`571-272-7822
`
`Paper No. 8
`Filed: May 13, 2016
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`PALO ALTO NETWORKS,INC.,
`Petitioner,
`
`Vv.
`
`FINJAN, INC,,
`Patent Owner.
`
`Case TPR2016-00159
`Putent 8,677,494 B2
`
`Before JAMES B. ARPIN, ZHENYU YANG,and
`CHARLESJ. BOUDREAU,Administrative Patent Judges.
`
`BOUDREAU,Administrative Patent Judge.
`
`NECISION
`Institution of Inter Partes Review
`37 CFE-R. § 42.108
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`I. INTRODUCTION
`
`Palo Alto Networks,Inc. (“Petitioner”) filed a Petition for an inter
`
`partes review of claims 1-18 of U.S. Patent No. 8,677,494 B2 (Ex. 1001,
`
`“the °494 patent’). Paper 1 (“Pet.”). Finjan, Inc. (“Patent Owner’’) filed a
`
`Preliminary Response. Paper 6 (Prelim. Resp.”). We review the Petition
`
`under 35 U.S.C. § 314.
`
`For the reasonsthat follow and on this record, we are persuadedthat
`
`Petitioner Uemunsirates a reasonable likelihood of prevailing in showing the
`
`unpatentability of claims 1-6 and 10-15 of the ’494 patent on certain of the
`
`grounds asserted. Accordingly, we institute an inter partes review as to
`
`those claims,
`
`A. Related Praceedings
`
`Accorcling to the parties, Patent Owne: previously asserted the °494
`
`patent against Petitioner in Finjan, Inc. v. Palo Alto Networks, Inc., 3:14-cv-
`
`04908 (N.D. Cal. 2014), Pet. 2; Paper 5, 1.
`‘Lhe ’494 patent also has beenasserted in at least four other district
`
`court actions: Finjan, Inc. v. Sophos, Inc., 3:14-cv-01197 (N.D. Cal. 2014);
`
`Finjan, Inc. v. Websense, Inc., 5:14-cv-V1353 (N.D. Cal. 2014); Finjan, Inc.
`
`v. Symantec Corp., 3:14-cv-02998 (N.D. Cal. 2014); and Finjan, Inc. v. Blue
`
`Coat Systems, Inc., 5:15-cv-03295 (N.D. Cal. 2015). Pet. 2; Paper 5,1, The
`
`’494 patent also has been the subject of petitions in Case IPR2015-01022,
`
`filed by Sophos,Inc., and Cases IPR2015-01892 and IPR2015-01897, filed
`
`by Symantec Corporation. Wepreviously denied the first and third of those
`
`petitions and granted the second on oneasserted ground. Sophos, Inc.v.
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Finjan, Inc., Case IPR2015-01022 (PTAB Sept. 24, 2015) (Paper 7);
`
`Symantec Corp. v. Finjan, Inc., Case IPR2015-01892 (PTAB Mar. 18, 2016)
`
`(Paper 9); Symantec Corp. v. Finjan, Inc., Case IPR2015-01897 (PTAB Feb.
`
`26, 2016) (Paper7).
`
`B. The ’494 Patent
`
`The ’494 patent describes protection systems and methods “capable of
`
`protecting a personal computer (‘PC’) or other persistently or even
`
`inteumittently network accessible devices or processes from harmful,
`
`undesirable, suspicious or other ‘malicious’ operations that might otherwise
`
`be effectuated by remotely operable code.” Ex. 1001, 2:51-56. “Remotely
`
`operable codethat is protectable against can include,” for example,
`
`“downloadable application programs, Trojan liurses und program code
`
`groupings, as well as software ‘components’, such as Java™applets,
`
`ActiveX™controls, JavaScript™/Visual Basic scripts, add-ins, etc., among
`
`others.” Jel. at 2:59 64.
`
`C’ Ilustrative Claims
`
`Of the challenged claims, claims 1 and 10 are independent. Those
`
`claims are illusiralive and are reproduced below:
`
`1. A computer-based method, comprising thestepsof:
`receiving aincoming, Nawnloadable;
`deriving security profile data for the Downloadable, including
`a list of suspicious compuler uperations that may be attempted by
`the Nownloadable; and
`
`storing the Downloadable security profile data in a database.
`
`
`
`1PR2016-00159
`Patent 8,677,494 B2
`
`10. A system for managing Downloadables, comprising:
`a receiver for receiving an incoming Downloadable;
`a Downloadable scanner coupled with said receiver, for
`deriving security profile data for the Downloadable, including a
`list of suspicious computer operations that may be attempted by
`the Downloadable; and
`
`a database manager coupled with said Downloadable scanner,
`for storing the Downloadable security profile data in a database.
`
`Ex. 1001, 21:19~25, 22:7-16. Each of challenged claims 2-9 depends
`
`directly from claim 1; and each of challenged claims 11—18 dependsdirectly
`
`from claim 10.
`
`/d. at 21:26—-22:6, 22:17-39.
`
`D, Asserted Grounds uf Unpuientability
`
`Petitioner asserts the following grounds of unpatentahility’
`
`Claims
`
`Basis
`
`Reference(s)
`
`Touboul
`
`Touboul!
`1,3-6,9, 10, 12-15,and 18 ew
`TouboulandJi?
`erand168|kandi17
`
`
`
`Touboul and Swimmer?
`
`2 and 11
`
`' International Patent Publication No. WO 98/21683 to Shlomo Touboul,
`published May22, 1998 (Ex. 1026, “Tuuboul”).
`2 Morton Swimmeret al., Dynamic Detection and Classification of
`Computer Viruses Using General Behaviour Patterns, VIRUS BULL. CONF.
`75 (Sept. 1995) (Ex. 1006, “Swimmer”).
`3U.S. Patent No. 5,983,348 to ShuangJi, issued Nov. 9, 1999 (Ex. 1010,
`“Ji’’).
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`
`
`
`
`
`
`1,2, 6, 10,11, and 15
`
`‘
`
`
`
`§ 103
`
`’ Swimmer
`
`
`
`Il. ANALYSIS
`
`
`
`
`A. Claim Construction
`
`In an inter partes review, the Board interprets a claim term in an
`
`unexpired patent according to its broadest reasonable construction in light of
`
`the specitication of the patent in which it appears. 37 C.F.R. § 42.100(b); In
`
`re Cuozzo Speed Techs., LLC, 778 F.3d 1271, 1278-81 (Fed. Cir. 2015),
`
`cert. granted sub nom. Cuozzo Speed Techs. LLC v. Lee, 136 S. Ct. 890
`
`(mem.) (7016). Under this standaid, we interpret claim terms using “the
`
`broadest reasonable meaning of the wordsin their ordinary usage as they
`
`a
`
`4 David M. Martin,Jr. et al., Blocking Java Applets at the Firewall, PRac.
`1997 Symp. ON NETWORK & DISTRIBUTED SYS. SEC. (©1997) (Ex. 1047,
`“Martin”). For reasons stated below, we conclude herein that each of the
`challenged claimsis entitled to the benefit of a November6, 1997 priority
`date. See infra.Sections II.B.1.a., b. We note that Martin states on its face
`that it is from the proceedings of a symposiumheld February 10-11, 1997
`(Ex. 1047, 1), but that the record copy of Martin bears a date stamp ofJune
`5, 1998 (id. at 3), does not indicate a publication date, and merely has a 1997
`copyright date (/d. at 1). ‘he Petition relies on a declaration of Dr. Aviel D..
`Rubin, Ph.D., one of the named authors of Martin, who declares that Martin
`wasdistributed to approximately 400 conference attendees in February
`1997. Pet. 7 (citing Ex. 1002 § 58). Patent Owner does not contestthis
`evidencein its Preliminary Response, and we assume, for purposes ofthis
`Decision only, that Martin was published on the last day of February 1997.
`
`-
`
`----——
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`would be understood by oneof ordinary skill in the art, taking into account
`
`whateverenlightenment by way ofdefinitions or otherwise that may be
`
`afforded by the written description contained in the applicant’s
`
`specification.” In re Morris, 127 F.3d 1048, 1054 (Fed. Cir. 1997). We
`
`presumethat claim terms havetheir ordinary and customary meaning. See
`
`Inre Trunslugic Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007) (“The
`
`ordinary and customary meaning is the meaning that the term would haveto
`
`a person of ordinaryskill in the art in question.”) (internal quotation marks
`
`omitted),
`
`Petitioncr proposes constructions for three claim terms:
`
`“Downloadable security profile data,”“database,” and “Downloadable.”
`
`Pet. 19-23. At this timc, Patent Owner only challenges Petitioner's
`
`proposcd cuustruction of the tirst of these terms. Prelim. Resp. 9-12. We
`
`address each term in turn.
`
`1.
`
`“Downloadable security profile data”
`
`Petitioner contends that the broadest reasonable interpretation of the
`
`term “Downloadable security profile data” is “information related to whether
`
`executing a downloadable is a security risk.” Pet. 19. According to
`
`Petitioner, this interpretation is consistent with the use of the term in the
`
`claims and Specification, as well as with Patent Owner’s positions taken in
`
`related district court proceedings. Jd. at 19-20.
`
`Patent Ownerdisagrees, arguing that, “[w]hen read within the context
`
`of the claims, there is no need to construe the phrase ‘Downloadable security
`
`profile data.’” Prelim. Resp. 9. According to Patent Owner, “the proper
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`construction for ‘Downloadable’ is ‘an executable application program
`
`which is downloaded from a source computer and run on the destinations
`
`computer,’” and “[t]he remaining part of the term ‘security profile data’
`
`should follow the plain language given to it in claims 1 and 10.” Jd. Patent
`
`Ownerfurther contends that Petitioner’s proposed construction improperly
`
`reads limitations out of the claims andis at odds with the teachings of the
`
`°494 patent. Jd. at 10-11. “For example, Petitioner’s interpretation
`
`impropeily reads the ‘securily protile’ limitation out ofthe claim[s] and
`
`replaces il with the vaguely worded ‘information related to.’” Jd. at 10.
`
`Moreover, according to Patent Owner, “the ’194 Patent, which is
`
`incorporated by reference into the ’494 Patent, describes deriving (e.g. via
`
`code scauuer, cunlent inspection, decomposing, parsing) ‘Downloadable
`
`sécurity protile data’ (aka DSP data) from the Downloadable.” Jd. (citing
`
`Ex. 1013, 6:5-10, 8:41-54, Fig. 6A (element 628)). Further, “[a]lthough
`
`Petitioner argues for a diffcrcnt construction, Petitioner concedes that the
`
`‘Downloadable security profile data’ include[] data derived from the
`
`Downloadable in its Petitivu.” fd. (citing Pet. 20).
`
`For purposes of this Duvision, we agree will: Patent Ownerthat, in
`
`view of the agreed interpretation of the term “Downloadable” and the
`
`~ context provided by the claims, there is no need to separately construe the
`
`term “Downloadable security profile data.”
`
`2. “database”
`
`Petitioner contends that the broadest reasonable interpretation of the
`
`term “database”is “a collection of interrelated data organized according to a
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`database schemato serve one or more applications.” Pet. 21. As mentioned
`
`above, Patent Ownerdoesnot challenge this interpretation at this time (see
`Prelim. Resp. 12), and we adoptit for purposes of this Decision.°
`
`3. “Downloadable”
`
`Petitioner contends that the broadest reasonable interpretation of the
`
`term “Downloadable”is “an executable application program, whichis
`
`downloaded from a source computer and run onthe destination computer.”
`
`Pet. 23. As mentioned above, Patent Ownerdoes not challenge this
`
`interpretation at this time (see Prelim. Resp. 12), and we adoptit for
`
`purposesofthis Decision.
`
`4. Other Terms
`
`On this record aud fur purposes of this Decision, we determine that no
`
`other claim terms require express interpretation. Wellman, Inc. v. Fastman
`
`Chem. Co., 642 F.3d 1355, 1361 (Fed. Cir. 2011) (“[C]laim terms need only
`999
`
`be construed ‘to the extent necessary to resolve the controversy.’”
`
`(quoting
`
`*Tudeed, a8 Pétitiouer points out (Pet. 21), this construction was proposed by
`Patent Owner and applicd by us iupriur proceedings, andit also has been
`adopted by the U.S. District Court for the Northern District of California in
`litigation involving the ’494 patent (see Finjan, Inc. v. Sophos, Inc., No. 14-
`cv-01197 (Dkt. No. 73 (Claim Construction Order), 3-7) (N.D. Cal. Mar. 2,
`2015) (Ex. 1063, 3~7); Symantec Corp. v. Finjan, Inc., Case IPR2015-
`01892, slip op. at 7-11 (PTAB March 18, 2016) (Paper 9); Sophos, Inc. v.
`Finjan, Inc., Case JPR2015-01022, slip op. at 9-10 (PTAB Sept. 24, 2015)
`(Paper 7)); Sophos, Inc. v. Finjan, Inc., Case IPR2015-00907, slip op. at 8-
`10 (PTAB Sept. 24, 2015) (Paper&)).
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Vivid Techs., Inc. v. Am. Sci. & Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir.
`
`1999))).
`
`B. Discussion ofAsserted Grounds
`
`1. Asserted Grounds Based on Touboul
`
`Petitioner contends Touboulanticipates claims 1, 3-6, 9, 10, 12-15,
`
`and 18. Pet. 29-33. In addition, Petitioner argues that the combination of
`
`Touboul and Swimmerrenders claims 2 and 11 obvious; that the
`
`combination of Toubouland Ji renders claims 7 and 16 obvious; and that
`
`Touboul renders claims 8 and 17 obvious. Jd. at 33-40. Asa threshold
`
`question, we must determine whether Touboulqualifies as prior art to any of
`
`the challenged claims.
`
`Accordliig lu Peliuoner, Touboul qualities as prior art because none of
`
`the challenyed claimsis entitled to a priority date earlier than March 30,
`
`2000. Jd. at 5-7, 13-18. Petitioner alleges, in particular, that the challenged
`
`claimsare entitled to the following priority dates:
`
`Priority Date
`Claims
`Claims 1, 3-6, 9, 10, 12—15, 18: March 30, 2000 (“Claimset 1°”)
`Claims 2, 11:
`May 26, 2009 (“Claimset 2”)
`Claims 7, 8, 16, 17:
`May 7, 2006 (“Claimset 3”’)
`
`let. 13.
`
`Alternatively, Petitioner argues, even if the claims of Claimset 1 are
`
`entitled to a priority date of November 6, 1997, Touboulstill would qualify
`
`as prior art with respect to the claims of Claimsets 2 and 3. Id. at 6-7, 14—
`
`15, 18-19. Based on the record before us, and for the following reasons, we
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`are not persuadedbyPetitioner’s contentions regarding the priority of the
`
`challenged claims, except as otherwise noted below.
`
`a. Priority Chain
`
`The °494 patent issued from U.S. Patent Application No. 13/290,708
`
`(“the °708 application”), filed November7, 2011. Ex. 1001, [21], [22]. As
`
`tiled, the ’708 application claimed priority from seven earlier applications:
`
`1) U.S. Patent Application No. 08/964,388 (Ex. 1074, “the °388
`application”), filed November6, 1997; issued as U.S. Patent No.
`6,092,194 (Ex. 1013, “the °194 patent”);
`
`2) U.S. Patent Application No. 09/539,667 (Ex. 1071, “the ’667
`application”), filed March 30, 2000, as a continuation of the ’388
`application;
`
`3) U.S. Patent Application No. 09/551,302 (Ex. 1072, “the °302
`application”), filed April 18, 2000;
`
`4) U.S. Provisional Patent Application No. 60/205,591 (Ex. 1073, “the
`°591 provisional”), filed May 17, 2000;
`
`5) U.S. Patent Application No. 09/861 ,229 (Ex. 1014, “the ’229
`application”), filed May 17, 2001, as a continuation-in-part of the
`°667 and °302 applications and claiming the benefit of the °591
`provisional; issued as U.S. Patent No. 7,058,822 B2 (Ex. 1016,“the
`°822 pateul”);
`
`6) U.S. Patent Application No. 11/370,114 (Ex. 1069, “the °114
`application’), filed March 7, 2006, as a continuation of the ’229
`application; issued a3 U.S. lateit Nu. 7,613,926 B2 (Ex. 1015, “the
`°926 patent’); and
`
`7) U.S. Patent Application No. 12/471,942 (“the °942 application”), filed
`May 26, 2009, as a continuation of the ’114 application.
`
`Fx. 3001, 1.
`
`10
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`On December6, 2013, during prosecution of the ’708 application,
`
`Applicants filed a petition to amend the application to include references to
`priority claims from two additional applications, namely, U.S. Patent
`Application No. 08/790,097 (Ex. 1075, “the 097 application”), filed
`
`|
`
`January 29, 1997, of which the *302 application was a continuation; and
`
`U.S. Provisional Application No. 60/030,639 (Ex. 1027, “the °639
`
`provisional”), filed November8, 1996, from which each ofthe ’388 and
`
`°097 applicatiuus had claimed priority. Ex. 3002. The Office granted
`
`Applicants’ petition on December24, 2013. Ex. 3003.
`
`Asfiled, the ’229 application, which eventually issued as the ’822
`
`patent, included a claim ofpriority from and an incorporation by reference
`
`of the ’302 application, the ’667 application, and the °591 provisional, but,
`
`as Petitiuner points out (see Pet. 16), did not claim priority from or include
`
`any reference to the ?520 and ’194 patents or the ’097 and ’388 applications,
`
`trom which those patents respectively issued.
`
`Petitioner contends that “Patent Owner’s failure to makea priority
`
`claim to any earlier application constitutes a ‘break’ in the chain back to any
`
`earlier applications”; that the ’494 patent's “grandparent ’926 [patent]
`
`cannot claimpriurily catlier than the date of the earliest date of an
`
`applivalion on the face ofits parent, the ’822 patent: March 30, 2000”; and
`
`‘that “[i]n turn, the °494 [patent]|—which depends on the ’926 [patent]’s
`
`priority—has the samepriority date limitation.” Pet. 15-16.
`
`AsPetitioner also puints out, however, Patent Owner, in the course of
`
`a reexamination ofthe ’822 patent,filed a Petition to Accept Unintentionally
`
`11
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Delayed Priority Claim Under 37 C.F.R. 1.78, requesting amendmentto
`
`include references to the °520 and °194 patents. Reexamination Control No.
`
`90/013,017, Petition dated March 6, 2014, at 1-3 (Ex. 3004 (“Priority
`
`Petition’), 1-3); see also Pet. 16. The Office granted the Priority Petition
`
`and issued a Corrected Filing Receipt including the priority claim to the
`
`previously omitted applications in July 2014. See Reexamination Control
`
`No. 90/013,017, Decision mailed July 25, 2014, at 1-3 (Ex. 1017, 1-3);
`
`Reexamination Control No. 90/013,017, Corrected Filing Receipt dated
`
`July 24, 2014, at 1 (Ex. 3005, 1). While acknowledging the Office’s
`
`Decision on the Priority Petition, Petitioner suggests that, because the
`
`Examinerin the reexamination later concluded that certain claims of the
`
`’822 patent are entitled to a priority date no earlier than May 17, 2000 (see
`
`Pet. 16 (citing Ex. 1082 at 7), because “[n]o certificate of correction has
`
`becn published”(id.), and because “[t]he reexamination of the ’822 patent
`“has not completed and is currently on appcal afte: ull petitioned claims in
`the ’822 patent were rejected as invalid”(id.), the Priority Petition is
`
`ineffectual with respect to the ’494 patent’s entitlement to the benefit of the
`
`November6, 1997 filing date of the ?388 application. Pctitioner’s
`
`suggestion is not persuasive. Petitioner cites no authority for the proposition
`
`that a granted pctition to accept an unintentionally delayed priority claim is
`
`effective only upon issuance ofa certificate of correction or reexamination
`
`certificate, and not upon grant of the petition. In any event, as Patent Owner
`
`points vul in its Preliminary Response, the Board reversed the rejection ofall
`
`appcaled claims in the reexamination of the ’822 patent (see Ex. 2007) and a
`
`12
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`reexamination certificate was issued by the Office on February 16, 2016
`
`(Ex. 2009). Prelim. Resp. 18.
`
`Nolably, however, we are persuaded byPetitioner, on this record, that
`
`the ’494 patent cannotpriority from the ’639 provisional (see Pet. 18-19),
`
`notwithstanding the Office’s decision (Ex. 3003) granting the Applicants’
`
`petition to amend the '708 application to include priority claims to the ’639
`
`provisional and the ’097 application (Ex. 3002). As Petitioner points out,
`
`the earliest priority document cited un ihe face otthe ?926 patent through
`
`which the ’494 claimspriority is the °194 patent (see Pet. 18), and there is no
`
`indication in the record that the °926 patent, or the °114 application, from
`
`whichit issued, was ever the subject of a petition to accept a delayedpriority
`
`claim to either the ’639 provisional or the ’097 application. We also note
`
`that Patent Ownerdoes not challenge this contention in its Preliminary
`
`Kesponse. Aveourdingly, for purposes of this Decision, we concludethat the
`
`’494 patentis not entitled to the henefit of either the November 8, 1996
`
`filing date of the '639 provisional or the January 29, 1997 filing date of the
`
`’097 application, and cannot claim anyearlier priority date than the
`
`November6, 1997 filing date of the ’388 application that issued as the ’194
`
`patent.
`
`b. Supportfor Cluimsets 1-3
`
`i. Claimset 1
`
`Apart from the arguiuents discussed above, Petitioner does not
`
`challenge the entitlement of claims 1, 3-6, 9, 10, 12—15, and 18 of the ’494
`
`13
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`patent (Claimset 1) to the benefit of the November6, 1997 filing date of the
`
`°388 application. See Pet. 15-19. Thus, based on the record before us and
`
`for the reasons stated above, we determine that challenged claims 1, 3-6, 9,
`
`10, 12-15, and 18 of the ’494 patent are entitled to the benefit of the
`November 6, 1997 filing date of the ’388 application.
`
`ii, Claimset 2
`
`Claim 2 depends from claim 1 of the °494 patent andrecites “storing a
`
`date & time when the Duwnloadable security profile data was derived, in the
`
`database.” Ex. 1001, 21:26-28. Claim 11 depends from claim 10, and
`
`' recites a similar limitation. Jd. at 22:17-20.
`
`Petitioner argues that written description support was not provided for
`
`claims 2. and 11 until the filing of the °942 upplication on May 26, 2009,
`
`because “no pre-°942 application discloses storing a ‘date.’” Pet. 14. Thus,
`
`Petitioner contends,the earliest priority date for claims 2 and 11 is May 26,
`
`2009. Id. at 6, 13, 14.
`
`Patent Ownerrespondsthat even if the ’194 patent does not contain in
`
`ipsissima verba the phrase “date & time,” a person of ordinary skill in the art
`
`would have understuud from the °194 patent that the inventor had possession
`
`uf the subject matter of claims 2 and 11 at the time the application for that
`
`patent was liled. Prelim. Resp. 24. Patent Ownerpoints, in particular, to the
`
`following disclosure in the ’194 patent:
`
`engine 510 determines whether
`log analysis
`event
`The
`notification of the user (e.g., the security system manager or
`[management information systems] director) is warranted. For
`example, the event log analysis engine 510 may warrant user
`
`14
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`notification whenever ten (10) suspicious Downloadables have
`been discarded by internal networksecurity system 110 within a
`thirty (30) minute period, thereby flagging a potential imminent
`security threat.
`
`Ex. 1013, 7:32-39 (cited at Prelim. Resp. 24). Patent Owner contendsthat a
`
`person of ordinary skill in the art would understand from this disclosure that
`
`the inventor was in possession of a system that indicated the relevant dates
`
`and times tor events, including the dates and time that Downloadable
`
`securily profile data were derived, and stored that information in a database.
`
`Prelim. Resp. 25.
`
`Weare persuaded by Patent Owner’s argument. In order for event log
`
`analysis engine 510 to determine that ten suspicious Downloadables have
`
`beei discarded within a thirty-minute period, it follows that the date and
`
`time associated with derivation of the security profilc data for each
`
`Duwnloadable must be logged.
`
`Thus, based ontlie revurd before us and tor the reasons stated above,
`
`we determine that challenged claims 2 and 11 of the ’494 patentalso are
`
`entitled to the benefit of the November6, 1997 filing date of the °388
`
`application that issued as the °194 patent.
`
`iii. Claimset 3
`
`Claims 7 and 8 directly depend from claim | of the °494 patent and
`
`recite that “the Downloadable security profile data” include “a URL from
`
`where the Downloadable originated” and “‘a digital certificate,” respectively.
`
`15
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Ex.-1001, 21:38-40, 22:1-3. Claims 16 and 17 depend from claim 10, and
`
`recite similar limitations. Jd. at 22:31-35.
`
`Petitioner argues that written description support was not provided for
`Claimset 3 until the filing of the ’114 application on March7, 2006.° In
`
`particular, according to Petitioner,
`
`. that any suggestion of
`.
`[i]t is not until the ‘114 Appf[lication] .
`including a certificate or a URI. within the security profile data
`is made.
`(Ex. 1069 at 89-90.) Earlier applications such as the
`onc that issued as the "194 patent (tiled Nov. 6, 1997) show
`“Known Certificates 309” stored separately from “DSP Data
`310.” (Ex. 1013 at Fig. 3.).
`
`Pct. 14-15.
`
`Patent Owner respondsthat the ’194 patent explicitly discloses these
`
`limitations, as both URLsand digital certificates are derived from an
`
`incoming Downloadable. Prelim. Resp. 25. Patent Ownerpoints, in
`
`particular, to the following statements in the ’194 patent: “The ID generator
`
`315 recited a Downloadable (including the URL from whichit came)”(id.
`
`(citing Ex. 1013, 4:41-45)); and “Thecertificate comparator 345 retrieves
`
`knowncertificates 309 that were deemed trustworthy by the security
`
`administratur and compares the found certificate with the known
`
`certificates 309 to determine whether the Downloadable was signed by
`
`a trusted certificate” (id. (citing Ex. 1013, 6:31-35)).
`
`° Petitioner repeatedly misstates the filing date of the ’114 application as
`May7, 2006. See Pet. 6, 13, 14.
`
`16
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`We again are persuaded by Patent Owner’s argument. Thus, based on
`
`the record before us and for the reasons stated above, we determine that
`
`challenged claims7, 8, 16, and 17 of the °494 patentalso are entitled to the
`
`benefit of the November6, 1997filing date of the °388 application that
`
`issued as the ’194 patent.
`
`c. Touboul is Not Prior Art Under 35 U.S.C. § 102(b)
`
`Asexplained above, on this record, we determinethat all of the
`
`challenged claimsare entitled to the benefit of the November6, 1997filing
`
`date of the °388 application. Touboul was published on May 22, 1998.
`
`Ex. 1003, [43]. Accordingly, Touboul does not qualify as priorart to the
`
`challenged claims of the ’494 patent under 35 U.S.C. § 102(b), as asserted
`
`by Petitioner. Pet. A
`
`d. Conclusion
`
`Onthis record, Petitioner has not shown that Touboulis prior art to
`
`the challenped claims of the ’494 patent. Accordingly, Petitioner has not
`
`demonstrated a reasonable likelihood of prevailing on its challenge to the
`
`patentability of claims 1, 3-6, 9, 10, 12-15, and 18 as anticipated by
`
`Tuubuulof its challeupes to the patentability of claims 2, 7, 8, 11, 16, and 17
`
`as obvious over Touboulalone or in combination with SwimmerorJi.
`
`2. Obviousness over Swimmer
`
`A patent claim is unpatentable under 35 U.S.C. § 103(a) if the
`
`differences bctween the claimed subject matter and the priorart are “such
`
`that the subject matter as a whole would have been obviousat the time the
`
`17
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`invention was madeto a person havingordinary skill in the art to which said
`
`subject matter pertains.” KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406
`
`(2007). The question of obviousnessis resolved on the basis of underlying
`
`factual determinations, including:
`
`(1) the scope and contentof the priorart;
`
`(2) any differences between the claimed subject matter and the priorart;
`(3) the level ufskill 1 the art’; and (4) objective evidence of
`
`nonobviousness, i.e., secondary considerations.’ Graham v. John Deere
`
`Ca , 383 U.S. 1,17 18 (1966).
`
`Petitioner contendsthat claims 1, 2, 6, 10, 11, and 15 of the °494
`
`patent are unpatentable undcr 35 U.S.C. § 103(a) over Swimmer. Pet. 40—
`
`51. We beyin our analysis with a brief overview of Swimmer, and we then
`
`address the parties’ contentions withrespect to the challenged claims.
`
`a. Overview afSwimmer
`
`Swimmergencrally is directed to a system, referred to as the “Virus
`
`Intrusion Detection Expert System”(“VIDES”), described as “a prototype
`
`fur un automatic analysis System tor computer viruses.” Ex. 1006, 1. In
`
`Swimmer’s system, an cmulatoris used to monitor the system activity of a
`
`Virtual computer. Jel. Sety of rulcs are used to detéct viruses and extract
`
`details of their behavior. Jd. The emulator collects system activity data and
`
`7 Petitioner proposesa definition for a person of ordinary skill in theart.
`Pet. 9-10; see Ex. 1018 930. Patent Owner does not challenge this
`definilion. For purposes of this Decision and to the extent necessary, we
`adopt Petitioner’s definition.
`8 Nee infra Section II.C.
`
`18
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`creates a set of audit record attributes that identify, among other things, disk
`
`operating system (“DOS”) functions requested by the program, the
`
`register/memory values used in calls to the DOSfunctions, and the
`
`register/memory values returned by the function calls. /d. at 1, 7,9. The
`
`emulator provides the resulting audit trail in a canonical format as an activity
`
`data reoord for further analysis by a tool referred to as “Advanced Security
`
`audit trial Analysis on uniX” (“ASAX”). Id. at 9-12. ASAX analyzes the
`
`activity data collected by the emulator aud detects viruses by employing
`
`rules that model typical virus bchavior, using a rule-based language
`
`(“RUles-baSed Sequence Evaluation Language,” or “RUSSEL”)to identify
`
`the virus attack. Jd. at 2, 4-5, 10-13. Swimmerdiscloses that ASAX also
`
`can pipe its output as a Normalized Audit Data Format (“NADF”’)file for
`
`further processing. Jd. al 7, 12. Swimmeralso states that “VIDES could
`
`conceivably be used outside the virus lab to detect viruses inareal
`
`cnvirouuent” and that “[o|ne possibility is to use it as a type offirewall for
`
`programsentering a protected network.” Jd. at 13.
`
`b. Discussion
`
`Tn support of its argument that vluims 1, 2, 6, 10, 11, and 15 are
`
`unpatentable over Swimmer, Petitioner provides a claim chart and further
`
`desuiiplion detailing its mapping of Swimmer’s disclosure onto each
`
`element of challenged independent claims 1 and 10. Pet. 41-49. Petitioner
`
`then provides analysis pointing to Swimmer’s teaching ofstoring
`
`timestamps amongstored security profile data, suggesting the “date & time”
`
`limitations of dependent claims 2 and 11, and detailing Swimmer’s
`
`19
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`disclosure of each of the types of suspicious computer operationsrecited in
`
`dependent claims 6 and 15, including calls madeafile system, calls madeto
`
`memory, calls made to a nctwork system, and calls made to an operating
`
`system. Id. at 49-51. Petitioner relies upon the Declaration of Dr. Aviel D.
`
`Rubin (Ex. 1002) to support its positions.
`
`We have cunsideréd Petitioner’s explanations and supporting
`
`evidence in view of Patent Owner’s Preliminary Response (Prelim.
`
`Resp 77-40), and we arc persuaded that Petitioner demonstrates a
`
`reasonable likelihood that it would succeedattrial in showing that each of
`
`claims 1, 2, 6, 10, 11, and 15 is unpatentable over Swimmer. Weaddress
`
`cach of Patent Owner’s arguments in turn.
`
`Patent Ownerargues,first, that Petitioner has not demonstrated that
`
`Swimmerdiscloses “receiving an incoming Downloadable,”as recited in
`
`vlaims 1 and 1U, because, according to Patent Owner, “Swimmeronly
`
`operates on files that are installed and running on the system.” Prelim.
`
`Resp. 27. According to Palent Owner, “Swimmer requires a virus to be
`
`installed and running on the user’s machinein order to run the emulation,”
`and “[t]hus, the emulator doer not run on ani ‘invuming Duwuluadable’
`(aka a Downloadable intended for a destination computer), but rather a
`
`Downloadable that has already been installed and running on the target
`
`machine.” Jd. As Patent Owner recognizes(see id. at 29-30), however,
`
`Petitioner cites Swimmer’s disclosure that “[o]ne possibility is to use [the
`
`VIDESsystem| as a type offirewall for programs entering a protected
`
`nctwoik” (Ex. 1006, 13 (emphasis added) (cited at Pet. 41, 43)). Contrary to
`
`20
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`Patent Owner’s contention that Swimmer’s disclosure “teaches away”from
`
`employing this embodiment (see Prelim. Resp. 29-30), Swimmerexplicitly
`
`states that “|a] conceptfor this is currently under development” (Ex. 1006,
`
`13) and provides further guidance bystating that “[f]or such a system to be
`
`accepted, it must not cause false positives,” and “must also be unnoticeable
`unless a virus is found,” as well as that “a virtual 8086 machine will be the
`
`basis for this” (id.).
`Patent Owneradditionally alleges “[t]he problems with Petitioner’s
`
`‘firewall’ theory are further compounded by Swimmer’s statement that any
`such firewall would be based ona virtual machine embodiment—notthe
`
`emulator embodiment that formsthe basis for Petitioner’s invalidity
`
`theories.” Prelim. Resp. 28. On this record, however, we are not persuaded
`that a skilled artisan would perceive that to be a meaningful difference.
`
`indeed, Swiimmier’s statement quoted by Patent Ownerin support ofits
`
`contention that a virtual machine will be basis fur Swimmer’s firewall makes
`
`clear that Swimmer’s audit system and ASAX tool would be employed, and
`
`suggests that no more than routine experimentation(i.e., “tun[ing]’”) would
`
`be required: “As a virtual 8086 machine will be the basis tor this, the only
`
`extra overhead will cume from the audit system and from ASAX. The audit
`
`system can be tuned to provide only the necessary data, .. , [and] ASAX has
`
`provenitself very fast: only the rules must be tuned for speed.” Ex. 1006, 13
`
`(cited at Prelim. Resp. 30).
`
`Because Swimmerexpressly contemplates analyzing “programs
`
`entering a protected network” and Patent Ownerhas not persuaded usto the
`
`21
`
`
`
`IPR2016-00159
`Patent 8,677,494 B2
`
`contrary on this record, we are persuaded, for purposes ofthis Decision, by
`
`Petitioner’s assertion that Swimmerteachesthe limitation “receiving an
`
`incoming Downloadable.” Pet. 44
`
`Patent Owner nextarguesthat Petitioner has not demonstrated that
`
`Swim