`571-272-7822
`
`Paper 8
`Entered: March 21, 2016
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS, INC.,
`Petitioner,
`
`V.
`
`FINJAN, INC.,
`Patent Owner.
`
`Case IPR2015-01979
`Patent 8,141,154 B2
`
`Before, THOMAS L. GIANNETTI, RICHARD E.RICE,and
`MIRIAM L. QUINN, Administrative Patent Judges.
`
`QUINN,Administrative Patent Judge.
`
`DECISION
`Institution of Inter Partes Review
`37 CER. § 42.108
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Palo Alto Networks,Inc. (“Petitioner”) filed a Petition to institute
`
`inter partes review of claims 1-8, 10, and 11 of U.S. Patent No. 8,141,154
`
`B2 (“the ?154 patent”) pursuant to 35 U.S.C. § 311-319. Paper 2 (“Pet.”).
`
`Finjan, Inc. (“Patent Owner”) timely filed a Preliminary Response. Paper 6
`
`(“Prelim. Resp.”). We havejurisdiction under 35 U.S.C. § 314.
`
`Forthe reasons that follow, we grant the Petition.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies that the patent-at-issue is the subject matter of
`
`various district court cases filed in the U.S. District Court for the Northern
`
`District of California (Case Nos. 3:14-cv-04908, 5:14-cv-02998, 5:15-cv-
`
`01353, 5:14-cv-04398, 3:14-cv-01197, and 3:13-cv-05808). Pet. 3.
`
`Petitioner also states that petitions for inter partes review have beenfiled
`
`regarding other patents at issue in the foregoing district court cases. Id.
`
`B. ASSERTED GROUNDS
`
`Petitioner contendsthat claims 1-8, 10, and 11(“the challenged
`
`claims”) are unpatentable under 35 U.S.C. § 103 based on the following
`
`specific grounds:
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Reference[s]
`
`
`
`
`Basis Claims challenged
`
`Khazan, Sirer, and Ben-Natan?
`
`§ 103
`
`2, 4-8, 10, and 11
`
`
`
`
`
`
`
`C. THE ’154 PATENT (Ex. 1001)
`
`The ’154 patent relates to computersecurity, and, more particularly,
`
`to systems and methodsfor protecting computers against malicious code
`
`such as computer viruses. Ex. 1001, 1:7-9, 8:38-40. The ’154 patent
`
`identifies the components of one embodimentof the system as follows: a
`
`gateway computer, a client computer, and a security computer. Jd. at
`
`8:45—47. The gateway computerreceives content from a network, such as
`
`the Internet, over a communication channel. Jd. at 8:47—48. “Such content
`
`maybe in the form of HTML pages, XML documents, Java applets and
`
`other such web content that is generally rendered by a web browser.” Jd. at
`
`_
`
`8:48-51. A content modifier modifies original content received by the
`
`gateway computer and produces modified content that includes a layer of
`
`protection to combat dynamically generated malicious code. Jd. at 9:13-16.
`
`' Patent Application Pub. No. US 2005/0108562 Al (Exhibit 1003)
`.
`(“Khazan”).
`? Sirer et al., Design and Implementation ofa Distributed Virtual machine
`for Networked Computers (1999) (Exhibit 1004) (“Sirer’).
`3 U.S. Patent No. 7,437,362 B1 (Exhibit 1005) (“Ben-Natan”).
`
`3
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`D. ILLUSTRATIVE CLAIMS
`
`Challenged claims 1, 4, 6, and 10 are independent, andillustrative
`
`claim | is reproduced below.
`
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`a content processor(1) for processing content received
`over a network, the content includinga call to a first function,
`and the call including an input, and(ii) for invoking a second
`function with the input, only if a security computer indicates
`that such invocationis safe;
`a transmitter for transmitting the input to the security
`computer for inspection, whenthefirst function is invoked; and
`a receiver for receiving an indicator from the security
`computer whetherit is safe to invoke the second function with
`the input.
`
`II.
`
`ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`The Boardinterprets claims using the “broadest reasonable
`
`constructionin light of the specification of the patent in which [they]
`
`appear[].” 37 C.F.R. § 42.100(b). We presumethat claim terms havetheir
`
`ordinary and customary meaning. See In re Translogic Tech., Inc., 504 F.3d
`
`1249, 1257 (Fed. Cir. 2007) (“The ordinary and customary meaningis the
`
`meaning that the term would haveto a person of ordinary skill in the art in
`
`question.”) (citation omitted).
`
`Petitioner proposed constructions for four terms: “first function,”
`39 66
`
`“second function,” “transmitter,”
`
`“receiver.” See Pet. 9-13. The proposed
`
`constructions are as follows:
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`
`
`
`
`
`transmitter
`
`receiver
`
`Petitioner’s Proposed Construction
`
`Substitute function (Pet. 9-10)
`
`Original function (Pet. 10-11)
`
`
`
`
`
`
`
`A circuit or electronic device designed to
`
` accept data from an external communication
`
`A circuit or electronic device designed to
`
`
`send electrically encoded data to another
`
`location (Pet. 11-12)
`
`system (Pet. 12-13).
`
`Petitioner generally supports its proposed constructions with citations
`
`to the specification of the ’154 patent and opinion testimony of its witness,
`
`Dr. Aviel Rubin (Rubin Decl. or Ex. 1002). Id.
`
`Patent Owner submits that each of the terms hasa plain and ordinary
`
`meaning understoodto a person of ordinary andthat no construction is
`
`needed. Prelim. Resp. 6—12. Upon review of the arguments and evidence
`
`presented in the Petition and the Preliminary Response, we concludethat
`none ofthese termsare at the heart of the parties’ arguments, and, therefore,
`construction of these termsis not helpful in our determination of whether to
`
`institute inter partes review. See Vivid Techs., Inc. v. Am. Sci. & Eng’g,
`
`Inc., 200 F.3d 795, 803 (Fed. Cir. 1999) (only claim terms in controversy
`
`need to be construed, and only to the extent necessary to resolve the
`
`controversy). Accordingly, we do not construe any claim termsatthis time.
`
`B. OBVIOUSNESS GROUND BASED ON KHAZANAND SIRER
`
`Petitioner asserts that Khazan discloses “every element of the
`
`Petitioned Claims except a modified input variable and details of performing
`
`5
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`dynamic analysis on a remote computer.” Pet. 16. Patent Owner challenges
`
`Petitioner’s assertions that Khazan discloses several limitations and asserts
`
`that Sirer’s disclosure of dynamic service components does not meetthe
`
`claims underPetitioner’s theory of unpatentability. Prelim. Resp. 14-24.
`
`1. Overview ofKhazan (Exhibit 1003)
`
`Khazanistitled “Technique for detecting executable malicious code
`
`using a combination ofstatic and dynamic analyses.” The Abstract of
`
`Khazan statesthat:
`
`Described are techniques used for automatic detection of
`malicious code byverifying that an application executes in
`accordance with a model defined using calls
`to a
`predetermined set of targets, such as external routines. A
`modelis constructed usinga static analysis of a binary form
`of the application, and is comprised of a list of calls to
`targets, their invocation and target locations, and possibly
`other call-related information. When the application is
`executed, dynamic analysis is used to intercept calls to
`targets and verify them against the model.
`
`Ex. 1003, Abstract. Figure 7, reproduced below, showsin moredetail the
`
`flow of control between functionsat run timeto interceptcalls to the
`
`predetermined functions or routines being monitored as part of dynamic
`
`analysis. Id. | 25.
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Applicatinn.EXE(Source Function)
`
` ADDRESS APILA API_A_OFFSRT:
`
`
`
`CALL API_A
`
`kernel 32 DLL (Target Function) 200°)
` LOCLA «:
`
`Wrapper Function
`
`
` sampotine Function
`212
`or Stub Function
`
`
`/rraen.n
`
`
`API_A_STUB:
`
`<VERIFY CALL ~ PRE
`
`MONTTORING CODE>
`<saved instructions from
`
`API_A>
` CALL API_A_TRAMPOLINE
`
`
`
`JUMP API_A + AP!_A_OFFSET:
`
`
`<POST MONITORING CODE>
`
`RETURN /* To source */
`
`
`
`
`The flow in Figure 7 depicts the control flow when a WIN32 API
`
`function is invoked at run time from the application using a call instruction.
`
`Id. § 82. A call is madeto the target function API_A. Jd. J 83. Control
`
`transfers (Fig. 7, arrow 202) to the target function API_A within the
`
`kernel132 DLL. Jd. The target function API_A includesa transfer or jump
`
`instruction to a wrapper function. Jd. Control, therefore, transfers (Fig. 7,
`
`arrow 204) to the wrapper function (API_A_STUB). Jd. Theintercepted
`
`call is verified. Id. ] 84. This verification includes using static analysis
`
`information, including parameter information. Jd. § 87. After verification, a
`
`trampoline function is invoked (Fig. 7, arrow 206) to execute previously
`
`saved instructions of API_A, whicharethefirst instructions of the routine
`
`API_Athat were replaced with a jump instruction to the wrapper function.
`
`Id. § 88. Control transfers back to the target function to continue execution
`
`of the target function body as indicated by arrow 208. Id.
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`2. Overview ofSirer (Ex. 1004)
`
`Sireris titled “Design and implementation of a distributed virtual
`
`machine for networked computers.” Ex. 1004, 1. Sirer describes
`
`centralizing service functionality in a distributed virtual machine by
`
`portioning static and dynamic components. /d at 2. Figure 1, reproduced
`
`below,illustrates the organization of those components.
`
`Static Service Components
`
`Dynamic Service
`Components
`
`Clients
`
`
`Server \
`ManagementSvcs
`Runime
`
`
`
`ecmone[en[coe]=p sewer {7
`
`
`
`
`Network
`
`Management
`
`
`
`Security
`
`Library
`moneger
`
`
`
`
`
`
`
`
`
`Administration
`Console
`
`
`
`Perimeter Services
`
`Execution Svcs
`
`Verifier
`
`Compiler
`
`Internet
`
`Security
`
`Client
`
`_
`
`
`
`Figure 1. The organization of static and dynamic service components in a distributed virtual machine.
`
`Figure 1 showsstatic service components, such as security
`
`enforcement, running at a networktrust boundary.
`
`/d. at 3. Dynamic
`
`service components provide service functionality to clients during run-time
`
`as necessary. Id. “The code for the dynamic service components resides on
`
`the central proxy andis distributed to clients on demand.” Jd. at 4. The
`
`security service “forces applications to comply with an organization’s
`
`security policy by inserting appropriate checks through binary rewriting.”
`
`Id. at 5. “During execution of the rewritten application, the enforcement
`
`manager executes the inserted access checks, querying the security service
`
`based on the security identifiers and permissionsit maintains.” Id.
`
`3. Discussion
`
`Petitioner contends that Khazan teaches “content received over a
`
`network” through Khazan’s instrumented “application executable.” See Pet.
`
`19; see also Ex. 1003 { 73 (“At step 128, the instrumented application and
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`associated libraries are executed.”). Petitioner points to Khazan’s claim 35
`
`as support for the contention that the “instrumented executable” is obtained
`
`from anotherhost, and, therefore, it is received over a network. Pet. 20.
`
`Petitioner contends that Khazan in combination with Sirer discloses the
`
`content “includinga call to a first function.” Pet. 20-21.
`
`Patent Owner challenges Petitioner’s contention by arguing that
`
`Khazan’s executable, e.g., Application. EXE shown in Figure 7, does not
`
`include a “first function.” Prelim. Resp. 15-17. Patent Ownerfurther
`
`contends that Sirer makescalls to a “dynamic service component,” which
`
`Patent Ownercontendsis a separate computer, and there is no evidencethat
`
`a computer is equivalent to a function. Prelim. Resp. 17-18. We are not
`
`persuadedat this time by Patent Owner’s arguments.
`
`Weunderstand the Petition as equating the claimed “content”to the
`
`instrumented application executable, not the original or source application
`
`executable. Further, although we agree with Patent Ownerthat there is a
`
`distinction between an “instrumented application executable” (which
`
`involves wrapper functions included in an application) and an “instrumented
`
`executable” (which involves wrapper functions includedinalibrary),
`
`Petitioner has asserted that Khazan teaches instrumentation of both whenit
`
`refers to “instrumented application andlibraries.” See Prelim. Resp. 12-13
`
`(Patent Owner arguing that wrapper functions are neverincluded in
`
`Khazan’s application, only in a library); but see Ex. 1003, Fig 4B (Step 128:
`“Execute the instrumented application and associated libraries”), § 79 (“Any
`[Jof a wide variety of different techniques may be used in connection with
`
`instrumenting the application 102 and any necessary libraries.”), and J 118
`
`(“[A]lthough the foregoing description instrumentslibraries, such as DLLs,
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`other bodies of code .
`
`.
`
`. even the application, may also be instrumented and
`
`used in connection with the techniques described herein.”).
`
`With regard to Sirer, Patent Ownerarguesthat Sirer does not teach
`
`“functions.” Prelim. Resp. 17-19. Patent Ownerfurther characterizes as
`
`unsupported attorney argumentPetitioner’s assertions that dynamic service
`
`componentsare calls to functions, and argues that cites to Petitioner’s
`
`Declarant, Dr. Rubin, “impermissibly attempt to circumvent the page
`
`limits.” Jd. These arguments are not persuasive for two reasons. First, Sirer
`
`states that the code for the dynamic service components is downloadedif
`
`needed. Ex. 1004, 4. Therefore, Sirer’s service components do not appear
`
`to be “computers,” as Patent Ownerargues, andinstead, Sirer tends to
`
`support Petitioner’s assertions. Second, we understandthe Petition to rely
`
`on Sirer as teaching instrumentation techniques performed at a proxy,
`whereas Khazan’s preferred embodimentteaches instrumentation at the host
`during dynamic analysis. Pet. 24-25. We do notsee Petitioner as relying
`
`solely on Sirer as teaching the “first function.” See Pet. 20 (“As received,
`
`the [Khazan] content includesthe substitute first function (added by
`
`Khazan’s instrumentation).”). Therefore, Patent Owner’s argument
`
`regarding deficiencies of Sirer’s teachingsin isolation does not address
`
`sufficiently the asserted combination of Khazan andSirer.
`
`Petitioner contends that Khazan teaches“the call including an input”
`
`because the wrapper function includes a parameter(i.e., input), which is
`
`verified during the pre-monitoring stage of the wrapper function execution.
`
`Pet. 27-28. In support of this argument, Petitioner proffers evidence that
`
`describes the operation of the Microsoft Detours package, referenced in
`
`Khazan,to explain that “original function parameters [are] passed to the
`
`10
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`wrapperfunction.” Jd. at 28 (citing Ex. 1002 <j 101-02, Ex. 1012, 5
`
`(Detours Article)). Patent Owner counters that the function the Petition
`
`alludes to includes an input, whereasthe claims require that “the call to the
`
`function[] includes an input.” Prelim. Resp. 20. We are not persuadedat
`
`this time by this argument becauseit fails to explain sufficiently the alleged
`
`deficiency. Furthermore, Petitioner has proffered a further assertion that
`
`including a call to the function would have been obvious because “[w]ithout
`
`providing the parameters from the wrapped function to the wrapper function,
`
`the wrapper function could not verify the parameter information,” and that
`
`the Detours package operation suggests passing the parameterto the
`
`function. Pet. 28. Patent Owner’s arguments do not address these
`
`assertions.
`
`Concerning dependentclaim 2, Petitioner asserts that Khazan teaches
`
`“suspend[ing] processing of the content after said transmitter transmits the
`
`input to the security computer.” Pet. 39. In particular, Petitioner alleges that
`
`Khazan “discloses suspending processing in the form oftransferring control
`
`from the application executable to the wrapper function whenit intercepts
`
`the call.” Jd. According to Petitioner, the execution of the contentis
`
`“suspendedfor security verification.” Jd. at 40. This suspension, according
`
`to Patent Owneroccurs before, not after the alleged transmission of the input
`
`to the security computer. Prelim. Resp. 21-22. This argumentis not
`
`persuasive at this time. Notwithstanding Patent Owner’s argument,
`
`Petitioner has presented sufficient information to show a reasonable
`
`likelihood of prevailing on the asserted challenge of claim 2.
`
`Finally, with regard to claims 3 and 5, Patent Ownerasserts that the
`
`Petition is deficient in showing that Khazan teaches “the inputis
`
`1]
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`dynamically generated by said content processorprior to being transmitted
`
`by said transmitter.” Prelim. Resp. 23-24. Petitioner points to Khazan
`
`creating and transmitting, during execution, the wrapper function parameter.
`
`Pet. 41. According to Petitioner, invocation at runtime dynamically
`
`generates the parameter. Jd. (relying on Dr. Rubin Decl., Ex. 1002,
`
`{{ 115-18). Patent Owner doesnotallege that Khazan worksdifferently or
`
`not as asserted, but rather, that Petitioner’s assertions are conclusory and that
`
`the statements in the declaration should be ignored. Prelim. Resp. 23. These
`
`arguments are not persuasive. The evidence and argumentspresented, atthis
`
`time, show a reasonablelikelihood of prevailing with respect to the
`
`challenge of unpatentability of claims 3 and5.
`
`Wehave reviewed further Petitioner’s assertions and support provided
`
`regarding the limitations recited in the challenged claims, but not addressed
`
`above. Wedeterminethat, at this juncture, Petitioner has shown a
`
`reasonable likelihood of prevailing in its contention that claims 1-5 would
`
`have been obvious over the combination of Khazan andSirer.
`
`C. GROUND BASED ON KHAZAN,SIRER, AND BEN-NATAN
`
`Petitioner contends that the “modified input variable” recited in
`
`claims 6 and 10 is taught by Ben-Natan. See, e.g., Pet. 48 (“Ben-Natan
`
`discloses ‘a modified input variable’ in the form of a ‘result data access
`999
`statement.’”). Patent Ownerchallenges the combination with Ben-Natan on
`
`the basis that Ben-Natan is not analogousart and doesnotdisclose the
`
`limitation. Prelim. Resp. 24-30.
`
`12
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`1. Overview ofBen-Natan (Ex. 1005)
`
`Ben-Natanis titled “System and methodsfor nonintrusive database
`
`security.” Ben-Natan describes “configurations of the invention [that]
`
`provide a nonintrusive data level security mechanism for intercepting
`
`database access streams.” Ex. 1005, 6:32-34. “Such an implementation
`
`deploys a security filter between the application and database, and observes,
`
`or ‘sniffs’ the stream of transactions between the application and the
`
`database.” Id. at 6:38-41. “If the ‘sniffed’ transactions indicate restricted
`
`data items, the security filter modifies the transaction to eliminate only the
`
`restricted data items, and otherwise allowsthe transaction to pass with the
`
`benign data items.” Id. at 6:50—54.
`
`2. Discussion
`
`Petitioner asserts that Khazan teaches an intercepted function(i.e.,
`
`second function) but does not teach “a modified input variable.” Pet. 48.
`
`Petitioner relies on Ben-Natan teaching a limiter that modifies a data access
`
`statementif the statement provided by the user does not meetthe security
`
`profile for the user. Jd. (citing Ex. 1005, 13:43-67, 14:1-24). According to
`
`Petitioner, a person of ordinary skill in the art would “recognize that a data
`
`access statement as disclosed in Ben-Natan is merely a type of function with
`
`input parameters used in, for example, the SQL query language.” Jd.
`
`Patent Owner argues that Ben-Natan is non-analogousart. Prelim.
`
`Resp. 24—28. In particular, Patent Ownercontendsthat “modifying SQL
`
`statements[] is not ‘reasonably pertinent’ to the problems faced by the
`
`inventors of the ’154 patent.” Jd. at 26. Further, the problem and solution
`
`identified by Ben-Natan, according to Patent Owner,is to “overcome[]
`
`deficiencies .
`
`. .with respect to data level security in data management and
`
`13
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`retrieval environments.” Jd.
`
`In contrast, Patent Ownerarguesthat the
`
`”154 patent is concerned with protecting computers from dynamically
`
`generated viruses. Id.
`
`Whethera reference is analogousart is an issue of fact that we resolve
`
`after an inquiry into the similarities of the problems and the closenessof the
`
`subject matter as viewed by a person ofordinary skill in the art. Scientific
`
`Plastic Prods., Inc. v. Biotage AB, 766 F.3d 1355, 1360 (Fed. Cir. 2014). At
`
`this time, the evidence of the viewpoint of a person of ordinary skill in the
`
`art with respect to the issue of analogousart is incomplete. Although Patent
`Owner, in the Preliminary Response, has attempted to draw outdistinctions
`
`between Ben-Natan and the ’154 patent, Petitioner has proffered evidence
`
`that Khazan and Ben-Natan havesimilarities and complementary techniques.
`
`See Ex. 1002 9 122. Therefore, at this juncture, notwithstanding Patent
`
`Owner’s arguments onthis issue, Petitioner has established a “reasonable
`
`likelihood”of prevailing.
`
`Patent Owneralso contends that Ben-Natan “neverrefers to a
`
`database query as a function.” Prelim. Resp. 28. Patent Owner further
`
`argues that Petitioner’s assertions are conclusory and that the statements in
`
`the declaration should be ignored. Jd. at 29. These arguments are not
`persuasive. Petitioner has supported its assertion that Ben-Natan’s SQL
`commandis a function because“[i]t instructs (commands) the database to
`
`perform somekind of operation and often includes inputs (parameters) and
`
`4 We recognize that Patent Ownerhasnot had an opportunity to cross-
`examine Petitioner’s declarant and introduce contrary evidence ontheissue.
`
`14
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`outputs.” Ex. 1002 4 121 (cited in the Petition at 48). The current record
`
`does not show any contrary evidence.
`
`Wehave reviewed the evidence and arguments presented in the
`
`Petition concerning the contention that claims 6-8, 10, and 11 would have-
`
`been obviousover the combination of Khazan, Sirer, and Ben-Natan. We
`also have reviewed the information presented in the Preliminary Response.
`Arguments by Patent Owneragainstinstitution have been considered and
`
`deemed unpersuasiveat this time. We determinethat, on the current record,
`
`Petitioner has shown a reasonable likelihood of prevailing in the contention
`
`that claims 6-8, 10, and 11 would have been obviousasasserted in the
`
`Petition.
`
`II.
`
`CONCLUSION
`
`For the foregoing reasons, weinstitute inter partes review of the
`
`”154 patent on all the asserted grounds and challenged claims, as follows:
`
`
`
`
`Reference[s]__—'|_Claimschallenged|Basis_
`
`
`6-8, 10, and 11
`
`Khazan, Sirer, and Ben-Natan
`
`§ 103
`
`The Board has not madea final determination on the patentability of
`
`any challenged claim.
`
`15
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`IV. ORDER
`
`In consideration of the foregoing,it is hereby:
`
`ORDEREDthatthe Petition is granted as to claims 1—8, 10, and 11 of
`
`the ’154 patent on the groundsstated in the Conclusion; and
`
`FURTHER ORDEREDthat pursuant to 35 U.S.C. § 314(a), inter
`partes review ofthe ’ 154 patent is herebyinstituted with trial commencing
`on the entry date of this decision, and pursuant to 35 U.S.C. § 314(c) and 37
`
`C.F.R. § 42.4, notice is hereby given ofthe institution oftrial.
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`PETITIONER:
`
`Orion Armon (Lead Counsel)
`Christopher Max Colice (Back-up Counsel)
`Jennifer Volk (Back-up Counsel)
`Brian Eutermoser (Back-up Counsel)
`oarmon@cooley.com
`mcolice@cooley.com
`jvolkfortier@cooley.com
`beutermoser@cooley.com
`zPaloAltoNetworksIPR@cooley.com
`
`PATENT OWNER:
`
`James Hannah (Lead Counsel)
`Jeffrey H. Price (Back-up Counsel)
`Michael Kim (Back-up Counsel)
`jhannah@kramerlevin.com
`jprice@kramerlevin.com
`mkim@finjan.com
`
`17
`
`