Fortinet, Inc. v. SRI International, Inc.

Filing 92

CLAIMS CONSTRUCTION ORDER. Signed by Judge JEFFREY S. WHITE on 10/22/13. (jjoS, COURT STAFF) (Filed on 10/22/2013)

1
2
3
4
5

IN THE UNITED STATES DISTRICT COURT

6

FOR THE NORTHERN DISTRICT OF CALIFORNIA

7
8

FORTINET, INC.,

9

Plaintiff,

United States District Court
For the Northern District of California

10
11

v.

CLAIM CONSTRUCTION ORDER

SRI INTERNATIONAL, INC.,

12

Defendant.
/

13
14

17
18

No. C 12-03231 JSW

CHECK POINT SOFTWARE
TECHNOLOGIES, INC.,

15
16

No. C 12-02540 JSW

Plaintiff,
v.
SRI INTERNATIONAL, INC.,
Defendant.

/

19
20

The Court has been presented with a technology tutorial and briefing leading up to a hearing

21

pursuant to Markman v. Westview Instruments, Inc., 517 U.S. 370 (1996). This Order construes ten

22

claim terms selected by the parties, which appear in the two patents at issue in this case: United States

23

Patent No. 6,711,615 (“the ‘615 Patent”) called “Network Surveillance,” and United States Patent No.

24

6,484,203 (“the ‘203 Patent”) called “Hierarchical Event Monitoring and Analysis.”

25

BACKGROUND

26

Fortinet, Inc. (“Fortinet”) and Check Point Software Technologies, Inc. (“Check Point”)

27

(collectively, “the Plaintiffs”) seek declaratory judgments of invalidity as to both the ‘615 and the ‘203

28

Patents. The Court shall address additional facts as necessary in the remainder of this Order.

1
2
3

ANALYSIS
A.

Legal Standard.
“It is a bedrock principle of patent law that the claims of a patent define the invention to

which the patentee is entitled the right to exclude.” Innova/Pure Water, Inc. v. Safari Water

5

Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004). The interpretation of the scope and

6

meaning of disputed terms in patent claims is a question of law and exclusively within the province

7

of a court to decide. Markman, 517 U.S. at 372. The inquiry into the meaning of the claim terms is

8

“an objective one.” Innova/Pure Water, 381 F.3d at 1116. As a result, when a court construes

9

disputed terms, it “looks to those sources available to the public that show what a person of skill in

10
United States District Court
For the Northern District of California

4

the art would have understood the disputed claim language to mean.” Id. In most cases, a court’s

11

analysis will focus on three sources: the claims, the specification, and the prosecution history.

12

Markman v. Westview Instruments, Inc., 52 F.3d 967, 979 (Fed. Cir. 1995) (en banc), aff’d, 517

13

U.S. 370 (1996). However, on occasion, it is appropriate to rely on extrinsic evidence regarding the

14

relevant scientific principles, the meaning of technical terms, and the state of the art at the time at

15

the time the patent issued. Id. at 979-81.

16

The starting point of the claim construction analysis is an examination of the specific

17

claim language. A court’s “claim construction analysis must begin and remain centered on the

18

claim language itself, for that is the language that the patentee has chosen to particularly point out

19

and distinctly claim the subject matter which the patentee regards as his invention.” Innova/Pure

20

Water, 381 F.3d at 1116 (internal quotations and citations omitted). Indeed, in the absence of an

21

express intent to impart a novel meaning to a term, an inventor’s chosen language is given its

22

ordinary meaning. York Prods., Inc. v. Cent. Tractor Farm & Family Ctr., 99 F.3d 1568, 1572

23

(Fed. Cir. 1996). Thus, “[c]laim language generally carries the ordinary meaning of the words in

24

their normal usage in the field of the invention.” Invitrogen Corp. v. Biocrest Mfg., L.P., 327 F.3d

25

1364, 1367 (Fed. Cir. 2003); see also Renishaw v. Marposs Societa’ per Azioni, 158 F.3d 1243,

26

1248 (Fed. Cir. 1998) (recognizing that “the claims define the scope of the right to exclude; the

27

claim construction inquiry, therefore, begins and ends in all cases with the actual words of the

28

claim”). A court’s final construction, therefore, must accord with the words chosen by the patentee
2

1

to mete out the boundaries of the claimed invention.
The court should also look to intrinsic evidence, including the written description, the

3

drawings, and the prosecution history, if included in the record, to provide context and clarification

4

regarding the intended meaning of the claim terms. Teleflex, Inc. v. Ficosa N. Am. Corp., 299 F.3d

5

1313, 1324-25 (Fed. Cir. 2002). The claims do not stand alone. Rather, “they are part of ‘a fully

6

integrated written instrument.’” Phillips v. AWH Corp., 415 F.3d 1303, 1315 (Fed. Cir. 2005) (en

7

banc) (quoting Markman, 52 F.3d at 978). The specification “may act as a sort of dictionary, which

8

explains the invention and may define terms used in the claims.” Markman, 52 F.3d at 979. The

9

specification also can indicate whether the patentee intended to limit the scope of a claim, despite

10
United States District Court
For the Northern District of California

2

the use of seemingly broad claim language. SciMed Life Sys., Inc. v. Advanced Cardiovascular

11

Sys., Inc., 242 F.3d 1337, 1341 (Fed. Cir. 2001) (recognizing that when the specification “makes

12

clear that the invention does not include a particular feature, that feature is deemed to be outside the

13

reach of the claims of the patent, even though the language of the claims, read without reference to

14

the specification, might be considered broad enough to encompass the feature in question”).

15

Intent to limit the claims can be demonstrated in a number of ways. For example, if the

16

patentee “acted as his own lexicographer,” and clearly and precisely “set forth a definition of the

17

disputed claim term in either the specification or prosecution history,” a court will defer to that

18

definition. CCS Fitness, Inc. v. Brunswick Corp., 288 F.3d 1359, 1366 (Fed. Cir. 2002). In order

19

to so limit the claims, “the patent applicant [must] set out the different meaning in the specification

20

in a manner sufficient to give one of ordinary skill in the art notice of the change from ordinary

21

meaning.” Innova/Pure Water, 381 F.3d at 1117. In addition, a court will adopt an alternative

22

meaning of a term “if the intrinsic evidence shows that the patentee distinguished that term from

23

prior art on the basis of a particular embodiment, expressly disclaimed subject matter, or described

24

a particular embodiment as important to the invention.” CCS Fitness, 288 F.3d at 1367. For

25

example the presumption of ordinary meaning will give way where the “inventor has disavowed or

26

disclaimed scope of coverage, by using words or expressions of manifest exclusion or restriction,

27

representing clear disavowal of claim scope.” Gemstar-TV Guide Int’l, Inc. v. ITC, 383 F.3d 1352,

28

1364 (Fed. Cir. 2004). Likewise, the specification may be used to resolve ambiguity “where the
3

1

ordinary and accustomed meaning of the words used in the claims lack sufficient clarity to permit

2

the scope of the claim to be ascertained from the words alone.” Teleflex, 299 F.3d at 1325.

3

However, limitations from the specification (such as from the preferred embodiment) may

4

not be read into the claims, absent the inventor’s express intention to the contrary. Id. at 1326; see

5

also CCS Fitness, 288 F.3d at 1366 (“[A] patentee need not ‘describe in the specification every

6

conceivable and possible future embodiment of his invention.’”) (quoting Rexnord Corp. v. Laitram

7

Corp., 274 F.3d 1336, 1344 (Fed. Cir. 2001)). To protect against this result, a court’s focus should

8

remain on understanding how a person of ordinary skill in the art would understand the claim

9

terms. Phillips, 415 F.3d at 1323.

United States District Court
For the Northern District of California

10

If the analysis of the intrinsic evidence fails to resolve any ambiguity in the claim language,

11

a court then may turn to extrinsic evidence, such as expert declarations and testimony from the

12

inventors. Intel Corp. v. VIA Techs., Inc., 319 F.3d 1357, 1367 (Fed. Cir. 2003) (“When an

13

analysis of intrinsic evidence resolves any ambiguity in a disputed claim term, it is improper to rely

14

on extrinsic evidence to contradict the meaning so ascertained.”) (emphasis in original). When

15

considering extrinsic evidence, a court should take care not to use it to vary or contradict the claim

16

terms. Rather, extrinsic evidence is relied upon more appropriately to assist in determining the

17

meaning or scope of technical terms in the claims. Vitronics Corp. v. Conceptronic, Inc., 90 F.3d

18

1576, 1583-84 (Fed. Cir. 1996).

19

Dictionaries also may play a role in the determination of the ordinary and customary

20

meaning of a claim term. In Phillips, the Federal Circuit reiterated that “[d]ictionaries or

21

comparable sources are often useful to assist in understanding the commonly understood meanings

22

of words . . . .” Phillips, 415 F.3d at 1322. The Phillips court, however, also admonished that

23

district courts should be careful not to allow dictionary definitions to supplant the inventor’s

24

understanding of the claimed subject matter. “The main problem with elevating the dictionary to . .

25

. prominence is that it focuses the inquiry on the abstract meaning of the words rather than on the

26

meaning of claim terms within in the context of the patent.” Id. at 1321. Accordingly, dictionaries

27

necessarily must play a role subordinate to the intrinsic evidence.

28

In addition, a court has the discretion to rely upon prior art, whether or not cited in the
4

1

specification or the file history, but only when the meaning of the disputed terms cannot be

2

ascertained from a careful reading of the public record. Vitronics, 90 F.3d at 1584. Referring to

3

prior art may make it unnecessary to rely upon expert testimony, because prior art may be

4

indicative of what those skilled in the art generally understood certain terms to mean. Id.

5

B.

Claim Construction.

6

1.

7

The term “network monitors appears in Claims 1, 4, 6, 13, 16, and 18 of the ‘615 Patent, and

“Network monitors”/“the monitors”

8

Claims 1, 4, 6, 12, 15, and 17 of the ‘203 Patent. The term “the monitors” appears in Claim 1 of

9

both the ‘615 and the ‘203 Patents. The parties agree that “the monitors” refers to “network

United States District Court
For the Northern District of California

10
11

monitors.”
Defendant SRI International, Inc. (“SRI”) argues that the term “network monitors” must be

12

construed to mean “software and/or hardware that can collect, analyze and/or respond to data.”

13

(Parties’ Final Joint Claim Construction Statement (“Statement”) at App. A.). The Plaintiffs, on the

14

other hand, argue that the term must be construed to mean “software and/or hardware that can detect

15

suspicious activity by analyzing network traffic data.” (Id.) During oral argument in the Markman

16

proceeding, Check Point proposed a compromise whereby the Court would accept SRI’s

17

construction but replace the second “and/or” with “and” and “data” with “network traffic data.”

18

The key dispute between the parties is whether all “network monitors” must be capable of

19

detecting suspicious activity through the analysis of network traffic data. SRI argues that the

20

construction the Plaintiffs advance would improperly require hierarchical monitors to include this

21

capability. The patents-in-suit require a hierarchical system of network monitors to perform a

22

variety of tasks related to network security. As part of the hierarchy, low level monitors may detect

23

suspicious activity, and then report the results to domain or enterprise monitors that may receive and

24

integrate those reports. See, e.g., ‘203 Patent at 2:56-65. The Plaintiffs’ proposed construction

25

therefore improperly limits “network monitors” to a single type of activity, thereby excluding

26

domain and enterprise monitors from the definition. SRI’s patents describe several levels of

27

network monitors, performing a range of tasks. See, e.g., ‘203 Patent at 3:12-4:04. The Court finds

28

that it would be improper to limit the definition of “network monitors” in the manner the Plaintiffs
5

1
2
3

propose.
Accordingly, the Court construes the term “network monitors” to mean: “software and/or
hardware that can collect, analyze and/or respond to data.”

4

2.

5

The term “suspicious network activity” appears in Claims 1 and 13 of the ‘615 Patent, and

6
7

“Suspicious network activity”

Claims 1 and 12 of the ‘203 Patent.
SRI argues that the term “suspicious network activity” must be construed to mean “activity

8

that indicates a known or possible malicious attack on the network.” (Statement at App. A.) The

9

Plaintiffs, on the other hand, argue that the term must be construed to mean “network traffic with

United States District Court
For the Northern District of California

10
11

attributes of a suspected, but unconfirmed, intrusion.” (Id.)
The key areas of dispute between the parties are: (1) whether “suspicious network activity”

12

can encompass known attacks; and (2) whether “network activity” is synonymous with “network

13

traffic.” The Patents’ specifications draw a distinction between suspicious and malicious activity.

14

See ‘203 Patent at 7:11-13. As part of the analysis of such activity, the monitors create both

15

suspicion reports and intrusion reports. Id. at 7:37-48. A person of ordinary skill in the art, reading

16

the claim language in light of the context of the Patents as a whole, would understand that the

17

patentee intended “suspicious” and “malicious” to have distinct meanings. See Rambus Inc. v.

18

Hynix Semiconductor Inc., 569 F. Supp. 2d 946, 968 (N.D. Cal. 2008) (quoting Phillips, 415 F.3d at

19

1312-13); see also ‘203 Patent at 7:11-13 (“Signature engine 24 can also examine the data portion of

20

packets in search of a variety of transactions that indicate suspicious, if not malicious, intentions by

21

an external client.”). “Malicious” activity is activity known to present a threat, therefore

22

“suspicious” activity should be construed to refer to unconfirmed threats.

23

However, the Court is convinced by SRI’s contentions at oral argument that “network

24

activity” is not synonymous with “network traffic.” Network activity includes network traffic, but

25

can also include “pings” and failed logon attempts. See ‘203 Patent at 7:6-10. That is, “network

26

activity” can also include activity undertaken by a foreign user, not simply traffic that actually

27

enters the network. Thus, network activity encompasses network traffic, but also has a broader

28

application.
6

1
2

Accordingly, the Court construes “suspicious network activity” to mean: “network activity
with attributes of a suspected, but unconfirmed, intrusion.”

3

3.

4

The term “automatically receiving and integrating” appears in Claim 1 of both the ‘615 and

5
6

“Automatically receiving and integrating”

the ‘203 Patents.
SRI argues that the term “automatically receiving and integrating” must be construed to

7

mean “without user intervention, receiving reports of suspicious activity and combining those

8

reports into a different end product; i.e., something more than simply collecting and reiterating

9

data.” (Statement at App. A.) The Plaintiffs, on the other hand, argue that the term must be

United States District Court
For the Northern District of California

10

construed to mean “without user intervention, receiving reports of suspicious activity and combining

11

those reports into a different end product (i.e., something more than simply collecting and reiterating

12

data) for purposes of detecting a suspected attack or threat.” (Id.)

13

The key dispute between the parties is whether detecting a suspected attack or threat is the

14

sole purpose of “automatically receiving and integrating.” At oral argument in the Markman

15

hearing, Fortinet suggested adding the words “at least” to further define the purpose of

16

“automatically receiving and integrating.” This proposed addition does not solve the problem

17

because “at least” still limits the purpose of “automatically receiving and integrating” solely to

18

detecting a suspected attack or threat.

19

However, “claims must be read in view of the specification, of which they are a part.”

20

Phillips, 415 F.3d at 1315 (citation and internal quotation marks omitted). The very purpose of the

21

patents-in-suit is to detect network intrusions. Therefore, it is reasonable to include reference to the

22

purpose of the invention when construing a disputed claim term. See id.

23

Accordingly, the Court construes the term “automatically receiving and integrating” to mean:

24

“without user intervention, receiving reports of suspicious activity and combining those reports into

25

a different end product (i.e., something more than simply collecting and reiterating data) including

26

for purposes of detecting a suspected attack or threat.”

27

4.

28

The term [hierarchical monitors] “adapted to automatically receive and integrate” appears in

[hierarchical monitors] “adapted to automatically receive and integrate”

7

1

Claim 13 of the ‘615 Patent and Claim 12 of the ‘203 Patent.

2

SRI argues that the term [hierarchical monitors] “adapted to automatically receive and

3

integrate” must be construed to mean “capable of receiving reports of suspicious activity and,

4

without user intervention, combining those reports into a different end product; i.e., something more

5

than simply collecting and reiterating data.” (Statement at App. A.) The Plaintiffs, on the other

6

hand, argue that the term “adapted to” does not be construed, and the remainder of the term must be

7

construed to mean “without user intervention, receiving reports of suspicious activity and combining

8

those reports into a different end product (i.e., something more than simply collecting and reiterating

9

data) for purposes of detecting a suspected attack or threat.” (Id.)

United States District Court
For the Northern District of California

10

The key dispute between the parties is whether “adapted to” should be construed as

11

synonymous with “capable of.” In common parlance,“adapted to” is most commonly defined more

12

narrowly than “capable of.” See, e.g., Aspex Eyewear, Inc. v. Marchon Eyewear, Inc., 672 F.3d

13

1335, 1349 (Fed. Cir. 2012); Brocade Commc’ns Sys., Inc. v. A10 Networks, Inc., No. C 10-3428

14

PSG, 2013 WL 831528, at *10-11 (N.D. Cal. Jan. 10, 2013). When determining what meaning the

15

patentee here assigned to “adapted to,” the Court must look at the patent as a whole. See Aspex

16

Eyewear, 672 F.3d at 1349. Here, the patentee chose to describe the claimed invention using past or

17

present tense language. See ‘615 Patent at Claim 13 (claiming “a plurality of network monitors

18

deployed . . . the hierarchical monitors adapted to automatically receive and integrate”); ‘203 Patent

19

at Claim 12 (same). The language the patentee chose does not reflect mere capability, but instead,

20

the claimed invention does not exist until the network monitors have been deployed and are adapted

21

to automatically receive and integrate. Thus, within the context of these Patents, “adapted to”

22

should be construed more narrowly than “capable of.” See Aspex Eyewear, 672 F.3d at 1349.

23

Accordingly, the Court construes the term [hierarchical monitors] “adapted to automatically

24

receive and integrate” to mean: “without user intervention, receiving reports of suspicious activity

25

and combining those reports into a different end product (i.e., something more than simply

26

collecting and reiterating data) including for purposes of detecting a suspected attack or threat.”

27

//

28

//
8

1

5.

2

network traffic data”

3
4

“Detecting, by the network monitors, suspicious activity based on analysis of

The term “detecting, by the network monitors, suspicious activity based on analysis of
network traffic data” appears in Claim 1 of both the ‘615 and ‘203 Patents.

5

SRI argues that the term “detecting, by the network monitors, suspicious activity based on

6

analysis of network traffic data” must be construed to mean “detecting based on an analysis of data

7

derived from or describing network packets and excluding analysis that is limited solely to host

8

operating system audit logs.” (Statement at App. A.) The Plaintiffs, on the other hand, argue that

9

the term must be construed to mean “detecting, by the network monitors, suspicious network

United States District Court
For the Northern District of California

10

activity based on direct examination of network packets.” (Id.)

11

The key dispute between the parties is whether “detecting” requires direct examination of

12

data. When the patents-in-suit underwent reexamination, SRI asserted repeatedly that “analysis of

13

network traffic data” requires direct examination of network packets. (See, e.g., Declaration of

14

Stefani E. Shanberg in Support of Plaintiff Check Point Software Technologies, Inc.’s Responsive

15

Claim Construction Brief (“Shanberg Decl.”) Ex. I at 7; Ex. J at 5.) “[P]rosecution history can be

16

invaluable for demonstrating the inventor's understanding of the claims and checking ‘whether the

17

inventor limited the invention in the course of prosecution, making the claim scope narrower than it

18

would otherwise be.’” Rambus, 569 F. Supp. 2d at 969 (quoting Phillips, 415 F.3d at 1317.). SRI’s

19

prosecution history unambiguously demonstrates that it intended to limit analysis of network traffic

20

data to direct examination of network packets. (See, e.g., Shanberg Decl. Ex. I at 7, 13; Ex. J at 5, 7,

21

11.)

22

Accordingly, the Court construes “detecting, by the network monitors, suspicious activity

23

based on analysis of network traffic data” to mean: “detecting, by the network monitors, suspicious

24

network activity based on direct examination of network packets.”

25
26
27
28

6.

“Said plurality of network monitors detecting suspicious network activity based
on analysis of network traffic data”

The term “said plurality of network monitors detecting suspicious network activity based on
analysis of network traffic data” appears in Claim 13 of the ‘615 Patent and Claim 12 of the ‘203
9

1
2

Patent.
SRI argues that the term “said plurality of network monitors detecting suspicious network

3

activity based on analysis of network traffic data” must be construed to mean “capable of detecting

4

based on an analysis of data derived from or describing network packets and excluding analysis that

5

is limited solely to host operating system audit logs.” (Statement at App. A.) The Plaintiffs, on the

6

other hand, argue that the term must be construed to mean “said plurality of network monitors

7

detecting suspicious network activity based on direct examination of network packets.” (Id.)

8
9

The key disputes between the parties are the same as those discussed in Claim terms 4 and 5;
that is, whether the network monitors must be actively detecting suspicious network activity, or

United States District Court
For the Northern District of California

10

merely capable of performing that function, and whether “detecting” requires direct examination.

11

For the same reasons discussed supra, the Court is persuaded that the claimed invention requires

12

active detecting – not merely the capability to detect – and that such detecting requires direct

13

examination of network packets.

14

Accordingly, the Court construes the term “said plurality of network monitors detecting

15

suspicious network activity based on analysis of network traffic data” to mean: “said plurality of

16

network monitors detecting suspicious network activity based on direct examination of network

17

packets.”

18

7.

19

The terms “network monitors deployed”/“network monitors are deployed” appears in Claims

20
21

“Network monitors deployed”/“network monitors are deployed”

13 and 18 of the ‘615 Patent, and Claims 12 and 17 of the ‘203 Patent.
SRI argues that the terms “network monitors deployed”/“network monitors are deployed”

22

must be construed to mean “network monitors that can be configured and/or installed.” (Statement

23

at App. A.) The Plaintiffs, on the other hand, note that the parties agree that “deploying a plurality

24

of network monitors” means “configuring and/or installing two or more network monitors,” and that

25

“software is configured and hardware is installed.” (Id.) The Plaintiffs contend that this claim term

26

does not require additional construction, but argue that if the Court construes the term, it must be

27

construed to mean “network monitors that are configured and/or installed” and that “software is

28

configured and hardware is installed.” (Id.)
10

1
2
3

The key dispute between the parties is the same issue regarding active language discussed
supra in Claim terms 4 and 6.
Accordingly, the Court construes the terms “network monitors deployed”/“network monitors

4

are deployed” to mean: “network monitors that are configured and/or installed” and “software is

5

configured and hardware is installed.”

6

8.

7

The term “correlating intrusion reports reflecting underlying commonalities” appears in

8
9

“Correlating intrusion reports reflecting underlying commonalities”

Claim 2 of both the ‘615 and the ‘203 Patents.
SRI argues that the term “correlating intrusion reports reflecting underlying commonalities”

United States District Court
For the Northern District of California

10

must be construed to mean “combining the reports to reflect underlying commonalities.” (Statement

11

at App. A.) Check Point agrees with SRI’s proposed construction. (Id. at 2 n.1.) Fortinet, on the

12

other hand, argues that the term either needs no construction, or in the alternative, it must be

13

construed to mean “combining intrusion reports with underlying commonalities to identify more

14

global threats.” (Id. at App. A.) At oral argument in the Markman hearing, Fortinet suggested the

15

alternative construction “combining intrusion reports with underlying commonalities at least to

16

identify threats.”

17

The key dispute between SRI and Fortinet is whether the sole purpose of combining the

18

reports is to identify more global threats to the network. This is essentially the same dispute

19

discussed supra in Claim term 3.

20

Accordingly, the Court construes the term “correlating intrusion reports reflecting underlying

21

commonalities” to mean: “combining the reports to reflect underlying commonalities, including to

22

identify threats.”

23

9.

24

The term “correlating intrusion reports reflecting underlying commonalities” appears in

25
26

“Correlating intrusion reports reflecting underlying commonalities”

Claim 14 of the ‘615 Patent, and Claim 13 of the ‘203 Patent.
SRI argues that the term “correlating intrusion reports reflecting underlying commonalities”

27

in the context of these Claims must be construed to mean “capable of combining the reports to

28

reflect underlying commonalities.” (Statement at App. A.) The Plaintiffs do not believe this term
11

1

needs additional construction but argue that it must be construed consistently with Claim term 8,

2

above. (Id.)

3

The key dispute between the parties is whether integration requires hierarchical monitors to

4

be correlating reports or whether it merely requires that they possess the capability to correlate

5

reports; that is, this is essentially the same issue regarding active language discussed supra in Claim

6

terms 4, 6, and 7. Moreover, the Court is persuaded by the Plaintiffs’ argument that this Claim term,

7

which is identical to Claim term 8, should be construed consistently with Claim term 8.

8
9

Accordingly, the Court construes the term “correlating intrusion reports reflecting underlying
commonalities” to mean: “combining the reports to reflect underlying commonalities, including to

United States District Court
For the Northern District of California

10

identify threats.”

11

10.

12

The term “network traffic data” appears in Claims 1 and 13 of the ‘615 Patent, and Claims 1

13
14

“Network traffic data”

and 12 of the ‘203 Patent.
SRI does not believe that this term requires construction. (Statement at App. A.) However,

15

should the Court construe the term, SRI argues that the term “network traffic data” must be

16

construed to mean “data derived from or describing network packets.” (Id.) The Plaintiffs, on the

17

other hand, argue that the term must be construed to mean “network traffic data” is comprised of

18

“network packets.” (Id.)

19

The key dispute between the parties is whether network traffic data can be equated with

20

network packets. During reexamination SRI stated that “[a]ccording to its plain meaning, the phrase

21

‘network traffic data’ refers to data obtained from network traffic, i.e., network packets.” (Shanberg

22

Decl. Ex. J at 5.) The Court is persuaded that, at the time of reexamination, SRI understood

23

“network traffic data” to be comprised of network packets. See Phillips, 415 F.3d at 1317; Rambus,

24

569 F. Supp. 2d at 969.

25
26
27
28

Accordingly, the Court construes the term “network traffic data” to mean: “network traffic
data” is comprised of “network packets.”
CONCLUSION
Based on the analysis set forth above, the Court adopts the foregoing constructions of the
12

1

disputed terms. The parties are ordered to submit a further joint case management report pursuant to

2

Patent Standing Order ¶ 13 by no later than November 8, 2013.

3

IT IS SO ORDERED.

4
5

Dated: October 22, 2013
JEFFREY S. WHITE
UNITED STATES DISTRICT JUDGE

6
7
8
9
United States District Court
For the Northern District of California

10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
13