Finjan, Inc. v. Sonicwall, Inc.

Filing 132

ORDER CONSTRUING CLAIMS IN U.S. PATENT NOS. 6,154,844; 6,965,968; 7,058,822; 7,613,926; 7,647,633; 8,225,408. Signed by Judge Beth Labson Freeman on 3/26/2019. (blflc3S, COURT STAFF) (Filed on 3/26/2019)

1
2
3

UNITED STATES DISTRICT COURT

4

NORTHERN DISTRICT OF CALIFORNIA

5

SAN JOSE DIVISION

6
7

FINJAN, INC.,
Plaintiff,

8
v.

9
10

SONICWALL, INC.,

ORDER CONSTRUING CLAIMS IN
U.S. PATENT NOS. 6,154,844; 6,965,968;
7,058,822; 7,613,926; 7,647,633; 8,225,408

Defendant.

11

United States District Court
Northern District of California

Case No. 17-cv-04467-BLF

12
13

Plaintiff Finjan, Inc. (“Finjan”) brings this patent infringement lawsuit against Defendant

14

Sonicwall, Inc. (“Sonicwall”), alleging infringement of ten patents, including six that are at issue

15

in the present claim construction dispute: U.S. Patent Nos. 6,154,844 (the “’844 Patent”);

16

6,965,968 (the “’968 Patent”); 7,058,822 (the “’822 Patent”); 7,613,926 (the “’926 Patent”);

17

7,647,633 (the “’633 Patent”); and 8,225,408 (the “’408 Patent”). The Court held a Markman

18

hearing on March 1, 2019 (“the Hearing”) for the purpose of construing ten disputed terms in the

19

above listed patents.

20

I.

BACKGROUND

21

The asserted patents are directed to network security technologies that detect online threats

22

from malware. Finjan asserts that Sonicwall’s products and services infringe the asserted patents.

23

See generally Compl., ECF 1. Each of the six patents at issue in the present claim construction

24

dispute is summarized below.

25

A.

26

The ’822 Patent is titled “Malicious Mobile Code Runtime Monitoring System and

The ’822 Patent and ’633 Patent

27

Methods” and was issued on June 6, 2006. Ex. 1 to Kastens Decl. (the ’822 Patent), ECF 89-2.

28

The ’633 Patent has the same name and specification and was issued on January 12, 2010. Ex. 2

1

to Kastens Decl. (the ’633 Patent), ECF 89-2. These related patents provide systems and methods

2

for protecting devices on an internal network from code, applications, and/or information

3

downloaded from the Internet that perform malicious operations. See, e.g., ’633 Patent at

4

Abstract. At a high level, some embodiments include a protection engine that resides on a

5

network server and monitors incoming information for executable code. Id. at 2:20–3:4. Upon

6

detection of executable code, the protection engine deploys a “mobile protection code” and

7

protection policies to a downloadable-destination. Id. at 3:5–21. At the destination, the

8

Downloadable is executed, typically within a sandboxed environment, and malicious or potentially

9

malicious operations that run or attempt to run are intercepted and neutralized by the mobile

10

protection code according to set protection policies. See id. at 3:22–40.
The ’844 Patent

United States District Court
Northern District of California

11

B.

12

The ’844 Patent is titled “System and Method for Attaching a Downloadable Security

13

Profile to a Downloadable” and was issued on November 28, 2000. Ex. 3 to Kastens Decl. (the

14

’844 Patent), ECF 89-2. This patent claims systems and methods for inspecting Downloadables

15

for suspicious code or behavior according to a set of rules and generating a profile of the results

16

from the inspection. See, e.g., id. at 1:62–3:7. In some embodiments, a content inspection engine

17

generates a security profile and links that profile to a Downloadable. Id. at 2:3–11. The profile

18

can include certificates that are later read by a protection engine to determine whether or not to

19

trust the profile. Id. at 2:20–48. By providing verifiable profiles, the claimed systems and

20

methods may efficiently protect computers from hostile Downloadables. Id. at 2:61–3:7.
The ’926 Patent

21

C.

22

The ’926 Patent is titled “Method and System for Protecting a Computer and a Network

23

from Hostile Downloadables” and was issued on November 3, 2009. Ex. 4 to Kastens Decl. (the

24

’926 Patent), ECF 89-2. The patent provides “protection systems and methods [for] [p]rotecting a

25

personal computer (“PC”) or other persistently or even intermittently network accessible devices

26

or processes from harmful, undesirable, suspicious or other ‘malicious’ operations.” Id. at 2:27–

27

31. To achieve this goal, some embodiments utilize a protection engine in order to determine

28

whether potential downloadables include executable code. See, e.g., id. at 9:57–62.
2

The ’408 Patent

1

D.

2

The ’408 Patent is titled “Method and System for Adaptive Rule-Based Content Scanners”

3

and was issued on July 17, 2012. Ex. 5 to Kastens Decl. (the ’408 Patent), ECF 89-2. The patent

4

provides “a method and system for scanning content that includes mobile code, to produce a

5

diagnostic analysis of potential exploits within the content.” Id. at 1:59–61. The invention uses an

6

adaptive rule-based content (“ARB”) scanner, which dynamically scans and diagnoses incoming

7

Internet content. See id. at 1:65–2:24. The system generates a parse tree based on tokens and

8

patterns of tokens it identifies, then identifies exploits (the malicious portions of the code) within

9

the parse tree. See id. at 2:25–57.
The ’968 Patent

E.

11

United States District Court
Northern District of California

10

The ’968 Patent is titled “Method and System for Adaptive Rule-Based Content Scanners”

12

and was issued on July 17, 2012. Ex. 6 to Kastens Decl. (the ’968 Patent), ECF 89-2. Content

13

from the Internet can be cached so that the same web page does not have to be retrieved each time

14

a user on the network requests the page. However, users on the same network may have different

15

security policies—different sets of rules that govern whether a file is allowed through the security

16

filter. The ’968 Patent provides a system and method of managing cached content in relation to

17

multiple security policies by, inter alia, providing a “policy-based index . . . indicating

18

allowability of cached content relative to a plurality of policies.” See id. at 1:63–2:7. A cache

19

manager may then utilize the policy-based index to determine whether cached content is allowable

20

for a different user than the original user who requested it and block cached content from being

21

delivered to users for whom it is not allowed. Id. at 2:7–11.

22

II.

LEGAL STANDARD

23

A.

24

Claim construction is a matter of law. Markman v. Westview Instruments, Inc., 517 U.S.

25

370, 387 (1996). “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the

26

invention to which the patentee is entitled the right to exclude.’” Phillips v. AWH Corp., 415 F.3d

27

1303, 1312 (Fed. Cir. 2005) (en banc) (internal citation omitted). As such, “[t]he appropriate

28

starting point . . . is always with the language of the asserted claim itself.” Comark Commc’ns,

General Principles

3

1
2

Inc. v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998).
Claim terms “are generally given their ordinary and customary meaning,” defined as “the

3

meaning . . . the term would have to a person of ordinary skill in the art in question . . . as of the

4

effective filing date of the patent application.” Phillips, 415 F.3d at 1313 (internal citation

5

omitted). The court reads claims in light of the specification, which is “the single best guide to the

6

meaning of a disputed term.” Id. at 1315; see also Lighting Ballast Control LLC v. Philips Elecs.

7

N. Am. Corp., 744 F.3d 1272, 1284–85 (Fed. Cir. 2014) (en banc). Furthermore, “the

8

interpretation to be given a term can only be determined and confirmed with a full understanding

9

of what the inventors actually invented and intended to envelop with the claim.” Phillips, 415
F.3d at 1316 (quoting Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1250 (Fed.

11

United States District Court
Northern District of California

10

Cir. 1998)). The words of the claims must therefore be understood as the inventor used them, as

12

such understanding is revealed by the patent and prosecution history. Id. The claim language,

13

written description, and patent prosecution history thus form the intrinsic record that is most

14

significant when determining the proper meaning of a disputed claim limitation. Id. at 1315–17;

15

see also Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996).

16

Evidence external to the patent is less significant than the intrinsic record, but the court

17

may also consider such extrinsic evidence as expert and inventor testimony, dictionaries, and

18

learned treatises “if the court deems it helpful in determining ‘the true meaning of language used

19

in the patent claims.’” Philips, 415 F.3d at 1318 (quoting Markman, 52 F.3d at 980). However,

20

extrinsic evidence may not be used to contradict or change the meaning of claims “in derogation

21

of the ‘indisputable public records consisting of the claims, the specification and the prosecution

22

history,’ thereby undermining the public notice function of patents.” Id. at 1319 (quoting

23

Southwall Techs., Inc. v. Cardinal IG Co., 54 F.3d 1570, 1578 (Fed. Cir. 1995)).

24

B.

25

Paragraph 6 of 35 U.S.C § 112 provides for means-plus-function claiming: “An element in

26

a claim for a combination may be expressed as a means . . . for performing a specified function . . .

27

and such claim shall be construed to cover the corresponding structure, material, or acts described

Means-Plus-Function Claims

28
4

1

in the specification and equivalents thereof.”1 When a claim uses the term “means” to describe a

2

limitation, it creates a presumption that the inventor used the term to invoke § 112 ¶ 6. Biomedino

3

v. Waters Technologies, 490 F.3d 946, 950 (Fed. Cir. 2007). The “presumption can be rebutted

4

when the claim, in addition to the functional language, recites structure sufficient to perform the

5

claimed function in its entirety.” Id.

6

If a court concludes that a claim limitation is a means-plus-function limitation, “two steps

7

of claim construction remain: 1) the court must first identify the function of the limitation; and 2)

8

the court must then look to the specification and identify the corresponding structure for that

9

function.” Id. The claim limitation will then be construed to cover that corresponding structure
and equivalents thereof. 35 U.S.C § 112 ¶ 6.

11

United States District Court
Northern District of California

10

III.

AGREED CONSTRUCTIONS
The parties agree on the construction of several terms. See Joint Claim Construction

12
13

Statement, ECF 80. Some of the agreed upon terms appear in U.S. Patent Nos. 6,804,780

14

(the “ʼ780 Patent”); 7,975,305 (the “’305 Patent”); and 8,677,494 (the “’494 Patent”), which are

15

asserted in this action but not subject to claim construction dispute. The Court approves and

16

adopts the following constructions:

17

Claim Term

Agreed Construction

18

“Downloadable”

19

(’844 Patent, claims 1, 15, 41, 43;
’494 Patent, claim 10;
’780 Patent, claims 1, 9, 17;
’926 Patent, claim 22)

“an executable application program, which is downloaded
from a source computer and run on the destination computer”

20
21

“database”

22

(’494 Patent, claim 10;
’926 Patent, claim 22;
’305 Patent, claims 1, 13)

23

“a collection of interrelated data organized according to a
database schema to serve one or more applications”

24
25
26
27
28

1

Paragraph 6 of 35 U.S.C. § 112 was replaced with newly designated § 112(f) when the America
Invents Act (“AIA”), Pub. L. No. 112-29, took effect on September 16, 2012. Because the patents
herein were filed before that date, the Court refers to the pre-AIA version of § 112.
5

2

“means for fetching at least one
software component identified by
the one or more references”

3

(’780 Patent, claim 17)

1

5

7
8
9

“means for obtaining a
Downloadable that includes one
or more references to software
components required to be
executed by the Downloadable”

United States District Court
Northern District of California

Function: obtaining a Downloadable that includes one or
more references to software components required to be
executed by the Downloadable
Structure: ID generator programmed to perform the
algorithm of step 810 disclosed in the ’780 Patent at Fig. 8;
9:60–62; and 4:50–54.

11

“parse tree”

12

(’408 Patent, claims 1, 9, 22)

14

Governed by 35 U.S.C. § 112(6)

(’780 Patent, claim 17)

10

13

Function: fetching at least one software component identified
by the one or more references
Structure: ID generator programmed to perform the
algorithm of step 820 disclosed in the ’780 Patent at Fig. 8;
9:62–64; and 4:56–66.

4

6

Governed by 35 U.S.C. § 112(6)

“policy index”
(’968 Patent, claim 1)

“a hierarchical structure of interconnected nodes built from
scanned content”
“a data structure indicating allowability of cached content
relative to a plurality of policies”

15
16
17

IV.

DISCUSSION
Prior to the Hearing the parties stipulated to forgo oral argument on disputed terms two,

18

three, four, and five under the expectation that the Court would adopt the constructions for these

19

terms entered in Finjan Inc. v. Cisco Systems, Inc., Case No. 17-cv-00072-BLF (“the Cisco case”).

20

See Stipulation to Streamline Issues for Oral Argument, ECF 122. In so stipulating the parties

21

have not waived any of their respective appellate rights and have not withdrawn any of their

22

respective positions as set forth in the claim construction briefing in the instant action. See id.

23

at 1. As set forth below, the Court does adopt the constructions previously entered in the Cisco

24

case for disputed terms two, three, four, and five and includes discussion in the present order that

25

mirrors the discussion in the Cisco case for these terms. In addition, the Court adopts a

26

construction for disputed term one that is identical to the construction in the Cisco case although

27

here the Court annotates term one to make clear an implicit limitation. The Court discusses in turn

28

the ten disputed terms.
6

1
2
3
4
5
6

A.

Disputed terms in the ’822 Patent and ’633 Patent
1. “mobile protection code” (’633 Patent claims 1, 8, and 14) (’822 Patent
claims 1 and 9)

Finjan’s Proposal
“code that,
at runtime, monitors or
intercepts actually or
potentially malicious code
operations without modifying
the executable code”

Sonicwall’s Proposal
“mobile executable code that,
at runtime, monitors for and
intercepts actually or
potentially malicious code
operations without modifying
the executable code”

Court’s Construction
“code that,
at runtime, monitors or
intercepts actually or
potentially malicious code
operations without modifying
the executable code”

7
where the mobile protection
code itself must be executable

8
9
10

United States District Court
Northern District of California

11

As a representative example, the disputed term “mobile protection code” appears in
independent claim 1 of the ’633 Patent, which recites:
1. A computer processor-based method, comprising:

12

receiving, by a computer, downloadable-information;

13

determining, by the computer, whether the downloadable-information includes
executable code; and

14
15
16
17
18
19
20
21
22
23
24
25
26
27

based upon the determination, transmitting from the computer mobile protection
code to at least one information-destination of the downloadable-information, if the
downloadable-information is determined to include executable code.
’633 Patent at 20:54–62 (emphasis added).
Finjan argues that its proposed construction is proper because it is consistent with how a
person of ordinary skill in the art would understand the intrinsic record and because its proposed
construction has already been adopted in this District by this Court. See Opening Br. at 4–5,
ECF 89. Indeed, prior claim construction orders issued in the same jurisdiction are entitled to
substantial deference. See Finjan, Inc. v. Symantec Corp., 2017 WL 550453, at *3 (N.D. Cal. Feb.
10, 2017) (“If anything, to the extent possible, the degree of deference should be greater where the
prior claim construction order was issued in the same jurisdiction.”); Visto Corp. v. Sproqit Techs.,
Inc., 445 F. Supp. 2d 1104, 1107–08 (N.D. Cal. 2006) (explaining that the Supreme Court has
stressed the particular importance of intrajurisdictional uniformity in claim construction).
In Finjan, Inc. v. Blue Coat Sys., Inc., 2014 WL 5361976 (N.D. Cal. Oct. 20, 2014) (“Blue
Coat I”), the undersigned considered precisely the term “mobile protection code” in the very same

28
7

1

’633 Patent and construed the term as “code that, at runtime, monitors or intercepts actually or

2

potentially malicious code operations.” Id. at *3; see also Finjan, Inc. v. Proofpoint, Inc., 2015

3

WL 7770208, at *5 (N.D. Cal. Dec. 3, 2015) (Judge Gilliam adopting an identical construction for

4

the same term in the same patent). Finjan’s proposed construction in the instant action seeks to

5

append the phrase “without modifying the executable code” but is otherwise identical to the

6

construction adopted by this Court in Blue Coat I and Proofpoint. Review of the undersigned’s

7

Blue Coat I order confirms that appending “without modifying the executable code” to the Court’s

8

prior construction is consistent with the Court’s prior order. In Blue Coat I, the Court considered

9

the related term “causing mobile protection code to be executed . . .” and construed it to require
that “the mobile protection code [is] communicated . . . without modifying the executable code.”

11

United States District Court
Northern District of California

10

2014 WL 5361976, at *8 (emphasis added). The Court additionally noted that “the intrinsic

12

evidence . . . indicate[s] that the MPC [mobile protection code] travels to the destination without

13

modifying executable code.” Id. Moreover, here, Sonicwall includes the “without modifying the

14

executable code” language in its own proposed construction. See Responsive Br. at 1, ECF 109.

15

In sum, Finjan’s proposed construction of “mobile protection code” in the instant action is

16

effectively the same as that adopted in Blue Coat I and Proofpoint and entitled to deference, see

17

Symantec, 2017 WL 550453, at *3.

18

The Court has carefully considered Sonicwall’s construction but is not persuaded

19

Sonicwall’s arguments overcome the deference provided Finjan’s proposed construction. For

20

example, Sonicwall seeks a construction that the mobile protection code “monitors for and

21

intercepts” malicious code. Responsive Br. at 1 (emphasis added). In other words, Sonicwall

22

argues that “monitors” and “intercepts” are “essentially synonymous.” Id. at 3. The intrinsic

23

evidence reveals that the mobile protection code “monitor[s] or otherwise intercept[s]” such

24

malicious operations. See ’633 Patent at 3:7–11 (emphasis added). While this may indicate that

25

“monitoring” is a subset of “intercepting” it does not equate the two terms. Moreover, the

26

specification further states that “the mobile protection code . . . enables various Downloadable

27

operations to be detected, intercepted or further responded to via protection operations.” Id. at

28

2:52–55 (emphasis added). This statement does not preclude monitoring that is separate from
8

1

intercepting. Thus, the Court does not find the intrinsic evidence sufficiently clear to justify

2

departure from the prior claim construction orders that explicitly construed mobile protection code

3

to “monitor[] or intercept[],” see Blue Coat I, 2014 WL 5361976, at *3; Proofpoint, 2015 WL

4

7770208, at *5.

5

However, Sonicwall does point out that the undersigned previously found that “the ‘code’

6

in ‘mobile protection code’ must be executable code.” See Finjan, Inc. v. Blue Coat Sys., LLC,

7

283 F. Supp. 3d 839, 870–71 (N.D. Cal. 2017) (“Blue Coat II”) (summary judgment order

8

discussing an implicit limitation in the undersigned’s claim construction order in Blue Coat I); see

9

also Responsive Br. at 2. The Court has reviewed its reasoning in Blue Coat II and agrees that the
“mobile protection code” must be executable code. At the Hearing, Finjan agreed that an

11

United States District Court
Northern District of California

10

annotation to reflect this limitation would be “consistent with [the Court’s] previous order.” See

12

Hearing Tr. at 7:18–19, ECF 127. Thus, the Court annotates the term to make clear this limitation

13

implicit in the undersigned’s prior constructions of the term.

14

Accordingly, for the reasons above, the Court adopts Finjan’s construction as annotated.

15

2. “A computer program product, comprising a computer usable medium
having a computer readable program code therein, the computer readable
program code adapted to be executed for computer security, the method
comprising:” (’633 Patent claim 14)

16
17
18
19
20
21
22
23
24
25
26
27

Finjan’s Proposal
The typographical error in the
preamble is corrected to read:
“A computer program
product, comprising a
computer usable medium
having a computer readable
program code therein, the
computer readable program
code adapted to be executed
for computer security,
comprising:”

Sonicwall’s Proposal
The phrase “the method”
should not be struck from the
preamble. As written, the
claim is indefinite under
IPXL for reciting a mix of
statutory classes of subject
matter.

Court’s Construction
The typographical error in the
preamble is corrected to read:
“A computer program
product, comprising a
computer usable medium
having a computer readable
program code therein, the
computer readable program
code adapted to be executed
for computer security,
comprising:”

The parties dispute whether the words “the method” in the preamble to claim 14 of the
’633 Patent are the result of a typographical error and properly removed in construing the claim.
Finjan argues that the words should be removed while Sonicwall argues that the words should
remain and render the claim indefinite under IPXL Holdings, L.L.C. v. Amazon.com, Inc., 430 F.3d

28
9

1

1377 (Fed. Cir. 2005). See Opening Br. at 7–8; Responsive Br. at 4–7.
The undersigned considered precisely this issue in Blue Coat I, 2014 WL 5361976. In

2
3

Blue Coat I the parties also disputed whether the words “the method” in the preamble to claim 14

4

were a typographical error. Id. at *7. The undersigned agreed with Plaintiff Finjan and construed

5

the term “to correct the typographical error” resulting in a construction identical to Finjan’s

6

proposed construction in the instant action. See id. at *7–8; Opening Br. at 7. The undersigned

7

further noted that “the corrected preamble can be reasonably interpreted to set forth a computer

8

readable program code that, when executed, performs the limitations of the claim.” Blue Coat I,

9

2014 WL 5361976, at *7.
When a patentee seeks a correction of claim language, “a district court can do so only if

10

United States District Court
Northern District of California

11

(1) the correction is not subject to reasonable debate based on consideration of the claim language

12

and the specification and (2) the prosecution history does not suggest a different interpretation of

13

the claims.” Novo Indus., L.P. v. Micro Molds Corp., 350 F.3d 1348, 1354 (Fed. Cir. 2003).

14

Sonicwall argues that in Blue Coat I the undersigned was “not presented with the language of the

15

dependent claims and prosecution history that: (i) contradicts Finjan’s correction; and (ii) suggests

16

a different possible interpretation of the preamble.” Responsive Br. at 4. In other words,

17

Sonicwall contends that the Court’s construction in Blue Coat I is not valid because the Court’s

18

“correction” to remove the words “fails both of the[] [Novo] requirements” when considering “the

19

dependent claims and prosecution history” of the ’633 Patent. See Responsive Br. at 4.
However, contrary to Sonicwall’s suggestion, the undersigned was faced with essentially

20
21

the same record and arguments in Blue Coat I. For example, Blue Coat argued—as Sonicwall

22

does here—that during the prosecution of the ’633 Patent the preamble was amended to be in line

23

with Ex Parte Bo Li, 88 U.S.P.Q.2d 1695 (2008), and thus not transformed into a proper

24

Beauregard claim.2 See Blue Coat’s Responsive Br. at 22–23, ECF 66 in 5:13-cv-03999;

25

Responsive Br. 4–5. As another example, Blue Coat argued that “a person of ordinary skill in the

26
27
28

2

Computer-readable media claims—such as claims covering programs encoded on tangible
computer-readable media—are commonly referred to as Beauregard claims after In re
Beauregard, 53 F.3d 1583 (Fed. Cir. 1995).
10

1

art looking at the claim language, specification, and prosecution history would be left to surmise

2

various inconsistent corrections,” see Blue Coat’s Responsive Br. at 23 (relying on Nova, 350 F.3d

3

at 1357), while Sonicwall likewise argues that the “claims” and “prosecution [history] suggest[] a

4

different interpretation” under Nova, see Responsive Br. at 5. In Blue Coat I, the undersigned

5

considered and rejected the arguments raised by Blue Coat and Sonicwall makes a no more

6

compelling case here.

7

Sonicwall additionally argues that because dependent claims 15 to 20 refer to “the method

8

of claim 14” there is reasonable debate about how the claim should be corrected. See Responsive

9

Br. at 4 (citing ’633 Patent) (emphasis removed). However, Sonicwall cannot credibly argue that
dependent claims 15 to 20 were not available to the Court in deciding Blue Coat I. Indeed, the

11

United States District Court
Northern District of California

10

Court previously found that the corrected preamble to claim 14 sets forth not a method but “a

12

computer readable program code.” Blue Coat I, 2014 WL 5361976, at *7. Moreover, the Court’s

13

prior construction in Blue Coat I is entitled to deference, see Symantec, 2017 WL 550453, at *3,

14

and Finjan seeks an identical construction here. In sum, the Court adopts Finjan’s construction.

15

Having removed the words “the method” from claim 14, the Court need not and does not

16

reach Sonicwall’s indefiniteness arguments under IPXL which depend on inclusion of the words

17

“the method.” See Responsive Br. at 6–7; see also Finjan, Inc. v. Blue Coat Sys., Inc., 2015 WL

18

3630000, at *12 (N.D. Cal. June 2, 2015) (finding claim 14 of the ’633 Patent not indefinite as

19

construed to not include the words “the method”).
Disputed terms in the ’844 Patent

20

B.

21

The parties dispute three terms in the ’844 Patent. All three terms appear in independent

22
23

claim 43 which recites:
43. An inspector system comprising:

24

means for receiving a Downloadable;

25

means for generating a first Downloadable security profile that identifies
suspicious code in the received Downloadable; and

26
27
28

means for linking the first Downloadable security profile to the Downloadable
before a web server makes the Downloadable available to web clients.
’844 Patent at 14:34–42 (emphasis added).
11

Sonicwall’s briefing raises a threshold issue regarding the three disputed terms recited in

1
2

claim 43. See Responsive Br. at 7–9. Specifically, Sonicwall contends that claim 43 is directed to

3

the “inspector 125” embodiment as opposed to the “network gateway 110” embodiment in

4

the ’844 Patent. Id. Finjan disagrees. See Reply Br. at 4–5, ECF 110. Because the parties’

5

disagreement pertains to a common issue in the disputed terms, the Court addresses that issue first.

6

Sonicwall argues that claim 43 is an “inspector system” claim and “cannot be read onto a

7

network gateway” for several reasons. See Responsive Br. at 7. Sonicwall first contends that the

8

preamble of claim 43 recites “an inspector system” and that Finjan added this word during

9

prosecution. See Responsive Br. at 8 (emphasis in original). According to Sonicwall, Finjan
argued before the patent examiner that “the claims were distinct from [the] Ji [prior art reference]

11

United States District Court
Northern District of California

10

because Ji disclosed a network gateway whereas the claims are directed to an ‘inspector.’” Id.

12

(citing Ex. E to McGrath Decl. (5/3/2000 Response) at 4, ECF 109-6). On this basis, Sonicwall

13

claims that Finjan manifested a clear intention to limit the claim scope to “inspector 125” while

14

excluding gateway embodiments. Id. at 8.

15

Sonicwall then asserts that claim 43 requires the inspector system to generate a

16

Downloadable Security Profile (“DSP”) and link the DSP to the Downloadable before a web

17

server makes the Downloadable available to web clients. Responsive Br. at 8. In Sonicwall’s

18

view, only the inspector 125 is described in the specification as both “generating” and “linking”

19

the DSP. Id. Sonicwall further asserts that the generic protection engine of the network gateway

20

only generates the DSP and passes the Downloadable without linking the Downloadable to the

21

DSP. Id. According to Sonicwall, because claim 43 recites functions that are performed only by

22

inspector 125, the corresponding structure of the three disputed terms of the ’844 Patent must be a

23

structure within the inspector 125. Id. at 9.
Finjan responds that Sonicwall’s construction is inconsistent with decisions issued by

24
25

courts within this District. See Reply Br. at 4–5. Finjan also argues that the ’844 Patent discloses

26

embodiments “where the inspector is at different locations, including at the network gateway.” Id.

27

at 5.

28

After carefully reviewing the parties’ briefing, the record, and the undersigned’s prior
12

decision on this same issue in the Cisco case, the Court agrees with Finjan’s position. First,

2

Sonicwall’s reliance on the fact that the preamble of claim 43 recites “inspector” is unpersuasive.

3

“[W]hen a patentee defines a structurally complete invention in the claim body and uses the

4

preamble only to state a purpose or intended use for the invention, the preamble is not a claim

5

limitation.” Novatek, Inc. v. Sollami Co., 559 F. App’x 1011, 1015 (Fed. Cir. 2014) (internal

6

quotation marks and citation omitted). That said, “clear reliance on the preamble during

7

prosecution to distinguish the claimed invention from prior art transforms the preamble into a

8

claim limitation.” Catalina Mktg. Int'l, Inc. v. Coolsavings.com, Inc., 289 F.3d 801, 808 (Fed. Cir.

9

2002). Here, the Court finds that the preamble of claim 43 is not a limitation. The body of the

10

claim structurally defines the claimed invention. In addition, the prosecution history of the ’844

11

United States District Court
Northern District of California

1

Patent does not clearly show that Finjan distinguished the Ji reference by adding “inspector” to the

12

preamble. Rather, Finjan emphasized that the Ji reference is distinguishable because it “does not

13

teach generating [DSP] or linking the [DSP] to a Downloadable before the web server makes the

14

Downloadable security profile available to web clients” and fails to disclose “examining an

15

already linked [DSP] by network gateways.” See Ex. E to McGrath Decl. (5/3/2000 Response)

16

at 5 (emphasis in original). These statements do not pertain to the preamble. Thus, the

17

prosecution history does not show that Finjan clearly relied on the preamble to limit claim 43.

18

Catalina, 289 F.3d at 808.

19

To the extent that Sonicwall invokes the prosecution disclaimer doctrine, its argument

20

fails. Any disclaimer must be “clear and unmistakable” and cannot be “amenable to multiple

21

reasonable interpretations.” Omega Eng'g, Inc, v. Raytek Corp., 334 F.3d 1314, 1325–26 (Fed.

22

Cir. 2003). Here, at best, Finjan’s patent prosecution statements are ambiguous and thus do not

23

support Sonicwall’s position. As such, Finjan’s statements do not show that it “clearly and

24

unmistakabl[y]” disavowed “network gateway” embodiments from the claim scope. Id. In fact,

25

other courts have reached the same conclusion after reviewing the prosecution history of the ’844

26

Patent. See Finjan, Inc. v. Symantec Corp., 2017 WL 550453, at *16 (N.D. Cal. Feb. 10, 2017)

27

(“The Court does not read this language to establish . . . that an inspector by definition can never

28

be at the gateway, or to amount to a clear and unmistakable disavowal.”).
13

1

Second, the Court is unpersuaded by Sonicwall’s argument that claim 43 excludes

2

“network gateway” embodiments on the grounds that the specification discloses only inspector

3

125 to “generate” and “link” the DSP. To be sure, the ’844 Patent expressly discloses that content

4

inspection engine 160 in the inspector 125 of Fig. 1 to both generate and link DSP to a

5

Downloadable. See, e.g., ’844 Patent at 8:36–9:4. However, the specification also explicitly

6

describes that the content inspection engine 525 which may be located at the network gateway

7

generates DSP for a Downloadable and that the content inspection engine 525 is “similar to the

8

content inspection engine 160 of the inspector 125.” Id. at 7:62–64, 7:67–8:2. The specification

9

further explains that the content inspection engine 525 generates DSP for the received
Downloadable as described with reference to Figs. 4 and 6, id. at 9:63–65, where it is disclosed

11

United States District Court
Northern District of California

10

that content inspection engine 160 attaches DSP, id. at 7:13–16, 8:36–9:4. Based on those

12

disclosures, and in particular, given that the ’844 Patent expressly describes that the content

13

inspection engine 160 at the network gateway is similar to those in the inspector 125, a person of

14

ordinary skill in the art would understand that the content inspection engine located at the gateway

15

can link DSP to the Downloadable. The Court therefore rejects Sonicwall’s argument that the

16

“linking” limitation in claim 43 shows that “network gateway” embodiments are excluded.

17

Accordingly, the Court concludes that claim 43 covers embodiments where the inspector is

18

located at the network gateway. This interpretation of claim 43 is consistent with the construction

19

of other courts. Symantec, 2017 WL 550453, at *16.

20
21
22
23
24
25
26

The Court now addresses the three disputed terms in the ’844 Patent separately below.
1. “means for receiving a Downloadable” (claim 43)
Finjan’s Proposal
Function: receiving a
Downloadable

Sonicwall’s Proposal
Function: receiving a
Downloadable

Court’s Construction
Function: receiving a
Downloadable

Structure: Downloadable file
interceptor

Structure: inspector 125 that
is external to a network
gateway

Structure: Downloadable file
interceptor

There is no dispute that this term is a means-plus-function limitation and that the function

27

is “receiving a Downloadable.” See Opening Br. at 9; Responsive Br. at 9. The Court therefore

28

adopts the function agreed by the parties.
14

1

The parties, however, dispute the structure for this limitation. Finjan argues that the proper

2

structure is “Downloadable file interceptor” because the ’844 Patent disclose this element to

3

perform “the function of receiving a Downloadable.” Opening Br. at 9. Finjan points out that

4

Judge Gilliam and Judge Orrick in this District determined that the proper structure is

5

“Downloadable file interceptor.” Id. (citing Finjan, Inc. v. Symantec Corp., 2017 WL 550453,

6

at *3–4 (N.D. Cal. Feb. 10, 2017); Finjan, Inc. v. Sophos, Inc., 2015 WL 890621, at *8 (N.D. Cal.

7

Mar. 2, 2015) (“[T]he structure for ‘means for receiving a Downloadable’ is unambiguous: the

8

Downloadable file interceptor.”)).

9

Sonicwall counters that the structure is the “inspector 125, which is external to network
gateway 110.” Responsive Br. at 9. Sonicwall’s proposal is based on its argument that claim 43

11

United States District Court
Northern District of California

10

excludes “network gateway” embodiments. See id. However, as discussed earlier, the Court

12

rejects Sonicwall’s position that claim 43 does not cover “network gateway” embodiments. Thus,

13

the Court finds that Sonicwall’s proposed structure is improper.

14

The remaining issue is whether the “Downloadable file interceptor” is the proper structure.

15

The specification clearly discloses that the Downloadable file interceptor performs the function of

16

receiving a Downloadable. See, e.g., ’844 Patent at 9:22–23. The parties, however, dispute the

17

location of the Downloadable file interceptor. Sonicwall contends that this structure is not part of

18

the inspector 125 on the grounds that it exists only on the network gateway or computer client.

19

Responsive Br. at 9. Finjan counters that there is no basis for a distinction between “inspector”

20

claims and “gateway” claims. See Reply Br. at 4.

21

After reviewing the ’844 Patent and the Court’s analysis of this term in the Cisco case, the

22

Court agrees with Finjan’s proposed structure. The specification describes a generic protection

23

engine that includes the Downloadable file interceptor for receiving incoming Downloadables.

24

See ’844 Patent at 7:41–48. This generic protection engine includes content inspection engine 525

25

that is similar to the content inspection engine 160 of the inspector 125, which is external to the

26

gateway as depicted in Fig. 1. Id. at 7:19–8:2. The specification further describes that the content

27

inspection engine 160 receives Downloadables like the generic protection engine. See id. at 4:52–

28

56 (“[T]he Downloadable ID for the Downloadable will be the same each time the content
15

1

inspection engine 160 (or a protection engine as illustrated in FIG. 5) receives the same

2

Downloadable . . . .”). Based on those disclosures, a person of ordinary skill in the art would

3

understand that inspector 125 with the content inspection engine 160 can include the structure of

4

the Downloadable file interceptor described in relation to the protection engine in order to receive

5

Downloadables. Accordingly, although the ’844 Patent expressly discusses the Downloadable file

6

interceptor in connection to embodiments pertaining to the network gateway or computer client

7

(’844 Patent at 7:41–44, 9:19–10:23), the Court finds that a person of ordinary skill in the art

8

would understand that the Downloadable file interceptor may be located on inspector 125.

9

The Court also notes that Judge Gilliam and Judge Orrick’s claim construction orders
determined the proper structure as the “Downloadable file interceptor.” Symantec Corp., 2017

11

United States District Court
Northern District of California

10

WL 550453, at *3–4; Sophos, 2015 WL 890621, at *8. The Court’s above conclusion is

12

consistent with those orders. Thus, the Court is further persuaded that the “Downloadable file

13

interceptor” is the correct structure for the “means for receiving a Downloadable.” Symantec,

14

2017 WL 550453, at *3 (explaining that prior claim construction orders issued in the same

15

jurisdiction may receive deference). The Court finds no reason to depart from the prior claim

16

construction orders.

17
18
19
20
21

For the above reasons, the Court adopts Finjan’s construction.
2. “means for generating a first Downloadable security profile that identifies
suspicious code in the received Downloadable” (claim 43)
Finjan’s Proposal
Function: generating a first
Downloadable security profile
that identifies suspicious code
in the received Downloadable

Sonicwall’s Proposal
Function: generating a first
Downloadable security profile
that identifies suspicious code
in the received Downloadable

Court’s Construction
Function: generating a first
Downloadable security profile
that identifies suspicious code
in the received Downloadable

Structure: content inspection
engine programmed to
perform the algorithm
disclosed at col. 8, lines 51–
60 of the ’844 Patent

Structure: content inspection
engine 160 of inspector 125
programmed to perform the
algorithm disclosed at col. 8,
lines 49–60 of the ’844 Patent
and col. 4, lines 36–47, 54–
57, col. 8, lines 23–24, col. 9,
lines 20–42 and Fig. 7 of U.S.
Patent No. 6,092,194.

Structure: content inspection
engine programmed to
perform the algorithm
disclosed at col. 8, lines 51–
60 of the ’844 Patent

22
23
24
25
26
27
28

The parties do not dispute that this term is a means-plus-function limitation and that the
16

1

function is “generating a first Downloadable security profile that identifies suspicious code in the

2

received Downloadable.” Opening Br. at 11; Responsive Br. at 10. The Court therefore adopts

3

the function agreed by the parties.

4

The parties, however, diverge on the proper structure for this limitation. Finjan asserts that

5

its proposed structure is correct because the structure is “taken directly from the specification of

6

the ’844 Patent as it relates to generating a [DSP].” Opening Br. at 11. Finjan further asserts that

7

Judge Gilliam adopted the same structure in Symantec, 2017 WL 550453, at *6–7. See Opening

8

Br. at 11.

9

Sonicwall first responds that the proper structure should be “tied to inspector 125” but that
Finjan’s proposal fails to do so. Responsive Br. at 10. Sonicwall next argues that the

11

United States District Court
Northern District of California

10

specification of the ’844 Patent “provides almost no detail of how the content inspection engine

12

160 generates a DSP that identifies suspicious code in the received Downloadable” and that code

13

is distinct from operations. See Responsive Br. at 10 (emphasis in original). Based on this

14

assertion, Sonicwall contends that the Court must look to U.S. Patent Application No. 08/964,388

15

(now U.S. Patent No. 6,092,194 (“the ’194 Patent”)), which the ’844 Patent incorporates by

16

reference, to construe the proper structure. Id. at 10.

17

Sonicwall’s first contention is based on the argument that claim 43 excludes “network

18

gateway” embodiments. But, again, the Court rejects Sonicwall’s argument that claim 43 does not

19

cover “network gateway” embodiments. The Court therefore is unpersuaded by Sonicwall’s first

20

contention that the proper structure should be tied to inspector 125.

21

Regarding Sonicwall’s second contention, the Court is unconvinced by Sonicwall’s

22

reliance on the ’194 Patent even if that patent were properly incorporated by reference into

23

the ’844 Patent. The ’194 Patent does not mention “content inspection engine” and the Court is

24

unable to identify with particularity which algorithms disclosed in the ’194 Patent pertain to the

25

“content inspection engine” described in the ’844 Patent. On the other hand, the ’844 Patent itself

26

sufficiently discloses the algorithm for the content inspection engine that performs the agreed

27

upon function:

28

As stated above, generating a DSP [by the content inspection engine]
17

includes examining the Downloadable 205 (and the Downloadable
components) for all suspicious operations that will or may be
performed by the Downloadable, all suspicious code patterns, all
known viruses, etc. Generating a DSP may include comparing all
operations that will or may be performed against a list of suspicious
operations or against a list of rules, e.g., a rules base 165.
Accordingly, if an operation in the Downloadable 205 matches one of
the suspicious operations or violates one of the rules, then the
operation is listed in the DSP 215.

1
2
3
4
5
6

’844 Patent at 8:51–60. Similar narrative algorithms have been found to disclose sufficient

7

structure. See Typhoon Touch Techs., Inc. v. Dell, Inc., 659 F.3d 1376, 1385–86 (Fed. Cir. 2011).

8

As such, the Court finds that the proper algorithm is disclosed in col. 8, lines 51–60 of the ’844

9

Patent. Indeed, Judge Gilliam reached the same conclusion. Symantec, 2017 WL 550453, at *6–7
(declining to rely on the ’194 Patent and holding that the ’844 Patent disclosed sufficient

11

United States District Court
Northern District of California

10

structure).

12

Moreover, Sonicwall’s argument that Court must look to the ’194 Patent on the grounds

13

that code is distinct from operations is unavailing. Finjan’s proposed algorithm in the ’844 Patent

14

describes “generating a DSP includes examining the Downloadable . . . for all suspicious

15

operations that will or may be performed by the Downloadable, all suspicious code patterns, all

16

known viruses, etc.” ’844 Patent at 8:51–55 (emphasis added). As an example, the ’844 Patent

17

discloses that a DSP can be generated using a “rules base.” Id. at 8:55–58. Moreover, the

18

specification discloses that a set of rules may include a “list of suspicious code patterns.” Id.

19

at 2:7–8. Thus, although Sonicwall is correct that “code” is distinct from “operations,” its

20

argument is unavailing. Based on those disclosures, the Court finds that a person of ordinary skill

21

in art would understand how the content inspection engine performs the function based on the

22

algorithm disclosed in col. 8, lines 51–60 of the ’844 Patent.

23
24
25
26
27
28

Accordingly, the Court adopts Finjan’s proposed construction.
3. “means for linking the first Downloadable security profile to the
Downloadable before a web server makes the Downloadable available
to web clients” (claim 43)
Finjan’s Proposal
Function: linking the first
Downloadable security profile
to the Downloadable before a
web server makes the

Sonicwall’s Proposal
Function: linking the first
Downloadable security profile
to the Downloadable before a
web server makes the
18

Court’s Construction
Function: linking the first
Downloadable security profile
to the Downloadable before a
web server makes the

1

Downloadable available to
web clients

Downloadable available to
web clients

Downloadable available to
web clients

Structure: content inspection
engine programmed to
perform the algorithm of step
630 disclosed at Fig. 6; col. 8,
lines 65–67; and col. 6, lines
13–24 of the ’844 Patent.

Structure: content inspection
engine 160 of inspector 125
programmed to perform step
630 of Fig. 6, disclosed at col.
8, lines 65–67 and col. 6, lines
13–20 of the ’844 Patent.
Specifically, attaching a
Downloadable security profile
to the Downloadable (col. 8,
lines 65–67 and col. 6, lines
13–18) or attaching to the
Downloadable a pointer that
points to a stored
Downloadable security profile
(col. 6, lines 18–20).

Structure: content inspection
engine programmed to
perform step 630 of Fig. 6,
disclosed at col. 8, lines 65–
67 and col. 6, lines 13–20 of
the ’844 Patent.
Specifically, attaching a
Downloadable security profile
to the Downloadable (col. 8,
lines 65–67 and col. 6, lines
13–18) or attaching to the
Downloadable a pointer that
points to a stored
Downloadable security profile
(col. 6, lines 18–20).

2
3
4
5
6
7
8
9
10

United States District Court
Northern District of California

11
12

There is no dispute that this term is a means-plus-function limitation and that the function

13

is “linking the first Downloadable security profile to the Downloadable before a web server makes

14

the Downloadable available to web clients.” Opening Br. at 13; Responsive Br. at 11. The Court

15

therefore adopts the agreed upon function.

16

The parties disagree on the structure for this limitation. Finjan argues that its proposed

17

construction is the one adopted by Judge Gilliam in Symantec, 2017 WL 550453, at *8. See

18

Opening Br. at 13–14. Finjan further contends that its proposal is consistent with the scope of the

19

agreed function and does not incorporate unnecessary and confusing elements. Id. at 14.

20

Sonicwall counters that its proposal specifies that the content inspection engine must be

21

part of the inspector 125. See Responsive Br. at 11. However, like Sonicwall’s earlier arguments,

22

this contention is based on Sonicwall’s view that claim 43 excludes “network gateway”

23

embodiments. The Court rejects that view and thus is unconvinced by this counter-argument.

24

Thus, to the extent that its proposal references content inspection engine 160 and inspector 125,

25

Sonicwall’s construction is improper.

26

Sonicwall also argues that the specification discloses only two methods for linking the

27

DSP to the Downloadable: “(1) attaching the DSP to the Downloadable and (2) attaching a pointer

28

to the Downloadable that points to the DSP stored in the network system 100.” Responsive Br. at
19

1

11–12. Sonicwall further asserts that col. 6, lines 20–24 of the specification should be excluded

2

from Finjan’s proposal. See id. at 12. That portion of the ’844 Patent states the following:
The term “linking” herein will be used to indicate an association
between the Downloadable 205 and the DSP 215 (including using a
pointer from the Downloadable 195 to the DSP 215, attaching the
DSP 215 to the Downloadable 205, etc.)

3
4
5
6

’844 Patent at 6:20–24. Sonicwall argues that this portion of the specification only identifies the

7

two methods for linking (which are already disclosed in col. 6, lines 13–20 and col. 8, lines 65–67)

8

and that the reference to “an association” and “etc.” are not algorithms that provide corresponding

9

structure. See Responsive Br. at 12. As discussed below, the Court agrees with Sonicwall on this

10

United States District Court
Northern District of California

11

point.
In allowing means-plus-function limitations, “Congress . . . plac[ed] specific constraints on

12

how such a limitation is to be construed, namely, by restricting the scope of coverage to only the

13

structure, materials, or acts described in the specification as corresponding to the claimed

14

function and equivalents thereof.” Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1347 (Fed.

15

Cir. 2015) (emphasis added). Here, the parties both propose algorithms for the structure and thus

16

agree that the specification must describe an algorithm to sufficiently disclose the structure. See

17

Aristocrat Techs. Australia Pty Ltd. v. Int’l Game Tech., 521 F.3d 1328, 1333 (Fed. Cir. 2008)

18

(“[C]omputer-implemented means-plus-function term is limited to the corresponding structure

19

disclosed in the specification and equivalents thereof, and the corresponding structure is

20

the algorithm.” (citation omitted) (emphasis added)). In other words, the structure of the disputed

21

means-plus-function term at issue is limited to the algorithm disclosed in the specification. See id.

22

Here, as Sonicwall argues, col. 6, lines 20–24 of the specification merely restates the

23

function “linking the first Downloadable security profile to the Downloadable” by referring

24

“linking” as an “association” but fails to specify how the content inspection engine performs the

25

claimed function. Thus, that passage does not adequately disclose an algorithm (other than the

26

two methods which Sonicwall does not dispute). See Aristocrat, 521 F.3d at 1334 (specification

27

did not contain an algorithm sufficient to disclose structure, when language identified by plaintiff

28

“simply describe[d] the function to be performed, not the algorithm by which it is performed”).
20

1

Because col. 6, lines 20–24 does not disclose anything beyond the two methods of linking by

2

attaching the DSP or the pointer to the DSP, the Court finds that this portion of the specification

3

does not disclose additional algorithm that corresponds to the structure of the means-plus-function

4

claim.
Finjan’s counter-arguments3 are unpersuasive. First, Finjan asserts that Judge Gilliam

5
6

adopted its proposed construction including col. 6, lines 20–24 of the ’844 Patent. See Opening

7

Br. at 13–14. However, Judge Gilliam expressed that the sentence “[t]he term ‘linking’ herein will

8

be used to indicate an association between the Downloadable 205 and the DSP 215 (including

9

using a pointer from the Downloadable 195 to the DSP 215, attaching the DSP 215 to the
Downloadable 205, etc.)” appears to “simply restate the function ‘linking the first Downloadable

11

United States District Court
Northern District of California

10

security profile to the Downloadable’ rather than providing an algorithm for how that function is

12

accomplished, an approach the Federal Circuit has found to be insufficient.” Symantec, 2017 WL

13

550453, at *8 (emphasis in original). Nevertheless, Judge Gilliam adopted that passage as part of

14

the construction because the parties’ proposal covered that portion of the ’844 Patent. Id. The

15

Court need not give much deference to Judge Gilliam’s construction when he identified an issue

16

with the parties’ proposal but nevertheless accepted it.
Second, Finjan argues that it would be improper to limit the term to examples of linking by

17
18

“attaching the DSP and the pointer.” See Reply Br. at 8; see also Opening Br. at 14–15.

19

However, the Court’s rejection of Finjan’s position is not improper. As mentioned above, section

20

112 ¶ 6 requires a means-plus-function claim to cover “only the structure, materials, or acts

21

described in the specification.” Williamson, 792 F.3d at 1347. The ’844 Patent discloses only the

22

two methods identified in col. 6, lines 13–20 and col. 8, lines 65–67 as the algorithm, and thus the

23

scope of the dispute term must be limited to that disclosure. See Williamson, 792 F.3d at 1347.

24

Based on the foregoing, the Court adopts Sonicwall’s proposed structure with the

25

exception of the reference to inspector 125 as set forth in the following: “content inspection engine

26

programmed to perform step 630 of Fig. 6, disclosed at col. 8, lines 65–67 and col. 6, lines 13–20

27
28

3

Finjan made additional counter-arguments in the Cisco case that the Court likewise rejected. See
ECF 134 at 13–16 in Finjan Inc. v. Cisco Systems, Inc., Case No. 17-cv-00072-BLF.
21

1

of the ’844 Patent. Specifically, attaching a Downloadable security profile to the Downloadable

2

(col. 8, lines 65–67 and col. 6, lines 13–18) or attaching to the Downloadable a pointer that points

3

to a stored Downloadable security profile (col. 6, lines 18–20).”

4
5
6
7
8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

C.

Disputed term in the ’926 Patent

1. “destination computer” (claim 22)
Finjan’s Proposal
Sonicwall’s Proposal
No construction necessary—
“client computer to which the
plain and ordinary meaning
incoming Downloadable is
directed”

Court’s Construction
No construction necessary—
plain and ordinary meaning

The parties contest the meaning of the term “destination computer” in claim 22 of the ’926
Patent. Claim 22 recites:
22. A system for managing Downloadables, comprising:
a receiver for receiving an incoming Downloadable;
a Downloadable identifier for performing a hashing function on the incoming
Downloadable to compute an incoming Downloadable ID;
a database manager for retrieving security profile data for the incoming
Downloadable from a database of Downloadable security profiles indexed
according to Downloadable IDs, based on the incoming Downloadable ID, the
security profile data including a list of suspicious computer operations that may be
attempted by the Downloadable; and
a transmitter coupled with said receiver, for transmitting the incoming
Downloadable and a representation of the retrieved Downloadable security profile
data to a destination computer, via a transport protocol transmission.
’926 Patent at 22:20–35 (emphasis added).
Finjan argues that the plain and ordinary meaning of “destination computer” is consistent
with the intrinsic record “because this term when read in the context of the claim is easy to
understand.” See Opening Br. at 16. Finjan contends that the term is “self-explanatory” and
simply describes “a computer that is a destination.” See id. Finjan further argues that Sonicwall’s
proposed “client computer” construction would exclude embodiments because “the ’926 Patent
describes embodiments in which the ‘destination computer’ is not [] limited” to “client
computer[s].” See id. at 16–17. In support, Finjan points to Judge Orrick’s reasoning in an order
on post-trial motions that “Finjan has presented evidence that ‘destination computer’ [in the ’926
Patent] may have many meanings.” See Finjan, Inc. v. Sophos, Inc., 244 F. Supp. 3d 1016, 1049–
22

1

50 (N.D. Cal. 2017) (finding that jury’s finding of infringement of the ’926 Patent was supported

2

by substantial evidence).

3

Sonicwall counters that a “plain and ordinary meaning” does not resolve the parties’

4

principal dispute—“whether the destination computer is limited to the client computer to which

5

the incoming Downloadable is directed . . . or includes other computers that may receive the

6

Downloadable.” See Responsive Br. at 13. Sonicwall argues that the term “destination computer”

7

does not appear in the specification of the ’926 Patent but does appear in the specification of

8

the ’780 Patent (which is incorporated by reference), and that the ’780 Patent “makes clear that

9

‘destination computer’ means the client computer to which the incoming Downloadable is
directed.” See id. at 13. Specifically, Sonicwall points to language in the ’780 Patent specification

11

United States District Court
Northern District of California

10

stating that “[a] Downloadable is an executable application program, which is downloaded from a

12

source computer and run on the destination computer.” See ’780 Patent at 1:50–53, ECF 1-4; see

13

also Responsive Br. at 13–14. Sonicwall contends that one of ordinary skill in the art would read

14

“destination computer” to mean “client computer” because during prosecution of the ’780 Patent

15

the applicant stated that “[t]he present invention concerns generation of an ID for mobile code

16

downloaded to a client computer, referred to as a Downloadable.” See 7/31/2003 Amendment

17

at 7 (emphasis added), Ex. I to McGrath Decl., ECF 109-10. Sonicwall additionally argues that

18

Finjan’s proposal would “improperly render the word ‘destination’ utterly superfluous” because

19

“the claims would have the exact same meaning both with and without the word ‘destination.’”

20

See Responsive Br. at 14 (emphasis removed).

21

The crux of this dispute is whether the “destination computer” in claim 22 of the ’926

22

Patent must be a “client computer.” For the reasons discussed below, the Court finds that the

23

“destination computer” in claim 22 is not so limited and may be a computer other than a “client

24

computer.” As an initial matter, Judge Orrick considered this issue in Finjan, Inc. v. Sophos, Inc.,

25

244 F. Supp. 3d 1016, 1049–50 (N.D. Cal. 2017), and found that Finjan had presented sufficient

26

evidence that “destination computer” does not refer exclusively to an end-user (e.g. client)

27

computer to withstand a post-trial motion for judgment as a matter of law. 244 F. Supp. 3d

28

at 1049. While Judge Orrick’s ruling was not a claim construction order and thus not afforded
23

1

substantial deference, see Symantec, 2017 WL 550453, at *3 (N.D. Cal. Feb. 10, 2017), Judge

2

Orrick’s reasoning is nonetheless persuasive. Indeed, Judge Orrick noted that “the word

3

‘destination’ adds something—it emphasizes that the computer to which the downloadable is

4

being transmitted is not any computer, but rather a particular computer.” See Sophos, 244

5

F. Supp. 3d at 1049 (emphasis in original). Judge Orrick concluded that Finjan had presented

6

evidence that “destination computer” had “many meanings under the ’926 Patent,” and was thus

7

not limited to end-user/client computers. See id. at 1049–50.

8
9

Sonicwall’s arguments to the contrary are unconvincing. First, the claims refer simply to a
“destination computer” without further limitation and neither the ’926 Patent specification nor
the ’780 Patent specification defines the destination computer to be a client computer. In support

11

United States District Court
Northern District of California

10

of its argument that “destination computer” and “client computer” are interchangeable Sonicwall

12

relies on the applicant’s statement during prosecution that “[t]he present invention concerns

13

generation of an ID for mobile code downloaded to a client computer, referred to as a

14

Downloadable.” See 7/31/2003 Amendment at 7 (emphasis added); see also Responsive Br.

15

at 14. However, for prosecution disclaimer to attach, “disavowing actions or statements made

16

during prosecution [must] be both clear and unmistakable.” Omega Eng'g, Inc, v. Raytek Corp.,

17

334 F.3d 1314, 1325–26 (Fed. Cir. 2003). Here, the applicant’s statement merely defines

18

“Downloadable” and indicates that the Downloadable may be downloaded to a client computer but

19

does not clearly and unmistakably disavow the scope of “destination computer,” which is not

20

mentioned at all. Thus, the applicant did not disclaim the full scope of “destination computer” in

21

this statement during prosecution.

22

Second, contrary to Sonicwall’s contention, permitting the term “destination computer” to

23

capture destinations other than a client computer does not “render the word ‘destination’ utterly

24

superfluous,” see Responsive Br. at 14. Just as Judge Orrick reasoned in Sophos, see 244 F. Supp.

25

3d at 1049, the word “destination” still requires that the Downloadable be transmitted to a

26

particular computer at which the Downloadable is run, rather than any computer whatsoever.

27

See ’780 Patent at 1:50–53 (“A Downloadable is an executable application program, which is

28
24

1

downloaded from a source computer and run on the destination computer.”4) (emphasis added).

2

Accordingly, “destination” is not rendered superfluous even where the “destination computer” is

3

not a “client computer.”
Finally, “claim terms must be given their plain and ordinary meaning to one of skill in the

4
5

art.” Thorner v. Sony Computer Ent. Am. LLC, 669 F.3d 1362, 1367 (Fed. Cir. 2012). A

6

“patentee is free to choose a broad term and expect to obtain the full scope of its plain and

7

ordinary meaning unless the patentee explicitly redefines the term or disavows its full scope.” Id.

8

On its face, claim 22 does not include the limitation proposed by Sonicwall and the Court does not

9

find sufficient support in the remainder of the intrinsic record to implicitly read in such a
requirement. In addition, Sonicwall’s argument that the “plain and ordinary meaning” does not

11

United States District Court
Northern District of California

10

resolve the parties’ principal dispute as to whether “destination computer” equals “client

12

computer” is unavailing. See Responsive Br. at 13. If the Court is to give the patentee’s choice of

13

terms any effect, the two terms are necessarily not synonymous. Thus, the Court’s construction

14

resolves the principal dispute.

15

In sum, the Court adopts the plain and ordinary meaning of the disputed term.

16

D.

17

The parties dispute two terms in the ’408 Patent. Both terms appear in claim 9, which

18

recites in part:
9. A computer system for multi-lingual content scanning, comprising:

19
20

. . . a scanner instantiator, stored on the medium and executed by the computer,
operatively coupled to said receiver and said multi-lingual language detector for
instantiating a scanner for the specific programming language, in response to
said determining, the scanner comprising:

21
22

a rules accessor for accessing parser rules and analyzer rules for the specific
programming language, wherein the parser rules define certain patterns in terms
of tokens, tokens being lexical constructs for the specific programming language,
and wherein the analyzer rules identify certain combinations of tokens and patterns
as being indicators of potential exploits, exploits being portions of program code
that are malicious . . .

23
24
25
26

Disputed terms in the ’408 Patent

’408 Patent at 20:35–60 (emphasis added). Each term is discussed in turn.

27
28

This definition of “Downloadable” matches the parties’ agreed upon construction of
“Downloadable.” See supra Section III; Joint Claim Construction Statement at 1, ECF 80.
25
4

1. “instantiating, by the computer, a scanner for the specific programming
language” / “instantiating a scanner for the specific programming language”
(claims 1, 9 and 22)

1
2

Finjan’s Proposal
No construction necessary—
plain and ordinary meaning

3
4

Alternatively:
“initializing a scanner for the
specific programming
language”5

5
6

Sonicwall’s Proposal
“substituting specific data,
instructions, or both into a
generic program unit to make
it usable for scanning the
specific programming
language”

Court’s Construction
“substituting specific data,
instructions, or both into a
scanner to make it usable for
scanning the specific
programming language”

The ’408 Patent provides “a method and system for scanning content that includes mobile

7
8

code, to produce a diagnostic analysis of potential exploits within the content.” Id. at 1:59–61.

9

The invention uses an adaptive rule-based content (“ARB”) scanner, which dynamically scans and
diagnoses incoming Internet content. See id. at 1:65–2:24. Unlike “prior art scanners that are

11

United States District Court
Northern District of California

10

hard-coded for one particular type of content,” id. at 2:2–3, the claimed ARB scanners “are able to

12

adapt [themselves] dynamically to scan a specific type of content” and the ARB scanner systems

13

are “preferably designed as a generic architecture that is language-independent, and is customized

14

for a specific language through use of a set of language-specific rules,” id. at 1:65–2:1, 6:17–20.
Finjan argues that “[t]his term does not require construction because it can be readily

15
16

understood by a person of ordinary skill in the art.” Opening Br. at 18. Finjan posits that a person

17

of ordinary skill in the art reviewing the ’408 Patent would understand “instantiating” to mean

18

“initializing.” See id. Finjan therefore contends that the plain and ordinary meaning of the

19

disputed term is “initializing a scanner for the specific programming language” or that the Court

20

should adopt that meaning in the alternative. See id.; Hearing Tr. at 32:5–11, ECF 127.

21

The Court disagrees. The ’408 Patent does not use “instantiating” and “initializing”

22

synonymously. Instead, the specification makes clear that the patentee intended the words to have

23

different effect. For example, in a paragraph discussing scanners, the specification recites:

24

ARB scanner factory module 630 instantiates a scanner repository 640.
Repository 640 produces a single instance of each ARB scanner defined in the
archive file. Preferably, each instance of an ARB scanner is able to initialize itself
and populate itself with the requisite data.

25
26
27
28

5

As proposed by Finjan at the Hearing. See Hearing Tr. at 32:5–11, ECF 127.
26

1

’408 Patent at 15:30–35. Here, the “instantiates” step takes place before and separate from the

2

“initialize” step. If the Court is to give the patentee’s choice of terms any effect, the two words

3

are necessarily not synonymous. Thus, the Court turns to the question of whether Sonicwall’s

4

proposal is appropriate.

5

Sonicwall argues that its proposed construction should govern because the specification

6

states that the ARB scanner is “preferably designed as a generic architecture that is language-

7

independent, and is customized for a specific language through use of a set of language-specific

8

rules.” See ’408 Patent at 6:17–20 (emphasis added); see also Responsive Br. at 18. Sonicwall

9

further argues that the specification explains that the “[t]okenizer 210 and normalizer 240 are
generic modules that can be adapted to process any content language, by providing a description

11

United States District Court
Northern District of California

10

of the content language with a rule file.” See ’408 Patent at 8:7–9 (emphasis added); see also

12

Responsive Br. at 16. Sonicwall contends that therefore the scanner is customized using

13

“language-specific data [] substituted into a generic module to allow the scanning of a specific

14

programming language.” See Responsive Br. at 16. Sonicwall additionally points out that its

15

proposed construction was adopted by the PTAB as the “broadest reasonable construction . . . in

16

light of the specification.” See id. at 18 (quoting and citing 3/29/2016 IPR Decision at 11–12,

17

Ex. K to McGrath Decl., ECF 109-12).

18

Finjan counters that “a different claim construction standard is applied in the IPR” and that

19

Sonicwall’s proposed construction would “import limitations into the claims when describing a

20

more general component of the scanner.” See Reply Br. at 11.

21

Indeed, the PTAB’s construction in IPR is not binding on this Court and is not afforded

22

deference. See SkyHawke Techs., LLC v. Deca Int’l Corp., 828 F.3d 1373, 1376 (Fed. Cir. 2016).

23

However, Sonicwall’s proposed construction is on point and helpful to the jury, with one

24

exception. The Court is not convinced that “a generic program unit” properly captures the scope

25

of the disputed term, which concerns “a scanner.” See Responsive Br. at 15; ’408 Patent claim 9.

26

The ’408 Patent makes clear that the ARB scanner system is “preferably designed as a generic

27

architecture,” see id. at 6:17–18 (emphasis added), but does not mandate that a scanner is

28

necessarily “a generic program unit.” Moreover, the word “instantiating” is at the crux of this
27

1

dispute, not the word “scanner.” Accordingly, the Court replaces Sonicwall’s proposed language

2

“a generic program unit” with the claim language “a scanner.”

3

“‘Claim construction’ is for the purpose of explaining and defining terms in the claims, and

4

usually requires use of words other than the words that are being defined.” Abbott Labs. V.

5

Sandoz, Inc., 544 F.3d 1341, 1360 (Fed. Cir. 2008). Finjan’s proposal that “instantiating a

6

scanner” has a plain and ordinary meaning will not aid the jury. On the other hand, Sonicwall’s

7

proposal as modified by the Court clarifies that “instantiating a scanner” means “substituting

8

specific data, instructions, or both into a scanner” to make it useable for scanning the specific

9

programming language. The words of the claim must be understood as the inventor used them.
See Phillips, 415 F.3d at 1316. Here, “substituting specific data, instructions, or both” is

11

United States District Court
Northern District of California

10

consistent with the patentee’s use of “instantiating” which describes a procedure of customizing or

12

setting up “a scanner for the specific programming language” after a “specific one of a plurality of

13

programming languages” is identified. See, e.g., ’408 Patent claim 1; ’408 Patent claim 9. Thus,

14

the Court finds that Sonicwall’s proposed construction as modified by the Court is consistent with

15

the claim language and provides the requisite guidance to the jury.

16

Based on the foregoing, the Court adopts the following construction: “substituting specific

17

data, instructions, or both into a scanner to make it usable for scanning the specific programming

18

language.”

19
20
21
22
23
24
25
26
27

2.

“a rules accessor for accessing parser rules and analyzer rules for the
specific programming language” (claim 9)

Finjan’s Proposal
No construction necessary—
plain and ordinary meaning

Sonicwall’s Proposal
Governed by 35 U.S.C.
§ 112(6)

Court’s Construction
Governed by 35 U.S.C.
§ 112(6)

Function: for accessing
parser rules and analyzer
rules for the specific
programming language

Function: accessing
parser rules and analyzer
rules for the specific
programming language

Structure: indefinite under
§ 112(2) for failure to
disclose corresponding
structure

Structure: indefinite under
§ 112(2) for failure to
disclose corresponding
structure

28
28

1

The parties dispute whether this term is a means-plus-function claim governed by

2

35 U.S.C. § 112 ¶ 6 and if so, whether adequate structure is disclosed. Finjan points out that the

3

word “means” does not appear in the claim language of the ’408 Patent and argues that Sonicwall

4

cannot rebut the presumption against invoking § 112 ¶ 6. See Opening Br. at 20; see also

5

Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1349 (Fed. Cir. 2015). Finjan contends that

6

“rules accessor” is “[not] a nonce word because the term connotes a specific structure for

7

identifying and providing access to information which in this case is access to the parser and

8

analyzer rules.” See Opening Br. at 20. Finjan further argues that even if this term were a mean-

9

plus-function term, it is not indefinite because “a rules accessor” alone “is sufficient structure.”

10

See id. at 21 n.4; see also Reply Br. at 12.

United States District Court
Northern District of California

11

On the other hand, Sonicwall contends that the “rules accessor” limitation is governed by

12

§ 112 ¶ 6 because “‘rules accessor’ does not have a commonly understood meaning” and because

13

the term is not viewed by those of skill in the art “to connote a particular structure.” See

14

Responsive Br. at 20. Sonicwall further contends that “‘rules accessor’ is simply another way of

15

saying ‘means for accessing rules’” with “no independent structural limitation.” See id. at 21.

16

Sonicwall next argues that the ’408 Patent specification fails to disclose corresponding structure

17

because “there is no mention made [] of a rules accessor” and because “the entire concept of rules

18

being accessed is missing” as well as any “algorithm for performing the recited function.” See id.

19
20

a. Invoking 35 U.S.C. § 112 ¶ 6
To determine whether a claim invokes § 112, the Court must determine if the claim

21

limitation is drafted in the means-plus-function format. Here, the disputed claim limitation does

22

not use the term “means.” Thus, there is a presumption that the limitation does not invoke § 112

23

¶ 6. See Williamson, 792 F.3d at 1348. However, this presumption is rebuttable and § 112 ¶ 6

24

will apply “if the challenger demonstrates that the claim term fails to ‘recite sufficiently definite

25

structure’ or else recites ‘function without reciting sufficient structure for performing that

26

function.’” See id. at 1349 (internal citation omitted). For the reasons discussed below, the Court

27

finds that Sonicwall has demonstrated that the claim term “fails to recite sufficiently definite

28

structure” or “recites function without reciting sufficient structure for performing that function” to
29

1

overcome this presumption.

2

Sonicwall presents search results showing that neither “rules accessor” nor “accessor” are

3

recognized terms or components in various computer, technical, or IT dictionaries. See McGrath

4

Decl. ¶ 13, ECF 109-1; Ex. L to McGrath Decl., ECF 109-13. In response, Finjan cites the

5

definition of “access” in a computer dictionary and argues that according to that definition the

6

meaning of “rules accessor” is self-explanatory—that “it is a component that accesses the data.”

7

See Reply Br. at 11–12; see also Webster’s New World Dictionary of Computer Terms (Sixth

8

Edition), Ex. C to Kastens Decl., ECF 110-4. Finjan’s argument misses the point. The key

9

question is not what the “rules accessor” accesses, but whether “rules accessor” is understood by a
person of ordinary skill in the art as an identifiable structure. In other words, whether the words

11

United States District Court
Northern District of California

10

“rules accessor” or “accessor” “provide [] indication of structure” or instead merely “set[] forth the

12

same black box recitation of structure for providing the same specified function as if the term

13

‘means’ had been used,” see Williamson, 792 F.3d at 1350. Sonicwall contends that “rules

14

accessor” is a “nonce term” because it was “coined specifically for the patent” and “provides no

15

direction as to a particular structure.” See Responsive Br. at 20–21 (internal quotation and citation

16

omitted).

17

Indeed, replacing “rules accessor for accessing [] rules” in claim 9 of the ’408 Patent with

18

“means for accessing [] rules” does not alter the structure. Under either reading, the term is

19

merely a description of the function performed. Put differently, “rules accessor” simply takes the

20

function being performed and states it in terms of a device. See Advanced Ground Info. Sys., Inc.

21

v. Life360, Inc., 830 F.3d 1341, 1348 (Fed. Cir. 2016) (finding “symbol generator” analogous to

22

“means for generating symbols” on similar grounds). Accordingly, Finjan’s argument that “rules

23

accessor” connotes specific structure through “access to the parser and analyzer rules” fails. See

24

Opening Br. at 20. At bottom, “rules accessor” does not designate structure. Cf. Skky, Inc. v.

25

MindGeek, s.a.r.l., 859 F.3d 1014, 1020 (Fed. Cir. 2017) (finding that “wireless device” is “used

26

in common parlance . . . to designate structure) (internal citation omitted).

27
28

The Court must additionally consider whether the claim language and specification
“describe how the [rules accessor], by its interaction with the other components in the [scanner
30

1

instantiator], is understood as the name for structure.” See Williamson, 792 F.3d at 1351. In

2

Williamson, the Federal Circuit found that “the claim does not describe how the ‘distributed

3

learning control module’ interacts with other components in the distributed learning control server

4

in a way that might inform the structural character . . . or otherwise impart structure.” Id. at 1351.

5

Instead, “portions of the claim [] describe certain inputs and outputs at a very high level.” Id.

6

Likewise, here, the claim does not explain how the “rules accessor” interacts with other

7

components (the tokenizer, parser, and notifier) of the “scanner instantiator” sufficient to impart

8

structure. See ’408 Patent at 20:48–21:8. Although these components may depend on the output

9

of the “rules accessor,” see., e.g., id. at 20:63–67 (parser operating “in accordance with the parser
rules accessed by said rules accessor”), such interaction is only described at a high level and

11

United States District Court
Northern District of California

10

merely reflects the same black box recitation of structure provided by “rules accessor.”

12

Finjan relies on Finjan, Inc. v. Proofpoint, Inc., 2015 WL 7770208 (N.D. Cal. Dec. 3,

13

2015) for the proposition that claim 9 of the ’408 Patent provides “detailed context” sufficient to

14

connote structure. See Opening Br. at 19–20. Proofpoint is inapposite. While the Proofpoint

15

court found that the claim language “informs the [content processor]’s structural character,” see

16

2015 WL 7770208, at *11, it did not rule that the claim language alone imparted sufficient

17

structure. Instead, the Proofpoint court relied heavily on disclosures in the specification and

18

figures to find sufficient structure for the disputed term “content processor.” See 2015 WL

19

7770208, at *11 (identifying specific language and diagrams in the specification describing the

20

content processor’s operation and interaction with other system components). Here, unlike in

21

Proofpoint, the ’408 Patent specification is silent as to the disputed functional term. Moreover,

22

the tokenizer, parser, and notifier of claim 9 simply act in accordance with the outputs of the

23

“rules accessor” and do not serve to inform or “to cabin the scope of the functional term” itself,

24

see Diebold Nixdorf, Inc. v. Int’l. Trade Comm’n, 899 F.3d 1291, 1300–01 (Fed. Cir. 2018). Thus,

25

the “rules accessor” could be any structure capable of performing the claimed function and lacks

26

structural meaning. See id. at 1301.

27
28

b.

Disclosure of corresponding structure

Having found that the disputed term invokes § 112 ¶ 6, the Court next determines whether
31

1

the specification discloses sufficient structure that corresponds to the claimed function. This is a

2

two-step process. “The court must first identify the claimed function.” Williamson, 792 F.3d

3

at 1351. “Then, the court must determine what structure, if any, disclosed in the specification

4

corresponds to the claimed function.” Id. “If the patentee fails to disclose adequate corresponding

5

structure, the claim is indefinite.” Id. For the reasons discussed below, the Court finds that the

6

’408 Patent specification fails to disclose sufficient structure that corresponds to the claimed

7

function in the disputed term.

8

Finjan argues that the claimed function is “accessing data, which in this case are the parser
and analyzer rules.” See Reply Br. at 12. Sonicwall contends that the function is simply the

10

portion of the claim language “for accessing parser rules and analyzer rules for the specific

11

United States District Court
Northern District of California

9

programming language.” See Responsive Br. at 18; see also ’408 Patent at 20:53–54. The Court

12

agrees with Sonicwall. Finjan’s “accessing data” proposal is overbroad. Claim 9 makes clear that

13

the “rule accessor” is specifically “for accessing parser rules and analyzer rules for the specific

14

programming language.” See ’408 Patent at 20:53–54. Accordingly, the Court adopts Sonicwall’s

15

proposed function with the exception of dropping the word “for” at the beginning of Sonicwall’s

16

proposal.

17

The Court next looks to the specification for structure corresponding to the claimed

18

function. The specification refers to “use of a set of language-specific rules,” see, e.g., id. at 6:19–

19

20, but makes no mention of an “accessor,” “rules accessor,” or the concept of accessing rules, see

20

generally ’408 Patent Specification. Finjan makes two arguments in support of its position that

21

the specification adequately discloses structure. Neither is persuasive.

22

First, Finjan argues that under In re Katz Interactive Call Processing Pat. Litig., 639 F.3d

23

1303 (Fed. Cir. 2011), “no explicit structure for accessing data would be required, as accessing the

24

described parser rules and analyzer rules[] is a known concept of computer operation,” see Reply

25

Br. at 12. The Court disagrees. Katz held that a standard microprocessor can serve as sufficient

26

structure for “functions [that] can be achieved by any general purpose computer without special

27

programming.” 639 F.3d at 1316. The Katz court held that claim terms involving basic

28

“processing,” “receiving,” and “storing” functions were not necessarily indefinite because a
32

1

general purpose computer need not “be specially programmed to perform the recited function.”

2

Id. The Federal Circuit has since clarified that the Katz exception is “narrow” and applies “only in

3

the rare circumstances where any general-purpose computer without any special programming can

4

perform the function.” See Ergo Licensing, LLC v. CareFusion 303, Inc., 673 F.3d 1361, 1364

5

(Fed. Cir. 2012) (declining to apply the Katz exception to the function of “controlling the adjusting

6

means”).

7

Here, the claimed function of “accessing parser rules and analyzer rules for the specific

8

programming language” is not a basic “processing” or “storing” function or the like that could be

9

performed on a general-purpose computer, see Katz, 639 F.3d at 1316. Instead, the function
would require special programming adapted to specific requirements—e.g., the ability to access

11

United States District Court
Northern District of California

10

“parser rules” and “analyzer rules,” which are patent specific. See Ergo, 673 F.3d at 1365 (“A

12

specially adapted computer is not a general-purpose computer.”). Thus, the narrow Katz exception

13

does not apply.

14

Second, Finjan argues that the specification discloses sufficient structure by way of an

15

“ARB rule file” and “an internal table, for rules to store and access variables.” See ’408 Patent at

16

10:4–7, 13:1–2; see also Reply Br. at 12. The Court has reviewed the cited portions of the

17

specification and is not persuaded. The “ARB rule file” refers to “parser_rules” and

18

“analyzer_rules” but does not include or discuss a concept or manner of accessing those rules. See

19

’408 Patent at 10:4–9. Likewise, the cited “internal table, for rules . . .” does not concern

20

accessing parser rules or analyzer rules but is instead a “symbol table” related to pattern

21

recognition by a parsing rule. See ’408 Patent at 8:46–48, 12:64–13:2. Accordingly, the

22

specification lacks the requisite structure.

23

In sum, the Court finds that the ’408 Patent specification fails to disclose sufficient

24

structure corresponding to the function of “accessing parser rules and analyzer rules for the

25

specific programming language.”

26
27
28

c.

Conclusion

Because the specification of the ’408 Patent does not disclose sufficient structure for the
“rules accessor” functional term and claim 9 includes this term, claim 9 is indefinite under 35
33

1

U.S.C. § 112 ¶ 2.

2

E.

3

The ’968 Patent provides a system and method of managing cached content in relation to

Disputed terms in the ’968 Patent

4

multiple security policies by, inter alia, providing a “policy-based index . . . indicating

5

allowability of cached content relative to a plurality of policies.” See id. at 1:63–2:7. A cache

6

manager may then utilize the policy-based index to determine whether cached content is allowable

7

for a different user than the original user who requested it and block cached content from being

8

delivered to users for whom it is not allowed. Id. at 2:7–11. The parties dispute two terms in the

9

’968 Patent. Both terms appear in claim 1, which recites:

10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23

1. A policy-based cache manager, comprising:
a memory storing a cache of digital content, a plurality of policies, and a policy
index to the cache contents, the policy index including entries that relate cache
content and policies by indicating cache content that is known to be allowable
relative to a given policy, for each of a plurality of policies;
a content scanner, communicatively coupled with said memory, for scanning a
digital content received, to derive a corresponding content profile; and
a content evaluator, communicatively coupled with said memory, for determining
whether a given digital content is allowable relative to a given policy, based on the
content profile, the results of which are saved as entries in the policy index.
’968 Patent at 9:47–62 (emphasis added). Each term is discussed in turn.
1. “polic[y/ies]” (claims 1 and 13)
Finjan’s Proposal
No construction necessary—
plain and ordinary meaning
Alternatively:
“a rule or rules for managing
a security system”

Sonicwall’s Proposal
“rule(s) or set(s) of rules that
determine whether a piece of
content can be accessed by a
user”

Court’s Construction
“rule(s) for managing a
security system”

At the Hearing Finjan clarified it is alternatively seeking a construction of “a rule or rules

24

for managing a security system.” See Hearing Tr. at 60:12–15; see also Reply Br. at 12. Finjan

25

argues that the ’968 Patent specification includes examples where the term “policy” generally

26

refers to rules for managing a security system and that Sonicwall’s proposal reads in limitations

27

not present in the claim language. See Opening Br. at 21–22. Sonicwall counters that “[t]he

28

Federal Circuit – and Finjan – previously agreed with Sonicwall’s proposed construction.” See
34

1

Responsive Br. at 22 (citing Finjan, Inc. v. Blue Coat Sys., Inc., 879 F.3d 1299, 1308 (Fed. Cir.

2

2018)). Sonicwall also argues that its proposed “piece of content” and “accessed by a user”

3

limitations are consistent with the “purpose of the invention [the ’968 Patent].” See Responsive

4

Br. at 23–24.

5

As an initial matter, the Court is not persuaded that Sonicwall’s proposed construction is

6

dictated by the Federal Circuit’s statement that “[t]he patentee agrees that a ‘policy’ is a rule or set

7

of rules that determines whether a piece of content can be accessed by a user,” see Finjan, Inc. v.

8

Blue Coat Sys., Inc., 879 F.3d 1299, 1308 (Fed. Cir. 2018) (finding that Blue Coat was entitled to

9

JMOL of non-infringement of claim 1 of the ’968 Patent). Although Finjan apparently agreed
with such a description before the Federal Circuit, the context here is entirely different. First, the

11

United States District Court
Northern District of California

10

Federal Circuit was reviewing the district court’s ruling on post-trial motions for judgment as a

12

matter of law, not claims construction. Moreover, “polic[y/ies]” was not construed. Second, the

13

Federal Circuit’s order does not specify whether Finjan agreed that the recited description

14

captured the full scope of the claim term “policy,” or whether Finjan was asked that question.

15

Indeed, the crux of the instant dispute is whether “polic[y/ies]” captures only what Sonicwall

16

proposes or Finjan’s more broad alternative construction.

17

Turning to the question of term scope, the Court finds that Sonicwall’s proposed

18

construction is impermissibly narrow. The intrinsic record simply does not limit “polic[y/ies]” to

19

rules that determine whether a piece of content can be accessed by a user. Instead, the term also

20

more generally contemplates rules for managing a security system. See, e.g., ’968 Patent at 3:65–

21

4:1 (“The policy may, for example, indicate which URL’s are to be blocked or which computer

22

viruses are known and should thus be blocked.”). As another example, a policy may contain

23

“URL filtering [] used to block ‘undesirable’ web pages from being delivered.” See id. at 1:40–42.

24

In other words, a policy may firewall certain sources at the outset and therefore is not limited to

25

determining whether a piece of content can be accessed by a user. Accordingly, Sonicwall’s

26

proposal is inapposite.

27
28

In sum, the Court adopts Finjan’s alternative proposed construction with a minor
grammatical alteration to read “rule(s) for managing a security system.”
35

1
2
3
4
5
6

2. “[content] profile” (claims 1 and 13)
Finjan’s Proposal
No construction necessary—
plain and ordinary meaning

Sonicwall’s Proposal
“a set of characteristics or
qualities that identify a type
or category of digital content”

Court’s Construction
“information describing the
received content”

Alternatively:
“information describing the
received content”
Discussion at the Hearing narrowed this dispute. Although not apparent in its briefing,
Finjan clarified it is alternatively seeking a construction of “information describing the received

8

content.” See Hearing Tr. at 75:11–13, 81:6–11; see also Reply Br. at 14. Sonicwall argued that a

9

“plain and ordinary” construction is not helpful but indicated that Finjan’s alternative construction

10

is not “far off” Sonicwall’s proposal. See Hearing Tr. at 77:20–24. The Court agrees that a plain

11

United States District Court
Northern District of California

7

and ordinary construction would not be helpful to the jury due to commonplace definitions of

12

“profile” or “content profile” that may conflate with the term as used in the ’968 Patent. Thus, the

13

Court analyzes Finjan’s alternative construction vs. Sonicwall’s proposed construction.

14

Finjan argues that “Sonicwall’s proposed construction . . . includes a number of limitations

15

that are not supported by the intrinsic record.” See Opening Br. at 23. Finjan further argues that

16

Sonicwall’s construction is based “on a construction adopted by the PTAB during an IPR, who in

17

turn relied on a dictionary definition . . . . [that] includes requirements that are inconsistent with

18

the specification.” See Reply Br. at 14. Sonicwall counters that its proposal is based on the

19

construction adopted by the PTAB in two IPR proceedings and that “the ‘content profile’ must

20

contain information that can be compared to a policy to determine whether the content is

21

allowable.” See Responsive Br. at 25.

22

Quite frankly, the Court does not see a great deal of space between Finjan’s alternative

23

construction and Sonicwall’s proposed construction. Both use broad language—Finjan proposes

24

“information” and Sonicwall proposes “characteristics or qualities.” Indeed, “content profile” as

25

used in the ’968 Patent is a broad term—claim 1 outlines that the content profile corresponds to

26

“digital content received.” See ’968 Patent at 9:55–57; see also ’968 Patent at 8:27–28 (“[T]he

27

content filter scans content [] to derive a profile thereof.”). The Court agrees with Sonicwall that

28

the “content profile” must contain information that can be compared to a policy to determine
36

1

whether the content is allowable. See ’968 Patent at 9:57–61 (“determining whether a given

2

digital content is allowable relative to a given policy, based on the content profile . . .)

3

(emphasis added). However, Finjan’s alternative construction includes this requirement by

4

construing “content profile” as “information describing the received content.” See Reply Br.

5

at 14. Accordingly, the Court need not rely on Sonicwall’s proposal which is based on the

6

PTAB’s dictionary-guided construction. See Philips, 415 F.3d at 1318.

7

All in all, the Court finds that Finjan’s alternative construction is consistent with the

8

intrinsic record and more helpful to the jury than Sonicwall’s proposal. Accordingly, the Court

9

adopts Finjan’s alternative construction.
//

11

United States District Court
Northern District of California

10

//

12

//

13

//

14

//

15

//

16

//

17

//

18

//

19

//

20

//

21

//

22

//

23

//

24

//

25

//

26

//

27

//

28

//
37

1
2
3

V.

ORDER
As set forth above, the Court construes the disputed terms as follow:
Court’s Construction
“code that, at runtime, monitors or intercepts
actually or potentially malicious code
operations without modifying the executable
code”

Claim Term
“mobile protection code”

4
5

(’633 Patent, claims 1, 8, and 14);
(’822 Patent claims 1 and 9)

6
7
8
9
10

“A computer program product, comprising a
computer usable medium having a computer
readable program code therein, the computer
readable program code adapted to be executed
for computer security, the method comprising:”

“means for receiving a Downloadable”

“A computer program product, comprising a
computer usable medium having a computer
readable program code therein, the computer
readable program code adapted to be
executed for computer security, comprising:”
Function: receiving a Downloadable

(’844 Patent, claim 43)
“means for generating a first Downloadable
security profile that identifies suspicious code
in the received Downloadable”

Structure: Downloadable file interceptor
Function: generating a first Downloadable
security profile that identifies suspicious code
in the received Downloadable

(’844 Patent, claim 43)

Structure: content inspection engine
programmed to perform the algorithm
disclosed at col. 8, lines 51–60 of the ’844
Patent
Function: linking the first Downloadable
security profile to the Downloadable before a
web server makes the Downloadable
available to web clients

(’633 patent, claim 14)

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19

where the mobile protection code itself must
be executable
The typographical error in the preamble is
corrected to read:

“means for linking the first Downloadable
security profile to the Downloadable before a
web server makes the Downloadable available
to web clients”

20
(’844 Patent, claim 43)

Structure: content inspection engine
programmed to perform step 630 of Fig. 6,
disclosed at col. 8, lines 65–67 and col. 6,
lines 13–20 of the ’844 Patent.
Specifically, attaching a Downloadable
security profile to the Downloadable (col. 8,
lines 65–67 and col. 6, lines 13–18) or
attaching to the Downloadable a pointer that
points to a stored Downloadable security
profile (col. 6, lines 18–20).

27

“destination computer”

No construction necessary—plain and
ordinary meaning

28

(’926 Patent, claim 22)

21
22
23
24
25
26

38

1
2
3
4
5
6
7

“instantiating, by the computer, a scanner for
the specific programming language” /
“instantiating a scanner for the specific
programming language”

“substituting specific data, instructions, or
both into a scanner to make it usable for
scanning the specific programming language”

(’408 Patent, claims 1, 9, and 22)
“a rules accessor for accessing parser rules and
analyzer rules for the specific programming
language”

Function: accessing
parser rules and analyzer
rules for the specific programming language

(’408 Patent, claim 9)
“polic[y/ies]”

Structure: indefinite under § 112(2) for
failure to disclose corresponding structure
“rule(s) for managing a security system”

(’968 Patent, claims 1 and 13)
“[content] profile”

“information describing the received content”

8
9
10

United States District Court
Northern District of California

11
12

(’968 Patent, claims 1 and 13)
The Court also adopts the following constructions that the parties agreed to in their Joint
Claim Construction Statement:

13
14
15
16
17
18
19
20
21
22

Claim Term

Agreed Construction

“Downloadable”

“an executable application program, which is downloaded
from a source computer and run on the destination computer”

(’844 Patent, claims 1, 15, 41, 43;
’494 Patent, claim 10;
’780 Patent, claims 1, 9, 17;
’926 Patent, claim 22)
“database”
(’494 Patent, claim 10;
’926 Patent, claim 22;
’305 Patent, claims 1, 13)
“means for fetching at least one
software component identified by
the one or more references”

Function: fetching at least one software component identified
by the one or more references

(’780 Patent, claim 17)

Structure: ID generator programmed to perform the
algorithm of step 820 disclosed in the ’780 Patent at Fig. 8;
9:62–64; and 4:56–66.

“means for obtaining a
Downloadable that includes one
or more references to software
components required to be
executed by the Downloadable”

Function: obtaining a Downloadable that includes one or
more references to software components required to be
executed by the Downloadable

23
24
25
26
27
28

“a collection of interrelated data organized according to a
database schema to serve one or more applications”

(’780 Patent, claim 17)

Structure: ID generator programmed to perform the
algorithm of step 810 disclosed in the ’780 Patent at Fig. 8;
9:60–62; and 4:50–54.
39

1

“parse tree”

2

(’408 Patent, claims 1, 9, 22)

3

“policy index”

4

(’968 Patent, claim 1)

“a hierarchical structure of interconnected nodes built from
scanned content”
“a data structure indicating allowability of cached content
relative to a plurality of policies”

5
6
7
8
9
10

United States District Court
Northern District of California

11

IT IS SO ORDERED.
Dated: March 26, 2019
______________________________________
BETH LABSON FREEMAN
United States District Judge

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
40