`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC.
`Petitioner
`
`V.
`
`FINJAN,INC.
`Patent Owner
`
`mor PE
`
`Inter Partes Review No. 2015-01979!
`U.S. Patent No. 8,141,154
`
`
`
`PETITIONERS’ NOTICE OF APPEAL
`
`1 Case IPR2016-00919 has been joined with this proceeding.
`
` 61:6WY81IAPLing
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`Pursuant to 37 C.F.R. § 90.2(a) and 35 U.S.C. §§ 141(c), 142, and 319, Palo
`
`Alto Networks, Inc. and Symantec Corp. (“Petitioners”) respectfully give notice
`that they appeal to the United States Court ofAppeals for the Federal Circuit from
`the Patent Trial and Appeal Board’s Final Written Decision entered on March 15,
`2017 (Paper 62), the Board’s Decision Denying Rehearing entered on May 19,
`2017 (Paper 64), and from other related orders, decisions, rulings, and opinions
`
`underlying the Board’s decisions.’
`For the limited purpose of providing the Director ofthe United States Patent
`and Trademark Office with the information specified in 37 C.F.R. § 90.2(a)(3)(i),
`the issues on appeal include the Board’s determination that Petitioners did not
`_ establish that claims 1-8, 10, and 11 of the °154 patent are unpatentable under 35 |
`U.S.C. § 103 in view ofthe grounds ofunpatentability on which trial was instituted
`
`(Paper 8). The issues on appeal also include any finding or determination
`
`supportingor related to these issues, as well as all other issues decided adversely to
`
`Petitioners in any order, decision, ruling, or opinion.
`
`2 Symantec Corp. was petitioner in IPR2016-00919, which was consolidated and
`
`joined with IPR2015-01979.
`
`(Paper 28.) Citations are to the IPR2015-01979
`
`docket.
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`Simultaneouswith this filing and in accordance with 37 C.F.R. § 90.2(a)(1),
`
`this Notice of Appeal is being filed with the Director and served on Patent Owner
`in accordance with 37 C.F.R. § 42.6(e). This Notice of Appeal, along with the
`required fees, is also being filed with the Clerk’s Office for the United States Court
`ofAppeals for the Federal Circuit in accordance with Fed. Cir. R. 15(a)(1).
`
`Dated: July 17, 2017
`
`Counsel for Palo Alto Networks,Inc.
`CooLey LLP
`ATTN:Patent Group
`1299 Pennsylvania Ave., NW, Suite 700
`Washington, DC 20004
`Tel: (703) 456-8000
`Fax: (202) 842-7899
`
`Respectfully submitted,
`CooLry LLP
`
`By:
`
` /Orion Armon/
`Orion Armon
`Reg. No. 65,421
`
`‘Counsel for Symantec Corp.
`Quinn Emanuel Urquhart & Sullivan
`500 West MadisonSt.
`Suite 2450
`Chicago, IL 60661
`Tel: (312) 705-7400
`Fax: (312) 705-7401
`nathanhamstra@quinnemanuel.com
`
`|
`
`Respectfully submitted,
`QUINN EMANUEL URQUHART
`& SULLIVAN
`~
`
`By:
`
`/Nathan Hamstra/
`Nathan Hamstra
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`CERTIFICATE OF SERVICE
`I hereby certify that, in addition to being filed electronically through the
`
`Patent Trial and Appeal Board’s End to End system, the foregoing Notice of
`
`Appeal was sent by overnight Federal Express on July 17, 2017, to the Director of
`the United States Patent and Trademark Office, at the following address:
`
`Office of the General Counsel
`Patent and Trademark Office
`Madison East
`10B20 600 Dulany Street
`Alexandria, Virginia 22314
`
`KK
`
`I hereby certify that a true and comect copy of the foregoing Notice of
`
`Appeal was filed electronically by CM/ECF on July 17, 2017, with the Clerk’s
`Office ofthe United States Court ofAppeals for the Federal Circuit.
`
`Pursuant to 37 C.F.R. §§ 90.2(a) and Federal Circuit Rule 15(a)(1), I certify
`that onJuly 17, 2017, the requisite $500.00 fee for appeal of the foregoing
`
`Petitioners’ Notice of Appeal was paid through Pay. gov to the United States Court
`
`ofAppeals for the Federal Circuit.
`
`OK
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`-
`
`Pursuant to 37 C.F.R. § 42.6(e),I certify that I caused to be served a true and
`
`correct copy of the foregoing Petitioners’ Notice ofAppeal on the Patent Owner at
`
`the e-mail addresses of the Patent Owner as follows:
`
`James Hannah
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`990 Marsh Road
`Menlo Park,CA 94025
`Phone: (650) 752-1712
`Fax: (650) 752-1812 _
`jhannah@kramerlevin.com ~
`
`Jeffrey H. Price
`KRAMERLEVIN NAFTALIS &
`FRANKEL LLP
`1177 Avenue of the Americas
`New York, NY 10036
`Phone: (212) 715-7502
`Fax: (212) 715-8302
`jprice@kramerlevin.com |
`
`Michael Kim
`Finjan,Inc.
`2000 University Ave., Ste. 600
`E. Palo Alto, CA 94303
`Phone: 650.397.9567
`mkim@finjan.com
`USPTO Reg.No. 40,450
`
`By:
`
`/Orion Armon/
`Orion Armon
`Reg. No. 65,421
`
`
`
`Trials@uspto.gov
`571-272-7822
`
`Paper 62
`Entered: March 15, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC. and SYMANTEC CORP.,
`Petitioner,
`
`V.
`
`FINJAN, INC.,
`Patent Owner.
`
`Case IPR2015-01979!
`Patent 8,141,154 B2
`
`Before, THOMASL. GIANNETTI, RICHARD E.RICE,and
`MIRIAML. QUINN,Administrative Patent Judges.
`
`QUINN,Administrative Patent Judge.
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 CFR. § 42.73
`
`1 This case is joined with IPR2016-00919. Paper 28 (“Decision on
`Institution of Inter Partes Review and Grant of Motion for Joinder,”filed by
`Symantec Corp.).
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Palo Alto Networks, Inc. and Symantec Corp. (collectively,
`“Petitioner”) have eachfiled petitionsto institute inter partes review of
`claims 1-8, 10, and 11 of U.S. Patent No. 8,141,154 B2 (“the 7154 patent”)
`
`pursuantto 35 U.S.C. § 311-319.In responseto thefirst petition, filed by
`Palo Alto Networks,Inc.,” Finjan, Inc. (“Patent Owner”) filed a Preliminary
`Response. Paper6 (“Prelim. Resp.”). Upon consideration ofthe Petition
`and the Preliminary Responsefiled by Finjan, we institutedtrial asto all the
`
`challenged claims. Paper 8 (“Dec.”).
`Subsequently, Symantecfiled a petition seeking review of the same
`claimsof the ’154 patent. IPR2016-00919, Paper 3. With this second
`petition, Symantecfiled a motion to join IPR2016-00919 with this
`proceeding. We granted Symantec’s motion, joined the cases, terminated
`IPR2016-00919, and ordered consolidation ofall Petitionerfilings in this
`
`proceeding. Paper 10,at 5.
`Duringtrial, Patent Ownerfiled a Patent Owner Response;? and
`Petitioner filed a Reply. Patent Owneralso filed Motions for Observations
`of the November 14, 2016 cross- examination of Petitioner’s declarant, Dr.
`
`Aviel Rubin. Paper 47 (“Mot. for Obs.”). Petitioner responded to Patent
`Owner’s Motion for Observations. Paper 49 (“Resp. Obs.”). Both parties
`
`also filed Motions to Exclude. Paper 46 (Pet. Mot. to Exclude”); Paper 48
`(“PO Mot. to Exclude”). Both parties filed Oppositions and Replies
`concerning the Motions to Exclude. Papers 50, 51, 53, 55.
`
`2 Paper2 (“Petition”or “Pet.”).
`3 Paper 22 (“PO Resp.”).
`4 Paper 35 (“Reply”).
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`An oral hearing was held on December15, 2016.°
`Wehavejurisdiction under 35 U.S.C. § 6. This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a). For the reasons discussed
`herein, and in view ofthe recordin this trial, we determinethat Petitioner
`
`has not shown by a preponderanceofthe evidence that claims 1-8, 10, and
`
`11 of the ’154 patent are unpatentable.
`
`Y.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies that the ’154 patent as the subject of various
`
`district court cases filed in the U.S. District Court for the Northern District
`
`of California (Case Nos. 3:14-cv-04908, 3:14-cv-02998, 5:15-cv-01353,
`5:14-cv-04398, 3:14-cv-01197, and 3:13-cv-05808). Pet. 3. Petitioner also
`
`states that petitions for inter partes review have beenfiled regarding other
`
`related patents. Id. The ’154 patent is also the subject of another inter
`partes review: IPR2016-00151 (and IPR2016-01071, joined therewith). In
`IPR2016-0151, we have issued a Final Written Decision, under 35 U.S.C.
`
`§ 318(a), concurrently with the instant Final Written Decision.
`
`B. INSTITUTED GROUNDS
`
`Weinstituted inter partes review of claim 1-8, 10, and 11 (“the
`
`challenged claims”) based on the following specific grounds:
`
`5 A transcript ofthe oral hearing is entered in the record as Paper 60 (“Tr.”).
`
`3
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Reference(s]
`
`|
`
`
`
`[Basis Claimschallenged
`
`Khazan,Sirer, and Ben-Natan®
`
`35 U.S.C. § 103
`
`6-8, 10, and 11
`
`
`
`
`
`
`
`Petitioner supports its contentions of unpatentability with declarations
`
`from Dr. Aviel Rubin. Ex. 1002 (“Aviel Declaration”); Ex. 1045 (Supp.
`
`Aviel Declaration”). Patent Owner supports its contentions with a
`
`declaration from Dr. Nenad Medvidovic. Ex. 2002 (“Medvidovic
`
`Declaration”). The cross-examinations of Dr..Rubin and Dr. Medvidovic are
`
`entered in the record as Exhibits 2005 and 1038, respectively.’
`
`C. THE ’154 PATENT(Ex. 1001)
`
`The ’154 patent relates to computer security and, more particularly, to
`systems and methodsfor protecting computers against malicious code such
`as computerviruses. Ex. 1001, 1:7—9, 8:38-40. The 7154 patent identifies
`the components of one embodimentof the system as follows: a gateway
`computer, a client computer, and a security computer. Id. at 8:45—-47. The
`gateway computerreceives content from a network, suchasthe Internet,
`
`over a communication channel. Jd. at 8:47—48. “Such content may bein the
`form of HTML pages, XML documents, Java appletsand other such web
`contentthat is generally rendered by a web browser.” Id. at 8:48-51. A
`content modifier modifies original content received by the gateway
`
`6 Patent Application Pub. No. US 2005/0108562 Al (Exhibit 1003)
`(“Khazan’).
`7 Sirer et al., Design and Implementation ofa Distributed Virtual machine
`for Networked Computers (1999) (Exhibit 1004) (“Sirer’).
`8 U.S. Patent No. 7,437,362 B1 (Exhibit 1005) (“Ben-Natan”).
`
`4
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`computer and produces modified content that includes a layer of protection
`
`to combat dynamically generated malicious code. Jd. at 9:13—-16.
`
`D. ILLUSTRATIVE CLAIM
`
`Challenged claims 1, 4, 6, and 10 are independent,andillustrative
`
`claim 1 is reproduced below.
`
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`a content processor(i) for processing content received
`over a network, the content including a call to a first function,
`and the call including an input, and (11) for invoking a second
`function with the input, only if a security computer indicates
`that such invocationis safe;
`
`a transmitter for transmitting the input to the security
`computer for inspection, whenthe first function is invoked; and
`a receiver for receiving an indicator from the security
`computer whetherit is safe to invoke the second function with
`the input.
`
`I.
`
`ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`In an inter partes review, claim terms in an unexpired patent are
`
`interpreted accordingto their broadest reasonable construction in light of the
`
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b);
`
`Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2142-46 (2016).
`Consistent with that standard, claim terms also are given their ordinary and
`
`customary meaning, as would be understood by oneof ordinary skill in the
`art in the context of the entire disclosure. See In re Translogic Tech., Inc.,
`
`504 F.3d 1249, 1257 (Fed. Cir. 2007). There are, however, two exceptions
`
`to that rule: “1) when a patentee sets out a definition and acts as his own
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`lexicographer,” and “2) when the patentee disavowsthe full scope of a claim
`
`term either in the specification or during prosecution.” See Thorner v. Sony
`
`Computer Entm’t Am. LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).
`
`If an inventoracts as his or her own lexicographer, the definition must
`
`be set forth in the specification with reasonable clarity, deliberateness, and
`precision. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243,
`
`1249 (Fed. Cir. 1998) (citing Jn re Paulsen, 30 F.3d 1475, 1480 (Fed. Cir.
`
`1994)). Althoughit is improperto read a limitation from the specification
`
`into the claims, Jn re Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir. 1993),
`
`claimsstill must be read in view ofthe specification of which they are a part.
`
`Microsoft Corp. v. Multi-Tech Sys., Inc., 357 F.3d 1340, 1347 (Fed. Cir.
`
`2004).
`
`“content”
`
`In our Decision on Institution, we did not construe expressly any
`
`claim terms. Dec. 5. Duringtrial, however, Patent Owner proposed a
`
`construction of the term “content” as “a data container that can be rendered
`
`by a client web browser.” PO Resp. 5. Petitioner challenges this
`
`construction as unduly narrow in view of the Specification. Reply 6. In
`
`particular, Petitioner argues that the Specification does not define the term
`
`and providesno “clear disavowal”of claim scope. Jd. 6-7. According to
`
`Petitioner, the Specification and extrinsic evidence support a broader
`
`construction of “content” to mean “code.” Jd. at 7-8 (citing Ex. 1001,
`12:49-52; Ex. 2005, 80:11-23).
`Becausethey are not consistent with the broadest reasonable
`
`interpretation in light of the specification, and as discussed further below, we
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`do not adopteither of the parties’ proposed constructions. Our reasoning
`
`follows.
`
`The ’154 patentis titled “System and Method for Inspecting
`Dynamically Generated Executable Code.” Ex. 1001, [54]. Although the
`title refers to “executable code,” the term “content” is used elsewhere in the
`
`patent when describing the invention. The Abstract further clarifies that a
`
`“method for protecting a client computer from dynamically generated
`
`malicious content, includ[es] receiving at a gateway computer content being
`sent to a client computer for processing, the content includinga call to an
`original function[.]” Jd. Abstract (emphasis added). The gateway computer
`
`modifies the “content,” which is then transmitted to the client computer for
`
`processing there. Id.
`
`By wayof background,the ’154 patent explains that the “ability to
`
`run executable code such as scripts within Internet browsers” has caused a
`new form of viruses “embedded within web pages and other web content,
`
`and[, which] begin executing within an Internet browseras soon as they
`
`enter a computer.” Jd. at 1:34-40. In particular, the ’154 patent describes
`
`these new “dynamically generated viruses” as “taking advantage of features
`
`of dynamic HTML generation, such as executable codeorscripts that are
`
`embedded within HTML pages, to generate themselves onthe fly at
`
`runtime.” Id. at 3:31-39. Therefore, according to the ’154 patent
`
`“dynamically generated malicious code cannot be detected by conventional
`
`reactive content inspection and conventional gateway level behavioral
`
`analysis content inspection, since the malicious JavaScript is not present in
`
`the content prior to run-time.” Jd. at 3:65—4:2. The invention, therefore,
`
`seeks to protect against “dynamically generated malicious code, in addition
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`to conventional computer viruses that are statically generated.” Jd. at
`
`|
`4:30-34.
`To accomplish this objective, the °154 patent describes the gateway
`
`computer receiving “content from a network, such as the Internet, over a
`communication channel.” Jd. at 8:47—48. The “content may be in the form
`of HTML pages, XML documents, Java applets and other such web content
`
`that is generally rendered by a web browser.” Jd. at 8:48-51; see alsoid. at
`
`13:49-52 (“Such content may be in the form of an HTML web page, an
`
`XML document, a Java applet, an EXE file, JavaScript, VBScript, an Active
`X Control, or any such data containerthat can be rendered by a client web
`browser.”); 13:49-52. A “content modifier 265” at the gateway modifies
`“original content received” by the gateway computer and produces modified
`“content, which includesa layer of protection to combat dynamically
`
`generated malicious code.” Jd. at 9:13-16. It does this by scanning the
`
`“original content” andidentifying certain function calls. Id. at 9:16—20.
`Selected function calls are then replaced with a corresponding substitute
`
`function call. Id. at 9:21-26.
`
`One example ofa functioncall in the original content is identified as
`“Document.write (‘content that is dynamically generated at run-time’).” Jd.
`
`at 11:55-12:2. The original content is modified by replacing theoriginal
`
`function call Document.write() with a substitute function call
`
`Substitute_document.write(). Jd. at 10:31-36. The client computer then
`
`receives the “content, as modified by the gateway computer.” Jd. at
`
`11:63-64. Andit is this modified content that the client computer processes,
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`by invoking the substitute function call and transmitting the inputof that
`
`substitute function for inspection. Jd. at 16:22—29.
`
`From the above descriptions, we understand the ‘154 patent
`
`Specification to refer to three categories of content. First, there is the
`
`“original content” that is scanned and modified at the gateway computer.
`Second,there is the “modified content” transmitted to, and received by, the
`
`client computer. Thirdis the “dynamically generated malicious content”
`
`that is generated at runtime and, thus, is undetected by the gateway computer
`
`in the “original content.”
`
`Wealso understand that the purpose of the ’154 patent is to protect
`
`the client computer from this “dynamically generated malicious content,”
`which is sometimesalso referred to in the Specification as “dynamically
`generated malicious code.” See, e.g., Ex. 1001, 4:31-33 (“new behavioral
`analysis technology affords protection against dynamically generated
`
`malicious code”); 4:38—40 (“before the client computer invokes a function
`
`call that may potentially dynamically generate malicious code’); 8:17—20
`(“FIG. 2 is a simplified block diagram of a system for protecting a computer
`from dynamically generated malicious executable code, in accordance with a
`
`preferred embodimentof the present invention”); 8:38—40 (“The present
`invention concerns systems and methodsfor protecting computers against
`
`dynamically generated malicious code.”).
`Notwithstanding the variety of content described in the Specification,
`
`the term “content”is recited broadly in all challenged claims as “content
`
`includingacall to a first function.” For example, claim 1 recites a content
`processorfor “processing content received over a network,the content
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`includingacall to a first function, and thecall including an input.” Jd. at
`
`17:34-36.
`
`The claim language also requires that the processed “content” be
`
`received over a network. Becausethe recited “first function”is the
`
`substituted function whose input is verified, the claimed “content,” in the
`
`context of the surrounding claim language, must refer to the modified
`
`content received at the client computer. See id. at 17:39—40 (“transmitting
`
`the input [of the first function call] to the security computer for inspection,
`
`whenthefirst function is invoked”). The claimed content cannotrefer to the
`
`“original content” that is received by the gateway computer and overthe
`
`Internet because that content, according to the Specification, would be
`
`capable of generating the undetected dynamically generated malicious
`
`content from whichthe client computeris to be protected.
`
`Based on this understanding, we do not agree with Patent Ownerthat
`
`the recited “content”is “a data container that can be rendered bya client
`
`web browser.” See PO Resp. 6. Although the Specification statesthat
`
`“content may be in the form of an HTML webpage, an XML document, a
`
`Java applet, an EXE file, JavaScript, VBScript, an ActiveX Control, or any
`
`such data container that can be rendered by a client web browser,”that
`
`passage describesthe “original content,” not the “modified content.” See
`
`Ex. 1001, 13:49-52. Furthermore, evenif that description were applicable
`
`to the “modified content,” the Specification uses the permissive words
`
`“may”and “can,” which suggests that the description of the form of the
`content in the Specification was not intended to set forth a definition for the
`
`term “content.” See i4i Ltd. P’ship v. Microsoft Corp., 598 F.3d 831, 844
`
`10
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`(Fed. Cir. 2010) (declining to limit claim term where the specification used
`permissive language).
`Furthermore, although the Specification addresses embodiments
`concerning web pages received overthe Internet, the Specification does not
`limit the “content” to web content only, or to content that can be rendered by
`a web browser. For example, in describing a content processor, the
`Specification states that it “may be a web browser running on client
`computer 210.” Ex. 1001, 10:60-62. This description again uses permissive
`language that suggests the intent notto limit the contentto a data container
`that can be renderedby a client web browser. Wealso findit informative
`that in discussing the communication channels over which theclient
`computer receives the “modified content,” the Specification states that
`“communication channels 220, 225 and 230 [of Figure 2] may each be
`multiple channels using standard communication protocols such as TCP/IP.”
`Ex. 1001, 8:67—9:2.? Thatis, the network over which the content is received
`maybe any network that delivers data using a standard communication
`protocol, not just the Internet.
`Accordingly, we are not persuadedthatthe Specification supports a
`construction of “content” that is limited to the specific embodimentof a data
`container that can be rendered by a client web browser, as Patent Owner
`argues. In re Van Geuns, 988 F.2d 1181, 1184, (Fed. Cir. 1993)
`(Moreover, limitations are not to be read into the claims from the
`specification.”(internal citations omitted).
`
`9 TCP/IP is an abbreviation for Transmission Control Protocol over Internet
`Protocol, and it is the most widely used communication protocol for delivery
`of data over networks, including the Internet. TCP/IP, WILEY ELECTRICAL
`AND ELECTRONICS ENGINEERING DICTIONARY, 774 (2004)(Ex. 3001).
`
`11
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Weare not persuaded, in addition, that Petitioner has made a
`sufficient showing that a person ofordinary skill in the art would understand
`the plain meaningof“content” as “code.” To support its proposed
`construction,Petitioner relies on the cross-examination testimony of its own
`
`expert, Dr. Aviel Rubin. Ex. 2005, 80:11—23. His testimony, however, 1S
`not persuasive because he proffers no reasoning for the conclusion that
`“content” is “code” under the broadest reasonable interpretation:
`
`Q What is your understanding of what “content” means?
`A Inthe context of the ’154 patent, content would be code.
`
`Q_ What do you mean by code?
`
`A Code, like an HTML pagethat has JavaScriptin it.
`
`Q Whenyousay code, do you mean any type of code?
`A Well, if you just say content, we are going to take the broadest
`reasonable interpretation of that. It would be any type of code, yes.
`
`Id.°
`
`Althoughit seems reasonable to say that the content includes “code,”
`no persuasive evidence limits the claimed content to only code. As we noted
`above, the Specification refers to code, sometimes interchangeably with
`content, but only in the context of dynamically generated code. The
`dynamically generated code, however, is not generated until runtime and,
`therefore, is not contained in the “modified content”that the client receives.
`
`See Ex. 1001, 3:65—4:2 (“dynamically generated code cannot be detected by
`
`conventional reactive content inspection and conventional gateway level
`
`10 We do not give weight to the testimony proffered by Dr. Medvidovic with
`regard to claim construction of this term given the contradictory positions
`asserted in this regard. See Reply 8.
`
`12.
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`behavioral analysis content inspection, since the malicious JavaScript is not
`presentin the contentprior to run-time.”). Furthermore, the Specification
`describes variousforms in which the content occurs, such as an HTML web
`page and Java applets (id. at 13:49-52), but does not address sufficiently
`whatis the “content”itself. But see, id. at 11:50—51 (“suppose the contentis
`
`an HTML page”).
`Given the broad disclosure of a network, as discussed above,the
`
`reference to a “data container” (id. at 13:51—-52) and “network content”(id.
`
`at 4:37-37), the concern overscripts embedded in web pagesor “other web
`content” (id. at 1:37-39), we conclude that the Specification of the ’154
`patentuses the claimed “content”to refer broadly to the data or information,
`modified for processing, that the client receives from the network, where, in
`the case ofthe Internet, it may refer to a web page and its elements. This
`interpretation is consistent also with the meaning ofthe term in the art, as
`evidenced by dictionaries concerning computing and engineering. See
`content, Microsoft Computer Dictionary, 125 (5 ed. 2002) (Ex. 3002)
`(defining “content”as (1) “the data that appears betweenthestarting and
`ending tags of an element in an SGML, XML, or HTML document. The
`content of an element may consist ofplain text or other elements,” (2) “The
`message body of a newsgrouparticle or e-mail message;” and(3) “The
`‘meat’ of a document, as opposedto its format or appearance.”); see also
`
`content, WILEY ELECTRICAL AND ELECTRONICS ENGINEERING DICTIONARY,
`142 (2004) (Ex. 3001) (“Information, especially that whichis available
`online, which may be any combination oftext, audio, video,files, or the
`
`like.”),
`
`13
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Accordingly, under the broadest reasonable interpretation in the
`
`context of the Specification and the surrounding claim language, we
`
`conclude that “content” is data or information, which has been modified and
`
`is received over a network.
`
`“call to a firstfunction”
`
`The term “call to a first function” is recited in all challenged claims.
`
`The argumentspresented regardingthis limitation turn on the scopeofthe
`word “call.” Specifically, Patent Owner attempts to distinguish the claims
`over Khazan by arguing that a “Sump”instruction is not the recited “call” to
`a function. PO Resp. 25-27. Dr. Medvidovic, Patent Owner’s expert,
`proffers opinions ontheissue by relying on a definition of “function call”
`derived from the Microsoft Press Computer Dictionary. Ex. 2002 § 110
`
`(citing Ex. 2014). That Dictionary provides that a “function call” is “[a] .
`program’s request for the services ofa particular function.” Jd; Ex. 2014.It
`also explains that “[a] function call is coded as the nameofthe function
`along with any parameters neededfor the function to perform its task.” Id.
`The Specification of the ’154 patent does not define the term “call to a
`first function.” The Specification, however, does use the phrase “function
`
`call” to state that “before the client computer invokes afunction call that
`
`may potentially dynamically generate malicious code,the client computer
`passesthe input to the function to the security computerfor inspection.” Ex.
`1001, 4:37—43 (emphasis added). The Specification alsostates that “the
`present invention operates by replacingoriginal function calls with substitute
`function calls within the content, at a gateway computer, prior to the content
`
`being receivedat the client computer.” Jd. at 4:57—-60. Therefore, we
`understand the Specification to use the phrase “functioncall” in the same
`
`14
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`sense as the phrase “call to a [] function.” That is, a program instruction
`specifies the function name andits parameters, where execution of the
`instruction results in the function providing a service. Thus, we find the
`
`dictionary definition of the term “function call” applicable here and
`
`indicative of the meaning ofthe term to a person ofordinary skill in the art.
`
`Furthermore, the dictionary definition is consistent with the
`
`embodiments described in the Specification. For example, one embodiment
`
`of the °154 patent provides for modifying an original function call with
`
`“corresponding function calls Substitute_function(input,*).” Id. at 9:21—-24.
`
`Thatis, the specification describes that the services of the function
`
`Substitute_function are being requested by the modified content.
`Furthermore, the format ofthe function in this particular embodiment,
`
`identifies the nameof the function and the parameters “input” and “*”. See
`
`also id.at 9:26—28 (explaining that the “input intendedfor the original
`
`function is also passed to the substitute function, along with possible
`additional input denoted by ‘*’”). We note that the “first function” is the
`substitute function included in the modified content, as discussed above in
`
`connection with our analysis of the term “content.”
`
`Werecognizethat the definition of “call to a first function” need not
`define the particular format of the instruction or further detail regarding its
`parameters. Wereachthis determination because the claim languageitself.
`requires that either the “call” or the “function” include an input. For
`example, claim 1 recites the “call including an input,” while claim6recites
`
`“the first function including an inputvariable.”
`
`15
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Accordingly, we determine that a “call to a first function” means an a
`
`statementor instruction in the content, the execution of which causesthe
`
`function to provide a service.
`-
`
`B. PRINCIPLES OF LAW
`
`A claim is unpatentable under 35 U.S.C. § 103(a) if the differences
`betweenthe claimed subject matter andthe priorart are such that the subject
`
`matter, as a whole, would have been obviousat the time the invention was
`
`madeto a person having ordinary skill in the art to which said subject matter
`pertains. KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398, 406 (2007). The
`question of obviousnessis resolved on the basis of underlying factual
`determinations including: (1) the scope and contentofthe priorart; (2) any
`differences between the claimed subject matter andthe prior art; (3) the level
`of ordinary skill in the art; and (4) objective evidence of nonobviousness.
`
`Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966).
`
`C. THE LEVEL OF SKILL IN THE ART
`
`In determining the level of ordinary skill in the art at the time of the
`invention, we note that various factors may be considered,including “type of
`
`problems encounteredin the art; prior art solutions to those problems;
`rapidity with which innovations are made; sophistication of the technology;
`and educational level of active workersin the field.” In re GPAC, Inc., 57
`
`F.3d 1573, 1579 (Fed. Cir. 1995) (citing Custom Accessories, Inc. v. Jeffrey-
`
`_ Allan Indus., Inc., 807 F.2d 955, 962 (Fed. Cir. 1986)).
`
`Petitioner asserts, through its expert, Dr. Aviel Rubin,that the
`“relevant technologyfield for the ’154 patent is security programs, including
`content scanners for program code.” Ex. 1002 § 21. Further, Dr. Rubin
`
`16
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`opines that a personof ordinary skill in the art would “hold a bachelor’s
`degree or the equivalent in computerscience (or related academic fields) and
`three to four years of additional experiencein the field of computersecurity,
`
`or equivalent work experience.” Id.
`Patent Owner, throughits expert, Dr. Nenad Medvidovic, offers a
`level of ordinary skill that is different from Petitioner’s. Ex. 2002 4 35. In
`Particular, Dr. Medvidovic opinesthat a person of ordinary skill in the art
`would have a “bachelor’s degree in computerscienceor related field, and
`either (1) two or more years of industry experience and/or (2) an advanced
`degree in computerscienceorrelated field.” Jd. In comparison, it appears
`that the minimum experience under Patent Owner’s proffered level ofskill is
`one yearless than Petitioner’s. Also, Patent Ownerproffers an alternative to
`work experience, namely an advanced degree. There is no specific
`articulation regarding how the difference of one year experience or the
`proposed alternative of an advanced degree in lieu of experience tangibly
`affects our obviousness inquiry. Further, there is no evidence in this record
`that the differences noted above impact in any meaningful waythe level of
`expertise of a person ofordinary skill in the art. Indeed, we note that Dr.
`Medvidovic’s opinions would not change if he had considered instead the
`level or ordinary skill in the art proffered by Dr. Rubin. Id. { 38.
`Accordingly, we determinethat in this case no express definition of
`the level of ordinary skill in the art is necessary andthatthe level of ordinary
`skill in the art is reflected by the prior art of record. See Okajimav.
`Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001); In re GPAC Inc., 57 F.3d
`1573, 1579 (Fed. Cir. 1995); In re Oelrich, 579 F.2d 86, 91 (CCPA 1978).
`
`17
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`D. OBVIOUSNESS GROUND BASED ON KHAZAN AND SIRER
`
`Petitioner asserts that Khazan discloses “every