`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`ae
`on
`a :
`
`=
`ge
`~~
`
`2017JULt
`
`PALO ALTO NETWORKS, INC.
`Petitioner
`
`.
`
`V.
`
`.
`
`FINJAN, INC.
`Patent Owner
`
`Inter Partes Review No. IPR2016-00151'
`US: Patent No. 8,141,154
`
`PETITIONERS’ NOTICE OF APPEAL.
`
`' Case IPR2016-01071 has been joined with this proceeding.
`
`
`
`Petitioners’ Notice of Appeal
`IPR2016-00151 (U.S. Patent No. 8,141,154)
`
`Pursuant to 37 C.F.R. § 90.2(a) and 35 U.S.C. §§ 141(c), 142, and 319, Palo
`Alto Networks, inc. and Symantec Corp. (“Petitioners”) respectfully give notice
`that they appeal to the United States Court of Appeals for the Federal Circuit from
`the Patent Trial and Appeal Board’s Final Written Decision entered on March 15,
`2017 (Paper 51), the Board’s Decision Denying Rehearing entered on May 19,
`2017 (Paper 53), and from other related orders, decisions, rulings, and opinions
`underlying the Board’s decisions
`For the limited purpose of providing the Director of the United States Patent
`and Trademark Office with the information specified in 37 C.F.R. § 90.2(a)(3)(),
`the issues on appeal include the Board’s determination that Petitioners did not
`
`establish that claims 1-8, 10, and 11 of the ’154 patent are unpatentable under 35
`U.S.C. § 103 in view of the grounds ofunpatentability on which trial was instituted
`Paper 10). The issues on appeal also include any finding or determination
`
`supporting or related to these issues, as well as all other issues decided adversely to
`
`Petitioners in any order, decision, ruling, or opinion.
`
`? Symantec Corp. was petitioner in IPR2016-01071, which was consolidated and
`
`joined. with IPR2016-00151. (Paper 21.) Citations are to the IPR2016-00151
`
`docket.
`
`
`
`Petitioners’ Notice of Appeal
`IPR2016-00151 (U.S. Patent No. 8,141,154)
`
`Simultaneous with this filing and in accordance with 37 C.F.R. § 90.2(a)(1),
`
`this Notice of Appeal is being filed with the Director and served on Patent Owner
`
`in accordance with 37 C.F.R. § 42.6(e). This Notice of Appeal, along with the
`
`required fees, is also being filed with the Clerk’s Office for the United States Court
`of Appeals for the Federal Circuit in accordance with Fed. Cir. R. 15(a)(1).
`
`Dated: July 17, 2017
`
`|
`
`Respectfully submitted,
`
`Counsel for Palo Alto Networks,Inc.
`Morrison & Foerster LLP
`.
`1650 Tysons Boulevard, Suite 400
`McLean, VA 22102
`Tel: (703) 760-7774
`Fax: (703) 890-2632
`SBiswas@mofo.com
`
`Counsel for Symantec Corp.
`Quinn Emanuel Urquhart & Sullivan
`500 West MadisonSt.
`Suite 2450
`Chicago,IL 60661
`Tel: (312) 705-7400
`Fax: (312) 705-7401
`nathanhamstra@quinnemanuel.com
`
`By:
`
`/ Shouvik Biswas/
`Shouvik Biswas
`Registration No.: 68,439
`
`Respectfully submitted,
`
`By:
`
`/ Nathan Hamstra /
`Nathan Hamstra
`
`
`
`Petitioners’ Notice of Appeal
`IPR2016-00151 (U.S. Patent No. 8,141,154)
`
`CERTIFICATE OF SERVICE
`
`‘I hereby certify that, in addition to being filed electronically through the
`Patent Trial and Appeal Board’s End to End system, the foregoing Notice of
`
`Appeal wasfiled by Express Mail on July 17,2017, with the Director of the United
`
`States Patent and Trademark Office,at the following address:
`
`Office of the General Counsel
`_ Patent and Trademark Office
`Madison East
`10B20 600 DulanyStreet
`Alexandria, Virginia 22314
`
`kK
`
`I hereby certify that a true and correct copy of the foregoing Notice of
`Appeal wasfiled electronically by CM/ECF on July 17, 2017, with the Clerk’s
`Office ofthe United StatesCourt ofAppeals for the Federal Circuit..
`.
`Pursuant to 37 CFR. §§ 90.2(a) and Federal Circuit Rule 15(a)(1), I certify
`that on July 17, 2017, the requisite fee for appeal of the foregoing Petitioners’
`Notice of Appeal was filed by CM/ECFin the United States Court of Appeals for
`
`the Federal Circuit.
`-
`ok
`Pursuant to 37 C.F.R. § 42.6(e), I certify that I caused to be served a true and
`- correct copy of the foregoing Petitioners’ Notice of Appeal on the Patent Ownerat
`
`
`
`Petitioners’ Notice of Appeal
`IPR2016-00151 (U.S. Patent No. 8,141,154)
`
`the correspondence address of the Patent Owneras follows: -
`
`James Hannah
`KRAMERLEVIN NAFTALIS &
`FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Phone: (650) 752-1712
`Fax: (650) 752-1812
`jhannah@kramerlevin.com
`
`Michael Kim
`Finjan, Inc.
`2000 University Ave., Ste. 600
`E. Palo Alto, CA 94303
`Phone: 650.397.9567
`mkim@finjan.com
`USPTO Reg. No. 40,450
`
`147984445 v1
`
`Jeffrey H. Price
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`1177 Avenue of the Americas
`New York, NY 10036
`Phone: (212) 715-7502
`Fax: (212) 715-8302
`jprice@kramerlevin.com
`
`Nathaniel A. Hamstra
`David Nelson
`.
`Kenneth K. Suh
`QUINN EMANUEL
`500 W. MadisonSt., Suite 2450
`Chicago, IL 60661
`nathanhamstra@quinnemanuel.com
`davenelson@quinnemanuel.com
`kennethsuh@quinnemanuel.com
`
`By:
`
`/ Kim Helenius/
`Kim Helenius
`
`
`
`Trials@uspto.gov
`571-272-7822
`
`Paper 51
`Entered: March 15, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC. and SYMANTEC CORP.,
`Petitioner,
`
`Vv.
`
`FINJAN,INC.,
`Patent Owner.
`
`Case IPR2016-00151!
`Patent 8,141,154 B2
`
`Before, THOMAS L. GIANNETTI, MIRIAM L. QUINN,and
`PATRICK M. BOUCHER,Administrative Patent Judges.
`
`QUINN, Administrative Patent Judge.
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 CFR. § 42.73
`
`! This case is joined with IPR2016-01071. Paper 21 (“Decision on
`Institution of Inter Partes Review and Grant of Motion for Joinder,” filed by
`Symantec Corp.).
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Palo Alto Networks, Inc. and Symantec Corp.(collectively
`
`“Petitioner”) each havefiled petitions to institute inter partes review of
`
`claims 1-12 of U.S. Patent No. 8,141,154 B2 (“the ’154 patent”) pursuantto
`
`.
`
`35 U.S.C. § 311-319. Paper 2 (“Pet.”); IPR2016-01071, Paper 1. In
`responseto the petition filed by Palo Alto Networks, Inc. (Paper 2), Finjan,
`Inc. (“Patent Owner”) filed a Preliminary Response. Paper 8 (“Prelim.
`Resp.”). Upon consideration of the Petition and the Preliminary Response,
`weinstituted trial as to challenged claims, 1-8, 10 and 11. Paper 10
`
`(“Dec.”).
`Subsequently, we reviewed and granted Symantec Corp.’s petition,
`which sought review ofthe same claims ofthe °154 patent. IPR2016-01071,
`Paper 1. With its petition, Symantec Corp.filed a motion requesting to join
`IPR2016-01071 with this proceeding, and we granted the motion. Paper 21.
`Upongranting the motion, we terminated Case IPR2016-01071, and ordered
`consolidation ofall Petitioner filings in this proceeding.
`/d. at 4—5.
`
`During trial, Patent Ownerfiled a Patent Owner Response (Paper19,
`“PO Resp.”); andPetitioner filed a Reply (Paper 32, “Reply”). Patent
`Owneralso filed a Motion for Observations of the December 20, 2016,
`
`cross-examination of Petitioner’s declarant, Dr. Aviel Rubin. Paper 40.
`Petitioner responded to Patent Owner’s Motion for Observations. Paper 43.
`Both parties also filed Motions to Exclude. Paper 38 (“Pet. Mot. to
`Exclude”); Paper 39 (“PO Mot. to Exclude”). Both parties filed Oppositions
`and Replies concerning the Motions to Exclude. Papers 42, 44, 45, 46. An
`oral hearing was held on January 24, 2017.”
`
`2 A transcript of the oral hearing is entered in the record as Paper 49 (“Tr.”).
`
`2
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Wehavejurisdiction under 35 U.S.C. § 6(c). This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a). For the reasons discussed
`herein, and in view ofthe recordin this trial, we determine that Petitioner
`
`|
`
`has not shown by a preponderanceofthe evidence that claims 1—8, 10, and
`
`11 of the ’154 patent are unpatentable.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies the ’154 patent as the subject of variousdistrict
`
`court cases filed in the U.S. District Court for the Northern District of
`
`California and District of Delaware. Pet. 42. Petitioner also states that
`
`petitions for interpartes review havebeenfiled regarding otherrelated
`patents. Id. The ’154 patentis also the subject of another inter partes
`review: IPR2015-01979 (and IPR2016-00919,joined therewith). In
`
`IPR2015-01979, we issue a Final Written Decision, under 35 U.S.C.
`
`§ 318 (a), concurrently with the instant Final Written Decision.
`
`B. FINAL WRITTEN DECISIONIN IPR2015-01979
`
`The parties have briefed whether estoppel under 35 U.S.C.
`§ 315 (e)(1) affects our ability to render a Final Written Decision in this
`proceeding. See Papers 30, 31. As stated above, IPR2015-01979 is also
`directed to the ’154 patent, and considers the same claims challenged in the
`instant proceeding. Because weissue final written decisions in both
`proceedings concurrently, we need not decide what effect, if any, the
`estoppel provisions of § 315 (e)(1) have on our ability to renderthis
`
`decision.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`C. INSTITUTED GROUNDS
`
`Weinstituted inter partes review of claims 1-8, 10, and 11 (“the
`
`challenged claims”) based on Petitioner’s challenge of those claims as
`unpatentable under 35'U.S.C. § 103(a) over Ross.’ Petitioner supports its
`contentions of unpatentability with a declaration from Dr. Aviel Rubin. Ex.
`1002 (“Rubin Declaration”). Patent Owner proffers a declaration from Dr.
`Nenad Medvidovic as evidence in support for its contentions. Ex. 2035
`(“Medvidovic Declaration”). The cross-examinations of Dr. Rubin and Dr.
`Medvidovicare in the record as Exhibits 2012 and 1011, respectively.
`
`D. THE ’154 PATENT (Ex. 1001)
`
`The ’154 patent relates to computer security and, more particularly, to
`systems and methods for protecting computers against malicious code such
`as computerviruses. Ex. 1001, 1:7—9, 8:38-40. The ’154 patent identifies
`the components of one embodimentof the system as follows: a gateway
`computer, a client computer, and a security computer. Jd. at 8:45—47. The
`gateway computerreceives content from a network, such asthe Internet,
`over a communication channel. Jd. at 8:47-48. “Such content may be in the
`
`form of HTML pages, XML documents, Java applets and other such web
`
`content that is generally rendered by a web browser.” Jd. at 8:48-51. A
`
`content modifier modifies original content received by the gateway
`computer and produces modified contentthat includes a layer of protection
`
`to combat dynamically generated malicious code. /d. at 9:13-16.
`
`3 Patent Application Pub. No. US 2007/0113282 Al (Exhibit 1003)
`(“Ross”).
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`E. ILLUSTRATIVE CLAIM
`
`Challenged claims 1, 4, 6, and 10 are independent, and illustrative
`
`claim 1 is reproduced below.
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`
`a content processor(i) for processing content received
`over a network, the content includinga callto a first function,
`and thecall including an input, and(ii) for invoking a second
`function with the input, only if a security computerindicates
`that such invocationis safe;
`
`a transmitter for transmitting the input to the security
`computerfor inspection, when the first function is invoked; and
`
`a receiver for receiving an indicator from the security
`computer whetherit is safe to invoke the second function with
`the input.
`
`Il.
`
`ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`In an interpartes review, claim terms in an unexpired patent are
`interpreted accordingto their broadest reasonable construction in light of the
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b);
`Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2142-46 (2016).
`Consistent with that standard, claim termsalso are given their ordinary and
`customary meaning, as would be understood by one of ordinary skill in the
`art in the context of the entire disclosure. See In re Translogic Tech., Inc.,
`
`504 F.3d 1249, 1257 (Fed. Cir. 2007). There are, however, two exceptions
`to that rule: “1) whena patenteesets out a definition and acts as his own
`lexicographer,” and “2) when the patentee disavowsthe full scope of a claim
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`term either in the specification or during prosecution.” See Thorner v. Sony
`Computer Entm’t Am. LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).
`If an inventor acts as his or her own lexicographer, the definition must
`be set forth in the specification with reasonable clarity, deliberateness, and
`precision. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243,
`1249 (Fed. Cir. 1998). Although it is improper to read a limitation from the
`specification into the claims, In re Van Geuns, 988 F.2d 1181, 1184 (Fed.
`Cir. 1993), claimsstill must be read in view of the specification of which
`they are a part. Microsoft Corp. v. Multi-Tech Sys., Inc., 357 F.3d 1340,
`1347 (Fed. Cir. 2004).
`In our Decision on Institution, we did not construe expressly any
`
`claim terms. Dec. 4—5. In its papers, Patent Owner arguesdistinctions from
`the prior art that hinge on whetherthe term “call to a first function” is
`different from “invoking”the first function. PO Resp. 22-23 (“Ross teaches
`a technique in which received content does not includea call to a first
`function. In contrast, Ross’ technique involves invoking a hook function.. .
`without the content including a call to the hook function.” (emphasis in
`
`original)).
`
`“call to afirstfunction”
`The term “call to a first function”is recited in all challenged claims.
`The argumentspresented regarding this limitation turn on the scope of the
`word “call.” Specifically, Patent Owner argues that Ross may invokethe
`“first function,” but Petitioner has not identified that Ross’s content includes
`a “call to a first function,” as required by the claims. Jd. at 20-21. At issue
`is to what extent the recited “call” refers to execution of the function. Dr.
`Medvidovic, Patent Owner’s expert, proffers opinions on the issue by
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`relying on a definition of “functioncall” derived from the Microsoft Press
`Computer Dictionary. Ex. 2035 4 57 (citing Ex. 2013). That Dictionary
`provides that a “function call” is “[a] program’s request for the services of a
`particular function.” Jd.; Ex. 2013. It also explainsthat “[a] function call is
`coded as the nameofthe function along with any parameters neededfor the
`function to perform its task.” Id.
`The Specification of the ’154 patent does not define the term “call to a
`first function.” But the Specification uses the phrase “function call”in
`stating that “before the client computer invokes a functioncall that may
`potentially dynamically generate malicious code, the client computer passes
`the input to the function to the security computer for inspection.” Ex. 1001,
`
`4:38-42. The Specificationalso states that “the present invention operates
`
`by replacingoriginal function calls with substitute function calls within the
`content, at a gateway computer, prior to the content being received at the
`
`client computer.” Jd. at 4:57-60. From such examples, we understand the
`Specification to use the phrase “function call” in the same sense that the
`claimsrecite in the phrase “call to a [] function.” Thatis, a “call” is part of
`the recited “content,” as a statement or instruction containing the function
`
`that, when executed, causes the function to provide a service. Thus, we find
`
`the dictionary definition of the term “functioncall” applicable here and
`indicative of the meaningofthe term to a person of ordinary skill in the art.
`
`Furthermore, the dictionary definition is consistent with the
`
`embodiments described in the Specification. For example, one embodiment
`
`of the ’154 patent provides for modifying an original function call with |
`
`“corresponding function calls Substitute_function(input,*).” Id. at 9:21—24.
`
`That is, the specification describes that the services of the function
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Substitute_function are being requested by the modified content.
`
`Furthermore, the format of the function in this particular embodiment
`
`identifies the nameof the function and the parameters “input” and “*”. See
`
`also id. at 9:26-28 (explaining that the “input intended forthe original
`
`function is also passed to the substitute function, along with possible
`additional input denoted by ‘*’”). From this description we determinethat
`the “call” is a statementor instruction in the content, the execution of which
`
`causes the function to provide a service.
`
`Wenote that this construction of “call to a first function” need not
`
`define the format of the instruction or statement, or further detail regarding
`
`its parameters. Wereach this determination because the claim language
`itself requires that either the call or the function include an input. For
`example, claim | recites the “call including an input,” while claim6recites
`
`“the first function including an input variable.”
`
`Petitioner arguesthat a call to a function and invoking a function are
`
`equivalent. Tr. 26:2-12. Dr. Rubin furthertestifies that a call is “when a
`
`function is invoked.” Ex. 2038, 74:9-11; see also 74:18—75:4 (testifying
`
`also that invoking the function name,transferring execution to the code in
`that function is acall). We do not agree with Petitioner in this regard. The
`claimsrecite “including a call” and “invoking”distinctly from each other.
`
`For example, claims 1 and4recite “the content includinga call to a first
`
`function” and “whenthe first function is invoked.” These limitations have
`
`different connotations. In the first instance, the “call” (noun)is included in
`the content, and therefore points to a programmatic statement or instruction
`in the content. The secondinstance, “first function is invoked,” however,
`
`refers to the effect of the call to the function being executed, 1.e., invoked.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`The sameanalysis applies regarding the language of claims 6 and 10,
`which do notrecite the word “invoke.” Claims 6 and 10, for example, recite
`“the content includinga call to a first function” and “whenthe first function
`is called.” Again, the “call” (noun) refers to a programmatic statement
`included in the content. However, “calling” is the effect of the call to the
`function being executed. Accordingly, based on the foregoing and under the
`broadest reasonable interpretation, we determinethat a “call to a first
`function” means a statementor instruction in a program requesting the
`services of a particular (i.e., first) function. |
`
`B. PRINCIPLES OF LAW
`
`A claim is unpatentable under 35 U.S.C. § 103(a) if the differences
`between the claimed subject matter and the priorart are such that the subject
`
`matter, as a whole, would have been obviousat the time the invention was
`
`madeto a person having ordinary skill in the art to which said subject matter
`pertains. KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406 (2007). The
`question of obviousnessis resolved on the basis of underlying factual
`determinations including: (1) the scope and contentoftheprior art; (2) any
`differences between the claimed subject matter and thepriorart; (3) the level
`
`of ordinary skill in the art; and (4) objective evidence of nonobviousness.
`
`Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966).
`
`C. THE LEVEL OF SKILL IN THE ART
`
`In determining the level of ordinary skill in the art at the time of the
`
`invention, we note that various factors may be considered,including “type of
`
`' problemsencounteredin the art; prior art solutions to those problems;
`rapidity with which innovations are made; sophistication of the technology;
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`and educational level of active workersin the field.” In re GPAC, Inc., 57
`
`F.3d 1573, 1579 (Fed. Cir. 1995)(citing Custom Accessories, Inc. v. Jeffrey-
`
`Allan Indus., Inc., 807 F.2d 955, 962 (Fed. Cir. 1986)).
`Petitioner asserts, through its expertDr. Aviel Rubin, that the
`“relevant technologyfield for the ’154 patent is security programs,including
`content scanners for program code.” Ex. 1002 § 25. Further, Dr. Rubin
`opines that a person ofordinary skill in the art would “hold a bachelor’s
`degree or the equivalent in computer science (or related academic fields) and
`three to four years of additional experience in the field of computersecurity,
`
`or equivalent work experience.” Id.
`Patent Owner, through its expert Dr. Nenad Medvidovic,offers a level
`
`of ordinary skill that is different from Petitioner’s. Ex. 2035 35. In
`Particular, Dr. Medvidovic opines that a person ofordinary skill in the art
`
`would have a “bachelor’s degree in computer science or related field, and
`either (1) two or moreyears of industry experience and/or (2) an advanced
`degree in computer science orrelated field.” Jd. In comparison,it appears
`that the minimum experience under Patent Owner’s proffered level of skill is
`one yearless than Petitioner’s. Also, Patent Owner proffers an alternative to
`work experience, namely an advanced degree. There is no specific
`articulation regarding howthe difference of one year’s experience or the
`proposedalternative of an advanced degree in lieu of experience tangibly
`affects our obviousness inquiry. Further, there is no evidence in this record
`that the differences noted above impact in any meaningful waythe level of
`expertise of a person of ordinary skill in the art. Indeed, wenote that Dr.
`Medvidovic’s opinions would not changeif he had consideredinsteadthe
`level or ordinary skill in the art proffered by Dr. Rubin. Id. § 39.
`
`10
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Accordingly, we determinethatin this case no expressarticulation of
`
`the level of ordinary skill in the art is necessary and that the level of ordinary
`
`skill in the art is reflected by the prior art of record. See Okajimav.
`
`Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001); In re GPAC Inc., 57 F.3d
`
`1573, 1579 (Fed. Cir. 1995); In re Oelrich, 579 F.2d 86, 91 (CCPA 1978).
`
`D. OBVIOUSNESS GROUND BASED ON Ross
`
`The Petition relies on Rossas teaching or suggesting all the
`
`limitations of claims 1-8, 10, and 11. Pet. 14-37. Having reviewed the
`
`arguments and evidence provided by Petitioner and the arguments and
`evidence presented by Patent Owner, we determine that Petitioner has failed
`to show by a preponderanceofthe evidence that Ross teaches or suggests all
`the limitations of the challenged claims, and moreparticularly, “the content
`
`includinga call to a first function.”
`
`1. Overview ofRoss (Exhibit 1003)
`
`Ross describes one embodiment where a device receives and
`
`processes“data content having at least one original function call [andit]
`includes a hook script generator and a script processing engine.” Ex. 1003
`4 10. One such deviceis depicted in Figure 2 of Ross, reproduced below.
`
`11
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`
`
`220
`DISPLAY
`
`
`
`TRANSCEIVER
`
`232
`PROCESSOR
`
`234
`PROCESSOR
`MEMORY
`224
`SCRIPT
`PROCESSING
`ENGINE (WEB
`BROWSER)
`
`202 204
`
`
` CLIENT
`SERVER
`
`
`
`250
`
`
`WEB SERVER
`TRANSCEIVER
`
`
`
`
`252
`
`
`WEB PAGE#1
`
`WEB PAGE#2
`PROCESSOR
`
`
`
`
`
`254
`PROCESSOR
`MEMORY
`
`
`
`
`— 200
`
`
`WEB PAGE #N
`
`
`
`
`
`
`
`
`
`
`.
`
`
`
`
`SCRIPT INJECTOR
`(BROWSER PLUG-IN)
`
`244
`HOOK SCRIPT GENERATOR
`
`246
`COMMUNICATION OBJECT
`
`FIG 2
`
`Figure 2 showsa client network device (client 202) and a server
`
`network device (server 204) communicating with each other over
`
`communication network 208 to exchange information, including web
`
`content. Id. Jf 16, 23. Figure 2 depicts web browser 224 and detection
`
`engine 240atthe client, but in other embodiments, detection engine 240
`
`maybe physically located away from client 202. Id. | 26. Detection
`
`engine 240 includesscript injector 242 to intercept incoming data content
`
`and introduce the incoming data to script-processing engine 224. Id. “Hook
`
`script generator 244 creates new functions, including constructor functions,
`
`which replace the standard JavaScript functions.” Jd.
`
`12
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`2. Discussion ofIndependent Claims
`Independent claim1is directed to a system, while claim 4 is directed
`to stored program code including functions performed by a computer device,
`where those functions track the functions recited in claim 1. Independent
`
`claim 6 is also directed to a system, albeit with somelimitations different
`
`from the system of claim 1. And independentclaim 10 is directed to stored
`program codeincluding functions performed by a computer device, where
`those functions track the functionsrecited in claim 6. Notwithstanding their
`differences, all the independentclaimsrecite “the content includinga call to
`
`a first function.” We find that Ross does not disclose this limitation.
`
`Content Includes a Call to a First Function
`
`Petitioner asserts that the recited “content” is met by a combination of
`
`Ross’s web content (HTTP data) and hook functions in the hook script. Pet.
`
`16 (“script processing engine processes content from both the web (HTTP
`data content) and from the hook script generator (hook functions)”). The
`Petition points out that Ross’s “hookscripts and their associated inputs teach
`or suggest ‘the content includingacall to a first function, and thecall
`including an input,’ as recited in claim 1.” Id. Specifically, the Petition
`states that each hookscript has “at least one hook function[,] where each
`hook function is configured to supersede a corresponding original function.”
`Id. at 17 (citing Ex. 1003 § 38). With regard to the “call” limitation,
`Petitioner asserts that a person of ordinary skill in the art would have
`understood that the hook scripts “includeacall to a first function call (i.e.,
`
`109).
`hook functions within a hook script).” Jd. at 18 (citing Ex. 1002
`Based on these assertions, we understand Petitioner’s contentionto be that
`
`13
`
`
`
`1PR2016-00151
`Patent 8,141,154 B2
`
`Ross’s description of hook functions in the hookscript teaches or suggests
`the “call to a first function.”
`
`Patent Ownerchallenges these assertions by arguing that merely
`
`pointing to hook functions within a hookscript is insufficient. PO Resp.
`
`20-22. According to Patent Owner, Ross’s hook script includes a function,
`
`i.e., the hook function, but not the “call” to that function. Jd. (citing Ex.
`
`2035 9956-59). Ross, according to Patent Owner, teaches a technique
`
`different from the claims. Jd. at 22—23. Rossfirst calls the original
`
`function, which Petitioner identifies as the recited “second function,” in
`
`order to invoke the hook function (“first function”). Jd. at 23 (citing Ex.
`
`1003 4] 12-13). In contrast, the claims require that the content include a
`
`call to a first function, in order to invoke the first function first. See, e.g.,
`
`claim 1 (“transmitting the input to the security computer... when the first
`function is invoked” and “invoking a second function with the input only ifa
`
`_
`
`security computer indicates that such invocation is safe”); claim 6
`(“transmitting the input variable to a security computer .
`.
`. when thefirst
`tunctionis called”“modifying the input variable if the security computer
`
`determinesthat[it is not] safe” and “calling a second function with a
`
`modified input variable”).
`In support ofPatent Owner’s argument, Dr. Medvidovic explains that
`Ross describes the combined hookscript and the original script as using an
`
`“assignment,” not a “call” for invoking the first function. PO Resp. 23-24
`
`(citing Ex. 2035 461). We credit this testimony. Rossillustrates in Figure 4,
`reproduced below, a combinedscript, which shows more detail regarding
`how Ross formulates the hook script and the included hook function. See
`
`Ex. 1003, Fig. 4.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`/ Generated Hook Script (Highly simplified example)
`SCRIPT language="JavaScript’”>
`ealAXO = ActiveXObject;
`
`function myXMLObject(realconstructor) {
`// Generated code (create Microsoft.XMLHTTP wrapperobject and return it)
`
`}
`
`
`
`
`nection HookedActiveXObject(objname) {
`/{ Security checks go here
`if (objname == “Microsoft.XMLHTTP") {
`return new myXMLObject(realAXO);
`} else {
`retum realAXO(objname); // ifno more security checks are needed
`
`}
`
`
`
`}A
`
`404
`
`302
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`ctiveXObject = HookedActiveXObject;
`</SCRIPT>
`
`/ Original Script
`SCRIPT language="JavaScript”>
`
`ar Req;
`eq = new ActiveXObject("Microsoft.XMLHTTP"),
`
`/ Open the request object with MKCOLand specify thatit will be sent asynchronously.
`eq.Open("MKCOL",folderURL,false);
`
`
`
`Figure 4 illustrates combined script 402 including hook script 404 and
`original script 302. Jd. Dr. Medvidovic identifies the hook function in hook
`script 404 as “function HookedActiveXObject(objname).” Ex. 2035 { 61.
`The combinedscript does not include a call to the function
`“HookedActiveXObject.” Instead, as Dr. Medvidovic explains, Ross’s hook
`
`script includesacall to the originalfunction, not the hook function, as
`
`shown below in Patent Owner’s annotated Figure 4.
`
`15
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`
`inciaons sayXMLObyect{realeonstrucioe) {
`ft Generand code (creme MicteaoRXMLHTTP arapper object and return it}
`stonookedAsivesbyob)(i
`ifCobjasmme= “MecrnotAMLUTIO"){
` Securny chects go
`|
`returnnewpryXMLObyecsreatAXO},
`
`belse {
`return realAXOfobec), «ofno more securrty checks are needed
`
`HookiFunction
`
`}
`
`A ASS,
`
`
`
`gineXObject * HeokedActovedObyext,
`OrgadSeng .
`a CalltoOriginal Function
`SerrneuerpeSenge>
`24om ActiveXObed"Mucrosa®XMLUTTP"},
`7Open the request obyect with MKCOL and specsdy that t will be scat asynchronously.
`09.Open“MKCOL", folderURL, fstve).
`RUT?
`
`“04
`
`302
`
`FIG 4
`
`The annotated Figure 4 of Ross, above, annotates Ross’s script by
`pointing out: (1) in brackets, that a group of instructions comprise the
`function “Hooked ActiveXObject(objname);”and (2) that the bodyofthe
`function is the “Hook Function.” See PO Resp. 23. The annotations also
`
`show that the instruction “Req=new
`ActiveXObject(“Microsoft.XMLHTTP”)”is the “Call to Original Function.”
`
`Id. Dr. Medvidovic explainsthat the call to “new
`ActiveXObject(“Microsoft.XMLHTTP”) indirectly invokes “function
`HookedActiveXObject,” using Ross’s assignment technique. See Ex. 2035
`{ 61. Ross’s description of the hook functions confirmsthis technique. For
`example, Rossstates that “[t]he hook function correspondingto the data
`content original function is executed when the originalfunction is called.”
`
`16
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Ex. 1003, Abstract; see also J 13 (“executing a hook function when a
`
`correspondingoriginal function is called in the data content”). Ross further
`
`states that the “hook function is configured to supersede a corresponding
`
`original function.” Id. J] 10-12.
`
`Although we have explained that the first invocation in Rossis not of
`
`the first function, the issue is not simply whether Ross executes or processes
`
`the first function first, before the second function. The issue is whetherthe
`
`content in Ross includesa “call to a first function,” as claimed. We find that
`
`|
`
`Ross doesnot.
`Patent Owner’s explanation of Ross is consistent with Ross’s
`description of how the hookscript is generated and processed. Ross’s hook
`
`script generator creates new functionsto replace the original functions, such
`
`as the JavaScript function embedded in a web page. Jd. § 26. When the web
`
`pageis received,thescript filter injects “the JavaScript that hooks the
`
`critical functions and methods before any other HTML in a loading page.”
`
`Id. § 29. To implement these “hooks,” Rossstates that it replaces the
`
`original function with a new replacementfunction or that it substitutes an
`
`original function with a filtered function by instantiating a “hooked”process.
`
`Id. ¥§ 33, 34. These statements of “replacement” and “substitution,”
`
`however, refer to how the hook functions are implemented whenthe script
`
`executes. Neither of these statements explains whethera “call” to a hook
`
`function is included in the script. That is, the replacementor substitution
`
`mayresult in invoking the hook function, without the content actually
`
`including a call. And this indirect invocation—notusing a call—ofthe
`
`hooked function is what Ross tends to show. Forinstance, Ross describes
`
`the method of processing the content as follows: (1) generating a hook
`
`17
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`script with a hook function; (2) loading the hookscript; (3) loading the data
`content havingthe original function; and (4) executing a hook function when
`a corresponding originalfunction is called in the data content. Id. § 38.
`
`Thus, the hook function is loaded before anything else is loaded in
`
`order to define the hook function and to effectuate the replacement. The
`
`replacement, or the method of superseding, is accomplished by the
`
`assignmentthat results from the use of the instruction
`ActiveXObject=HookedActiveXObject. As Dr. Medvidovic explains, by
`
`wayof assignment of ActiveXObject(original function) to
`
`HookedActiveXObject (substitute or first function), a call to the original
`
`function indirectly invokes the substitute or first function. See Ex. 1011,
`
`10:20-13:21. This understanding is further confirmed by Ross’s description
`ofthe hook functions, as stated above, and whenit refers to them as “new
`objects that