`571-272-7822
`
`Paper 10
`Entered: April 20, 2016
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC.,
`Petitioner,
`
`V.
`
`FINJAN,INC.,
`Patent Owner.
`
`Case IPR2016-00151
`Patent 8,141,154 B2
`
`Before THOMASL. GIANNETTI, MIRIAM L. QUINN,and
`PATRICK M. BOUCHER,Administrative Patent Judges.
`
`QUINN, Administrative Patent Judge.
`
`DECISION
`Partial Institution of Inter Partes Review; Motion for Joinder
`37 C.F-R. § 42.108; 35 U.S.C. § 315(c)
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Palo Alto Networks,Inc. (‘Petitioner’) filed a Petition to institute
`
`inter partes review of claims 1-12 of U.S. Patent No. 8,141,154 B2 (‘the
`
`°154 patent”) pursuant to 35 U.S.C. §§ 311-319. Paper 2 (“Pet.”).
`
`Petitioner also filed a Motion for Joinder (Paper 3, “Mot.”). Finjan, Inc.
`
`(“Patent Owner’’) timely filed a Preliminary Response. Paper8 (“Prelim.
`
`Resp.”). In its Preliminary Response, Patent Owner addressesPetitioner’s
`
`Motion for Joinder.
`
`/d. at 1. We have jurisdiction under 35 U.S.C. § 314.
`
`For the reasonsthat follow, we grant the Petition as to claims 1-8, 10,
`
`and 11, and deny Petitioner’s Motion for Joinder.
`
`I.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner states that Patent Owner“hasfiled a patent infringement
`
`lawsuit against Petitioner, and similar actions against other Defendants.”
`
`Pet. 42. Those district court cases are identified as Case Nos.: 1-08-cv-
`
`00300-GMS(D. Del. May 21, 2008); 5:13-cv-03999-BLF (N.D. Cal. Aug.
`28, 2013); 3-14-cv-04908-JSC (N.D. Cal. Nov. 4, 2014); 5-15-cv-03295-
`
`BLF(N.D.Cal. July 15, 2015). Jd. Petitioneralso states that petitions for
`inter partes review havebeenfiled regarding other patents assigned to
`
`Patent Owner. Jd.
`
`B. ASSERTED GROUNDS
`
`Petitioner contendsthat claims 1-12 (“the challenged claims”) are
`
`unpatentable under 35 U.S.C. § 103 based onthe following specific grounds:
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Ross and Calder’
`
` Reference(s]
`
`Basis|Claimschallenged
`
`
`
`
`§ 103
`
`9 and 12
`
`C. THE 7154 PATENT(Ex. 1001)
`
`The ’154 patent relates to computer security, and, more particularly,
`
`to systems and methods for protecting computers against malicious code
`
`such as computer viruses. Ex. 1001, 1:7—9, 8:38-40. The ’154 patent
`
`identifies the components of one embodimentof the system as follows: a
`
`gateway computer, a client computer, and a security computer. Jd. at
`
`8:45-47. The gateway computer receives content from a network, such as
`
`the Internet, over a communication channel.
`
`/d. at 8:47—48. “Such content
`
`may be in the form of HTML pages, XML documents, Java applets and
`
`other such web content that is generally rendered by a web browser.” Jd. at
`
`8:48-51. A content modifier modifies original content received by the
`gateway computer and produces modified content that includes a layer of
`protection to combat dynamically generated malicious code. Jd. at 9:13—-16.
`
`' Patent Application Pub. No. US 2007/0113282 Al (Exhibit 1003)
`(“Ross’”’).
`? Patent Application Pub. No. US 2002/0066022 Al (Exhibit 1004)
`(“Calder”).
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`D. ILLUSTRATIVE CLAIMS
`
`Challenged claims 1, 4, 6, and 10 are independent, andillustrative
`
`claim 1 is reproduced below.
`
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`a content processor(i) for processing content received
`over a network, the content including a call to a first function,
`and the call including an input, and(ii) for invoking a second
`function with the input, only if a security computer indicates
`that such invocation is safe;
`a transmitter for transmitting the input to the security
`computer for inspection, whenthe first function is invoked; and
`a receiver for receiving an indicator from the security
`computer whetherit is safe to invoke the second function with
`the input.
`
`fl.
`
`ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`The Board interprets claims using the “broadest reasonable
`
`construction in light of the specification of the patent in which [they]
`appear[].” 37 C.F.R. § 42.100(b). We presumethat claim terms havetheir
`ordinary and customary meaning. See In re Translogic Tech., Inc., 504 F.3d
`1249, 1257 (Fed. Cir. 2007) (“The ordinary and customary meaning‘is the
`meaning that the term would haveto a person ofordinary skill in the art in
`question.’” (quoting Phillips v. AWH Corp., 415 F.3d 1303, 1313 (Fed Cir.
`
`2005) (en banc))).
`Petitioner proposed a construction for one term: “dynamically
`
`generate[d].” See Pet. 8-9. Patent Owner responded that the term has a
`plain and ordinary meaning understoodto a person ofordinary skill in the
`art, and that it needs no construction. Prelim. Resp. 8-10. We do not need
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`to construe a proposed term ifthe construction is not helpful in our
`determination of whetherto institute trial. See Vivid Techs., Inc. v. Am. Sci.
`
`& Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999) (only claim terms in
`controversy need to be construed, and only to the extent necessary to resolve
`
`the controversy). Because the construction of the term “dynamically
`generate[d]”is not germaneto our determination whetherto institutetrial,
`we do not considereither of the parties’ arguments. Accordingly, we do not
`
`construe any claim termsat this time.
`
`B. SECTION 325(D) AND MOTION FOR JOINDER
`
`Theinstant Petition was filed with a Motion for Joinder, alleging
`
`similarities with the petition filed previously, by Symantec, in IPR2015-
`01547 (“the 1547 IPR”). Mot. 2. The Motionstates that the groundsalleged
`in both petitions “use the same art and substantially the same arguments to
`invalidate the claims of the... ’154 patent.” /d. Patent Owner urges the
`
`Board to decline institution of inter partes review under 35 U.S.C. § 325(d),
`given the above-mentioned statementin Petitioner’s Motion. Prelim. Resp.
`10-11. We do not agree with Patent Owner, and we decline to exercise our
`
`discretion and deny the Petition under § 325(d) for three reasons.
`First, we find material differences in the arguments presented in the
`
`1547 IPR andthe Petition here. For example, we determined in the 1547
`
`IPR that the petition there focused on web content being the “content
`received over a network,” whereas here, we considera different
`
`contention—that web content and hookscripts are the recited “content.”
`
`Furthermore, the 1547 IPR petition proposed different grounds of challenge.
`Although Rossalso was the centerpiece of the 1547 IPR,the Petitioner there
`contended Rossanticipated independentclaims 1 and 4, with the same
`
`5
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`evidence presented for independent claims 6 and 10. Here, the Petition
`asserts obviousness groundsforall the claims, with the accompanying
`
`analysis explaining Petitioner’s reliance on multiple Ross embodiments.
`
`This analysis was not provided in the 1547 IPR.
`
`Second, we denied the 1547 IPR Petition based on the failure to
`
`present and explain the information adequately,not on the failure of the
`prior art as a whole. For instance, we determined that the Petition failed to
`point out that Ross’s web content received the recited “content received over
`a network”: “Neither the Petition nor the Declaration of Mr. Davidson,at
`
`the cited paragraph 79, explains how Ross’s data content received over a
`networkalso includes the hook functions alleged to be therecited‘first
`
`function,’ which must be included in the content received over a network.”
`
`Ex. 2005, 7 (citation omitted). We explained this further in our denialof the
`Request for Rehearing in the 1547 IPR. See 1547 IPR, Paper11, 4 (“[W]e
`are not persuaded that we overlooked that Ross discloses ‘processing content
`received over a network,the content including a call to a first function,’ as
`
`alleged by [the 1547 IPR] Petitioner now on rehearing, because Petitioner’s
`allegations were not presented adequately in the Petition.”). Therefore,
`although Rossis asserted priorart in both petitions, the instant Petition
`providesanalysis and contentionsnot presented adequately (oratall) in the
`
`1547 IPR.
`
`Third, the timing offiling the instant Petition weighs in favor of not
`exercising our discretion because Petitioner herefiled its Petition before we
`
`issued the decision denyingtrial in the 1547 IPR.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Accordingly, although Petitioner has admitted to an overlap between
`
`the instant Petition and the 1547 IPR petition, we decline to exercise our
`
`discretion to deny institution under 35 U.S.C. § 325(d).
`
`Furthermore, because we have denied the 1547 IPR, the Motion for
`
`Joinder is moot, and, therefore, is denied.
`
`C. GROUNDS BASED ON OBVIOUSNESS OVER ROSS
`
`Petitioner asserts that Ross teaches or suggestsall the limitations of
`
`claims 1-8, 10, and 11. Pet. 14-37. Petitioner further provides a
`
`Declaration of Dr. Aviel D. Rubin as support of its unpatentability
`
`contentions. Ex. 1002. Having reviewed the arguments and evidence
`provided by Petitioner and the information presented in the Preliminary
`Response, we determinethat Petitioner has shown a reasonablelikelihood of
`
`prevailing on its contentions.
`
`1. Overview ofRoss (Exhibit 1003)
`
`Ross describes one embodiment where a device receives and
`
`processes “data content having at least one original function call [andit]
`includes a hook script generator and a script processing engine.” Ex. 1003
`410. One such deviceis depicted in Figure 2 of Ross, reproduced below.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Nwe'
`
`232
`PROCESSOR
`
`234
`PROCESSOR
`MEMORY
`224
`SCRIPT
`PROCESSING
`ENGINE (WEB
`BROWSER
`
`222
`KEYBOARD
`
`WEBPAGE#1
`
`WEBPAGE#2
`
`
`
`252
`PROCESSOR
`
`254
`PROCESSOR
`MEMORY
`
`204
`202
`
`CLIENT
`SERVER
`
`
`220
`
`
`250
`DISPLAY
`TRANSCEIVER
`
`
`
`
`
`
`
`
`i
`
` WEB PAGE #N
`
`
`
`
`
`
`
`
`DETECTION ENGINE
`
`242
`-
`
`SCRIPT INJECTOR
`
`BROWSER PLUG-IN
`
`
`244
`
`
`HOOK SCRIPT GENERATOR
`
`
`
`
`
`246
`COMMUNICATION OBJECT
`
`
`
`FIG 2
`
`Figure 2 showsa client network device (client 202) and a server
`
`network device (server 204) communicating with each other over
`
`communication network 208 to exchange information, including web
`
`content. Id. 4 16, 23. Figure 2 depicts web browser 224 anddetection
`engine 240at the client, but in other embodiments, detection engine 240
`may be physically located away from client 202. Id. 4 26. Detection
`engine 240 includesscript injector 242 to intercept incoming data content
`and introduce the incoming data to script-processing engine 224. Id. “Hook
`script generator 244 creates new functions, including constructor functions,
`which replace the standard JavaScript functions.” Jd.
`
`2. Discussion
`
`With regard to illustrative independentclaim 1, Petitioner proffers
`evidence that Ross’s script processing engine 618 teaches the recited
`
`“content processor.” Pet. 15—16. Petitioner specifically contends that
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Ross’s script processing engine receives over a network both the web
`
`content and the hookscript from the hookscript generator. Jd. The hook
`
`script includes hook functions that, according to Petitioner, include “acall to
`
`a first function,” Ross thereby teaching that the content (hookscript)
`
`includes the recited “call to a first function.” Jd. at 16-18. For the
`
`limitations regarding the security computer, Petitioner points to Ross’s
`
`communication object relay 622 that communicates with decision service
`
`624, which maybe a “type of security computer.” Jd. at 18.
`
`Patent Ownerprimarily challenges Petitioner’s contentions with the
`
`argumentthat Ross’s hookscript is not the recited “content received over a
`
`network.” Prelim. Resp. 15-19. Weare not persuaded by this argument.
`
`Weunderstandthe Petition to allege that Ross’s hookscript is the recited
`
`“content” that is received over a network because Ross contemplates
`
`implementing someorall of detection engine 240in an auxiliary device ora
`“network device.” Pet. 16. Petitioner argues that “[i]t would have been
`
`obvious to a POSITAthatif a script generator was situated ona device that
`
`is separate from a client device, the two devices could be connected by a
`network.” Jd. (citing Rubin Decl., Ex. 1002
`105). We understand
`
`Petitioner’s contention to be predicated, therefore, on a teaching or
`
`suggestion of a networked script generator in Ross’s alternative
`embodiment. Patent Owner’s argument, however, does not address this
`specific networked script generator contention. See, e.g., Prelim. Resp. 16
`(arguing that “the client device” must include the script injector and hook
`script generator in order to gain protection). Accordingly, we find
`unpersuasive the argumentthat Rosslimits its teachings to the hookscript
`being at the client device, and, thus, not received from a network.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Patent Ownerproffers additional arguments directed to the limitation
`
`of “content received over a network,” all of which we have considered and
`
`also found unpersuasive. Particularly, Patent Owner points out that Figures
`
`2 and 6 of Rossillustrate that the hook script generator “generates a hook
`
`. is received over the network.” Jd. at 17 (emphasis
`.
`script while content .
`omitted). Even if we wereto interpret Ross’s Figures to disclose the timing
`
`of generating the hookscript, as Patent Owneralleges, this argument would
`
`fail. That is because the claimsare silent regarding the timing for creating
`
`the “call to a first function.” Therefore, Patent Owner’s arguments are not
`
`commensurate with the scope of the claim. Nor are we persuaded that
`
`Figures 2 and 6 of Rossillustrate that the hook script received by the script
`
`processing engine is not “content received over a network.”
`Finally, we are not persuaded by Patent Owner’s argumentthat the
`Board has already decided, in the 1547 IPR, the issue of whether Ross
`
`teaches the limitation (id. at 17-18). As stated above in Section II.B, we
`
`denied institution in the 1547 IPR based onthe failure of the petition to
`
`show how Ross’s web content discloses the disputed limitation. We did not
`
`address whether Ross’s hookscript teaches or suggests the claim limitation,
`
`“content received over a network,” especially as we found that the 1547 IPR
`
`Petition did not make that contention adequately clear.
`
`With regard to its challenges to independent claims 6 and 10,
`Petitioner identifies the same support as discussed for independentclaim 1,
`
`and further that Ross’s filtered script behavior 634 teachesthe recited
`
`“modified input variable” (Pet. 30-31, 35-36). In particular, the Petition
`states that “[t]he ‘filtered script behavior’ can include allowing theoriginal
`function to be executed, disabling original functions that are determined to
`
`10
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`be malicious, or modifying original functions.” Jd. at 30 (citing Rubin Decl.,
`
`Ex. 1002 § 138). Patent Ownerchallenges this showing because Ross
`
`allegedly “only discloses modification of an original function, not
`
`modification of an input value.” Prelim. Resp. 19-20. Weare not
`
`persuadedbythis argument.
`
`Patent Owner’s argumentrelies on a narrow view of Ross’s
`
`disclosure. Although Patent Ownerpoints out Ross’s disclosure that “some
`
`portion of the original function may be preserved, while another portion may
`
`be modified,” Patent Owner does not explain how this passage forecloses a
`
`modification of the original function’s input. Jd. at 20 (emphasis omitted).
`
`Petitioner has proffered testimony from Dr. Rubin that the one embodiment
`
`of Ross, describing modification of the location in a directory to write an
`
`output, teaches a person of ordinary skill in the art that one way to change
`
`the location is to modify the input to the original write function. See Pet. 31
`
`(citing Ex. 1002 7 139). Patent Owner’s argument characterizing as
`
`conclusory the statement in the Rubin Declaration is unpersuasive. See
`
`Prelim. Resp. 20-21. Ross’s description of modifying the write function
`
`appearsto support the proffered testimony. See Ex. 1002 { 139 (citing Ex.
`
`1003, { 38).
`With regard to dependent claims3, 5, 8, and 11, Petitioner asserts that
`Ross teaches “the input is dynamically generated” becauseit describesthat
`Ross uses JavaScriptat the script processing engine andthat the engine
`receives as an input the HTTP data content. Pet. 23-24. Patent Ownertakes
`
`issue with Petitioner’s argument because Rossis “completely silent
`regarding dynamically generated malicious content, including dynamically
`generated inputs.” Prelim. Resp. 21. Patent Owneralso arguesthat neither
`
`11
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`the JavaScript disclosure nor the statements in the Rubin Declaration show
`that Ross meets the “dynamically generated” limitation. We are not
`
`persuadedby either of Patent Owner’s arguments.
`First, we are not persuaded by Patent Owner’s characterization of the
`
`JavaScript “late binding”as “only mean[ing] that the functions and
`argumentsare identified by their namesat run-time, not that a function input
`is dynamically generatedat run-time.” Prelim. Resp. 22. The passage in
`Ross describing JavaScript’s “late binding”refers to it as “linking or calling
`of a process, routine, or object at runtime based on current conditions.” Ex.
`1003 § 25. This passage, thus, is not limited only to identifying functions
`and arguments, as Patent Owneralleges, but also refers to calling an object
`at runtime, based on current conditions. The passage further describes late
`
`binding for the possibility of replacing and modifying argumentfunctions,
`and introduces JavaScript technology in describing that actual script method
`calls are detected, in an effort to detect potentially malicious script code. Jd.
`Accordingly, we find Patent Owner’s arguments regarding Ross’s disclosure
`to be too narrow a characterization ofits teachings. And because the
`
`Declaration of Dr. Rubin relies on the above-quoted passage (andothers) of
`
`Ross, we do not find Dr. Rubin’s statements conclusory.
`In summary, having reviewed the arguments and evidenceof record,
`we are persuadedthat Petitioner has shown a reasonable likelihood of
`prevailing in its contention that claims 1-8, 10, and 11 are unpatentable as
`
`obvious over Ross.
`
`D. GROUND BASED ON ROSS AND CALDER
`
`With regard to claims 9 and 12,Petitioner asserts that a recited
`limitation—“input variable includesa call to an additional function”—is not
`
`12
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`expressly taught by Ross. Pet. 37. This limitation, Petitioner argues, is
`taught impliedly by the discussion in Ross of JavaScript or taught by Calder
`“through its discussion of executable memory pages.” Jd. (citing Ex. 1002
`§ 158).
`|
`1. Overview of Calder (Ex. 1003)
`
`The distributed computing system described by Calder includesa pre-
`
`processing module that prepares a software package for execution on any
`numberof client computers. Ex. 1004
`77, Fig. 1. Application package
`
`115 is a modified software application adapted to each client computer 140.
`
`Id. Calder further describes that application package 115 is sent to server
`
`120 after being processed by the pre-processor module 110. Jd. 485. “The
`
`application package 115 is electronically transferred from a server 120,
`which can be an independently networked computer, across the network
`
`130, and into any numberofclient computers 140.” Jd. 7 78. Figure 4,
`
`reproduced below,depicts a virtualized execution environment.
`SECURE EXECUTION
`
`405
`PREPROCESSED(,
`APPLICATION
`
`4 aio
`
`APPLICATION
`MANAGER
`
`VIRTUALIZED SYSTEM INTERFACE
`(RESOURCES,FILES, DATA, NAMES
`
`[Nereucanceya[NereucanceyLS
`RESOURCEne VIRTUALIZED|VIRTUALIZED oe ERR eae
`ne REGISTRY|FILESYSTEM oe ERR INTERFACES
`
`Zs
`
`
`
`SYSTEM
`INTERFACE
`
`[So” aan[So”'S
`
`RESOURCE
`
`
`REGISTRY ENVIRONMENT|neve|INTERFACESSYSTEM
`ALLOCATION
`DEALLOCATION
`
`FILE
`
`OTHER
`
`GRAPHICS
`
`13
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`Figure 4 showsthat system resources are controlled by using virtual
`layer 415 to intercept application programming interface (API) routinesthat
`utilize these resources. Jd. § 86. System calls made by application 405 are
`intercepted by an interception module, whichis part of virtual layer 415. Id.
`
`q 87.
`
`To create application package 115, binaries are rewritten to remove
`improper sequences. Jd. § 93. Improper functions or sequencesare defined
`by a predefined list. Jd. 4 95. If no improper sequencesare identified, the
`import table of binaries is rewritten to reference the interception module. Id.
`4 97. An importtable lists all of the dynamically linked libraries (DLLs).
`used by application 405. Id. 998. The processofinitializing and patching
`the DLLsinvolves loading and running the DLL for the intercept module,
`which patches andintercepts all the DLL calls before any of the application
`
`package’s code is executed. Jd. J] 98, 104.
`In addition to intercepting DLL calls, the interception module
`virtualizes a suite of network request routines in response to application 405
`
`122. The interception modulealsointercepts
`/d.
`invoking the routines.
`page modification routines. Id. § 125. In particular, Calder describesthat, in
`responseto an invocationof a routine to modify certain page permissions,
`after the application identifies the pages, the interception module refusesto
`make code pages readable and writeable. Jd.
`199. Then the interception
`module determines whetherthe application is requesting to make the pages
`
`executable. Jd. If that is the case, the pages are checked for improper
`sequences and the improper sequencesare rewritten to be intercepted. Id.
`
`§ 200.
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`2. Discussion
`
`Patent Ownerchallenges Petitioner’s assertions regarding claims 9
`
`and 12 based on multiple arguments. Prelim. Resp. 23-27. Specifically,
`
`Patent Ownerargues that Calder has not been shownto teach an input that
`
`itself includes a call to an additional function as in the ’154 patent. Jd. at 24.
`
`Patent Owneralso argues that the Calder groundis not developed
`
`sufficiently to permit understanding of Petitioner’s contention. Jd. at 25-26.
`
`Finally, Patent Ownercharacterizes Dr. Rubin’s testimony as conclusory.
`
`Id. at 27.
`
`Weare persuadedthat Petitioner has not shownsufficiently that Ross
`impliedly teaches the limitation or that the combination of Ross and Calder
`teaches or suggests the limitation in claims 9 and 12. With regard to Ross’s
`disclosure, we find insufficient Petitioner’s assertion that the mere disclosure
`of JavaScript is sufficient to teach the limitation.
`Further, as Patent Ownerpointsout, the ’154 patent discloses that a
`function call with an input variable that includesa call to another functionis,
`
`in one example, provided by the following:
`
`Document.write(“<h1>Document.write
`(“<h1><SCRIPT>Some JavaScript</SCRIPT>
`</h1”)</h1>”’)
`Such a function call first calls Document.write() to
`generate the functioncall (3), and then calls
`Document.write() again to generate the JavaScript. Ifthe
`inputs to each of the Document.write() invocations in (5)
`are themselves dynamically generated at run-time, then
`one pass through input inspector may notdetect the
`JavaScript.
`Ex. 1001, 12:28—42. Guided by this disclosure and the claim language, we
`understand claims 9 and 12 to require that the input variable ofthe first
`
`15
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`function call, which is included in the content received from the network,
`
`mustbe,itself, a call to another function.
`
`Calder describes that the improper page sequencesare rewritten. See
`
`Ex. 1004 § 200. Petitioner has not shown, however, that this rewriting of
`
`Calder involves an input variable of the permission modification request so
`
`that it includes a call to another function. That is, Calder is silent on, and
`
`Petitioner does not explain sufficiently, which and howthe input variable in
`
`Calder’s alleged memory page request is a call to another function.
`
`Furthermore, having reviewed the Abstract, and paragraphs 5, 19, and
`
`200, cited by Petitioner as support, we are not persuaded that these passages
`
`teach or suggest what Dr. Rubin concludes,that the input variable of the
`
`replacementcall includesa call to a second function. See Pet. 40 (citing Ex.
`1002 4 162). Also, to the extent the binary code is rewritten as alleged by
`
`Petitioner in Calder’s page permission embodiment, that rewriting has not
`
`been shownto occur during pre-processing. See Pet. 39 (“scanning the
`
`. for code sequences that cause the computer
`.
`dynamically generated code .
`to trap... and means for modifying the coded sequencessuch that the
`computer does nottrap to the operating system”). Therefore, we find
`insufficient the proffered rationale of “incorporat[ing] the ability to handle
`inputs that call additional functionsas disclosed in Calderto the system of
`Ross” (Pet. 37). Petitioner has failed to lay the foundation forthis rationale.
`For example,Petitioner identifies Ross’s hook script as the contentthat
`includes the first function call with the input, which is the result of Ross’s
`hook script generator. We do not see adequate explanation in the record
`regarding what modification of Ross’s hookscript generator (or injector)
`would be needed to dynamically generate the input and rewrite the binary
`
`16
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`(as done in Calder) in order to achieve the recursive function alleged to be
`
`the result of Calder.
`
`Asfor the further limitation that the “modified input variable includes
`
`a call to a modified additional function instead ofa call to the additional
`
`function,” the Petition is less clear how this is met by Calder and Ross.
`
`Petitioner relies on “rewriting DLLs loaded during program execution,” as
`teaching this limitation. Pet. 40. Again,there is insufficient explanation
`regarding Petitioner’s contention of how Calder’s interception of DLLs
`meets the limitation of the modified input variable includingacall to a
`
`modified additional function. Wefind the Petition’s presentation ofthis
`
`challenge insufficient to meet Petitioner’s burden. See 37 C.F.R.
`
`§§ 42.22(a)(2), 42.104 (b)(4),(5).
`Accordingly, we are not persuaded that Petitioner has shown
`sufficiently a reasonable likelihood of prevailing in its contention that claims
`9 and 12 are unpatentable as obvious over Ross and Calder,
`
`Il.
`CONCLUSION
`For the foregoing reasons, weinstitute inter partes review of claims
`1-8, 10, and 11 of the ’154 patent on the ground of obviousness over Ross
`under 35 U.S.C. § 103. We donotinstitute inter partes review of claims 9
`and 12 of the ?154 patent on the ground of obviousness over Ross and
`
`Calder.
`
`17
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`IV. ORDER
`
`In consideration of the foregoing,it is hereby:
`
`ORDEREDthatthe Petition is granted as to claims 1-8, 10, and 11 of
`
`the °154 patent on the groundstated in the Conclusion;
`FURTHER ORDEREDthatPetitioner’s Motion for Joinder is denied;
`
`and
`
`FURTHER ORDEREDthat pursuant to 35 U.S.C. § 314(a), inter
`
`partes review of the ’154 patent is hereby instituted with trial commencing
`on the entry date of this decision, and pursuant to 35 U.S.C. § 314(c) and
`37 C.E.R. § 42.4, notice is hereby given ofthe institution oftrial.
`
`18
`
`
`
`IPR2016-00151
`Patent 8,141,154 B2
`
`PETITIONER:
`
`Matthew I. Kreeger
`Jonathan Bockman
`Shouvik Biswas
`MORRISON & FOERSTER LLP
`MKreeger@mofo.com
`FinjanPANMofoTeam@mofo.com
`FinjanPANMofoTeam@mofo.com
`
`PATENT OWNER:
`
`James Hannah
`Jeffrey H. Price
`Michael Kim
`KRAMERLEVIN NAFTALIS & FRANKEL LLP
`jhannah@kramerlevin.com
`jprice@kramerlevin.com
`mkim@finjan.com
`
`19
`
`