Finjan, Inc. v. Cisco Systems Inc.

Filing 134

ORDER CONSTRUING CLAIMS IN U.S. PATENT NOS. 6,154,844; 6,804,780; 7,647,633; 8,141,154; 8,677,494. Signed by Judge Beth Labson Freeman on 7/23/2018. (blflc4S, COURT STAFF) (Filed on 7/23/2018)

Download PDF
1 2 3 UNITED STATES DISTRICT COURT 4 NORTHERN DISTRICT OF CALIFORNIA 5 SAN JOSE DIVISION 6 7 FINJAN, INC., Plaintiff, 8 ORDER CONSTRUING CLAIMS IN U.S. PATENT NOS. 6,154,844; 6,804,780; 7,647,633; 8,141,154; 8,677,494 v. 9 10 11 Case No. 17-cv-00072-BLF CISCO SYSTEMS, INC., [Re: ECF 100, 112, 127] United States District Court Northern District of California Defendant. 12 13 14 15 16 17 18 19 Plaintiff Finjan, Inc. (“Finjan”) brings this patent infringement lawsuit against Defendant Cisco Systems, Inc. (“Cisco”), alleging infringement of five of Finjan’s patents directed to computer and network security: U.S. Patent Nos. 6,154,844 (“the ’844 patent”); 6,804,780 (“the ’780 patent”); 7,647,633 (“the ’633 patent”); 8,141,154 (“the ’154 patent”); and 8,677,494 (“the ’494 patent”) (collectively, the “Asserted Patents”). The Court held a tutorial on June 7, 2018 and a Markman hearing on June 15, 2018 for the purpose of construing ten disputed terms in the ’844, ’780, ’633, ’154, and ’494 patents. 20 21 I. BACKGROUND The Asserted Patents are directed to network security technologies that detect online 22 threats from malware. Finjan asserts that Cisco’s products and services infringe the Asserted 23 Patents. See generally Second. Am. Compl., ECF 55. Each patent is summarized below. 24 25 26 27 28 A. The ’844 Patent The ’844 patent is titled “System and Method for Attaching a Downloadable Security Profile to a Downloadable” and was issued on November 28, 2000. Ex. 1 to Hannah Decl. (the ’844 patent), ECF 100-3. This patent claims systems and methods for inspecting Downloadables 1 for suspicious code or behavior according to a set of rules and generating a profile of the results 2 from the inspection. See, e.g., id. at 1:62–3:7. In some embodiments, a content inspection engine 3 generates a security profile and links that profile to a Downloadable. Id. at 2:3–11. The profile 4 can include certificates that are later read by a protection engine to determine whether or not to 5 trust the profile. Id. at 2:20–48. By providing verifiable profiles, the claimed systems and 6 methods may efficiently protect computers from hostile Downloadables. Id. at 2:61–3:7. The ’494 Patent B. 8 The ’494 patent is titled “Malicious Mobile Code Runtime Monitoring System and 9 Methods” and was issued on March 18, 2014. Ex. 2 to Hannah Decl. (the ’494 patent), ECF 100- 10 4. The patent provides “[p]rotection systems and methods . . . for protecting one or more personal 11 United States District Court Northern District of California 7 computers (“PCs”) and/or other intermittently or persistently network accessible devices or 12 processes from undesirable or otherwise malicious operations . . . .” Id. at 2:51–55. To achieve 13 this goal, some embodiments utilize a protection engine in order to identify executable code. Id. 14 at 11:65–12:14, 12:38–47. The ’780 Patent 15 C. 16 The ’780 patent is titled “System and Method for Protecting a Computer and a Network 17 From Hostile Downloadables” and was issued on October 12, 2004. Ex. 3 to Hannah Decl. (the 18 ’780 patent), ECF 100-5. This patent teaches the generation of a re-usable ID for downloaded 19 files so that future iterations of those files can be easily identified. For instance, the patent 20 discloses that an ID generator can compute an ID that identifies a Downloadable by fetching 21 components of the Downloadable and performing a hashing function on the fetched components. 22 See, e.g., id. at 2:12–16. The ’633 Patent 23 D. 24 The ’633 patent is titled “Malicious Mobile Code Runtime Monitoring System and 25 Methods” and was issued on January 12, 2010. Ex. 4 to Hannah Decl. (the ’633 patent), ECF 100- 26 6. The patent provides systems and methods for protecting devices on an internal network from 27 code, applications, and/or information downloaded from the Internet that performs malicious 28 operations. Id. at Abstract. At a high level, some embodiments include a protection engine that 2 1 resides on a network server and monitors incoming information for executable code. Id. at 2:20– 2 3:4. Upon detection of executable code, the protection engine deploys a “mobile protection code” 3 and protection policies to a downloadable-destination. Id. col. 3:5–21. At the destination, the 4 Downloadable is executed, typically within a sandboxed environment, and malicious or potentially 5 malicious operations that run or attempt to run are intercepted and neutralized by the mobile 6 protection code according to set protection policies. See id. at 3:22–40. The ’154 Patent 7 E. 8 The ’154 patent is titled “System and Method for Inspecting Dynamically Generated Executable Code” and was issued on March 20, 2012. Ex. 5 to Hannah Decl. (the ’154 patent), 10 ECF 100-7. The patent concerns “new behavioral analysis technology [that] affords protection 11 United States District Court Northern District of California 9 against dynamically generated malicious code,” which are viruses generated at runtime. Id. at 12 4:32–34; see also id. at 3:32–33. In some embodiments, a gateway computer receives content 13 from the internet, where the content includes a call to an original function and an input. Id. at 14 5:26–32. The gateway computer modifies the received content by replacing the call to the original 15 function with a corresponding call to a substitute function. Id. at 5:32–35. The substitute function 16 sends the input to a security computer, which determines whether it is safe to invoke the original 17 function with the input at a client computer. Id. at 5:35–43. In this approach, the patent provides 18 technology that protects computers from dynamically generated malicious code. 19 II. LEGAL STANDARD 20 A. 21 Claim construction is a matter of law. Markman v. Westview Instruments, Inc., 517 U.S. 22 370, 387 (1996). “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the 23 invention to which the patentee is entitled the right to exclude,” Phillips v. AWH Corp., 415 F.3d 24 1303, 1312 (Fed. Cir. 2005) (en banc) (internal citation omitted), and, as such, “[t]he appropriate 25 starting point . . . is always with the language of the asserted claim itself,” Comark Commc’ns, Inc. 26 v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998). 27 28 General Principles Claim terms “are generally given their ordinary and customary meaning,” defined as “the meaning . . . the term would have to a person of ordinary skill in the art in question . . . as of the 3 1 effective filing date of the patent application.” Phillips, 415 F.3d at 1313 (internal citation 2 omitted). The court reads claims in light of the specification, which is “the single best guide to the 3 meaning of a disputed term.” Id. at 1315; see also Lighting Ballast Control LLC v. Philips Elecs. 4 N. Am. Corp., 744 F.3d 1272, 1284-85 (Fed. Cir. 2014) (en banc). Furthermore, “the 5 interpretation to be given a term can only be determined and confirmed with a full understanding 6 of what the inventors actually invented and intended to envelop with the claim.” Phillips, 415 7 F.3d at 1316 (quoting Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1250 (Fed. 8 Cir. 1998)). The words of the claims must therefore be understood as the inventor used them, as 9 such understanding is revealed by the patent and prosecution history. Id. The claim language, written description, and patent prosecution history thus form the intrinsic record that is most 11 United States District Court Northern District of California 10 significant when determining the proper meaning of a disputed claim limitation. Id. at 1315–17; 12 see also Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996). Evidence external to the patent is less significant than the intrinsic record, but the court 13 14 may also consider such extrinsic evidence as expert and inventor testimony, dictionaries, and 15 learned treatises “if the court deems it helpful in determining ‘the true meaning of language used 16 in the patent claims.’” Philips, 415 F.3d at 1318 (quoting Markman, 52 F.3d at 980). However, 17 extrinsic evidence may not be used to contradict or change the meaning of claims “in derogation 18 of the ‘indisputable public records consisting of the claims, the specification and the prosecution 19 history,’ thereby undermining the public notice function of patents.” Id. at 1319 (quoting 20 Southwall Techs., Inc. v. Cardinal IG Co., 54 F.3d 1570, 1578 (Fed. Cir. 1995)). 21 B. 22 Paragraph 6 of 35 U.S.C § 112 provides for means-plus-function claiming: “An element in 23 a claim for a combination may be expressed as a means . . . for performing a specified function . . . 24 and such claim shall be construed to cover the corresponding structure, material, or acts described 25 in the specification and equivalents thereof.”1 When a claim uses the term “means” to describe a Means-Plus-Function Claims 26 27 28 1 Paragraph 6 of 35 U.S.C. § 112 was replaced with newly designated § 112(f) when the America Invents Act (“AIA”), Pub. L. No. 112-29, took effect on September 16, 2012. Because the Asserted Patents were filed before that date, the Court refers to the pre-AIA version of § 112. 4 1 limitation, it creates a presumption that the inventor used the term to invoke § 112 ¶ 6. Biomedino 2 v. Waters Technologies, 490 F.3d 946, 950 (Fed. Cir. 2007). The “presumption can be rebutted 3 when the claim, in addition to the functional language, recites structure sufficient to perform the 4 claimed function in its entirety.” Id. 5 If a court concludes that a claim limitation is a means-plus-function limitation, “two steps 6 of claim construction remain: 1) the court must first identify the function of the limitation; and 2) 7 the court must then look to the specification and identify the corresponding structure for that 8 function.” Id. The claim limitation will then be construed to cover that corresponding structure 9 and equivalents thereof. 35 U.S.C § 112 ¶ 6. 10 III. The parties agree on the construction of several terms. See Joint Claim Construction United States District Court Northern District of California 11 12 13 AGREED CONSTRUCTIONS Statement, ECF 85. The Court accordingly approves and adopts the following constructions: Term Agreed Construction 14 Downloadable 15 16 (’844 patent, claims 1, 15, 43; ’494 patent, claim 10; ’780 patent, claims 1, 9, 17, 18) an executable application program, which is downloaded from a source computer and run on the destination computer 17 Database 18 (’494 patent, claim 10) a collection of interrelated data organized according to a database schema to serve one or more applications 19 20 IV. DISPUTED TERMS IN THE ’844 PATENT The parties dispute four terms in the ’844 patent. All four terms appear in independent 21 claim 43 which recites: 22 43. An inspector system comprising: 23 24 25 26 27 means for receiving a Downloadable; means for generating a first Downloadable security profile that identifies suspicious code in the received Downloadable; and means for linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients. ’844 patent at 14:34–42 (emphasis added). The fourth term, also emphasized above in claim 43, is 28 5 1 “before a web server makes the Downloadable available to web clients.” That disputed term is 2 recited in claims 1, 15, and 43. Cisco’s briefing raises a threshold issue regarding the first to third disputed terms recited in 3 4 claim 43. Responsive Br. 1–3, ECF 112. Specifically, Cisco contends that claim 43 is directed to 5 the “inspector 125” embodiment as opposed to the “network gateway 110” embodiment in 6 the ’844 patent. Id. Finjan disagrees. Reply Br. 1–3, ECF 127. Because the parties’ 7 disagreement pertains to a common issue in the disputed terms, the Court addresses that issue first. 8 Cisco argues that claim 43 is an “inspector system claim and cannot be read onto a 9 network gateway” for several reasons. Cisco first contends that the preamble of claim 43 recites “an inspector system” and that Finjan added this word during prosecution. Responsive Br. 2 11 United States District Court Northern District of California 10 (emphasis in original). According to Cisco, Finjan argued before the patent examiner that “the 12 claims were distinct from [the] Ji [prior art reference] because Ji disclosed a network gateway 13 whereas the claims are directed to an ‘inspector.’” Id. (citing Ex. 1 to Gunther Decl. (5/3/2000 14 Response), ECF 112-3). On this basis, Cisco claims that Finjan manifested a clear intention to 15 limit the claim scope to “inspector 125” while excluding gateway embodiments. Id. at 2–3. Cisco then asserts that claim 43 requires the inspector system to generate a Downloadable 16 17 Security Profile (“DSP”) and link the DSP to the Downloadable before a web server makes the 18 Downloadable available to web clients. Responsive Br. 3. In Cisco’s view, only the inspector 125 19 is described in the specification as both “generating” and “linking” the DSP. Id. Cisco further 20 asserts that the generic protection engine of the network gateway only generates the DSP and 21 passes the Downloadable without linking the Downloadable to the DSP. Id. According to Cisco, 22 because claim 43 recites functions that are performed only by inspector 125, the corresponding 23 structure of the first to third terms must be a structure within the inspector 125. Id. Finjan responds that Cisco’s construction is inconsistent with decisions issued by courts 24 25 within this District. See Reply Br. 1–3. Finjan also argues that the ’844 patent discloses 26 embodiments “where the inspector is at different locations, including at the network gateway.” Id. 27 at 1. 28 After carefully reviewing the parties’ briefing and the record, the Court agrees with 6 1 Finjan’s position. First, Cisco’s reliance on the fact that the preamble of claim 43 recites 2 “inspector” is unpersuasive. “[W]hen a patentee defines a structurally complete invention in the 3 claim body and uses the preamble only to state a purpose or intended use for the invention, the 4 preamble is not a claim limitation.” Novatek, Inc. v. Sollami Co., 559 F. App'x 1011, 1015 (Fed. 5 Cir. 2014) (internal quotation marks and citation omitted). That said, “clear reliance on the 6 preamble during prosecution to distinguish the claimed invention from prior art transforms the 7 preamble into a claim limitation.” Catalina Mktg. Int'l, Inc. v. Coolsavings.com, Inc., 289 F.3d 8 801, 808 (Fed. Cir. 2002). Here, the Court finds that the preamble of claim 43 is not a limitation. 9 The body of the claim structurally defines the claimed invention. In addition, the prosecution history of the ’844 patent does not clearly show that Finjan distinguished the Ji reference by 11 United States District Court Northern District of California 10 adding “inspector” to the preamble. Rather, Finjan emphasized that the Ji reference is 12 distinguishable because it “does not teach generating [DSP] or linking the [DSP] to a 13 Downloadable before the web server makes the Downloadable security profile available to web 14 clients” and fails to disclose “examining an already linked [DSP] by network gateways.” See Ex. 15 1 to Gunther Decl. (5/3/2000 Response) (emphasis in original). These statements do not pertain to 16 the preamble. Thus, the prosecution history does not show that Finjan clearly relied on the 17 preamble to limit claim 43. Catalina, 289 F.3d at 808. 18 To the extent that Cisco invokes the prosecution disclaimer doctrine, its argument fails. 19 Any disclaimer must be “clear and unmistakable” and cannot be “amenable to multiple reasonable 20 interpretations.” Omega Eng'g, Inc, v. Raytek Corp., 334 F.3d 1314, 1325–26 (Fed. Cir. 2003). 21 Here, at best, Finjan’s patent prosecution statements are ambiguous and thus do not support 22 Cisco’s position. As such, Finjan’s statements do not show that it “clearly and unmistakabl[y]” 23 disavowed “network gateway” embodiments from the claim scope. Id. In fact, other courts have 24 reached the same conclusion after reviewing the prosecution history of the ’844 patent. See 25 Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG, 2017 WL 550453, at *16 (N.D. Cal. Feb. 26 10, 2017) (“The Court does not read this language to establish . . . that an inspector by definition 27 can never be at the gateway, or to amount to a clear and unmistakable disavowal.”). 28 Second, the Court is unpersuaded by Cisco’s argument that claim 43 excludes “network 7 1 gateway” embodiments on the grounds that the specification discloses only inspector 125 to 2 “generate” and “link” the DSP. To be sure, the ’844 patent expressly discloses that content 3 inspection engine 160 in the inspector 125 of Fig. 1 to both generate and link DSP to a 4 Downloadable. See e.g., ’844 patent at 8:36–9:4. However, the specification also explicitly 5 describes that the content inspection engine 525 which may be located at the network gateway 6 generates DSP for a Downloadable and that the content inspection engine 525 is “similar to the 7 content inspection engine 160 of the inspector 125.” Id. at 7:62–64, 7:67–8:2. The specification 8 further explains that the content inspection engine 525 generates DSP for the received 9 Downloadable as described with reference to Figs. 4 and 6, id. at 9:63–65, where it is disclosed that content inspection engine 160 attaches DSP, id. at 7:13–16, 8:36–9:4. Based on those 11 United States District Court Northern District of California 10 disclosures, and in particular, given that the ’844 patent expressly describes that the content 12 inspection engine 160 at the network gateway is similar to those in the inspector 125, a person of 13 ordinary skill in the art would understand that the content inspection engine located at the gateway 14 can link DSP to the Downloadable. The Court therefore rejects Cisco’s argument that the “linking” 15 limitation in claim 43 shows that “network gateway” embodiments are excluded. 16 Accordingly, the Court concludes that claim 43 covers embodiments where the inspector is 17 located at the network gateway. This interpretation of claim 43 is consistent with the construction 18 of other courts. Symantec, 2017 WL 550453, at *16. 19 The Court now addresses the four disputed terms in the ’844 patent separately below. 20 A. 21 22 “means for receiving a Downloadable” (claim 43) Finjan’s Proposal Function: receiving a Downloadable Cisco’s Proposal Function: receiving a Downloadable Court’s Construction Function: receiving a Downloadable Structure: downloadable file interceptor Structure: inspector 125 that is external to a network gateway Structure: downloadable file interceptor 23 24 25 26 27 28 There is no dispute that this term is a means-plus-function limitation and that the function is “receiving a Downloadable.” Opening Br. 3, ECF 100; Responsive Br. 3. The Court therefore adopts the function agreed by the parties. 8 1 The parties, however, dispute the structure for this limitation. Finjan argues that the proper 2 structure is “downloadable file interceptor” because the ’844 patent disclose this element to 3 perform “the function of receiving a Downloadable.” Opening Br. 3. Finjan points out that Judge 4 Gilliam and Judge Orrick in this District determined that the proper structure is “downloadable file 5 interceptor.” Id. (citing Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG, 2017 WL 6 550453, at *3–4 (N.D. Cal. Feb. 10, 2017); Finjan, Inc. v. Sophos, Inc., No. 14-CV-01197-WHO, 7 2015 WL 890621, at *8 (N.D. Cal. Mar. 2, 2015) (“[T]he structure for ‘means for receiving a 8 Downloadable’ is unambiguous: the Downloadable file interceptor.”)). 9 Cisco counters that the structure is the “inspector 125 that is external to a network gateway.” Responsive Br. 3. Cisco’s proposal is based on its argument that claim 43 excludes 11 United States District Court Northern District of California 10 “network gateway” embodiments. See id. at 4. However, as discussed earlier, the Court rejects 12 Cisco’s position that claim 43 does not cover “network gateway” embodiments. Thus, the Court 13 finds that Cisco’s proposed structure is improper. 14 The remaining issue is whether the “downloadable file interceptor” is the proper structure. 15 The specification clearly discloses that the downloadable file interceptor performs the function of 16 receiving a Downloadable. See, e.g., ’844 patent at 9:22–23. The parties, however, dispute the 17 location of the downloadable file interceptor. Cisco contends that this structure is not part of the 18 inspector 125 on the grounds that it exists only on the network gateway. Responsive Br. 3; 19 Hearing Tr. 35:22–36:3, ECF 132. Thus, according to Cisco, Finjan’s proposed structure would 20 exclude embodiments where the inspector is external to the network gateway. See Hearing Tr. 21 36:1–3. Finjan countered that its construction “would not read out embodiments from the 22 specification” because the “downloadable file interceptor can be at the inspector as well.” Id. at 23 55:13–17, 55:19–56:4. For support, Finjan pointed to col. 7, line 19 to col. 8, line 2 of the 24 specification, which in part states that the “content inspection engine 525 is similar to the content 25 inspection engine 160 of the inspector 125.” Hearing Tr. 55:19–56:2, 57:2–57:19. On this basis, 26 Finjan represented that its proposed construction does not limit claim 43 to only “network 27 gateway” embodiments. See id. at 57:20–58:3. 28 After reviewing the ’844 patent, the Court agrees with Finjan’s conclusion. The 9 1 specification describes a generic protection engine that includes the downloadable file interceptor 2 for receiving incoming Downloadables. ’844 patent at 7:41–48. This generic protection engine 3 includes content inspection engine 525 that is similar to the content inspection engine 160 of the 4 inspector 125, which is external to the gateway as depicted in Fig. 1. Id. at 7:19–8:2. The 5 specification further describes that the content inspection engine 160 receives Downloadables like 6 the generic protection engine. See id. at 4:52–56 (“[T]he Downloadable ID for the Downloadable 7 will be the same each time the content inspection engine 160 (or a protection engine as illustrated 8 in FIG. 5) receives the same Downloadable . . . .”). Based on those disclosures, a person of 9 ordinary skill in the art would understand that inspector 125 with the content inspection engine 160 can include the structure of the downloadable file interceptor described in relation to the 11 United States District Court Northern District of California 10 protection engine in order to receive Downloadables. Accordingly, although the ’844 patent 12 expressly discusses the downloadable file interceptor in connection to embodiments pertaining to 13 the network gateway or computer client (’844 patent at 7:41–44, 9:19–10:23), the Court finds that 14 a person of ordinary skill in the art would understand that the downloadable file interceptor may 15 be located on inspector 125. 16 The Court also notes that Judge Gilliam and Judge Orrick’s claim construction orders 17 determined the proper structure as the “downloadable file interceptor.” Symantec Corp., , 2017 18 WL 550453, at *3–4; Sophos, 2015 WL 890621, at *8. The Court’s above conclusion is 19 consistent with those orders. Thus, the Court is further persuaded that the “downloadable file 20 interceptor” is the correct structure for the “means for receiving a Downloadable.” Symantec, 21 2017 WL 550453, at *3 (explaining that prior claim construction orders issued in the same 22 jurisdiction may receive deference). The Court finds no reason to depart from the prior claim 23 construction orders. 24 For the above reasons, the Court adopts Finjan’s construction. 25 // 26 // 27 // 28 10 B. 1 2 3 4 5 6 7 8 “means for generating a first Downloadable security profile that identifies suspicious code in the received Downloadable” (Claim 43) Finjan’s Proposal Function: generating a first Downloadable security profile that identifies suspicious code in the received Downloadable Cisco’s Proposal Function: generating a first [Downloadable security profile that identifies suspicious code in the received Downloadable]2 Court’s Construction Function: generating a first Downloadable security profile that identifies suspicious code in the received Downloadable Structure: content inspection engine programmed to perform the algorithm disclosed at Col. 8, lines 51– 60 of the ’844 patent Structure: content inspection engine 160 of inspector 125 programmed to perform the algorithm disclosed at 8:49–60 of the ’844 patent and 5:36–47, 5:54–57, 8:23–24, 9:20–42, and Fig. 7 of U.S. Patent No. 6,092,194 Structure: content inspection engine programmed to perform the algorithm disclosed at Col. 8, lines 51–60 of the ’844 patent 9 10 United States District Court Northern District of California 11 12 13 14 15 16 17 The parties do not dispute that this term is a means-plus-function limitation and that the function is “generating a first Downloadable security profile that identifies suspicious code in the received Downloadable.” Opening Br. 5; Responsive Br. 4. The Court therefore adopts the function agreed by the parties. The parties, however, diverge on the proper structure for this limitation. Finjan asserts that its proposed structure is correct because the structure is “taken directly from the specification of the ’844 patent as it relates to generating a [DSP].” Opening Br. 5. Finjan further asserts that 18 19 20 21 22 23 24 25 26 27 28 Judge Gilliam adopted the same structure in Symantec, 2017 WL 550453, at *6–7. Opening Br. 5–6. Cisco first responds that the proper structure should be “tied to inspector 125” but that Finjan’s proposal fails to do so. Responsive Br. 4. Cisco next argues that the specification of the ’844 patent “provides almost no detail of how the content inspection engine 160 generates a DSP that identifies suspicious code in the received Downloadable” and that code is distinct from operations. Id.; see also id. n.4. Based on this assertion, Cisco contends that the Court must look to U.S. Patent Application No. 08/964,388 (now U.S. Patent No. 6,092, 194 (“the ’194 patent”)), 2 Cisco states that the square brackets shown in its proposed constructions indicate that the bracketed phrase should be subject to the proposed construction for the respective term in the Joint Claim Construction Statement. Response Br. 4 n.2. 11 1 2 which the ’844 patent incorporates by reference, to construe the proper structure. Id. at 4–5. Cisco’s first contention is based on the argument that claim 43 excludes “network gateway” 3 embodiments. But, again, the Court rejects Cisco’s argument that claim 43 does not cover 4 “network gateway” embodiments. The Court therefore is unpersuaded by Cisco’s first contention 5 that the proper structure should be tied to inspector 125. 6 Regarding Cisco’s second contention, the Court is unconvinced by Cisco’s reliance on 7 the ’194 patent even if that patent were properly incorporated by reference into the ’844 patent. 8 The ’194 patent does not mention “content inspection engine” and the Court is unable to identify 9 with particularity which algorithms disclosed in the ’194 patent pertain to the “content inspection engine” described in the ’844 patent. On the other hand, the ’844 patent itself sufficiently 11 United States District Court Northern District of California 10 discloses the algorithm for the content inspection engine that performs the agreed upon function: 12 13 14 15 16 17 As stated above, generating a DSP [by the content inspection engine] includes examining the Downloadable 205 (and the Downloadable components) for all suspicious operations that will or may be performed by the Downloadable, all suspicious code patterns, all known viruses, etc. Generating a DSP may include comparing all operations that will or may be performed against a list of suspicious operations or against a list of rules, e.g., a rules base 165. Accordingly, if an operation in the Downloadable 205 matches one of the suspicious operations or violates one of the rules, then the operation is listed in the DSP 215. 18 ’844 patent at 8:51–60. Similar narrative algorithms have been found to disclose sufficient 19 structure. See Typhoon Touch Techs., Inc. v. Dell, Inc., 659 F.3d 1376, 1385–86 (Fed. Cir. 2011). 20 As such, the Court finds that the proper algorithm is disclosed in col. 8, lines 51–60 of the ’844 21 patent. Indeed, Judge Gilliam reached the same conclusion. Symantec, 2017 WL 550453, at *6–7 22 (declining to rely on the ’194 patent and holding that the ’844 patent disclosed sufficient structure). 23 Moreover, Cisco’s argument that Court must look to the ’194 patent on the grounds that 24 code is distinct from operations is unavailing. Finjan’s proposed algorithm in the ’844 patent 25 describes “generating a DSP includes examining the Downloadable . . . for all suspicious 26 operations that will or may be performed by the Downloadable, all suspicious code patterns, all 27 known viruses, etc.” ’844 patent at 8:51–55 (emphasis added). As an example, the ’844 patent 28 discloses that a DSP can be generated using a “rules base.” Id. at 8:55–58. Moreover, the 12 1 specification discloses that a set of rules may include a “list of suspicious code patterns.” Id. at 2 2:7–8. Thus, although Cisco is correct that “code” is distinct from “operations,” its argument is 3 unavailing. Based on those disclosures, the Court finds that a person of ordinary skill in art would 4 understand how the content inspection engine performs the function based on the algorithm 5 disclosed in col. 8, lines 51–60 of the ’844 patent. 6 Accordingly, the Court adopts Finjan’s proposed construction. 7 C. 8 9 10 United States District Court Northern District of California 11 12 “means for linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients” (Claim 43) Finjan’s Proposal Function: linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients Cisco’s Proposal Function: linking the first Downloadable security profile to the Downloadable [before a web server makes the Downloadable available to web clients] Court’s Construction Function: linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients Structure: content inspection engine programmed to perform the algorithm of step 630 disclosed at Fig. 6; col. 8, lines 65–67; and col. 6, lines 13-24. Structure: content inspection engine 160 of inspector 125 programmed to perform step 630 of FIG. 6, disclosed at 8:65–67 and col. 6, lines 13–20. Specifically, attaching a Downloadable security profile to the Downloadable (col. 8, lines 65–67 and col. 6, lines 13–18) or attaching to the Downloadable a pointer that points to a stored Downloadable security profile (col. 6, lines 18–20). Structure: content inspection engine programmed to perform step 630 of FIG. 6, disclosed at 8:65–67 and col. 6, lines 13–20. Specifically, attaching a Downloadable security profile to the Downloadable (col. 8, lines 65–67 and col. 6, lines 13–18) or attaching to the Downloadable a pointer that points to a stored Downloadable security profile (col. 6, lines 18–20). 13 14 15 16 17 18 19 20 21 22 23 There is no dispute that this term is a means-plus-function limitation and that the function 24 is “linking the first Downloadable security profile to the Downloadable before a web server makes 25 the Downloadable available to web clients.” Opening Br. 7; Responsive Br. 5. The Court 26 therefore adopts the agreed upon function. 27 28 The parties disagree on the structure for this limitation. Finjan argues that its proposed construction is the one adopted by Judge Gilliam in Symantec, 2017 WL 550453, at *8. Opening 13 1 Br. 7. Finjan further contends that its proposal is consistent with the scope of the agreed function 2 and does not incorporate unnecessary and confusing elements. Id. at 8. 3 Cisco counters that its proposal specifies that the content inspection engine must be part of 4 the inspector 125. Responsive Br. 6. However, like Cisco’s earlier arguments, this contention is 5 based on Cisco’s view that claim 43 excludes “network gateway” embodiments. The Court rejects 6 that view and thus is unconvinced by this counter-argument. Thus, to the extent that its proposal 7 references content inspection engine 160 and inspector 125, Cisco’s construction is improper. 8 Cisco also argues that the specification discloses only two methods for linking the DSP to 9 the Downloadable: “(1) attaching the DSP to the Downloadable and (2) attaching a pointer to the Downloadable that points to the DSP stored in the network system 100.” Responsive Br. 6. Cisco 11 United States District Court Northern District of California 10 further asserts that col. 6, lines 20–24 of the specification should be excluded from Finjan’s 12 proposal. See id. That portion of the ’844 patent states the following: 13 14 15 The term “linking” herein will be used to indicate an association between the Downloadable 205 and the DSP 215 (including using a pointer from the Downloadable 195 to the DSP 215, attaching the DSP 215 to the Downloadable 205, etc.) 16 ’844 patent at 6:20–24. Cisco argues that this portion of the specification only identifies the two 17 methods for linking (which are already disclosed in col. 6, lines 13–20 and col. 8, lines 65–67) and 18 that the reference to “an association” and “etc.” are not algorithms that provide corresponding 19 structure. See Responsive Br. 6. As discussed below, the Court agrees with Cisco on this point. 20 In allowing means-plus-function limitations, “Congress . . . plac[ed] specific constraints on 21 how such a limitation is to be construed, namely, by restricting the scope of coverage to only the 22 structure, materials, or acts described in the specification as corresponding to the claimed 23 function and equivalents thereof.” Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1347 (Fed. 24 Cir. 2015). Here, the parties both propose algorithms for the structure and thus agree that the 25 specification must describe an algorithm to sufficiently disclose the structure. See Aristocrat 26 Techs. Australia Pty Ltd. v. Int'l Game Tech., 521 F.3d 1328, 1333 (Fed. Cir. 2008) 27 (“[C]computer-implemented means-plus-function term is limited to the corresponding structure 28 disclosed in the specification and equivalents thereof, and the corresponding structure is 14 1 the algorithm.” (citation omitted) (emphasis added)). In other words, the structure of the disputed 2 means-plus-function term at issue is limited to the algorithm disclosed in the specification. See id. 3 Here, as Cisco argues, col. 6, lines 20–24 of the specification merely restates the function 4 “linking the first Downloadable security profile to the Downloadable” by referring “linking” as an 5 “association” but fails to specify how the content inspection engine performs the claimed function. 6 Thus, that passage does not adequately disclose an algorithm (other than the two methods which 7 Cisco does not dispute). See Aristocrat, 521 F.3d at 1334 (specification did not contain an 8 algorithm sufficient to disclose structure, when language identified by plaintiff “simply describe[d] 9 the function to be performed, not the algorithm by which it is performed”). In fact, Finjan’s expert, Dr. Medvidovic, testified that the ’844 patent uses “linking” and creating an “association” as 11 United States District Court Northern District of California 10 synonyms. Ex. 3 to Gunther Decl. (Medvidovic Dep. Tr. 28:17–29:2), ECF 112-5. Because col. 6, 12 lines 20–24 does not disclose anything beyond the two methods of linking by attaching the DSP or 13 the pointer to the DSP, the Court finds that this portion of the specification does not disclose 14 additional algorithm that corresponds to the structure of the means-plus-function claim. 15 Finjan’s counter-arguments are unpersuasive. First, Finjan asserts that Judge Gilliam 16 adopted its proposed construction including col. 6, lines 20–24 of the ’844 patent. However, 17 Judge Gilliam expressed that the sentence “[t]he term ‘linking’ herein will be used to indicate an 18 association between the Downloadable 205 and the DSP 215 (including using a pointer from the 19 Downloadable 195 to the DSP 215, attaching the DSP 215 to the Downloadable 205, etc.)” 20 appears to “simply restate the function ‘linking the first Downloadable security profile to the 21 Downloadable’ rather than providing an algorithm for how that function is accomplished, an 22 approach the Federal Circuit has found to be insufficient.” Symantec, 2017 WL 550453, at *8. 23 Nevertheless, Judge Gilliam adopted that passage as part of the construction because the parties’ 24 proposal covered that portion of the ’844 patent. Id. The Court need not give much deference to 25 Judge Gilliam’s construction when he identified an issue with the parties’ proposal but 26 nevertheless accepted it. 27 28 Second, Finjan argues that Cisco’s own expert, Dr. Clark, admits that “the ’844 patent does not require ‘attaching’ . . . [and] that the function can also be done by linking.” Reply Br. 5. 15 1 (citing Ex. 1 to Hannah Decl. (Clark Dep. Tr. 83:3–85:9, 151:17–20), ECF 127-1)). Dr. Clark’s 2 deposition indicates that he explained the two methods for linking based on use of the pointer and 3 attaching the DSP as disclosed in col. 6, lines 13–20. As such, this argument does not change the 4 Court’s conclusion. 5 Third, Finjan contends that “one skilled in the art would recognize that the DSP 215 can be 6 linked to the Downloadable 205 using other techniques such as association.” Reply Br. 5. 7 However, Finjan’s own expert, Dr. Medvidovic, testified that “association” is synonymous with 8 “linking.” Ex. 3 to Gunther Decl. (Medvidovic Dep. Tr. 28:17–29:2). The Court thus finds that 9 the specification’s mere reference to “association” does not sufficiently disclose an algorithm to 10 United States District Court Northern District of California 11 support the disputed means-plus-function claim. Fourth, Finjan argues that it would be improper to limit the term to examples of linking by 12 “attaching the DSP and the pointer.” Reply Br. 5. However, the Court’s rejection of Finjan’s 13 position is not improper. As mentioned above, section 112 ¶ 6 requires that a means-plus-function 14 claim to cover “only the structure, materials, or acts described in the specification.” Williamson, 15 792 F.3d at 1347. The ’844 patent discloses only the two methods identified in col. 6, lines 13–20 16 and col. 8, lines 65–67 as the algorithm, and thus the scope of the dispute term must be limited to 17 that disclosure. See id. 18 Based on the foregoing, the Court adopts Cisco’s proposed structure with the exception of 19 the reference to inspector 125 as set forth in the following: “content inspection engine 20 programmed to perform step 630 of FIG. 6, disclosed at 8:65–67 and col. 6, lines 13–20. 21 Specifically, attaching a Downloadable security profile to the Downloadable (col. 8, lines 65–67 22 and col. 6, lines 13–18) or attaching to the Downloadable a pointer that points to a stored 23 Downloadable security profile (col. 6, lines 18–20).” 24 “before a web server makes the Downloadable available to web clients” (Claims 1, 15, 43) Finjan’s Proposal Cisco’s Proposal Court’s Construction Plain and ordinary meaning. before any web Plain and ordinary meaning. Plain and ordinary meaning of server makes the Plain and ordinary meaning of “web “web client” is “an application Downloadable client” is “an application on the on the computer of an end user available to any web computer of an end user that requests that requests a Downloadable client a Downloadable from the web server” from the web server” 25 26 27 28 D. 16 1 Finjan argues that its proposed construction is proper because it is supported by the intrinsic record and is consistent with the main purpose of the ’844 patent. Opening Br. 9–10 3 (citing ’844 patent at 1:62–63, 2:65–3:2). Finjan further urges this Court to adopt Finjan’s 4 construction as it is exactly the same one adopted by Judge Gilliam in Symantec and is consistent 5 with decision of the Federal Circuit and numerous other orders in this District. Id. at 9 (citing 6 Symantec, 2017 WL 550453, at *18); id. (collecting cases). In particular, Finjan asserts that 7 Cisco’s construction directly contradicts the Federal Circuit decision in the appeal of Finjan, Inc. 8 v. Blue Coat Sys., Inc., No. 13-cv-03999-BLF (“Blue Coat I”), 2014 WL 5361976 (N.D. Cal. Oct. 9 20, 2014). Opening Br. 11 (citing Finjan, Inc. v. Blue Coat Sys., Inc., 879 F.3d 1299, 1306–07 10 (Fed. Cir. 2018)). Moreover, Finjan claims that Cisco’s proposal improperly excludes “network 11 United States District Court Northern District of California 2 gateway” embodiments. See id. at 12. 12 Cisco vigorously disagrees. Cisco argues that the claim language requires that a DSP be 13 generated and linked to the Downloadable “‘before’ a web server takes a certain action, i.e., makes 14 the Downloadable available to web clients.” Responsive Br. 8. According to Cisco, a 15 Downloadable is made available to web clients “when the web server places (e.g., deploys) the 16 Downloadable on the Internet such that web clients, or even a network gateway, may request the 17 Downloadable.” Id. (emphasis added). Cisco points to the use of “deployment” in the 18 specification to support its proposed construction. Id. (citing ’844 patent at 5:3–13). Cisco also 19 asserts that a similar construction was recently adopted in Finjan, Inc. v. ESET, LLC, No. 3:17-cv- 20 0183-CAB-(BGS) (S.D. Cal.). Id. at 9. As another point, Cisco contends that Finjan’s statements 21 that were made during prosecution to distinguish the Ji prior art reference support Cisco’s 22 construction. Id. (Ex. 1 to Gunther Decl. (5/3/2000 Response) 2–5). 23 The Court is unpersuaded by Cisco’s arguments. First, as Finjan argues, Cisco’s 24 interpretation of the disputed term would exclude embodiments where inspection of the 25 Downloadable occurs at a network gateway. Cisco asserts that this is not a problem because “the 26 claims at issue are inspector claims—not network gateway claims.” Responsive Br. 10 (emphasis 27 in original). However, as discussed earlier, the Court rejects such an interpretation because the 28 record does not clearly show that “network gateway” embodiments are excluded for the claims at 17 1 issue. Second, Cisco’s argument regarding the “deployment” language in the ’844 patent has 3 been rejected by courts in this District. In particular, Judge Gilliam in Symantec held that the 4 “deployment” language did not support a construction similar to what Cisco proposes here. 2017 5 WL 550453, at *14–16. In doing so, Judge Gilliam held that such a construction would 6 improperly exclude preferred embodiments from the claims and that “this is not a circumstance in 7 which it may properly interpret the asserted claims to exclude what [the defendant] characterizes 8 as the ‘gateway embodiment,’ because that embodiment is not ‘inconsistent with unambiguous 9 language in the patent’s specification or prosecution history.’” Symantec, 2017 WL 550453, at 10 *16. Moreover, Judge Gilliam found that the ’844 patent’s prosecution history regarding the Ji 11 United States District Court Northern District of California 2 reference did not establish that “an inspector by definition can never be at the gateway, or to 12 amount to a clear and unmistakable disavowal of claim scope.” Id. (citing SAS Inst., Inc. v. 13 ComplementSoft, LLC., 825 F.3d 1341, 1349 (Fed. Cir. 2016)). The Court agrees and finds no 14 reason to depart from Judge Gilliam’s conclusions. 15 Third, Cisco’s reliance on ESET is weak. In ESET, the Southern District of California 16 court adopted the following construction: “before the Downloadable is available on a web server 17 to be called up or forwarded to a web client.” ESET, No. 3:17-cv-0183-CAB-(BGS), Dkt. 195. 18 The court, however, provided no reasoning for its construction. Moreover, ESET’s claim 19 construction ruling is from outside this District. Under these circumstances, the Court gives little 20 weight to the construction in ESET compared to the thoroughly reasoned claim construction orders 21 of this District. Symantec, 2017 WL 550453, at *3 (“If anything, to the extent possible, the degree 22 of deference should be greater where the prior claim construction order was issued in the same 23 jurisdiction.”); Visto Corp. v. Sproqit Techs., Inc., 445 F. Supp. 2d 1104, 1107–08 (N.D. Cal. 24 2006) (explaining that the Supreme Court has stressed the particular importance of 25 intrajurisdictional uniformity in claim construction). 26 Fourth, the Federal Circuit’s decision in Finjan, Inc. v. Blue Coat Sys., Inc., 879 F.3d 1299 27 (Fed. Cir. 2018) reinforces the Court’s view that Finjan’s proposal is the proper construction. In 28 that decision, the Federal Circuit was deciding whether there was substantial evidence to support 18 1 the jury verdict of infringement based on the claim construction issued by the trial court. Id. at 2 1306–07. The issued construction “before [a/the] non-network gateway web server make[s] the 3 Downloadable available to web clients” (id. at 1306) is similar to Finjan’s proposal in this case 4 except for the addition of “non-network gateway,” which was added in Blue Coat I due to a 5 dispute not present here. To be clear, the issue of claim construction was not squarely presented 6 before the Federal Circuit because the defendant waived its argument. Id. Nevertheless, in 7 reaching its decision, the Federal Circuit held that the disputed term could “reasonably be 8 understood to require that linking occur at some point before users are permitted to access that 9 downloadable—but not necessarily before the downloadable is made available on the Internet.” Id. (emphasis in original). Thus, the Federal Circuit provided guidance on the reasonable 11 United States District Court Northern District of California 10 interpretation of the disputed term. As Finjan argues (Opening Br. 11), that guidance directly 12 contradicts the interpretation that Cisco urges this Court to adopt. The Court therefore is further 13 unconvinced by Cisco’s proposed construction. Accordingly, the Court rejects Cisco’s proposal and adopts the plain and ordinary meaning 14 15 of the disputed term as other courts within this District have done so. Symantec, 2017 WL 16 550453, at *14–16. One remaining issue is whether the construction should clarify the plain and ordinary 17 18 meaning of “web client” in the disputed term. Finjan urges this Court to construe “web client” to 19 mean “an application on the computer of an end user that requests a Downloadable from the web 20 server” as was determined in Symantec. Opening Br. 9. Cisco provides no counter-argument as to 21 this issue. In Symantec, Judge Gilliam found that the plain and ordinary meaning of “web client” 22 in the context of the ’844 patent is “an application on the computer of an end user that requests a 23 Downloadable from the web server” and that instructing this construction to the jury was 24 necessary to avoid a dispute at trial. 2017 WL 550453, at *16–17. The Court agrees with Judge 25 Gilliam’s reasoning and therefore adopts Finjan’s proposed construction of the phrase “web 26 client.” 27 // 28 // 19 1 DISPUTED TERM IN THE ’494 PATENT V. The parties dispute one term in the ’494 patent, which is addressed below. 2 3 4 5 A. Finjan’s Proposal No construction necessary – Plain and ordinary meaning. 6 7 8 9 10 United States District Court Northern District of California 11 “Downloadable scanner” (Claim 10) Cisco’s Proposal software for disassembling machine code of a Downloadable and resolving commands to identify suspicious operations in the Downloadable Court’s Construction software that searches code to identify suspicious patterns or suspicious computer operations The disputed term “Downloadable scanner” appears in independent claim 10, which recites: 10. A system for managing Downloadables, comprising: a receiver for receiving an incoming Downloadable; 12 13 a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and 14 15 16 17 a database manager coupled with said Downloadable scanner, for storing the Downloadable security profile data in a database. ’494 patent at 22:7–16 (emphasis added). Finjan argues that “Downloadable scanner” should be given its plain and ordinary meaning 18 because “it is a simple term that a person of ordinary skill in the art[] . . . would understand 19 without further construction.” Opening Br. 13. Finjan further asserts that the claim language is 20 clear and unambiguous because claim 10 describes that the Downloadable scanner “derives 21 security profile (“DSP”) data for a Downloadable, including a list of suspicious computer 22 operations that the Downloadable may attempt.” Id. 23 Cisco responds that its proposed construction follows directly from the Court’s decision in 24 Finjan, Inc. v. Blue Coat Sys., LLC, No. 15-CV-03295-BLF, 2016 WL 7212322, at *1 (N.D. Cal. 25 Dec. 13, 2016) (“Blue Coat II Section 101 Order”). Responsive Br. 11–12. Specifically, Cisco 26 asserts that the Court noted that the ’494 patent does not include relevant disclosure concerning a 27 “Downloadable scanner” and thus looked at U.S. Patent No. 6,092,194 (“the ’194 patent”) which 28 is incorporated by reference in the ’494 patent. Id. at 12. According to Cisco, the ’194 patent 20 1 discloses a code scanner and a decomposition process where the code scanner “disassembl[es] the 2 machine code of the Downloadable” and “resolv[es] a respective command in the machine code. 3 Id. In light of the disclosure in the ’194 patent, Cisco argues that the Court determined that the 4 claims in the ’494 patent were directed to patent-eligible subject matter because they require “a 5 precise process of decomposing code and extracting operations.” Id. at 11. 6 In Finjan’s view, Cisco’s proposed construction is contrary to the intrinsic record and 7 unreasonably limits the claim because the ’494 patent discloses that Downloadables may include 8 “scripting languages such as HTML, JavaScript and program script.” Opening Br. 13–14. Finjan 9 also counters that there is no evidence that Finjan unequivocally disavowed embodiments where a Downloadable is not in machine code. See Reply Br. 8. Moreover, Finjan asserts that Cisco’s 11 United States District Court Northern District of California 10 reliance on the Blue Coat II Section 101 Order is misplaced because the “standard for claim 12 construction and a Section 101 analysis are different as a finding that a claim is non-abstract by 13 looking at the specification to determine the problem to be solved does not mean there has been a 14 clear and unmistakable disclaimer in the intrinsic record.” Id. 15 As a preliminary issue, the Court agrees that it must look to the ’194 patent to construe 16 “Downloadable scanner.” As noted in the Blue Coat II Section 101 Order, “significant clarifying 17 detail [of the claims] is provided in a specification that belongs not to the ’494 patent itself, but to 18 a parent patent (the ’194 patent), which the ’494 patent identifies and declares to be ‘hereby 19 incorporated by reference.’” 2016 WL 7212322, at *7 (citing ’494 patent at 1:37–38). That said, 20 the precise standard applied in the Blue Coat II Section 101 Order is not applicable to the claim 21 construction issue presented to this Court. There the court faced the determination of patent- 22 eligibility of the claims and recognized that it was “not required to undertake a full claim 23 construction process in order to do this.” Id. Also, the court was ruling on a motion for judgment 24 on the pleadings and thus “err[ed] on the side of incorporating more—not less—particularities 25 from the specification into its understanding of the claims, while still refraining from importing 26 limitations from the specification” in order to construe the pleadings in favor of Finjan. Id., at *8. 27 28 After reviewing the specifications of the ’494 and ’194 patents, the Court rejects Cisco’s proposed construction. Cisco’s construction relies on a specific method disclosed in relation to 21 1 Fig. 7 of the ’194 patent. See ’194 patent at 9:20–33. To be sure, that method is the only 2 embodiment that discloses a process of decomposing code and extracting operations in detail. 3 However, it is “well established[] [that] an applicant is not required to describe in the specification 4 every conceivable and possible future embodiment of his invention.” Innogenetics, N.V. v. Abbott 5 Labs., 512 F.3d 1363, 1370 (Fed. Cir. 2008) (citing SRI Int'l v. Matsushita Elec. Corp. of Am., 775 6 F.2d 1107, 1121 (Fed. Cir. 1985)). Indeed, claims of a patent generally should not be construed as 7 being limited to one embodiment even if the patent describes only that embodiment. See Phillips, 8 415 F.3d at 1323. Therefore, the Court is unpersuaded by Cisco’s argument that a “Downloadable 9 scanner” is limited to the embodiment where the code scanner is described to disassemble machine 10 code. United States District Court Northern District of California 11 In fact, the specification of the ’194 patent shows that Cisco’s construction is too narrow. 12 For instance, the specification discloses an embodiment where a code scanner “uses conventional 13 parsing techniques to decompose the code (including all prefetched components) of the 14 Downloadable.” ’194 patent at 5:42–44. Here, there is no limitation that the code must be 15 “machine code.” The specification further discloses that the code scanner “may search the code 16 for any pattern, which is undesirable or suggests that the code was written by a hacker.” Id. at 17 5:54–57. In addition, the specification describes that the Downloadable may include a JavaScript 18 or a Visual Basic script, neither of which is machine code. In light of those disclosures, a person 19 of ordinary skill in the art would understand that the ’194 patent describes that the code scanner 20 may evaluate non-machine code in the Downloadable without disassembling machine code. 21 The above conclusion is not inconsistent with the Blue Coat II Section 101 Order. As 22 mentioned, in that case, the court was presented with a different issue and considered the claim 23 based on a standard applicable for a motion for judgment on the pleadings. To be sure, the court 24 recognized that an embodiment of deriving security file data involves “a precise processing of 25 decomposing code and extracting operations” discussed in relation to Fig. 7 of the ’194 patent. 26 Blue Coat II Section 101 Order 20–21. The court further stated that a person of ordinary skill in 27 the art would understand “deriving security profile data” to “refer to this type of process.” Id. at 28 21. When referencing “this type of process,” the Court recognized that the “move from profiling 22 1 at the file level to profiling at the operation level was [a] non-conventional rearrangement of the 2 malware profiling process.” Id. Profiling at the operation level does not necessarily require 3 disassembling machine code.3 As such, when the court mentioned “this type of process,” it did 4 not hold that the “precise processing of decomposing code and extracting operations” described in 5 connection to Fig. 7 (which discusses disassembly of machine code) was a limitation incorporated 6 into the “Downloadable scanner.” On the other hand, the Court also finds Finjan’s proposed construction to be unsatisfactory. 7 Presenting that the scanner has a plain and ordinary meaning will not aid the jury. As discussed 9 above, the specification of the ’194 patent discloses that a code scanner “may search the code for 10 any pattern, which is undesirable or suggests that the code was written by a hacker.” Id. at 5:54– 11 United States District Court Northern District of California 8 57. The code scanner may generate DSP data that includes suspicious computer operations. Id. at 12 5:50–54. As such, the Court finds that a person of ordinary skill in the art would understand that a 13 “Downloadable scanner” is “software that searches code to identify suspicious patterns or 14 suspicious computer operations.” The Court therefore will adopt this construction. 15 During the hearing, Finjan asserted that the ’494 patent “talks about suspicious operations” 16 and a construction would have to take into account for “operations.” Hearing Tr. 85:7–14, 85:22– 17 24. The Court is satisfied that claim 10 with the adopted construction of “Downloadable scanner” 18 provides identification of “suspicious computer operations” as described in relation to the scanner 19 disclosed in the ’494 and ’194 patents. 20 VI. DISPUTED TERM IN THE ’780 PATENT 21 The parties dispute one term in the ’780 patent, which is addressed below. 22 A. 23 24 25 26 “performing a hashing function on the Downloadable and the fetched software components to generate a Downloadable ID” (Claims 1, 9, 17, 18) Finjan’s Proposal performing a hashing function on the Downloadable together with its fetched software Cisco’s Proposal Court’s Construction performing a hashing performing a hashing function on function on the the Downloadable together with Downloadable together with its fetched software components its fetched software to generate a unique and 27 3 28 Indeed, during the hearing, Cisco indicated that the machine code is converted to a “different form” to determine whether operations are suspicious. See Hearing Tr. 72:1–11. 23 1 2 3 4 5 6 7 8 9 10 United States District Court Northern District of California 11 12 13 14 components to generate a Downloadable ID components to generate a unique and reproducible number or string that is the same whether the software components are referenced by the Downloadable and or are included with the Downloadable reproducible ID for that Downloadable The disputed term appears in independent claims 1, 9, 17 and 18 of the ’780 patent. Claim 1 is representative of how the term is used in the claim language: 1. A computer-based method for generating a Downloadable ID to identify a Downloadable, comprising: obtaining a Downloadable that includes one or more references to software components required to be executed by the Downloadable; fetching at least one software component identified by the one or more references; and performing a hashing function on the Downloadable and the fetched software components to generate a Downloadable ID. ’780 patent at 10:23–32 (emphasis added). Finjan asserts that its proposed construction should be adopted because other courts 15 accepted the same construction. Opening Br. 14–15. Finjan further contends that Cisco’s 16 proposal is not supported by the intrinsic record to the extent that Cisco intends to limit a 17 “Downloadable ID” to be a single “number or string.” Id. at 15. According to Finjan, the claims 18 allow the generation of one or more Downloadable IDs. Id. 19 Cisco responds that its construction articulates the actual meaning of the claim term. 20 Responsive Br. 13–14. In particular, Cisco asserts that the “alleged invention of the ’780 patent is 21 generating a Downloadable ID by performing ‘a digital hash of the complete Downloadable code’ 22 so the Downloadable ID ‘will be the same each time the ID generator . . . receives the same 23 Downloadable.’” Id. (citing the ’780 patent at 4:54–66)) (emphasis in original). Cisco claims that 24 its construction is consistent with the intrinsic record. Id. at 14. 25 The Court is unpersuaded by Cisco’s arguments. The specification of the ’780 patent 26 clearly discloses an embodiment where an ID generator performs a “hashing function on at least a 27 portion of the Downloadable code to generate a Downloadable ID.” ’780 patent at 9:65–67 28 (emphasis added). Regarding this embodiment, the specification also discloses that “the 24 1 Downloadable ID will be the same for the identical Downloadable each time it is encountered.” Id. 2 at 10:3–5. Thus, to the extent that Cisco contends that the complete Downloadable must be 3 always hashed, that view is contrary to the intrinsic record. Oatey Co. v. IPS Corp., 514 F.3d 4 1271, 1277 (Fed. Cir. 2008) (“At leas[t] where claims can reasonably to interpreted to include a 5 specific embodiment, it is incorrect to construe the claims to exclude that embodiment, absent 6 probative evidence on the contrary.”). 7 Cisco further argues that Finjan’s proposed construction led to a post-Markman dispute on 8 the claim scope in Finjan, Inc. v. Blue Coat Sys., Inc., No. 13-CV-03999-BLF, 2015 WL 3630000, 9 at *5 (N.D. Cal. June 2, 2015). Responsive Br. 13. In that case, the dispute between the parties was the meaning of “together with” in the adopted construction “performing a hashing function on 11 United States District Court Northern District of California 10 the Downloadable together with its fetched software components . . . .” Finjan, 2015 WL 12 3630000, at *5. Upon reviewing the specification, the court held that the claim term at issue 13 required a hashing function that “transmutes the Downloadable and its components into a unique 14 and reproducible ID for that Downloadable.” Id., at *7; see also id., at *6. Although Cisco 15 appears to have attempted to address the issue raised in Blue Coat, 2015 WL 3630000, the Court 16 finds that Cisco’s construction contains unnecessary language and is confusing. In light of the 17 dispute in Blue Coat, 2015 WL 3630000, the Court will adopt the language which both Finjan and 18 Cisco proposes but modify it as the following: “performing a hashing function on the 19 Downloadable together with its fetched software components to generate a unique and 20 reproducible ID for that Downloadable.” 21 Finjan contends that the claims allow the generation of one or more Downloadable IDs. 22 Opening Br. 15. The Court’s adopted construction does not preclude such a possibility. As 23 discussed in Finjan, 2015 WL 3630000, at *7, a sensible reading of the claims “would be that the 24 ID generator performs ‘one or more’ hashing functions to generate ‘one or more’ Downloadable 25 IDs for ‘one or more’ Downloadables.” Insofar as a specific Downloadable is concerned, the 26 specification discloses performing a hashing function so that “the Downloadable ID will be the 27 same [for that] Downloadable.” ’780 patent at 10:3-5. The Court’s construction is consistent with 28 the specification of the ’780 patent. 25 During the hearing, Cisco asserted that one will not obtain the same Downloadable ID if 1 2 the Downloadable and its components are individually “hash[ed]” and then combined as opposed 3 to “hash[ing]” the combination of the Downloadable and its components altogether. See Hearing 4 Tr. 79:13–16, 80:17–25. However, whether Cisco is correct may depend on the specific hash 5 function that is performed. In any case, Cisco’s argument does not convince this Court that the 6 adopted construction is inconsistent with the record. As discussed above, the specification of the 7 ’780 patent discloses the use of a hashing function that leads to a unique and reproducible ID for a 8 specific Downloadable. See, e.g., ’780 patent at 4:64–66, 10:3-5. 9 VII. The parties dispute three terms in the ’633 patent. All three terms appear in independent 10 United States District Court Northern District of California 11 DISPUTED TERMS IN THE ’633 PATENT claim 13 which recites: 13. A processor-based system for computer security, the system comprising: 12 13 means for receiving downloadable-information; 14 means for determining whether the downloadable-information includes executable code; and 15 means for causing mobile protection code to be communicated to at least one information-destination of the downloadable-information, if the downloadable-information is determined to include executable code. 16 17 ’633 patent at 21:49–57 (emphasis added). The Court addresses the three terms separately below. 18 A. 19 20 21 22 “means for determining whether the downloadable-information includes executable code” (Claim 13) Finjan’s Proposal Function: determining whether the downloadableinformation includes executable code Cisco’s Proposal Function: determining whether the downloadableinformation includes executable code Court’s Construction Function: determining whether the downloadable-information includes executable code Structure: code detection engine to perform the algorithm of col. 2 at 63–66, col. 14, line 58 to col. 15, line 8 or col. 16, lines 16–27. Structure: server with4 content inspection engine for performing algorithm of FIG. 10a described at 19:18–47. Structure: code detector to perform the algorithm of col. 14, line 58 to col. 15, line 8 or col. 16, lines 16–27. 23 24 25 26 There is no dispute that this term is a means-plus-function limitation and that the function 27 28 4 Cisco removed the “server” component in its proposed construction. Responsive Br. 15 n.9. 26 1 is “determining whether the downloadable-information includes executable code.” Opening Br. 2 16; Responsive Br. 15. The Court therefore adopts the agreed upon function. The parties, however, dispute the structure for this limitation. This disagreement 4 implicates three issues. First, Finjan points to “code detection engine,” whereas Cisco points to 5 “content inspection engine” as the structure. Upon reviewing the ’633 patent, the Court finds that 6 there is no meaningful difference between “code detection engine,” “content inspection engine,” 7 and “code detector.” For instance, the specification describes that Fig. 5 illustrates a “content 8 inspection engine” in the Brief Description of the Drawings Section while describing the element 9 depicted in Fig. 5 as a “code detector” in the Detailed Description Section. ’633 patent at 4:60–61, 10 12:8. The term “code detection engine” is used in the Summary of the Invention Section once as a 11 United States District Court Northern District of California 3 general description. See id. at 2:64–66. The parties do not provide any argument that there is a 12 meaningful difference between these terms. In fact, Finjan’s brief uses “code detection engine” to 13 describe portions of the specification which are referenced in connection to a “code detector.” 14 During the hearing, Cisco indicated that the three terms appear to indicate “the same thing.” 15 Hearing Tr. 91:18–25. Against this background, the Court adopts “code detector” which the 16 specification explicitly uses to describe the specific algorithms discussed below. 17 Second, Cisco argues that Finjan’s proposed algorithm at col. 2 at lines 63–66 of the ’633 18 patent “merely parrots the recited function and does not recite an algorithm.” Responsive Br. 15 19 n.10. The Court agrees with Cisco’s argument. Column 2 at lines 62–66 of the specification 20 states that the “protection engine includes an information monitor for monitoring information 21 received by the server, and a code detection engine for determining whether the received 22 information includes executable code.” This portion merely repeats the function and does not 23 disclose an algorithm for Finjan’s proposed structure. Thus, the Court rejects Finjan’s proposal to 24 include the “algorithm [at] col. 2 at 63–66.” See Aristocrat, 521 F.3d at 1334. Third, the main dispute between the parties is what kind of algorithm is the “code detector” 25 26 required to perform.5 Finjan proposes that the “code detector” performs either the algorithm at 27 5 28 Because the Court adopts “code detector,” it will refer to this term throughout this part of the order instead of “code detection engine” or “content inspection engine” proposed by the parties. 27 1 col. 14, line 58 to col. 15, line 8 or col. 16, lines 16–27 of the specification. Cisco proposes that 2 the “code detector” performs the algorithm of FIG. 10a described at col. 19 lines 18–47 of the 3 specification. During the hearing, Cisco clarified its position and stated that it would accept 4 Finjan’s proposal if the word “or” was changed to “and.” See Hearing Tr. 92:23–25, 94:1–3. 5 Here, the parties agree that the ’633 patent discloses two types of techniques that correspond to the recited function issue: (1) file-type detection (see ’633 patent at 14:58–15:8) and 7 (2) content detection (see id. at 16:16–27). File-type detection involves evaluating the file format 8 (e.g., exe, applet, zip, etc.) to determine whether the file contains executable code. Id. at 14:58– 9 15:8. Content detection concerns, for example, analyzing the file for binary information or 10 patterns to determine whether the file contains executable code. Id. at 16:16–27. Here, the 11 United States District Court Northern District of California 6 parties’ dispute is whether the claim term requires both techniques to be deployed or only one. 12 Cisco contends that both techniques must be utilized. 13 The specification itself does not disclose that the code detector must perform both 14 techniques. At the hearing, Cisco argued that its proposed construction is based on Finjan’s 15 arguments that were presented during a reexamination proceeding. Hearing Tr. 94:1–3. 16 According to Cisco, Finjan argued during the reexamination proceeding that the claims require “an 17 active determination” which accounts for the possibility that a downloadable has executable code 18 and that content detection is required because “a downloadable might obfuscate that [it] has 19 executable code.” Responsive Br. 16. In Cisco’s view, Finjan disclaimed the use of only 20 deploying file-type detection and therefore claim 10 requires both file-type detection and content 21 detection in the manner described in relation to Fig. 10a. See id. at 17. 22 Prosecution disclaimer precludes a patentee from recapturing a specific meaning that was 23 previously disclaimed during prosecution. Omega Eng'g, Inc, v. Raytek Corp., 334 F.3d 1314, 24 1325–26 (Fed. Cir. 2003). For prosecution disclaimer to attach, “disavowing actions or statements 25 made during prosecution [must] be both clear and unmistakable.” Id. Here, Cisco relies on 26 Finjan’ statements that the claims “require an active determination as to whether (or not) any (not 27 limited to applets) downloadable information contains executable code” and that “[b]y searching 28 for executable code, rather than simply applet tags, the ’633 [p]atent provides additional protection 28 1 against obfuscated code because a Downloadable may be malicious even if it does not contain an 2 applet identifier.” Responsive Br. 16 (citing Exs. 6 and 7 to Gunther Decl. (response during 3 reexamination proceeding), ECF 112-8, -9). The Court, however, finds that those statements do 4 not show that Finjan clearly and unmistakably disclaimed file-type detection for the claim scope. 5 For instance, arguably, “active determination” and “searching for executable code, rather than 6 simply applet tags” may include analyzing a file format to determine whether the file includes an 7 executable type such as an “exe” file. In other words, at best, whether Finjan disclaimed 8 embodiments that use only the file-type detection is ambiguous. Accordingly, the Court concludes 9 that Cisco has not established that the prosecution history of the ’633 patent shows disclaimer regarding the file-type detection algorithm. Therefore, the Court rejects Cisco’s proposed 11 United States District Court Northern District of California 10 construction. Based on the above discussion, the Court adopts the following structure: “code detector to 12 13 perform the algorithm of col. 14, line 58 to col. 15, line 8 or col. 16, lines 16–27.” 14 B. 15 16 17 18 19 20 21 22 23 24 “means for causing mobile protection code to be communicated to at least one information-destination of the downloadable-information, if the downloadableinformation is determined to include executable code” (Claim 13) Finjan’s Proposal Function: if the downloadable-information is determined to include executable code, causing mobile protection code to be communicated to at least one information-destination of the downloadableinformation without modifying the executable code Cisco’s Proposal Function: causing mobile protection code to be communicated to at least one information-destination of the downloadableinformation, if the downloadable-information is determined to include executable code Court’s Construction Function: if the downloadableinformation is determined to include executable code, causing mobile protection code to be communicated to at least one information-destination of the downloadable-information without modifying the executable code Structure: transfer engine programmed to perform the algorithm of col. 14, lines 24–36. Structure: server with6 packaging engine 403 of FIG. 4 performing the algorithm described at 12:38–12:64 and 13:19– 13:41 Structure: transfer engine programmed to perform the algorithm of col. 14, lines 24–36. 25 26 27 28 6 Cisco removed the “server” component in its proposed construction. Responsive Br. 15 n.9. 29 There is no dispute that this term is a means-plus-function limitation. Regarding the 1 2 function, Finjan proposes that the language “if the downloadable-information is determined to 3 include executable code” should be placed before “causing mobile protection code to be 4 communicated to at least one information-destination of the downloadable-information without 5 modifying the executable code.”7 Opening Br. 18. Cisco contends that the order of the two 6 phrases should be reversed. Responsive Br. 18. As for structure, Finjan points to “transfer engine” that performs “the algorithm of col. 14, 7 8 lines 24–36,” whereas Cisco points to “packaging engine 403 of FIG. 4 [that] perform[s] the 9 algorithm described at 12:38–12:64 and 13:19–13:41.” Compare Opening Br. 17–18 with 10 Responsive Br. 17. The Court first turns to the structure of the claim term which reflects the parties’ main United States District Court Northern District of California 11 12 dispute. Finjan argues that the “transfer engine” is the proper structure because the ’633 patent 13 describes that element to “transfer[] mobile code protection to its information-destination.” 14 Opening Br. 18. Finjan also contends that Cisco’s proposal is incorrect because the portions of the 15 specification identified by Cisco “relate to other components that do not cause mobile protection 16 code to be communicated.” Id. As such, in Finjan’s view, Cisco’s proposed structure imports 17 “limitations that are related to other functions and components, such as the agent generator and 18 linking engine.” Id. at 19. Cisco responds that the “causal link between the determination that the downloadable- 19 20 information includes executable code and the action—causing [mobile protection code] to be 21 communicated—is at the heart of the recited function and must be accounted for in identifying the 22 corresponding structure.” Responsive Br. 18. In this regard, Cisco contends that the transfer 23 engine is not the structure that “causes” communication of the mobile protection code because the 24 transfer engine relies on “results” from the “linking engine,” which is included in the packaging 25 engine. Id. at 19. Cisco further asserts that the transfer engine even transfers Downloadables that 26 do not include executable code presumably without the mobile protection code. Id. at 18–19. 27 7 28 Cisco agrees to the add the limitation “without modifying the executable code.” Responsive Br. 18 n.15. 30 1 After reviewing the ’633 patent, the Court finds that a person of ordinary skill in the art 2 would understand that the transfer engine is the proper structure. First, the specification describes 3 that the transfer engine causes protection “results” to be transferred to a destination user device. 4 ’633 patent at 14:24–27. Specifically, the specification discloses that the transfer engine can 5 transfer “a Downloadable, a determined non-executable, or a sandboxed package.” Id. at 14:27– 6 29 (emphasis added). A sandboxed package can include mobile protection code and a detected- 7 Downloadable. Id. at 11:6–7. Thus, to the extent that Cisco argues that the transfer engine does 8 not “cause” transfer of mobile protection code, that argument is contradicted by the disclosure of 9 the ’633 patent. Second, Cisco improperly relies on the phrase “if the downloadable-information is 11 United States District Court Northern District of California 10 determined to include executable code.” While this phrase states a condition, it does not require 12 that the identified structure take action only when “the downloadable-information is determined to 13 include executable code.” As written, the claim language is silent on when the condition is not 14 satisfied. Thus, Cisco’s contention that the transfer engine cannot be the structure because that 15 element communicates Downloadables without executable code is irrelevant. 16 Third, as Finjan argues (Opening Br. 19), Cisco’s proposed construction would import 17 extraneous limitations that are limited to other functions performed by elements such as the agent 18 generator and linking engine. While the agent generator provides a mobile protection code and the 19 linking engine forms a sandboxed package (’633 patent at 12:38–64, 13:19–41), those elements do 20 not communicate the mobile protection code to a destination. Thus, adopting Cisco’s proposed 21 structure and algorithms would impermissibly import extraneous limitations. Acromed Corp. v. 22 Sofamor Danek Grp., Inc., 253 F.3d 1371, 1382 (Fed. Cir. 2001) (“[A] court may not import into 23 the claim structural limitations from the written description that are unnecessary to perform the 24 claimed function.”). 25 Fourth, other claims in the ’633 patent support the Court’s conclusion that a person of 26 ordinary skill in the art would understand that the transfer engine is the proper structure that causes 27 mobile protection code to be communicated. For example, independent claim 8 recites similar 28 language to the disputed term at issue: 31 1 a protection agent engine communicatively coupled to the content inspection engine for causing mobile protection code (“MPC”) to be communicated by the computer to at least one informationdestination of the downloadable-information, if the downloadableinformation is determined to include executable code. 2 3 ’633 patent at 21:27–33. The specification does not disclose that the “protection agent engine” 5 corresponds to the packaging engine, which is Cisco’s proposed structure. On the other hand, the 6 specification clearly describes that the transfer engine is part of the “protection agent engine.” Id. 7 at 14:24–27. Thus, when reading claims such as claim 8 and the specification of the’633 patent, a 8 person of ordinary skill in the art would understand that the transfer engine is the claimed structure 9 that “caus[es] mobile protection code to be communicated to at least one information-destination 10 of the downloadable-information without modifying the executable code” when the condition “if 11 United States District Court Northern District of California 4 the downloadable-information is determined to include executable code” is satisfied. 12 Accordingly, the Court accepts Finjan’s proposed construction and adopts “transfer engine 13 programmed to perform the algorithm of col. 14, lines 24–36” as the structure. Regarding 14 function, the parties’ proposed functions are not meaningfully different. The Court accepts 15 Finjan’s proposed language which was previously adopted in Finjan, Inc. v. Blue Coat Sys., Inc., 16 No. 13-CV-03999-BLF, 2014 WL 5361976, at *5 (N.D. Cal. Oct. 20, 2014). 17 18 19 20 21 22 23 24 25 26 27 28 C. “information-destination of the downloadable-information” / “downloadableinformation destination” (Claims 1, 8, 13, 14) Finjan’s Proposal No construction necessary – Plain and ordinary meaning. The plain and ordinary meaning of the terms “information-destination” and “downloadableinformation destination” is a device or process that is capable of receiving and initiating or otherwise hosting a mobile code execution. Cisco’s Proposal client(s) that originally requested, and is the final destination for, the downloadable-information Court’s Construction user device that includes one or more devices or process that are capable of receiving and initiating or otherwise hosting a mobile code execution The third disputed term in the ’633 patent is “information-destination of the downloadableinformation” and “downloadable-information destination.” The parties’ proposals construe those 32 1 two phrases to have the same meaning. See Opening Br. 19; Responsive Br. 19. In other words, 2 the parties at least agree that the two phrases should be construed to have the same meaning. See 3 Responsive Br. 20 n.17. 4 Finjan argues that the term should be construed as “a device or process that is capable of 5 receiving and initiating or otherwise hosting a mobile code execution” and that this construction 6 was adopted in Finjan, Inc., v. Proofpoint, Inc., No. 13-CV-05808-HSG, 2015 WL 7770208, at *5 7 (N.D. Cal. Dec. 3, 2015). Opening Br. 19. 8 Cisco counters that Finjan’s proposal ignores the concept of the “downloadable- 9 information” recited in the term and that the court in Proofpoint analyzed only the meaning of “‘information-destination’ and not ‘information-destination of the downloadable.’” Responsive 11 United States District Court Northern District of California 10 Br. 19–20 (emphasis in original). In Cisco’s view, the phrase “of the downloadable-information” 12 requires that “the mobile protection code is transmitted to a specific ‘information-destination.’” 13 Id. at 20. Cisco argues that the specification makes clear that the final destination for the 14 downloadable-information is the client which originally requested the Downloadable. Id. For 15 support, Cisco asserts that the specification describes that Downloadables which are determined 16 not to have executable code are delivered to the client that originally requested the downloadable- 17 information. Id. at 20–21 (citing ’633 patent at 9:44–57). According to Cisco, “the final 18 destination of a downloadable is the same whether the downloadable is found to contain 19 executable code or not.” Id. at 21 (citing ’633 patent at 19:1–17). On this basis, Cisco contends 20 that “the information-destination of the downloadable” is the client that originally requested the 21 downloadable. Id. In addition, Cisco argues that Finjan confirmed during prosecution that a 22 downloadable is sent to the final destination along with the mobile protection code. Id. at 21–22 23 (citing Ex. 8 to Gunther Decl. (6/22/2005 Response), ECF 112-10 (“The present invention 24 provides a packaging of mobile protection code with a downloadable intended for a destination 25 computer . . . . The package is structured so that when it is received at its intended destination 26 computer, the mobile protection code is executed prior to executing the downloadable.”)). 27 28 Court is unpersuaded by Cisco’s arguments. First, there is no basis for Cisco’s contention that taking into account the language “of the downloadable-information” affects the analysis 33 1 conducted by the court in Proofpoint. In fact, Proofpoint addressed the construction of 2 “downloadable-information destination,” which is the very same term at issue here. As such, 3 Proofpoint’s construction is persuasive. Symantec, 2017 WL 550453, at *3 (“[T]o the extent 4 possible, the degree of deference should be greater where the prior claim construction order was 5 issued in the same jurisdiction.”). Second, as mentioned, Cisco contends that the “information-destination of the 6 7 downloadable-information” must be the final destination of a downloadable on the grounds that 8 the specification describes that an unexecutable Downloadable is sent to the client that originally 9 requested the downloadable. The Court finds this argument unpersuasive. Even if Cisco’s characterization of the specification is correct (which the Court does not decide), the portions cited 11 United States District Court Northern District of California 10 by Cisco pertain only to one embodiment disclosed in the ’633 patent. On the other hand, as 12 Finjan asserts, the specification contains other disclosures that support Finjan’s proposal. For 13 example, the specification describes that mobile protection code can be sent to multiple 14 destinations. See ’633 patent at 10:11–15. More importantly, the specification explicitly equates 15 “information-destination” with “user device,”8 and describes that a “user device” can include “one 16 or more devices or processes (such as email, browser or other clients) that are capable of receiving 17 and initiating or otherwise hosting a mobile code execution.” Id. at 7:58–62. In addition, the 18 specification discloses that a “user device” can operate as a firewall/server.” Id. at 7:50. The 19 Court thus finds that Cisco’s reading of the specification is too narrow. Third, Cisco’s reliance on the prosecution history of the ’633 patent is unavailing. During 20 21 prosecution, Finjan described that the “present invention provides a packaging of mobile 22 protection code with a downloadable intended for a destination computer.” See, e.g., Ex. 8 to 23 Gunther Decl. (6/22/2005 Response). However, it is ambiguous whether the “intended . . . 24 destination computer” amounts to a “client that originally requested, and is the final destination 25 for, the downloadable-information.” As such, the Court rejects Cisco’s arguments that rely on the 26 prosecution history. See Inverness Med. Switzerland GmbH v. Warner Lambert Co., 309 F.3d 27 8 28 The specification also equates “user devices” with “Downloadable-destinations.” ’633 patent at 7:5. 34 1 1373, 1382 (Fed. Cir. 2002) (the ambiguity of the prosecution history made it less relevant to 2 claim construction). After reviewing the record, the Court finds that the specification’s description of 3 4 “information-destination” and “user device” to be dispositive: A suitable information-destination or “user device” can further include one or more devices or processes (such as email, browser or other clients) that are capable of receiving and initiating or otherwise hosting a mobile code execution. 5 6 7 8 9 ’633 patent7:58–62. Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996) (“The specification acts as a dictionary when it expressly defines terms used in the claims or when it defines terms by implication.”). Finjan’s proposal does not reference “user device,” which most 10 accurately reflects the meaning of the disputed term as disclosed in the specification. United States District Court Northern District of California 11 Accordingly, the Court adopts Finjan’s proposal with the following modification: “user device that 12 includes one or more devices or process that are capable of receiving and initiating or otherwise 13 hosting a mobile code execution.” This construction is consistent with the holding in Proofpoint. 14 Symantec, 2017 WL 550453, at *3 (holding that deference should be given to a prior claim 15 construction order issued in the same jurisdiction). 16 17 18 19 20 VIII. DISPUTED TERM IN THE ’154 PATENT A. “first function” / “second function” (Claim 1) Finjan’s Proposal No construction necessary – Plain and ordinary meaning. 21 22 23 24 25 26 27 28 Cisco’s Proposal substitute function / original function, which is different than the first function Court’s Construction substitute function / original function, which is different than the first function The parties dispute the meaning of “first function” and “second “function” in independent claim 1, which recites: 1. A system for protecting a computer from dynamically generated malicious content, comprising: a content processor (i) for processing content received over a network, the content including a call to a first function, and the call including an input, and (ii) for invoking a second function with the input, only if a security computer indicates that such invocation is safe; a transmitter for transmitting the input to the security computer for inspection, when the first function is invoked; and 35 1 2 3 a receiver for receiving an indicator from the security computer whether it is safe to invoke the second function with the input. ’154 patent at 17:32–44. Finjan argues that “first function” and “second function” should be given their plain and ordinary meaning because “a person of ordinary skill in the art understands this term as it is used 5 in the claims and the specification without further construction.” Opening Br. 20. According to 6 Finjan, these phrases have been determined to require no construction in Finjan, Inc., v. 7 Proofpoint, Inc., No. 13-CV-05808-HSG, 2015 WL 7770208, at *8 (N.D. Cal. Dec. 3, 2015). 8 Finjan further asserts that the ’154 patent includes embodiments where the “first function and the 9 second function are the same, and not a substitute function.” Opening Br. 20. As an example, 10 Finjan contends that “Document.write(‘<h>hello<h>’) in Table II is the first function and that 11 United States District Court Northern District of California 4 “Document.write(‘text’) in Table III is the second function. Id. Finjan also points out that the 12 ’154 patent describes a recursive function call—Document.write(“<h1>Document.write 13 (“<h1><SCRIPT>Some JavaScript</SCRIPT></h1>”)</h1>”). Reply Br. 15 (citing ’154 patent 14 at 12:28–36). According to Finjan, the outer Document.write() function is the first function and 15 the inner Document.write() function is the second function or vice versa. 16 Cisco counters that Finjan’s proposal renders the terms “first” and “second” superfluous. 17 Responsive Br. 23. Cisco also argues that it would be nonsensical to allow the “first function” and 18 “second function” to be same on the grounds that it would be “impossible to invoke the second 19 function ‘only if’ a security computer indicates such invocation is safe” as the “same” first 20 function would have been already invoked. Id. Based on the specification, Cisco claims that the 21 “first function” is the substitute function and that the “second function” is the original function 22 disclosed in the ’194 patent. Id. at 23–24. In addition, Cisco asserts that Finjan’s statements 23 before the PTAB during an inter partes review (“IPR”) proceeding show that the “first function” is 24 the “substitute function.” Id. at 24. 25 As a preliminary issue, the “use of the terms ‘first’ and ‘second’ is a common patent-law 26 convention to distinguish between repeated instances of an element or limitation.” 3M Innovative 27 Properties Co. v. Avery Dennison Corp., 350 F.3d 1365, 1371 (Fed. Cir. 2003). As such, the 28 Court is not barred from construing the “first function” and the “second function” as the same type 36 1 of function (e.g., Document.write). However, claims are not construed in vacuum. The Court 2 must determine how a person of ordinary skill in the art would understand the claim terms based 3 on the intrinsic and extrinsic record. Phillips, 415 F.3d at 1313–18. In doing so, it is entirely 4 appropriate for the Court to “rely heavily on the written description for guidance as to the meaning 5 of the claims” and look to the remainder of the claim language. Phillips, 415 F.3d at 1314, 1317; 6 Linear Tech. Corp. v. Int'l Trade Comm'n, 566 F.3d 1049, 1059 (Fed. Cir. 2009). Against this 7 backdrop, the Court agrees with Cisco’s proposed construction upon reviewing the record as 8 stated below. 9 Finjan’s argument that “Table II identifies a first function as Document.write (‘<h>hello<h>’), and Table III identifies a second function as “Document.write(‘text’)” is 11 United States District Court Northern District of California 10 unsupported by the specification when viewed in light of the language in claim 1. Specifically, 12 claim 1 requires that “a transmitter for transmitting the input to the security computer for 13 inspection, when the first function is invoked.” ’154 patent at 17:39–40 (emphasis added). 14 Although Finjan is correct that the specification discusses document.write( ) in relation to Tables 15 II and III, nowhere does the specification disclose invoking Document.write(‘<h>hello<h>’) (i.e., 16 Finjan’s first function) to transmit the input of the first function to the security computer for 17 inspection. Rather, the specification describes that invoking the substitute function (e.g., 18 substitute_document.write( )) leads to the transmission of the input to the security computer. ’154 19 patent at 10:62–64. As such, Finjan’s argument is inconsistent with other limitations of claim 1 20 and the specification. Moreover, Finjan’s contention that the ’154 patent describes a recursive 21 function call suffers from the same problem. Therefore, the Court finds that a person of ordinary 22 skill in the art would not understand the “first function” and “second function” as Finjan suggests. 23 Finjan does not point to any disclosure in the ’194 patent that shows that invoking the 24 “first function” leads to “transmi[ssion] [of] the input to the security computer for inspection” 25 where the “first function” and “second function” are the same type of function. To be sure, a court 26 should be careful in confining claims to embodiments disclosed in the specification. Phillips, 415 27 F.3d at 1323. But limitations in the specification may very well define the scope of the claim if 28 that is “how a person of ordinary skill in the art would understand the claim terms.” See id. 37 1 Because the claims and disclosure of the ’154 patent supports Cisco’s proposed construction and 2 contradicts Finjan’s arguments, the Court agrees with Cisco’s proposal. 3 The above conclusion is reinforced by Finjan’s statements before the PTAB during the IPR proceeding. For example, Finjan argued that “[t]he ’154 patent talks about a call to a first 5 function, and that’s a call to a substitute function. . . . If you call a substitute function or you call a 6 first function, you don’t have the opportunity to call an original function which may harm your 7 computer.” Ex. 11 to Gunther Decl. (IPR2016-00151 Tr.) at 35:3–8, ECF 112-13. During the 8 hearing before this Court, Finjan asserted that it was only referring to examples and did not intend 9 to limit “first function” and “second function” to original and substitution functions. Hearing Tr. 10 114:1–9. The transcript of the IPR proceeding, however, reflects that Finjan repeatedly indicated 11 United States District Court Northern District of California 4 that calling the first function is calling the substitute function (as opposed to calling the original 12 function). Even if Finjan made those representations as examples, the IPR proceeding does not 13 provide any support that the “first function” and “second function” can be the same function such 14 as document.write( ) as Finjan proposes. 15 At the hearing, Finjan further argued that the “’154 patent . . . [does not] require 16 modification of the content” and that “there’s nothing about a gateway, any modification 17 happening, and certainly nothing about replacing function calls.” Hearing Tr. 104:12–18. It 18 appears that Finjan made this argument to rebut Cisco’s construction that the “first function” is the 19 “substitute function.” However, the specification clearly discloses a content modifier in the 20 gateway that modifies original content to replace the original function with the substitute function. 21 See, e.g., ’154 patent at 9:13–28. In fact, in Proofpoint, Finjan made such an argument to address 22 claim construction of the same disputed term. 2015 WL 7770208, at *8 (“Plaintiff notes that . . . 23 the original function is replaced by the substitute function at the gateway, before the security 24 computer receives the content.” (emphasis in original)). To be clear, claim 1 does not recite a 25 gateway that modifies content. Such an element is not claimed. That said, for the reasons 26 discussed earlier, a person of ordinary skill in the art would understand that the “first function” 27 corresponds to the substitute function in light of the claim language and the specification. 28 For the above reasons, the Court adopts Cisco’s proposed construction: the “first function” 38 1 means “substitute function,” and the “second function” means “original function, which is 2 different than the first function.” The Court recognizes that this construction is different from the 3 construction provided in Proofpoint. The Court respectfully diverges from Proofpoint because 4 that case was neither presented with the issue whether the “first function” is the substitute function 5 nor had the benefit of reviewing Finjan’s recent statements made during the IPR proceeding. 6 IX. 7 As set forth above, the Court construes the disputed terms as follows: Claim Term Court’s Construction Function: receiving a Downloadable “means for receiving a Downloadable” 8 9 10 United States District Court Northern District of California 11 12 ORDER (’844 patent, claim 43) “means for generating a first Downloadable security profile that identifies suspicious code in the received Downloadable” Structure: downloadable file interceptor Function: generating a first Downloadable security profile that identifies suspicious code in the received Downloadable (’844 patent, claim 43) Structure: content inspection engine programmed to perform the algorithm disclosed at Col. 8, lines 51–60 of the ’844 patent Function: linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients 13 14 16 “means for linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients” 17 (’844 patent, claim 43) 15 18 19 20 21 22 23 “before a web server makes the Downloadable available to web clients” 24 (’844 patent, claims 1, 15, 43) 25 26 27 28 “Downloadable Scanner” (’494 patent, claim 10) “performing a hashing function on the Downloadable and the fetched software Structure: content inspection engine programmed to perform step 630 of FIG. 6, disclosed at 8:65–67 and col. 6, lines 13–20. Specifically, attaching a Downloadable security profile to the Downloadable (col. 8, lines 65–67 and col. 6, lines 13–18) or attaching to the Downloadable a pointer that points to a stored Downloadable security profile (col. 6, lines 18–20). Plain and ordinary meaning. Plain and ordinary meaning of “web client” is “an application on the computer of an end user that requests a Downloadable from the web server” software that searches code to identify suspicious patterns or suspicious computer operations performing a hashing function on the Downloadable together with its fetched 39 1 2 3 4 5 6 7 8 9 components to generate a Downloadable ID” (’780 patent, claims 1, 9, 17, 18) “means for determining whether the downloadable-information includes executable code” (’633 patent, claim 13) “means for causing mobile protection code to be communicated to at least one informationdestination of the downloadable-information, if the downloadable-information is determined to include executable code” (’633 patent, claim 13) 10 United States District Court Northern District of California 11 12 13 14 15 “information-destination of the downloadableinformation” / “downloadable-information destination” (’633 patent, claims 1, 8, 13, 14) “first function” / “second function” Function: determining whether the downloadable-information includes executable code Structure: code detector to perform the algorithm of col. 14, line 58 to col. 15, line 8 or col. 16, lines 16–27. Function: if the downloadable-information is determined to include executable code, causing mobile protection code to be communicated to at least one informationdestination of the downloadable-information without modifying the executable code Structure: transfer engine programmed to perform the algorithm of col. 14, lines 24–36. user device that includes one or more devices or process that are capable of receiving and initiating or otherwise hosting a mobile code execution substitute function / original function, which is different than the first function (’154 patent, claim 1) The Court also adopts the following constructions that the parties agreed to in their Joint 16 17 software components to generate a unique and reproducible ID for that Downloadable Claim Construction Statement: 18 Term Agreed Construction 19 Downloadable 20 (’844 patent, claims 1, 15, 43; ’494 patent, claim 10; ’780 patent, claims 1, 9, 17, 18) an executable application program, which is downloaded from a source computer and run on the destination computer 21 22 23 24 25 26 27 Database (’494 patent, claim 10) a collection of interrelated data organized according to a database schema to serve one or more applications IT IS SO ORDERED. Dated: July 23, 2018 ______________________________________ BETH LABSON FREEMAN United States District Judge 28 40

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?