UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC.
`Petitioner
`
`V.
`
`FINJAN,INC.
`Patent Owner
`
`mor PE
`
`Inter Partes Review No. 2015-01979!
`U.S. Patent No. 8,141,154
`
`
`
`PETITIONERS’ NOTICE OF APPEAL
`
`1 Case IPR2016-00919 has been joined with this proceeding.
`
` 61:6WY81IAPLing
`
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC.
`Petitioner
`
`V.
`
`FINJAN,INC.
`Patent Owner
`
`mor PE
`
`Inter Partes Review No. 2015-01979!
`U.S. Patent No. 8,141,154
`
`
`
`PETITIONERS’ NOTICE OF APPEAL
`
`1 Case IPR2016-00919 has been joined with this proceeding.
`
` 61:6WY81IAPLing
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`Pursuant to 37 C.F.R. § 90.2(a) and 35 U.S.C. §§ 141(c), 142, and 319, Palo
`
`Alto Networks, Inc. and Symantec Corp. (“Petitioners”) respectfully give notice
`that they appeal to the United States Court ofAppeals for the Federal Circuit from
`the Patent Trial and Appeal Board’s Final Written Decision entered on March 15,
`2017 (Paper 62), the Board’s Decision Denying Rehearing entered on May 19,
`2017 (Paper 64), and from other related orders, decisions, rulings, and opinions
`
`underlying the Board’s decisions.’
`For the limited purpose of providing the Director ofthe United States Patent
`and Trademark Office with the information specified in 37 C.F.R. § 90.2(a)(3)(i),
`the issues on appeal include the Board’s determination that Petitioners did not
`_ establish that claims 1-8, 10, and 11 of the °154 patent are unpatentable under 35 |
`U.S.C. § 103 in view ofthe grounds ofunpatentability on which trial was instituted
`
`(Paper 8). The issues on appeal also include any finding or determination
`
`supportingor related to these issues, as well as all other issues decided adversely to
`
`Petitioners in any order, decision, ruling, or opinion.
`
`2 Symantec Corp. was petitioner in IPR2016-00919, which was consolidated and
`
`joined with IPR2015-01979.
`
`(Paper 28.) Citations are to the IPR2015-01979
`
`docket.
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`Simultaneouswith this filing and in accordance with 37 C.F.R. § 90.2(a)(1),
`
`this Notice of Appeal is being filed with the Director and served on Patent Owner
`in accordance with 37 C.F.R. § 42.6(e). This Notice of Appeal, along with the
`required fees, is also being filed with the Clerk’s Office for the United States Court
`ofAppeals for the Federal Circuit in accordance with Fed. Cir. R. 15(a)(1).
`
`Dated: July 17, 2017
`
`Counsel for Palo Alto Networks,Inc.
`CooLey LLP
`ATTN:Patent Group
`1299 Pennsylvania Ave., NW, Suite 700
`Washington, DC 20004
`Tel: (703) 456-8000
`Fax: (202) 842-7899
`
`Respectfully submitted,
`CooLry LLP
`
`By:
`
` /Orion Armon/
`Orion Armon
`Reg. No. 65,421
`
`‘Counsel for Symantec Corp.
`Quinn Emanuel Urquhart & Sullivan
`500 West MadisonSt.
`Suite 2450
`Chicago, IL 60661
`Tel: (312) 705-7400
`Fax: (312) 705-7401
`nathanhamstra@quinnemanuel.com
`
`|
`
`Respectfully submitted,
`QUINN EMANUEL URQUHART
`& SULLIVAN
`~
`
`By:
`
`/Nathan Hamstra/
`Nathan Hamstra
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`CERTIFICATE OF SERVICE
`I hereby certify that, in addition to being filed electronically through the
`
`Patent Trial and Appeal Board’s End to End system, the foregoing Notice of
`
`Appeal was sent by overnight Federal Express on July 17, 2017, to the Director of
`the United States Patent and Trademark Office, at the following address:
`
`Office of the General Counsel
`Patent and Trademark Office
`Madison East
`10B20 600 Dulany Street
`Alexandria, Virginia 22314
`
`KK
`
`I hereby certify that a true and comect copy of the foregoing Notice of
`
`Appeal was filed electronically by CM/ECF on July 17, 2017, with the Clerk’s
`Office ofthe United States Court ofAppeals for the Federal Circuit.
`
`Pursuant to 37 C.F.R. §§ 90.2(a) and Federal Circuit Rule 15(a)(1), I certify
`that onJuly 17, 2017, the requisite $500.00 fee for appeal of the foregoing
`
`Petitioners’ Notice of Appeal was paid through Pay. gov to the United States Court
`
`ofAppeals for the Federal Circuit.
`
`OK
`
`
`
`Petitioners’ Notice of Appeal
`IPR2015-01979 (U.S. Patent No. 8,141,154)
`
`-
`
`Pursuant to 37 C.F.R. § 42.6(e),I certify that I caused to be served a true and
`
`correct copy of the foregoing Petitioners’ Notice ofAppeal on the Patent Owner at
`
`the e-mail addresses of the Patent Owner as follows:
`
`James Hannah
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`990 Marsh Road
`Menlo Park,CA 94025
`Phone: (650) 752-1712
`Fax: (650) 752-1812 _
`jhannah@kramerlevin.com ~
`
`Jeffrey H. Price
`KRAMERLEVIN NAFTALIS &
`FRANKEL LLP
`1177 Avenue of the Americas
`New York, NY 10036
`Phone: (212) 715-7502
`Fax: (212) 715-8302
`jprice@kramerlevin.com |
`
`Michael Kim
`Finjan,Inc.
`2000 University Ave., Ste. 600
`E. Palo Alto, CA 94303
`Phone: 650.397.9567
`mkim@finjan.com
`USPTO Reg.No. 40,450
`
`By:
`
`/Orion Armon/
`Orion Armon
`Reg. No. 65,421
`
`
`
`Trials@uspto.gov
`571-272-7822
`
`Paper 62
`Entered: March 15, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC. and SYMANTEC CORP.,
`Petitioner,
`
`V.
`
`FINJAN, INC.,
`Patent Owner.
`
`Case IPR2015-01979!
`Patent 8,141,154 B2
`
`Before, THOMASL. GIANNETTI, RICHARD E.RICE,and
`MIRIAML. QUINN,Administrative Patent Judges.
`
`QUINN,Administrative Patent Judge.
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 CFR. § 42.73
`
`1 This case is joined with IPR2016-00919. Paper 28 (“Decision on
`Institution of Inter Partes Review and Grant of Motion for Joinder,”filed by
`Symantec Corp.).
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Palo Alto Networks, Inc. and Symantec Corp. (collectively,
`“Petitioner”) have eachfiled petitionsto institute inter partes review of
`claims 1-8, 10, and 11 of U.S. Patent No. 8,141,154 B2 (“the 7154 patent”)
`
`pursuantto 35 U.S.C. § 311-319.In responseto thefirst petition, filed by
`Palo Alto Networks,Inc.,” Finjan, Inc. (“Patent Owner”) filed a Preliminary
`Response. Paper6 (“Prelim. Resp.”). Upon consideration ofthe Petition
`and the Preliminary Responsefiled by Finjan, we institutedtrial asto all the
`
`challenged claims. Paper 8 (“Dec.”).
`Subsequently, Symantecfiled a petition seeking review of the same
`claimsof the ’154 patent. IPR2016-00919, Paper 3. With this second
`petition, Symantecfiled a motion to join IPR2016-00919 with this
`proceeding. We granted Symantec’s motion, joined the cases, terminated
`IPR2016-00919, and ordered consolidation ofall Petitionerfilings in this
`
`proceeding. Paper 10,at 5.
`Duringtrial, Patent Ownerfiled a Patent Owner Response;? and
`Petitioner filed a Reply. Patent Owneralso filed Motions for Observations
`of the November 14, 2016 cross- examination of Petitioner’s declarant, Dr.
`
`Aviel Rubin. Paper 47 (“Mot. for Obs.”). Petitioner responded to Patent
`Owner’s Motion for Observations. Paper 49 (“Resp. Obs.”). Both parties
`
`also filed Motions to Exclude. Paper 46 (Pet. Mot. to Exclude”); Paper 48
`(“PO Mot. to Exclude”). Both parties filed Oppositions and Replies
`concerning the Motions to Exclude. Papers 50, 51, 53, 55.
`
`2 Paper2 (“Petition”or “Pet.”).
`3 Paper 22 (“PO Resp.”).
`4 Paper 35 (“Reply”).
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`An oral hearing was held on December15, 2016.°
`Wehavejurisdiction under 35 U.S.C. § 6. This Final Written
`Decision is issued pursuant to 35 U.S.C. § 318(a). For the reasons discussed
`herein, and in view ofthe recordin this trial, we determinethat Petitioner
`
`has not shown by a preponderanceofthe evidence that claims 1-8, 10, and
`
`11 of the ’154 patent are unpatentable.
`
`Y.
`
`BACKGROUND
`
`A. RELATED MATTERS
`
`Petitioner identifies that the ’154 patent as the subject of various
`
`district court cases filed in the U.S. District Court for the Northern District
`
`of California (Case Nos. 3:14-cv-04908, 3:14-cv-02998, 5:15-cv-01353,
`5:14-cv-04398, 3:14-cv-01197, and 3:13-cv-05808). Pet. 3. Petitioner also
`
`states that petitions for inter partes review have beenfiled regarding other
`
`related patents. Id. The ’154 patent is also the subject of another inter
`partes review: IPR2016-00151 (and IPR2016-01071, joined therewith). In
`IPR2016-0151, we have issued a Final Written Decision, under 35 U.S.C.
`
`§ 318(a), concurrently with the instant Final Written Decision.
`
`B. INSTITUTED GROUNDS
`
`Weinstituted inter partes review of claim 1-8, 10, and 11 (“the
`
`challenged claims”) based on the following specific grounds:
`
`5 A transcript ofthe oral hearing is entered in the record as Paper 60 (“Tr.”).
`
`3
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Reference(s]
`
`|
`
`
`
`[Basis Claimschallenged
`
`Khazan,Sirer, and Ben-Natan®
`
`35 U.S.C. § 103
`
`6-8, 10, and 11
`
`
`
`
`
`
`
`Petitioner supports its contentions of unpatentability with declarations
`
`from Dr. Aviel Rubin. Ex. 1002 (“Aviel Declaration”); Ex. 1045 (Supp.
`
`Aviel Declaration”). Patent Owner supports its contentions with a
`
`declaration from Dr. Nenad Medvidovic. Ex. 2002 (“Medvidovic
`
`Declaration”). The cross-examinations of Dr..Rubin and Dr. Medvidovic are
`
`entered in the record as Exhibits 2005 and 1038, respectively.’
`
`C. THE ’154 PATENT(Ex. 1001)
`
`The ’154 patent relates to computer security and, more particularly, to
`systems and methodsfor protecting computers against malicious code such
`as computerviruses. Ex. 1001, 1:7—9, 8:38-40. The 7154 patent identifies
`the components of one embodimentof the system as follows: a gateway
`computer, a client computer, and a security computer. Id. at 8:45—-47. The
`gateway computerreceives content from a network, suchasthe Internet,
`
`over a communication channel. Jd. at 8:47—48. “Such content may bein the
`form of HTML pages, XML documents, Java appletsand other such web
`contentthat is generally rendered by a web browser.” Id. at 8:48-51. A
`content modifier modifies original content received by the gateway
`
`6 Patent Application Pub. No. US 2005/0108562 Al (Exhibit 1003)
`(“Khazan’).
`7 Sirer et al., Design and Implementation ofa Distributed Virtual machine
`for Networked Computers (1999) (Exhibit 1004) (“Sirer’).
`8 U.S. Patent No. 7,437,362 B1 (Exhibit 1005) (“Ben-Natan”).
`
`4
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`computer and produces modified content that includes a layer of protection
`
`to combat dynamically generated malicious code. Jd. at 9:13—-16.
`
`D. ILLUSTRATIVE CLAIM
`
`Challenged claims 1, 4, 6, and 10 are independent,andillustrative
`
`claim 1 is reproduced below.
`
`1. A system for protecting a computer from dynamically
`generated malicious content, comprising:
`a content processor(i) for processing content received
`over a network, the content including a call to a first function,
`and the call including an input, and (11) for invoking a second
`function with the input, only if a security computer indicates
`that such invocationis safe;
`
`a transmitter for transmitting the input to the security
`computer for inspection, whenthe first function is invoked; and
`a receiver for receiving an indicator from the security
`computer whetherit is safe to invoke the second function with
`the input.
`
`I.
`
`ANALYSIS
`
`A. CLAIM INTERPRETATION
`
`In an inter partes review, claim terms in an unexpired patent are
`
`interpreted accordingto their broadest reasonable construction in light of the
`
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b);
`
`Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2142-46 (2016).
`Consistent with that standard, claim terms also are given their ordinary and
`
`customary meaning, as would be understood by oneof ordinary skill in the
`art in the context of the entire disclosure. See In re Translogic Tech., Inc.,
`
`504 F.3d 1249, 1257 (Fed. Cir. 2007). There are, however, two exceptions
`
`to that rule: “1) when a patentee sets out a definition and acts as his own
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`lexicographer,” and “2) when the patentee disavowsthe full scope of a claim
`
`term either in the specification or during prosecution.” See Thorner v. Sony
`
`Computer Entm’t Am. LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).
`
`If an inventoracts as his or her own lexicographer, the definition must
`
`be set forth in the specification with reasonable clarity, deliberateness, and
`precision. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243,
`
`1249 (Fed. Cir. 1998) (citing Jn re Paulsen, 30 F.3d 1475, 1480 (Fed. Cir.
`
`1994)). Althoughit is improperto read a limitation from the specification
`
`into the claims, Jn re Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir. 1993),
`
`claimsstill must be read in view ofthe specification of which they are a part.
`
`Microsoft Corp. v. Multi-Tech Sys., Inc., 357 F.3d 1340, 1347 (Fed. Cir.
`
`2004).
`
`“content”
`
`In our Decision on Institution, we did not construe expressly any
`
`claim terms. Dec. 5. Duringtrial, however, Patent Owner proposed a
`
`construction of the term “content” as “a data container that can be rendered
`
`by a client web browser.” PO Resp. 5. Petitioner challenges this
`
`construction as unduly narrow in view of the Specification. Reply 6. In
`
`particular, Petitioner argues that the Specification does not define the term
`
`and providesno “clear disavowal”of claim scope. Jd. 6-7. According to
`
`Petitioner, the Specification and extrinsic evidence support a broader
`
`construction of “content” to mean “code.” Jd. at 7-8 (citing Ex. 1001,
`12:49-52; Ex. 2005, 80:11-23).
`Becausethey are not consistent with the broadest reasonable
`
`interpretation in light of the specification, and as discussed further below, we
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`do not adopteither of the parties’ proposed constructions. Our reasoning
`
`follows.
`
`The ’154 patentis titled “System and Method for Inspecting
`Dynamically Generated Executable Code.” Ex. 1001, [54]. Although the
`title refers to “executable code,” the term “content” is used elsewhere in the
`
`patent when describing the invention. The Abstract further clarifies that a
`
`“method for protecting a client computer from dynamically generated
`
`malicious content, includ[es] receiving at a gateway computer content being
`sent to a client computer for processing, the content includinga call to an
`original function[.]” Jd. Abstract (emphasis added). The gateway computer
`
`modifies the “content,” which is then transmitted to the client computer for
`
`processing there. Id.
`
`By wayof background,the ’154 patent explains that the “ability to
`
`run executable code such as scripts within Internet browsers” has caused a
`new form of viruses “embedded within web pages and other web content,
`
`and[, which] begin executing within an Internet browseras soon as they
`
`enter a computer.” Jd. at 1:34-40. In particular, the ’154 patent describes
`
`these new “dynamically generated viruses” as “taking advantage of features
`
`of dynamic HTML generation, such as executable codeorscripts that are
`
`embedded within HTML pages, to generate themselves onthe fly at
`
`runtime.” Id. at 3:31-39. Therefore, according to the ’154 patent
`
`“dynamically generated malicious code cannot be detected by conventional
`
`reactive content inspection and conventional gateway level behavioral
`
`analysis content inspection, since the malicious JavaScript is not present in
`
`the content prior to run-time.” Jd. at 3:65—4:2. The invention, therefore,
`
`seeks to protect against “dynamically generated malicious code, in addition
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`to conventional computer viruses that are statically generated.” Jd. at
`
`|
`4:30-34.
`To accomplish this objective, the °154 patent describes the gateway
`
`computer receiving “content from a network, such as the Internet, over a
`communication channel.” Jd. at 8:47—48. The “content may be in the form
`of HTML pages, XML documents, Java applets and other such web content
`
`that is generally rendered by a web browser.” Jd. at 8:48-51; see alsoid. at
`
`13:49-52 (“Such content may be in the form of an HTML web page, an
`
`XML document, a Java applet, an EXE file, JavaScript, VBScript, an Active
`X Control, or any such data containerthat can be rendered by a client web
`browser.”); 13:49-52. A “content modifier 265” at the gateway modifies
`“original content received” by the gateway computer and produces modified
`“content, which includesa layer of protection to combat dynamically
`
`generated malicious code.” Jd. at 9:13-16. It does this by scanning the
`
`“original content” andidentifying certain function calls. Id. at 9:16—20.
`Selected function calls are then replaced with a corresponding substitute
`
`function call. Id. at 9:21-26.
`
`One example ofa functioncall in the original content is identified as
`“Document.write (‘content that is dynamically generated at run-time’).” Jd.
`
`at 11:55-12:2. The original content is modified by replacing theoriginal
`
`function call Document.write() with a substitute function call
`
`Substitute_document.write(). Jd. at 10:31-36. The client computer then
`
`receives the “content, as modified by the gateway computer.” Jd. at
`
`11:63-64. Andit is this modified content that the client computer processes,
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`by invoking the substitute function call and transmitting the inputof that
`
`substitute function for inspection. Jd. at 16:22—29.
`
`From the above descriptions, we understand the ‘154 patent
`
`Specification to refer to three categories of content. First, there is the
`
`“original content” that is scanned and modified at the gateway computer.
`Second,there is the “modified content” transmitted to, and received by, the
`
`client computer. Thirdis the “dynamically generated malicious content”
`
`that is generated at runtime and, thus, is undetected by the gateway computer
`
`in the “original content.”
`
`Wealso understand that the purpose of the ’154 patent is to protect
`
`the client computer from this “dynamically generated malicious content,”
`which is sometimesalso referred to in the Specification as “dynamically
`generated malicious code.” See, e.g., Ex. 1001, 4:31-33 (“new behavioral
`analysis technology affords protection against dynamically generated
`
`malicious code”); 4:38—40 (“before the client computer invokes a function
`
`call that may potentially dynamically generate malicious code’); 8:17—20
`(“FIG. 2 is a simplified block diagram of a system for protecting a computer
`from dynamically generated malicious executable code, in accordance with a
`
`preferred embodimentof the present invention”); 8:38—40 (“The present
`invention concerns systems and methodsfor protecting computers against
`
`dynamically generated malicious code.”).
`Notwithstanding the variety of content described in the Specification,
`
`the term “content”is recited broadly in all challenged claims as “content
`
`includingacall to a first function.” For example, claim 1 recites a content
`processorfor “processing content received over a network,the content
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`includingacall to a first function, and thecall including an input.” Jd. at
`
`17:34-36.
`
`The claim language also requires that the processed “content” be
`
`received over a network. Becausethe recited “first function”is the
`
`substituted function whose input is verified, the claimed “content,” in the
`
`context of the surrounding claim language, must refer to the modified
`
`content received at the client computer. See id. at 17:39—40 (“transmitting
`
`the input [of the first function call] to the security computer for inspection,
`
`whenthefirst function is invoked”). The claimed content cannotrefer to the
`
`“original content” that is received by the gateway computer and overthe
`
`Internet because that content, according to the Specification, would be
`
`capable of generating the undetected dynamically generated malicious
`
`content from whichthe client computeris to be protected.
`
`Based on this understanding, we do not agree with Patent Ownerthat
`
`the recited “content”is “a data container that can be rendered bya client
`
`web browser.” See PO Resp. 6. Although the Specification statesthat
`
`“content may be in the form of an HTML webpage, an XML document, a
`
`Java applet, an EXE file, JavaScript, VBScript, an ActiveX Control, or any
`
`such data container that can be rendered by a client web browser,”that
`
`passage describesthe “original content,” not the “modified content.” See
`
`Ex. 1001, 13:49-52. Furthermore, evenif that description were applicable
`
`to the “modified content,” the Specification uses the permissive words
`
`“may”and “can,” which suggests that the description of the form of the
`content in the Specification was not intended to set forth a definition for the
`
`term “content.” See i4i Ltd. P’ship v. Microsoft Corp., 598 F.3d 831, 844
`
`10
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`(Fed. Cir. 2010) (declining to limit claim term where the specification used
`permissive language).
`Furthermore, although the Specification addresses embodiments
`concerning web pages received overthe Internet, the Specification does not
`limit the “content” to web content only, or to content that can be rendered by
`a web browser. For example, in describing a content processor, the
`Specification states that it “may be a web browser running on client
`computer 210.” Ex. 1001, 10:60-62. This description again uses permissive
`language that suggests the intent notto limit the contentto a data container
`that can be renderedby a client web browser. Wealso findit informative
`that in discussing the communication channels over which theclient
`computer receives the “modified content,” the Specification states that
`“communication channels 220, 225 and 230 [of Figure 2] may each be
`multiple channels using standard communication protocols such as TCP/IP.”
`Ex. 1001, 8:67—9:2.? Thatis, the network over which the content is received
`maybe any network that delivers data using a standard communication
`protocol, not just the Internet.
`Accordingly, we are not persuadedthatthe Specification supports a
`construction of “content” that is limited to the specific embodimentof a data
`container that can be rendered by a client web browser, as Patent Owner
`argues. In re Van Geuns, 988 F.2d 1181, 1184, (Fed. Cir. 1993)
`(Moreover, limitations are not to be read into the claims from the
`specification.”(internal citations omitted).
`
`9 TCP/IP is an abbreviation for Transmission Control Protocol over Internet
`Protocol, and it is the most widely used communication protocol for delivery
`of data over networks, including the Internet. TCP/IP, WILEY ELECTRICAL
`AND ELECTRONICS ENGINEERING DICTIONARY, 774 (2004)(Ex. 3001).
`
`11
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Weare not persuaded, in addition, that Petitioner has made a
`sufficient showing that a person ofordinary skill in the art would understand
`the plain meaningof“content” as “code.” To support its proposed
`construction,Petitioner relies on the cross-examination testimony of its own
`
`expert, Dr. Aviel Rubin. Ex. 2005, 80:11—23. His testimony, however, 1S
`not persuasive because he proffers no reasoning for the conclusion that
`“content” is “code” under the broadest reasonable interpretation:
`
`Q What is your understanding of what “content” means?
`A Inthe context of the ’154 patent, content would be code.
`
`Q_ What do you mean by code?
`
`A Code, like an HTML pagethat has JavaScriptin it.
`
`Q Whenyousay code, do you mean any type of code?
`A Well, if you just say content, we are going to take the broadest
`reasonable interpretation of that. It would be any type of code, yes.
`
`Id.°
`
`Althoughit seems reasonable to say that the content includes “code,”
`no persuasive evidence limits the claimed content to only code. As we noted
`above, the Specification refers to code, sometimes interchangeably with
`content, but only in the context of dynamically generated code. The
`dynamically generated code, however, is not generated until runtime and,
`therefore, is not contained in the “modified content”that the client receives.
`
`See Ex. 1001, 3:65—4:2 (“dynamically generated code cannot be detected by
`
`conventional reactive content inspection and conventional gateway level
`
`10 We do not give weight to the testimony proffered by Dr. Medvidovic with
`regard to claim construction of this term given the contradictory positions
`asserted in this regard. See Reply 8.
`
`12.
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`behavioral analysis content inspection, since the malicious JavaScript is not
`presentin the contentprior to run-time.”). Furthermore, the Specification
`describes variousforms in which the content occurs, such as an HTML web
`page and Java applets (id. at 13:49-52), but does not address sufficiently
`whatis the “content”itself. But see, id. at 11:50—51 (“suppose the contentis
`
`an HTML page”).
`Given the broad disclosure of a network, as discussed above,the
`
`reference to a “data container” (id. at 13:51—-52) and “network content”(id.
`
`at 4:37-37), the concern overscripts embedded in web pagesor “other web
`content” (id. at 1:37-39), we conclude that the Specification of the ’154
`patentuses the claimed “content”to refer broadly to the data or information,
`modified for processing, that the client receives from the network, where, in
`the case ofthe Internet, it may refer to a web page and its elements. This
`interpretation is consistent also with the meaning ofthe term in the art, as
`evidenced by dictionaries concerning computing and engineering. See
`content, Microsoft Computer Dictionary, 125 (5 ed. 2002) (Ex. 3002)
`(defining “content”as (1) “the data that appears betweenthestarting and
`ending tags of an element in an SGML, XML, or HTML document. The
`content of an element may consist ofplain text or other elements,” (2) “The
`message body of a newsgrouparticle or e-mail message;” and(3) “The
`‘meat’ of a document, as opposedto its format or appearance.”); see also
`
`content, WILEY ELECTRICAL AND ELECTRONICS ENGINEERING DICTIONARY,
`142 (2004) (Ex. 3001) (“Information, especially that whichis available
`online, which may be any combination oftext, audio, video,files, or the
`
`like.”),
`
`13
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Accordingly, under the broadest reasonable interpretation in the
`
`context of the Specification and the surrounding claim language, we
`
`conclude that “content” is data or information, which has been modified and
`
`is received over a network.
`
`“call to a firstfunction”
`
`The term “call to a first function” is recited in all challenged claims.
`
`The argumentspresented regardingthis limitation turn on the scopeofthe
`word “call.” Specifically, Patent Owner attempts to distinguish the claims
`over Khazan by arguing that a “Sump”instruction is not the recited “call” to
`a function. PO Resp. 25-27. Dr. Medvidovic, Patent Owner’s expert,
`proffers opinions ontheissue by relying on a definition of “function call”
`derived from the Microsoft Press Computer Dictionary. Ex. 2002 § 110
`
`(citing Ex. 2014). That Dictionary provides that a “function call” is “[a] .
`program’s request for the services ofa particular function.” Jd; Ex. 2014.It
`also explains that “[a] function call is coded as the nameofthe function
`along with any parameters neededfor the function to perform its task.” Id.
`The Specification of the ’154 patent does not define the term “call to a
`first function.” The Specification, however, does use the phrase “function
`
`call” to state that “before the client computer invokes afunction call that
`
`may potentially dynamically generate malicious code,the client computer
`passesthe input to the function to the security computerfor inspection.” Ex.
`1001, 4:37—43 (emphasis added). The Specification alsostates that “the
`present invention operates by replacingoriginal function calls with substitute
`function calls within the content, at a gateway computer, prior to the content
`
`being receivedat the client computer.” Jd. at 4:57—-60. Therefore, we
`understand the Specification to use the phrase “functioncall” in the same
`
`14
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`sense as the phrase “call to a [] function.” That is, a program instruction
`specifies the function name andits parameters, where execution of the
`instruction results in the function providing a service. Thus, we find the
`
`dictionary definition of the term “function call” applicable here and
`
`indicative of the meaning ofthe term to a person ofordinary skill in the art.
`
`Furthermore, the dictionary definition is consistent with the
`
`embodiments described in the Specification. For example, one embodiment
`
`of the °154 patent provides for modifying an original function call with
`
`“corresponding function calls Substitute_function(input,*).” Id. at 9:21—-24.
`
`Thatis, the specification describes that the services of the function
`
`Substitute_function are being requested by the modified content.
`Furthermore, the format ofthe function in this particular embodiment,
`
`identifies the nameof the function and the parameters “input” and “*”. See
`
`also id.at 9:26—28 (explaining that the “input intendedfor the original
`
`function is also passed to the substitute function, along with possible
`additional input denoted by ‘*’”). We note that the “first function” is the
`substitute function included in the modified content, as discussed above in
`
`connection with our analysis of the term “content.”
`
`Werecognizethat the definition of “call to a first function” need not
`define the particular format of the instruction or further detail regarding its
`parameters. Wereachthis determination because the claim languageitself.
`requires that either the “call” or the “function” include an input. For
`example, claim 1 recites the “call including an input,” while claim6recites
`
`“the first function including an inputvariable.”
`
`15
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`Accordingly, we determine that a “call to a first function” means an a
`
`statementor instruction in the content, the execution of which causesthe
`
`function to provide a service.
`-
`
`B. PRINCIPLES OF LAW
`
`A claim is unpatentable under 35 U.S.C. § 103(a) if the differences
`betweenthe claimed subject matter andthe priorart are such that the subject
`
`matter, as a whole, would have been obviousat the time the invention was
`
`madeto a person having ordinary skill in the art to which said subject matter
`pertains. KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398, 406 (2007). The
`question of obviousnessis resolved on the basis of underlying factual
`determinations including: (1) the scope and contentofthe priorart; (2) any
`differences between the claimed subject matter andthe prior art; (3) the level
`of ordinary skill in the art; and (4) objective evidence of nonobviousness.
`
`Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966).
`
`C. THE LEVEL OF SKILL IN THE ART
`
`In determining the level of ordinary skill in the art at the time of the
`invention, we note that various factors may be considered,including “type of
`
`problems encounteredin the art; prior art solutions to those problems;
`rapidity with which innovations are made; sophistication of the technology;
`and educational level of active workersin the field.” In re GPAC, Inc., 57
`
`F.3d 1573, 1579 (Fed. Cir. 1995) (citing Custom Accessories, Inc. v. Jeffrey-
`
`_ Allan Indus., Inc., 807 F.2d 955, 962 (Fed. Cir. 1986)).
`
`Petitioner asserts, through its expert, Dr. Aviel Rubin,that the
`“relevant technologyfield for the ’154 patent is security programs, including
`content scanners for program code.” Ex. 1002 § 21. Further, Dr. Rubin
`
`16
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`opines that a personof ordinary skill in the art would “hold a bachelor’s
`degree or the equivalent in computerscience (or related academic fields) and
`three to four years of additional experiencein the field of computersecurity,
`
`or equivalent work experience.” Id.
`Patent Owner, throughits expert, Dr. Nenad Medvidovic, offers a
`level of ordinary skill that is different from Petitioner’s. Ex. 2002 4 35. In
`Particular, Dr. Medvidovic opinesthat a person of ordinary skill in the art
`would have a “bachelor’s degree in computerscienceor related field, and
`either (1) two or more years of industry experience and/or (2) an advanced
`degree in computerscienceorrelated field.” Jd. In comparison, it appears
`that the minimum experience under Patent Owner’s proffered level ofskill is
`one yearless than Petitioner’s. Also, Patent Ownerproffers an alternative to
`work experience, namely an advanced degree. There is no specific
`articulation regarding how the difference of one year experience or the
`proposed alternative of an advanced degree in lieu of experience tangibly
`affects our obviousness inquiry. Further, there is no evidence in this record
`that the differences noted above impact in any meaningful waythe level of
`expertise of a person ofordinary skill in the art. Indeed, we note that Dr.
`Medvidovic’s opinions would not change if he had considered instead the
`level or ordinary skill in the art proffered by Dr. Rubin. Id. { 38.
`Accordingly, we determinethat in this case no express definition of
`the level of ordinary skill in the art is necessary andthatthe level of ordinary
`skill in the art is reflected by the prior art of record. See Okajimav.
`Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001); In re GPAC Inc., 57 F.3d
`1573, 1579 (Fed. Cir. 1995); In re Oelrich, 579 F.2d 86, 91 (CCPA 1978).
`
`17
`
`
`
`IPR2015-01979
`Patent 8,141,154 B2
`
`D. OBVIOUSNESS GROUND BASED ON KHAZAN AND SIRER
`
`Petitioner asserts that Khazan discloses “every
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
