 of 60 PageID #: 4374
`
`
`
`
`Federal Cases
`
`
`
`
`
`TABLE OF AUTHORITIES
`
`Barkan Wireless IP Holdings, L.P. v. Samsung Elecs. Co., No. 2:18-CV-28-JRG,
`2019 U.S. Dist. LEXIS 20394 (E.D. Tex. Feb. 7, 2019) .........................................................18
`
`Berkheimer v. HP Inc., 881 F.3d 1360 (Fed. Cir. 2018) ................................................................31
`
`Blackboard, Inc. v. Desire2Learn, Inc., 574 F.3d 1371 (Fed. Cir. 2009) ........................................6
`
`Bos. Sci. Scimed, Inc. v. Cordis Corp., 554 F.3d 982 (Fed. Cir. 2009) .........................................34
`
`Bushnell Hawthorne, LLC v. Cisco Sys., Inc., 813 F. App’x 522, 525-527 (Fed.
`Cir. 2020) .................................................................................................................................20
`
`CBT Flint Partners, LLC v. Return Path, Inc., 654 F.3d 1353 (Fed. Cir. 2011) ...........................40
`
`Clear Imaging Rsch., LLC v. Samsung Elecs. Co., 2020 WL 6384731 (E.D. Tex.
`Oct. 30, 2020) ..........................................................................................................................31
`
`Grp. One, Ltd. v. Hallmark Cards, Inc., 407 F.3d 1297 (Fed. Cir. 2005) .....................................27
`
`Hologic, Inc. v. SenoRx, Inc., 639 F.3d 1329 (Fed. Cir. 2011) ......................................................33
`
`Indacon, Inc. v. Facebook, Inc., 824 F.3d 1352 (Fed. Cir 2016) ............................ 16, 18-19, 24-25
`
`Intel Corp. v. Qualcomm Inc., 21 F.4th 784 (Fed. Cir. 2021) .........................................................2
`
`Interval Licensing LLC v. AOL, Inc., 766 F.3d 1364 (Fed. Cir. 2014) ..........................................26
`
`Irdeto Access, Inc. v. Echostar Satellite Corp., 383 F.3d 1295 (Fed. Cir. 2004) ... 14-15, 18-19, 23
`
`Liberty Ammunition, Inc. v. United States, 835 F.3d 1388 (Fed. Cir. 2016) ...................................5
`
`Lucent Tech., Inc. v. Gateway, Inc., 525 F.3d 1200 (Fed. Cir. 2008) ............................................27
`
`Merck & Co. v. Teva Pharmaceuticals USA, Inc., 395 F.3d 1364, 1372 (Fed. Cir.
`2005) ........................................................................................................................... 12, 31-32
`
`Mobile Telecommunications Technologies, LLC v. Google Inc., No. 2:16-cv-2-
`JRG-RSP, 2016 WL 7338398 (E.D. Tex. Dec. 19, 2016) .......................................................13
`
`Nautilus, Inc. v. Biosig Instruments, Inc., 572 U.S. 898 (2014) ............................14, 19, 21, 26, 31
`
`Novo Indus., L.P. v. Micro Molds Corp., 350 F.3d 1348 (Fed. Cir. 2003) ..............................20, 27
`
`Nystrom v. Trex Co., 424 F.3d 1136 (Fed. Cir. 2005) ...................................................................18
`
`
`
`iv
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 5
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 6 of 60 PageID #: 4375
`
`
`
`
`
`
`
`
`O2 Micro Int’l. v. Beyond Innovation Tech. Co., 521 F.3d 1351 (Fed. Cir. 2008) .......................37
`
`Oatey Co. v. IPS Corp., 514 F.3d 1271 (Fed. Cir. 2008)............................................................. 8-9
`
`Omega Eng’g, Inc, v. Raytek Corp., 334 F.3d 1314 (Fed. Cir. 2003) ......................................... 8-9
`
`Pavo Sols. LLC v. Kingston Tech. Co., Inc., 35 F.4th 1367 (Fed. Cir. 2022) ..........................40, 42
`
`Phillips v. AWH Corp., 415 F.3d 1303 (Fed. Cir. 2005) (en banc) ...........................................2, 16
`
`Renishaw PLC v. Marposs Societa’, 158 F.3d 1243 (Fed. Cir. 1998) ...........................................29
`
`SIMO Holdings Inc. v. Hong Kong uCloudlink Network Tech. Ltd., 983 F.3d 1367
`(Fed. Cir. 2021) ........................................................................................................................13
`
`SpeedTrack, Inc. v. Amazon.com, 998 F.3d 1373 (Fed. Cir. 2021) ...............................................33
`
`Teleflex, Inc. v. Ficosa N. Am. Corp., 299 F.3d 1313 (Fed. Cir. 2002) ...........................................3
`
`Ultravision Techs., LLC v. Holophane Eur. Ltd, 2020 WL 6271231 (E.D. Tex.
`Oct. 26, 2020) ..........................................................................................................................32
`
`Vehicle IP, LLC v. Cellco P’ship, 757 Fed. Appx. 954 (Fed. Cir. Jan. 22, 2019) ...................19, 24
`
`Williamson v. Citrix Online, LLC, 792 F.3d 1339 (Fed. Cir. 2015) ................................................7
`
`Federal Statutes
`
`35 U.S.C. § 112, ¶ 6 ..................................................................................................................... 5-9
`
`
`
`
`
`
`
`
`
`v
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 6
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 7 of 60 PageID #: 4376
`
`
`
`
`
`
`
`
`TABLE OF EXHIBITS AND ABBREVIATIONS
`
`Ex. #1
`
`Document/Exhibit Description (Abbreviation)
`
`
`
`A
`
`B
`
`C
`
`D
`
`E
`
`F
`
`G
`
`H
`
`I
`
`J
`
`K
`
`L
`
`M
`
`N
`
`O
`
`P
`
`Q
`
`R
`
`1
`
`2
`
`3
`
`4
`
`Taasera Licensing LLC’s Opening Claim Construction Brief, Dkt. 256 (“Br.”)
`
`U.S. Patent No. 6,842,796, Dkt. 256-2 (the “‘796 Patent”)
`
`U.S. Patent No. 7,673,137, Dkt. 256-3 (the “‘137 Patent”)
`
`U.S. Patent No. 8,127,356, Dkt. 256-4 (the “‘356 Patent”)
`
`U.S. Patent No. 8,327,441, Dkt. 256-5 (the “‘441 Patent”)
`
`U.S. Patent No. 8,819,419, Dkt. 256-6 (the “‘419 Patent”)
`
`U.S. Patent No. 8,850,517, Dkt. 256-7 (the “‘517 Patent”)
`
`U.S. Patent No. 8,955,038, Dkt. 256-8 (the “‘038 Patent”)
`
`U.S. Patent No. 8,990,948, Dkt. 256-9 (the “‘948 Patent”)
`
`U.S. Patent No. 9,071,518, Dkt. 256-10 (the “‘518 Patent”)
`
`U.S. Patent No. 9,092,616, Dkt. 256-11 (the “‘616 Patent”)
`
`U.S. Patent No. 9,118,634, Dkt. 256-12 (the “‘634 Patent”)
`
`U.S. Patent No. 9,608,997, Dkt. 256-13 (the “‘997 Patent”)
`
`U.S. Patent No. 9,628,453, Dkt. 256-14 (the “‘453 Patent”)
`
`U.S. Patent No. 9,860,251, Dkt. 256-15 (the “‘251 Patent”)
`
`U.S. Patent No. 9,923,918, Dkt. 256-16 (the “‘918 Patent”)
`
`Declaration of Dr. Eric Cole Regarding Claim Construction, Dkt. 256-17 (“Cole
`Decl.)
`
`Declaration of John R. Black Jr. Regarding Claim Construction, Dkt. 256-18
`(“Black Decl.)
`
`Declaration of Dr. Aviel D. Rubin with Regard to Certain Claim Terms of U.S.
`Patent Nos. 8,990,948, 9,092,616 and 9,071,518, Dkt. 256-25 (“Rubin Decl.”)
`Excerpt from Dictionary of Computer and Internet Terms (Vol. 1) (2016), DEFS-
`TAASERA-PA_0037286 - TAASERA-PA_0037290.
`Excerpt from Attestation and Trusted Computing (2006), TAASERA-
`PA_0037276 - TAASERA-PA_0037285.
`Excerpt from ‘616 Patent File History, Response to Office Action (April 14, 2014)
`(TAASERA-0001570-1586).
`Excerpt from Computer Graphics Dictionary (2002), DEFS-TAASERA-
`PA_0037298 - TAASERA-PA_0037300.
`
`
`1The exhibit numbers identified herein are to the existing exhibit numbers used within Taasera
`Licensing LLC’s Opening Claim Construction Brief (Dkt. 256) (Exs. A-R, Q-1 to Q-6, R-1 to R-
`3) and to new exhibit numbers used herein Defendants’ Responsive Claim Construction Brief.
`
`
`
`vi
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 7
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 8 of 60 PageID #: 4377
`
`
`
`
`
`
`
`
`
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`Excerpt from Concise Oxford English Dictionary, 12th Ed. (2011), DEFS-
`TAASERA-PA_0037301 - TAASERA-PA_0037303.
`Excerpt from ‘518 Patent File History, May 19, 2014 Response to Office Action.
`
`Excerpt from ‘518 Patent File History, Feb. 9, 2015 Response to Office Action.
`
`Excerpt from Merriam-Webster Online Dictionary, 2010 (available at
`https://web.archive.org/web/20101206084256/http:/www.merriam-
`webster.com/dictionary/initiate).
`Excerpt from ‘419 Patent File History, Appellant’s Brief In Response to Office
`Action, TAASERA-0002998 – TAASERA-0003014.
`Excerpt from ‘419 Patent File History, Amendment and Reply to Office Action
`Dated September 12, 2006, TAASERA-0002947 – TAASERA-0002958.
`
`vii
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 8
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 9 of 60 PageID #: 4378
`
`
`
`
`
`
`
`
`Pursuant to P.R. 4-5(b) and the Court’s Seventh Amended Docket Control Order (Dkt.
`
`257), Defendants hereby submit their Responsive Claim Construction Brief.2
`
`Level of Ordinary Skill in the Art
`
`Defendants submit that Plaintiff’s definition of a POSITA is overly broad in that it
`
`identifies experience in the general field of “computer programming for communication systems”
`
`as sufficient, without requiring specific experience in computer/cyber security (Br. 2; Black Decl.
`
`¶ 42; Rubin Decl. ¶ 31), but this distinction has no bearing on the instant disputes.
`
`U.S. Patent No. 6,842,796
`
`The ’796 Patent discloses techniques for exploiting readily identifiable phrases, known as
`
`“regular expressions,” to identify and extract data. The patent uses a phone call as an example,
`
`where a “caller is likely to identify himself in one of just a few ways,” e.g., “Hi John, it’s Bob.”
`
`Ex. A, 2:3-10. When the “Hi <recipient-name>, it’s <caller-name>” structure is known, the system
`
`can identify the expression, extract information (e.g., recipient-name and caller-name), and act
`
`upon it. Id., 2:17-21. According to the patent, this approach is beneficial because existing computer
`
`programming languages “have built in support for regular expressions.” Id., 2:22-27.
`
`1. “regular expression”/”regularly identifiable expression” (’796 Patent, 1, 12, 23-25)3
`
`Defendants’ Proposal
`Plaintiff’s Proposal
`Plain and ordinary meaning of “regular expression”
`matchable pattern
`The phrase “regular expression” consists of commonly understood terms,4 whose meaning
`
`
`2 The claim constructions, arguments and evidence proffered herein are provided by Defendants
`in one document in view of the fact that the cases are joined in Multi-District-Litigation Case
`No. 2:22-md-03042-JRG. Each term, proposed construction, and supporting argument and
`evidence represents the P.R. 4-5(b) Claim Construction Brief for at least one Defendant.
`
`3 The term “regular expression” only appears in claims 24-25, but the parties agree that both
`terms should be afforded the same meaning across all claims.
`
`4 Indeed, the patent itself makes clear that regular expressions were well-known in the art. Id.,
`3:2-5 (incorporating by reference Aho et al., “Compilers: Principles, Techniques, and Tools,”
`
`1
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 9
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 10 of 60 PageID #: 4379
`
`
`
`
`
`
`
`
`can be readily ascertainable by the jury. Absent lexicography or clear disavowal, claims are to be
`
`afforded their plain and ordinary meaning to one of ordinary skill. Phillips v. AWH Corp., 415
`
`F.3d 1303, 1313, (Fed. Cir. 2005) (en banc). Such is the case here.
`
`Plaintiff’s arguments do not withstand scrutiny. First, Plaintiff takes contradictory
`
`positions. On the one hand it maintains that these terms have “no plain or established meaning to
`
`one of ordinary skill in the art” (Br., 2), but in the next paragraph claims that “[t]hese phrases are
`
`terms of art in the software field” (Id., 3). Which one is it—are they terms of art, or do they have
`
`no established meaning? Regardless, Plaintiff offers no support for its position that the phrases
`
`are terms of art, much less identify their meaning.
`
`Plaintiff next turns to the patent, but its arguments are unavailing. Plaintiff tacitly admits
`
`that its construction is redundant. Plaintiff claims that the ‘796 Patent’s independent claims
`
`explicitly describe that regularly identifiable expressions ‘represent a pattern that is matchable.’”
`
`(Br. 3).5 If the claims “explicitly describe” that the expressions represent a pattern that is
`
`matchable, then Plaintiff’s proposed construction renders other claim terms superfluous. For
`
`example, inserting Plaintiff’s construction into claim 1 yields: a “[matchable pattern] represents a
`
`pattern that is matchable.” Such a construction “makes no contribution to the claim.” Intel Corp.
`
`v. Qualcomm Inc., 21 F.4th 784, 792 (Fed. Cir. 2021) (rejecting proposed construction because
`
`“courts [should] avoid a reading that renders some words altogether redundant.”).
`
`Plaintiff’s reliance on the specification is equally flawed. It points to an excerpt in column
`
`three, but the full passage is illuminating:
`
`In accordance with an illustrative embodiment of the invention, the term “regular
`expression” is taken to mean any form of pattern that is matchable in the flex, lex,
`
`Addison-Wesley, 1985).
`
`
`
`5 All emphases in this brief were added unless otherwise noted.
`
`
`
`2
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 10
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 11 of 60 PageID #: 4380
`
`
`
`
`
`
`
`
`or perl programming languages, although the invention is not limited thereto.
`
`Ex. A, 3:22-26. If the Court were to find that this passage constitutes lexicography, then the entire
`
`“definition” must be adopted—including the references to specific programming languages. But
`
`of course, by its very language, this passage is not definitional.
`
`Finally, Plaintiff recites exemplary embodiments provided by the specification. (Br. 3). To
`
`the extent Plaintiff is attempting to read preferred embodiments into the claims, that is improper.
`
`Teleflex, Inc. v. Ficosa N. Am. Corp., 299 F.3d 1313, 1327 (Fed. Cir. 2002).
`
`These terms should be afforded their ordinary meaning. The Court should reject Plaintiff’s
`
`attempt to improperly limit their scope and create redundancies.
`
`U.S. Patent No. 7,673,137
`
`The ’137 Patent discloses systems and methods for managing the security of a computer
`
`network. In particular, the patent discloses a “protector system” that functions through a “two-step
`
`process” to ensure a program is safe. In the first step, the protector system determines if a program
`
`is “valid.” In the second step, the system decides whether to monitor the program based on whether
`
`it was validated. If the program was validated, “it can be run without further monitoring or
`
`interruptions for the user.” If the program was not validated, it will be monitored because it is not
`
`known whether the program is considered safe to execute. Ex. B, 3:28-35, 51-54. This two-step
`
`process is consistently described within the specification. Id., 4:6-11, 4:50-65, 9:4-11, 10:56-61.
`
`2. “if the new program is validated, permitting the new program to continue
`loading and to execute in connection with the computing device” (’137 Patent, 6,
`13, 14, 24)
`
`Plaintiff’s Proposal
`
`Plain and ordinary
`meaning
`
`Defendants’ Proposal
`If the new program is [validated (claims 6, 13); the same as the
`allowed program (claims 14, 24)], then it is not monitored while it
`[loads and executes in connection with the computing device
`(claims 6, 13); executes on the computing device (claims 14, 24)]
`The dispute for this term is whether a validated program is monitored. Consistent with the
`
`
`
`3
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 11
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 12 of 60 PageID #: 4381
`
`
`
`
`
`
`
`
`’137 Patent’s goal of providing “an effective and efficient method for implementing security while
`
`minimizing the burdens and interruptions for the user” (Ex. B, 10:49-54), if a program is validated,
`
`it is not monitored. Plaintiff‘s expert recognizes this. Ex. P ¶ 53 (“one of the benefits of the claimed
`
`invention is performing a validation step … to minimize unnecessary monitoring...”).
`
`Indeed, the intrinsic record uniformly describes that programs are monitored if they are not
`
`validated. The specification states that “the present invention employs a two-step process to
`
`validate software programs and monitor non-validated software programs. . . . In the first phase
`
`of the process, the protector system validates authorized programs to ensure that they have not
`
`been corrupted before running them. For programs that cannot be validated, the protector
`
`system can monitor the programs as they execute during the second phase.” Ex. B, 4:53-65;
`
`see also id., cls. 6, 13, 14, 24; id., 3:32-41 (“If the program is not validated, it can be monitored at
`
`the kernel level of the operating system during the second phase....”); 6:64-67, 9:7-11, 9:38-41.
`
`By contrast, validated programs are not monitored, and do not need to be. Id., 4:54-65,
`
`cls. 6, 13, 14, 24; id., 3:28-32 (“If the program is validated, it can be run without further
`
`monitoring or interruptions for the user.”). This is common sense in view of the ‘137 Patent’s
`
`purpose: a program known to be valid does not need to be monitored, thus saving resources. Id.,
`
`10:54-59 (“By validating certain programs during the pre-execution process, the protector system
`
`minimizes the amount of work that must be done in monitoring and controlling programs during
`
`the execution phase.”); 4:4-11; 8:63-9:7. Plaintiff’s expert admits that the component described in
`
`the specification for monitoring executing programs is for non-validated programs. Ex. P at ¶ 53;
`
`see also Ex. B, 7:26-30 (discussing execution module). Plaintiff cannot have it both ways.
`
`Defendants’ proposal is further supported by the claim language, which is structured in an
`
`alternative if/then format such that whether monitoring happens depends on whether the program
`
`
`
`4
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 12
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 13 of 60 PageID #: 4382
`
`
`
`
`
`
`
`
`was validated (e.g., “if the new program is validated, permitting the new program to continue
`
`loading;” “if the new program is not validated, monitoring the new program while it loads”).
`
`Plaintiff points to a single passage in the specification that refers to “little… additional
`
`security monitoring” to claim that “a program may still be monitored (either minimally or not at
`
`all) as it continues loading and executes” (Br. 5), but Plaintiff fails to explain what the phrase
`
`“little… additional security monitoring” means or where the line is between “little… additional”
`
`and simply security monitoring.6 Given that “little... additional security monitoring” requires a
`
`determination of degree to understand whether a system might fall within the scope of the claims
`
`at issue, a construction is needed. Liberty Ammunition, Inc. v. United States, 835 F.3d 1388, 1395-
`
`96 (Fed. Cir. 2016). The intrinsic evidence only describes not requiring monitoring of validated
`
`programs, which is consistent with Defendants’ proposal and with the goals of the ’137 Patent.
`
`3. “an execution module coupled to the detection module and operable for
`monitoring, at the operating system kernel of the computing device, the program
`in response to the trigger intercepted by the detection module” (’137 Patent, Cl. 1)
`
`Defendants’ Proposal
`Plaintiff’s Proposal
`Means-plus-function
`112 ¶ 6
`
`
`Function: monitoring, at the operating system kernel of
`Function: monitoring, at the
`the computing device, the program in response to the
`operating system kernel of the
`trigger intercepted by the detection module
`computing device, the program in
`
`response to the trigger intercepted by
`Algorithm: not disclosed; therefore, claim is indefinite
`the detection module
`
`
`Alternatively: If the program was not validated, then
`Structure: software algorithm that
`monitor the non-validated program in response to
`performs the steps of FIG. 6
`triggers while the program is executing
`
`The parties agree that this term should be subject to 112(6) and the associated function.
`
`
`6 At most, Taasera’s argument would indicate that “little . . . security monitoring” can be used on
`a program after it has been validated, not that unlimited monitoring is used. That understanding
`would introduce a term of degree that renders the claim indefinite. Berkheimer v. HP Inc., 881
`F.3d 1360, 1364 (Fed. Cir. 2018)
`
`
`
`5
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 13
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 14 of 60 PageID #: 4383
`
`
`
`
`
`
`
`
`However, the ’137 Patent does not disclose an algorithm corresponding to that function and, as a
`
`result, the claim is indefinite. The patent does not describe how the execution module monitors a
`
`non-validated program in response to the trigger intercepted by the detection module.7 Nor does
`
`the patent describe an algorithm for monitoring validated programs. Indeed, Plaintiff relies on
`
`Figure 6 that is titled “Non-Validated Execution Process.” If Plaintiff’s position for term 2––that
`
`the ’137 Patent allows monitoring of validated programs––were adopted, then this failure to
`
`disclose an algorithm for monitoring valid programs would be another ground of indefiniteness.
`
`Plaintiff argues the steps of Fig. 6 provide the necessary software algorithm, but the entirety
`
`of Fig. 6 is not linked to the function, which requires monitoring by the execution module. Indeed,
`
`Plaintiff recognizes the execution module’s function is distinct from that of the pre-execution
`
`module. Br. 6. The claim language distinguishes the functions of the validation module and the
`
`detection module from the execution module, as well. Ex. B, Cl. 1. Thus, steps that are clearly
`
`linked to any non-execution modules cannot be part of an algorithm implementing the claimed
`
`function. As described, only steps 640 and 645, and possibly step 630, are linked to any monitoring
`
`functionality of the execution module. See id., 9:43-10:15.
`
`Even assuming steps 630, 640, and 645 of Fig. 6 pertain to the execution module
`
`monitoring the non-validated program, those blocks are just black boxes. For example, Plaintiff
`
`points to no disclosed algorithm for how the “management module executes necessary precautions
`
`and remedial actions” in Fig. 6 or in the accompanying description (id., 9:63-66) nor how the “new
`
`executable continues to load and execute” (id., 10:1-9). As to step 645, in and of itself it does not
`
`disclose an algorithm; to the extent any steps are disclosed, they are in Fig. 7, which Plaintiff does
`
`
`7 The parties appear to agree that monitoring of a program in response to the trigger intercepted
`by the detection module applies only to non-validated programs. Br. 6-7.
`
`
`
`6
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 14
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 15 of 60 PageID #: 4384
`
`
`
`
`
`
`
`
`not contend is part of the relevant algorithm. Id., 10:9-15. Regardless, an “algorithm” that requires
`
`and relies on “black boxes” is not sufficient to disclose an algorithm for 112(6) purposes. See
`
`Blackboard, Inc. v. Desire2Learn, Inc., 574 F.3d 1371, 1383-85 (Fed. Cir. 2009).
`
`If the Court disagrees that this term is subject to 112(6), it should be construed: “if the
`
`program was not validated, then monitor the non-validated program in response to triggers while
`
`the program is executing, and if the program was validated, then do not monitor the program” for
`
`the reasons discussed in the previous term.
`
`U.S. Patent No. 8,127,356
`
`4. “network administration traffic” (’356 Patent Cls. 1, 2, 9, 10, 13, 14, 17, 18)
`“[third/fourth] program instructions to determine if the packet is network
`administration traffic” (’356 Patent Cls. 1, 9, 10, 13, 17)
`
`Term
`“network administration
`traffic”
`
`Plaintiff’s Proposal
`
`Defendants’ Proposal
`
`Plain and ordinary meaning.
`
`Indefinite.
`
`“[third/fourth] program
`instructions to determine if
`the packet is network
`administration traffic”
`
`Subject to 112(6).
`Subject to 112 ¶ 6.
`Structure: indefinite.
`Structure: Software algorithm
`Function: determine if the
`that performs the steps of FIG. 7.
`packet is network
`Function: determine if the packet
`administration traffic.
`is network administration traffic.
`Both parties agree the term “[third/fourth] program instructions to determine if the packet
`
`is network administration traffic” is subject to § 112 ¶ 6, and that the function of the term is
`
`“determine if the packet is network administration traffic.”
`
`A.
`
`The ’356 Patent does not disclose “adequate” structure for the claimed
`function.
`
`Because the “program instructions…” term is subject to § 112 ¶ 6, “the patentee must
`
`disclose adequate corresponding structure to perform all of the claimed functions.” Williamson v.
`
`Citrix Online, LLC, 792 F.3d 1339, 1351–52 (Fed. Cir. 2015). “Even if the specification discloses
`
`corresponding structure, the disclosure must be of ‘adequate’ corresponding structure to achieve
`
`the claimed function.” Id. at 1352.
`
`
`
`7
`
`IPR2024-00027
`CrowdStrike Exhibit 1010 Page 15
`
`

`

`Case 2:22-md-03042-JRG Document 259 Filed 08/18/23 Page 16 of 60 PageID #: 4385
`
`
`
`
`
`
`
`
`The ’356 Patent expressly teaches that “Examples of network administration traffic are
`
`secure shell (‘SSH’) traffic to remotely