CUPP Cybersecurity LLC et al v. Trend Micro, Inc. et al

Filing 150

CLAIM CONSTRUCTION MEMORANDUM OPINION AND ORDER: The Court adopts the constructions set forth above, as summarized in the following table. The parties are ORDERED not to refer, directly or indirectly, to each other's claim construction posit ions in the presence of the jury. Likewise, the parties are ORDERED to refrain from mentioning any portion of this opinion, other than the actual definitions adopted by the Court, in the presence of the jury. (Ordered by Chief Judge Barbara M. G. Lynn on 12/6/2021) (mjr)

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 1 of 36 PageID 6506

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF TEXAS
DALLAS DIVISION
CUPP CYBERSECURITY, LLC, and CUPP
COMPUTING AS,

§
§
§
§
§
§
§
§
§
§
§
§
§

Plaintiffs,
v.
TREND MICRO, INC., TREND MICRO
AMERICA, INC., and TREND MICRO
INCORPORATED,
Defendants.

Civil Action No. 3:18-cv-1251-M
(Consolidated with
Civil Action No. 3:20-cv-03206-M)

CLAIM CONSTRUCTION MEMORANDUM OPINION AND ORDER
This Order addresses the claim construction disputes presented by Plaintiffs CUPP
Cybersecurity, LLC, and CUPP Computing AS, and Defendants Trend Micro, Inc., Trend Micro
America, Inc., and Trend Micro Incorporated. 1 The parties submitted opening and responsive
claim construction briefs (ECF Nos. 53, 55, 57, 58), and the Court held a claim construction
hearing in 2019. Later in 2019, the case was stayed pending resolution of seven petitions for
inter partes review (“IPR”) related to this case. After the stay was lifted, the parties submitted
supplemental claim construction briefs to address potential prosecution disclaimer during the
IPR proceedings and claim construction issues as to two newly asserted claims. (ECF Nos. 93,
94, 96). Having considered the arguments and evidence presented by the parties, the Court
issues this Order.

1

On November 1, 2021, this case was consolidated with CUPP Cybersecurity LLC v. Trend Micro Inc., Case No.
3:20-cv-03206-M (CUPP2). This Order addresses claim construction disputes presented in Case No. 3:18-cv-1251M prior to consolidation. The Court will issue a separate order discussing the claim construction disputes presented
in CUPP2.

1

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

I.

Page 2 of 36 PageID 6507

BACKGROUND
Plaintiffs CUPP Cybersecurity, LLC and CUPP Computing AS (together, “CUPP”) are

security providers for mobile devices, which have “a robust portfolio of innovative technology
relating to mobile device security, [addressing] problems found in mobile device management,
network security, DMZ (‘demilitarized zone’) security, and endpoint security.” ECF No. 55 at 1;
ECF No. 1 (“Compl.”) ¶ 8. Defendants Trend Micro, Inc., Trend Micro America, Inc., and
Trend Micro Incorporated (together, “Trend Micro”) make a number of products falling into
several categories: user protection products (i.e., Smart Protection Complete Suit), network
defense products (i.e., Advance Threat Protection), hybrid cloud security products (i.e., Deep
Security), worry-free products (i.e., Worry-Free Standard), home products (i.e., Antivirus for
Mac), Trend Micro Portable Security, Trend Micro Mobile Security, control manager technology
(which supports hybrid cloud security, network defense, and user protection products), XGen
security technology (which powers hybrid cloud security, user protection, worry-free, and
network defense products), smart protection network technology, and power management
technology (i.e., Power Management Module). Compl. ¶¶ 34–48.
CUPP alleges that Trend Micro’s products infringe four of CUPP’s patents: United States
Patent Nos. 9,756,079 (“the ’079 patent”), 9,747,444 (“the ’444 patent”), 8,365,272 (“the ’272
patent”), and 8,789,202 (“the ’202 patent”). 2 Specifically, CUPP asserts the following eight
claims: claim 7 of the ’079 patent, claims 11 and 21 of the ’444 patent, claim 16 of the ’272

2

CUPP initially asserted four additional patents, United States Patent Nos. 8,631,488 (“the ’488 patent”),
9,106,683 (“the ’683 patent”), 9,843,595 (“the ’595 patent”), and 9,781,164 (“the ’164 patent”).
Following IPR, the Patent Trial and Appeal Board (“PTAB”) found unpatentable all challenged claims of
the ’488, ’683, ’595, and ’164 patents. See ECF No. 72.

2

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 3 of 36 PageID 6508

patent, and claims 1, 11, 16, and 21 of the ’202 patent. 3 The parties identify one agreed
construction and five disputed terms for the Court’s resolution. 4
A.

The ’444 Patent.

The ’444 patent is titled “System and Method for Providing Network Security to Mobile
Devices.” CUPP submits the ’444 patent generally describes protecting mobile devices against
attacks and malicious code. ECF No. 55 at 3. The patent claims a security system that can
identify whether a mobile device is in a protected or unprotected network. Id. If the security
system detects that network traffic is unsafe, the system will forward the data to the system’s
processor, which will then scan the data for malicious content before determining whether to
send the data to the mobile device. Id. The abstract of the ’444 patent states,
A small piece of hardware connects to a mobile device and filters out attacks and
malicious code. Using the piece of hardware, a mobile device can be protected by
greater security and possibly by the same level of security offered by its associated
corporation/enterprise. In one embodiment, a mobile security system includes a
connection mechanism for connecting to a data port of a mobile device and for
communicating with the mobile device; a network connection module for acting as
a gateway to a network; a security policy for determining whether to forward
content intended for the mobile device to the mobile device; and a security engine
for executing the security policy.

3

Pursuant to the Court’s scheduling order, by December 18, 2018, CUPP narrowed its infringement case
to twenty asserted claims. ECF No. 39, at 3-5. The PTAB’s final written decisions on the seven IPR
petitions filed in connection with this case subsequently invalidated fourteen of those twenty claims. See
ECF No. 72. After the stay was lifted, the Court granted leave for CUPP to assert two previously
unasserted claims as to a single accused product: claims 1 and 21 of the ’202 patent as to the OfficeScan
10.6. ECF No. 87 at 7. Accordingly, CUPP currently asserts eight claims.

4

During the initial exchange of claim construction briefing and Markman hearing in this case, the parties
raised disputes as to the meaning of terms in claims that have since been invalidated by the PTAB. See,
e.g., ECF No. 48, Ex. A at 1 (Joint Claim Construction and Prehearing Statement) (requesting
construction of terms in the ’488 and ’683 patents); id. at 13, 15 (requesting construction of “A computer,
comprising” and “A computer system, comprising,” terms which appear only in the since-invalidated
claim 1 of the ’272 patent, and claim 1 of the ’079 patent, respectively). Accordingly, given that the
claims in which these disputed terms appear have been invalidated, the parties’ dispute as to the
construction of these terms is moot, and the Court will not address them.

3

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 4 of 36 PageID 6509

’444 patent, Abstract.
Claim 21 of the ’444 patent claims:
A security system comprising:
security system memory storing a security policy identifying one or more
trusted networks and defining when to forward network data intended for a
mobile device to the mobile device for processing by at least one mobile device
processor of the mobile device, the at least one mobile device processor of the
mobile device being different than a security system processor of the security
system,
the security policy defining that when the mobile device does not reside on
any of the one or more trusted networks identified by the security policy,
the security system processor of the security system will scan the network
data for malicious content to decide whether the network data should be
forwarded to the mobile device,
the security policy defining that when the mobile device resides on any of
the one or more trusted networks identified by the security policy, the
security system processor of the security system will allow the network data
to be forwarded to the mobile device without the security system processor
of the security system scanning for the malicious content;
means for receiving from the mobile device particular network data before the
at least one mobile device processor of the mobile device processes the
particular network data, the particular network data having been forwarded to
the security system by the at least one mobile device processor of the mobile
device; and
security code configured to implement the security policy as it relates to the
particular network data received from the mobile device, the security code
configured to modify at least a portion of the particular network data before
delivering the particular network data as modified to the mobile device.
’444 patent, cl. 21.
No petitions for IPR of the ’444 patent were filed before the PTAB.
B.

The ’272 and ’079 Patents

The ’079 Patent is a continuation of United States Patent No. 9,391,956, which is a
continuation of the ’272 Patent. The ’272 and ’079 patents are both titled “System and Method

4

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 5 of 36 PageID 6510

for Providing Network and Computer Firewall Protection with Dynamic Address Isolation to a
Device,” and the specifications of both the ’272 and ’079 patents are nearly identical.
CUPP submits that these patents claim the protection of a mobile device using an
application associated with an application address, a network address translation engine, and a
firewall. ECF No. 93 at 6–7. The application sends out a request to a network. Id. The
application address is translated to a public address by the Network Address Translation
(“NAT”) engine so that any unprotected network only sees a public address. Id. When the
computer receives data from the unprotected network in response to the request, the data is
provided to a firewall that inspects the traffic according to a security policy before the data is
executed on the computer. Id. Thus, the system can determine whether the data associated with
an application requires scanning and subsequent blocking. Id.
The abstract of the ’272 patent states:
A computer performs dynamic address isolation. The computer comprises an
application associated with an application address, a network interface coupled to
receive incoming data packets from and transmit outgoing data packets to an
external network, a network address translation engine configured to translate
between the application address and a public address, and a driver for automatically
forwarding the outgoing data packets to the network address translation engine to
translate the application address to the public address, and for automatically
forwarding the incoming data packets to the network address translation engine to
translate the public address to the application address. The computer may
communicate with a firewall configured to handle both network-level security and
application-level security.
’272 patent, Abstract.
Claim 16 of the ’272 patent claims the following:
A method within a computer of processing outgoing data, the method comprising:
receiving the outgoing data from an application, the application being
associated with an internal address;

5

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 6 of 36 PageID 6511

translating, using a network address translation engine within the computer, the
internal address into a public address;
routing, using a driver within the computer, at least a subset of the outgoing
data to an external network using the public address, thereby dynamically
isolating the internal address from the external network; and
providing, using a network interface within the computer, the subset of the
outgoing data to the external network.
’272 patent, cl. 16.
Claim 7 of the ’079 patent claims the following:
A system comprising:
a network interface configured to be coupled to an external network;
a firewall in communication with the network interface, the firewall configured
to perform both network-level security and application-level security on
incoming data packets, the firewall being further configured to reject the
incoming data packets if the incoming data packets include malicious content
according to a security policy, the firewall being configured to allow the
incoming data packets to pass to one or more applications if the incoming data
packets do not include malicious content according to the security policy;
a computer system in communication with the firewall, the computer system
having one or more applications associated with at least one application
address, the computer system being configured to send to the firewall outgoing
data packets including an application identifier identifying a particular
application of the one or more applications to the firewall; and
an address translation engine configured to translate the at least one application
address associated with the particular application of the one or more
applications to an external address, thereby dynamically isolating the particular
application of the one or more applications from the external network.
’079 patent, cl. 7.
The ’272 and ’079 patents were the subject of IPR proceedings before the PTAB in
IPR2019-00561 (the “’272 patent IPR”) and IPR2019-00641 (the “’079 patent IPR”). The

6

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 7 of 36 PageID 6512

PTAB issued decisions instituting review of the ’272 and ’079 patents, 5 and final written
decisions finding unpatentable certain claims in the ’272 and ’079 patents. 6 As relevant here, the
PTAB provided preliminary and final constructions of “dynamically isolating,” a term appearing
in claim 16 of the ’272 patent and claim 7 of the ’079 patent. See ’272 patent IPR Inst., slip op.
at 12–13; ’272 patent IPR FWD, slip op. at 20–24; ’079 patent IPR Inst., slip op. at 12–14; ’079
patent IPR FWD, slip op. at 19–24. The PTAB also provided preliminary and final constructions
of the terms “subset” and “the subset of the outgoing data,” both of which appear in claim 16 of
the ’272 patent. See ’272 patent IPR Inst., slip op. at 25–26; ’272 patent IPR FWD, slip op. at
24–25.
C.

The ’202 Patent.

The ’202 patent is titled “Systems and Methods for Providing Real Time Access
Monitoring of a Removable Media Device.” The ’202 patent describes systems and methods to
provide data and device security in connection with a removable media device—such as, for
example, a USB flash drive—and a digital device. The specification describes how, according to
the prior art, non-secured and secured USB flash drives lacked certain features to increase
security, such as user authentication and file filtering to limit or restrict access, content
screening, and audit trails to track access or changes to the data on the flash drive. ’202 patent,
at 18:35–42, 19:7–27. The ’202 patent describes embodiments of the invention that overcome
these limitations of the prior art, including a method comprising detecting a removable media

5

Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, paper 7 (PTAB July 26, 2019) (“’272 patent
IPR Inst.”); Trend Micro Inc. v. CUPP Computing AS, IPR2019-00641, paper 7 (PTAB July 26, 2019)
(“’079 patent IPR Inst.”).
6
Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, paper 27 (PTAB July 6, 2020) (“’272 patent
IPR FWD”); Trend Micro Inc. v. CUPP Computing AS, IPR2019-00641, paper 26 (PTAB July 6, 2020)
(“’079 patent IPR FWD”).

7

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 8 of 36 PageID 6513

device coupled to a digital device, authenticating a password to access the removable media
device, injecting redirection code into the digital device, intercepting, with the redirection code, a
request for data, determining to allow the request for data based on a security policy, and
providing the data based on the determination. Id. at 2:4–52. The method may further comprise
selecting the security policy from a plurality of security policies based, at least in part, on the
password and/or filtering the content of the requested data. Id.
Claim 1 of the ’202 patent is representative of claim 21 for purposes of this Order, 7 and
claims:
A method, comprising:
detecting a removable media device coupled to a digital device;
injecting redirection code into the digital device after detecting the removable
media device is coupled to the digital device, the redirection code configured to
intercept a first function call and configured to execute a second function call
in place of the first function call;
intercepting, with the redirection code, a request for data on the removable
media device;
determining whether to allow the intercepted request for data based on a
security policy, the security policy implementing content analysis and risk
assessment algorithms; and
providing requested data based on the determination.
’202 patent, cl. 1.
Claim 11 of the ’202 patent claims:
A removable media device comprising:
a login engine configured to detect coupling to a digital device, the login engine
further configured to inject redirection code into the digital device after
detecting the coupling to the digital device, the redirection code being

7

With the exception of each claim’s respective preamble, claims 1 and 21 are identical and do not differ in their use
of the disputed claim terms, “injecting redirection code into the digital device” and “a request for data on the
removable media device.” Nor do the parties make any arguments specific to either claim in particular.

8

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 9 of 36 PageID 6514

configured to intercept a first function call and configured to execute a second
function call in place of the first function call; and
a controller configured to intercept a request for the data, determine whether to
allow the request for the data based on a security policy, the security policy
implementing content analysis and risk assessment algorithms, and provide
requested data based on the determination.
Id. cl. 11.
The ’202 patent was the subject of inter partes review before the U.S. Patent and
Trademark Office in IPR2019-00803 (the “’202 patent IPR”). The PTAB instituted review of
the ’202 patent, and issued a final written decision, concluding that none of the challenged
claims were unpatentable.
II.

LEGAL PRINCIPLES
A.

General Principles of Claim Construction

The construction of disputed claims is a question of law for the court. Markman v.
Westview Instruments, Inc., 52 F.3d 967, 971–72 (Fed. Cir. 1995), aff’d, 517 U.S. 370 (1996).
“Ultimately, the interpretation to be given a term can only be determined and confirmed with a
full understanding of what the inventors actually invented and intended to envelop with the
claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (en banc) (citation
omitted). Accordingly, a proper construction “stays true to the claim language and most
naturally aligns with the patent’s description of the invention.” Id. (citation omitted).
“It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention
to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting
Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir.
2004)). Courts first “look to the words of the claims themselves . . . to define the scope of the
patented invention.” Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996)

9

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 10 of 36 PageID 6515

(citation omitted). The claim terms are “generally given their ordinary and customary meaning,”
but “a patentee may choose to be his own lexicographer and use terms in a manner other than
their ordinary meaning, as long as the special definition of the term is clearly stated in the patent
specification or file history.” Id. (citation omitted). The “ordinary and customary meaning” of
the terms in a claim is “the meaning that the term[s] would have to a person of ordinary skill in
the art in question at the time of the invention.” Phillips, 415 F.3d at 1313.
When the meaning of a term to a person of ordinary skill in the art is not apparent, a court
is required to consult other sources, including “the words of the claims themselves, the remainder
of the specification, the prosecution history, extrinsic evidence concerning relevant scientific
principles, the meaning of technical terms, and the state of the art.” Id. (citation omitted). A
court must consider the context in which the term is used in an asserted claim or related claims in
the patent, being mindful that “the person of ordinary skill in the art is deemed to read the claim
term not only in the context of the particular claim in which the disputed term appears, but in the
context of the entire patent, including the specification.” Id. The specification is “always highly
relevant to the claim construction analysis” and is “the single best guide to the meaning of a
disputed term.” Id. at 1315 (quoting Vitronics, 90 F.3d at 1582). For example, should the
specification reveal that a claim term has been given a special definition by the patentee that is
different from the ordinary meaning of the term, the inventor’s lexicography is controlling. Id. at
1316. Furthermore, if the specification reveals an intentional disclaimer or disavowal of claim
scope by the patentee, the claim scope dictated by the specification is controlling. Id.
Finally, in construing claims, a court may consult extrinsic evidence, including “expert
and inventor testimony, dictionaries, and learned treatises.” Phillips, 415 F.3d at 1317 (citing
Markman, 52 F.3d at 980). Technical dictionaries may assist a court in “‘better understand[ing]

10

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 11 of 36 PageID 6516

the underlying technology’ and the way in which one of skill in the art might use the claim
terms.” Id. at 1318 (quoting Vitronics, 90 F.3d at 1584 n.6). Expert testimony may also be
helpful to “provide background on the technology at issue, to explain how an invention works, to
ensure that the court’s understanding of the technical aspects of the patent is consistent with that
of a person of skill in the art, or to establish that a particular term in the patent or the prior art has
a particular meaning in the pertinent field.” Id. (citation omitted).
Although extrinsic evidence may “shed useful light on the relevant art,” it is considered
“less significant than the intrinsic record.” Phillips, 415 F.3d at 1317 (quoting C.R. Bard, Inc. v.
U.S. Surgical Corp., 388 F.3d 858, 862 (Fed. Cir. 2004)). More simply, “extrinsic evidence may
be useful to the court, but it is unlikely to result in a reliable interpretation of patent claim scope
unless considered in the context of the intrinsic evidence.” Id. at 1319. Accordingly, “a court
should discount any expert testimony ‘that is clearly at odds with the claim construction
mandated by the claims themselves, the written description, and the prosecution history, in other
words, with the written record of the patent.’” Id. at 1318 (quoting Key Pharms. v. Hercon Labs.
Corp., 161 F.3d 709, 716 (Fed. Cir. 1998)).
III.

AGREED CONSTRUCTION
The parties have agreed to the following construction set forth in their Supplemental

Joint Claim Construction and Prehearing Statement (ECF No. 92):
Term
“A removable media device comprising:”
• ’202 patent, claim 11
IV.

Agreed Construction
The preamble is limiting.

CONSTRUCTION OF DISPUTED TERMS
A.

“means for receiving from the mobile device particular network data before
the at least one mobile device processor of the mobile device processes the
particular network data, the particular network data having been forwarded

11

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 12 of 36 PageID 6517

to the security system by the at least one mobile device processor of the
mobile device” / “means for receiving”
Disputed Term
“means for receiving from the mobile
device particular network data before
the at least one mobile device processor
of the mobile device processes the
particular network data, the particular
network data having been forwarded to
the security system by the at least one
mobile device processor of the mobile
device” / “means for receiving”
• ’444 patent, claim 21

CUPP’s Proposed
Construction
Governed by 35 U.S.C.
§ 112(f)

Trend Micro’s
Proposed Construction
Governed by 35 U.S.C.
§ 112(f)

Function: receiving

Function: receiving
from the mobile device
particular network data
Structure: hardware
and/or software that
before the at least one
enable(s)
mobile device processor
communication,
of the mobile device
including through
processes the particular
adapters, ports, drivers, network data, the
WiFi, WiMAX, CDMA, particular network data
having been forwarded
GSM, Ethernet,
BlueTooth, PCMCIA,
to the security system
modem, USB, or NIC.
by the at least one
mobile device processor
of the mobile device
Structure: USB
connection 1020

The parties agree that the “means for . . .” limitation of claim 21 of the ’444 patent is a
means-plus-function limitation governed by § 112(f). See Wenger Mfg., Inc. v. Coating Mach.
Sys., Inc., 239 F.3d 1225, 1232 (Fed. Cir. 2001) (“[I]n determining whether a claim limitation is
a means-plus-function limitation, the use of the word ‘means’ creates a presumption that § 112[f]
applies.”).
A means-plus-function claim element triggers 35 U.S.C. § 112(f), which allows an
applicant to express a claim limitation “as a means or step for performing a specified function
without the recital of structure, material, or acts in support thereof,” and provides that “such
claim[s] shall be construed to cover the corresponding structure, material, or acts described in the
specification and equivalents thereof.” 35 U.S.C. § 112(f); see also Ergo Licensing, LLC v.
12

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 13 of 36 PageID 6518

CareFusion 303, Inc., 673 F.3d 1361, 1363 (Fed. Cir. 2012). In other words, a means-plusfunction claim element allows the patentee to use a generic means to express a claim limitation,
but the specification must disclose the corresponding structure. Ergo Licensing, LLC, 673 F.3d
at 1363 (quoting Biomedino, LLC v. Waters Techs. Corp., 490 F.3d 946, 948 (Fed. Cir. 2007)).
Thus, construction of a means-plus-function limitation consists of two steps: (1) identifying the
claimed function, and (2) determining what, if any, structure in the specification corresponds
with that function. Cardiac Pacemakers, Inc. v. St. Jude Med., Inc., 296 F.3d 1106, 1113 (Fed.
Cir. 2002). The court must construe the function to include only those limitations in the claim
language. Id. “It is improper to narrow the scope of the function beyond claim language” or to
broaden the scope by disregarding limitations in the claims themselves. Id. (indicating further
that “[o]rdinary principles of claim construction govern interpretation of the claim language used
to describe the function”).
Here, because the “means for . . . ” limitation in claim 21 of the ’444 patent recites a
function, but not a structure for performing that function, the limitation falls under § 112(f).
Accordingly, the Court must both identify the claimed function and determine what structure, if
any, in the specification corresponds with that function.
1.

Function

The Parties’ Positions
CUPP argues that “receiving” is the function and the language after the word “receiving”
describes other actions that the “receiving” element performs, citing to the testimony of its
expert, Dr. Medvidovic, to support its argument that a person of ordinary skill in the art “would
define that function as receiving.”

13

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 14 of 36 PageID 6519

Trend Micro responds that this construction unduly broadens the specifics of the claim.
ECF No. 53 at 23 (citing Joovy LLC v. Baby Trend, 3:06-cv-0616-P, 2007 WL 5688725, at *3
(N.D. Tex. Feb. 14, 2008) (“The Court must not narrow or broaden the specifics of the claim due
to a means-plus-function interpretation.”)). Trend Micro argues that the function includes all the
language after “means for,” because the limitation does not include a “whereby” clause, a clause
that states a result, or a clause that “adds nothing to the substance of the claim,” and all of the
limitations following the preposition “for” are substantive. ECF No. 53 at 20. For example, the
particular network data must come from the mobile device, must not have been processed by the
mobile device, and must have been forwarded by the mobile device. See ’444 patent, at 18:12–1.
Trend Micro cites case law where courts have found that the function of a means-plus-function
limitation is set forth by all of the limitations after the preposition “for.” See, e.g., Spherix Inc. v.
Vtech Telecoms, Ltd., No. 3:13-cv-3494-M, 2015 WL 9311489, at *17 (N.D. Tex. Mar. 19,
2015) (finding the function included all of the limitations after the preposition “for”: “first
processor means at the handset for displaying keyed alphanumeric data on the screen and
concurrently transmitting the alphanumeric data and commands to the base station”).
CUPP argues that the cases cited by Trend Micro are distinguishable, because “they
relate to examples where the function is described in the context of what the component at issue
does—not what other components in the system are doing.” ECF No. 57 at 15. For example, in
Lockheed Martin Corp. v. Space Systems/Loral Inc., the court identified the function as
emphasized below:
Means for rotating said wheel in accordance with a predetermined rate schedule
which varies sinusoidally over the orbit at the orbital frequency of the satellite
whereby the altitude of said satellite is offset in response to the effect of said
rotating wheel by the direction of the pitch axis being changed with respect to said
momentum vector.

14

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 15 of 36 PageID 6520

324 F.3d 1308 (Fed. Cir. 2003) (emphasis added).
CUPP asserts that the italicized function concerns how the function of rotating is done,
unlike here, where the language after “receiving” does not relate to how the receiving is done,
but rather describes other components in the system and how they operate.
Analysis
The Court concludes that the function of the means-plus-function limitation in claim 21
of the ’444 patent includes all of the words after the word “for,” i.e., the function is receiving
from the mobile device particular network data before the at least one mobile device processor of
the mobile device processes the particular network data, the particular network data having been
forwarded to the security system by the at least one mobile device processor of the mobile
device. Contrary to CUPP’s argument, the words after “for” relate to the mobile security system
doing the “receiving,” and do not merely describe what other components in the system are
doing. Specifically, the language describes from where the data is received (“the mobile
device”; “having been forwarded to the security system by the at least one mobile device
processor of the mobile device”), what data is received (“particular network data . . . having been
forwarded to the security system by the at least one mobile device processor of the mobile
device”); and when the data is received (“before the at least one mobile device processor . . .
processes the particular network data”). ’444 patent, at 18:12–17. These limitations clearly
modify the “receiving” function, and ignoring them would improperly broaden the claim’s scope.
See Lockheed Martin, 324 F.3d at 1319 (“[N]either may the function be improperly broadened
by ignoring the clear limitations contained in the claim language. The function of a means-plusfunction claim must be construed to include the limitations contained in the claim language.”).

15

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

2.

Page 16 of 36 PageID 6521

Structure

Having identified the function, the Court must now determine the corresponding
structure. “A disclosed structure is corresponding only if the specification or the prosecution
history clearly links or associates that structure to the function recited in the claim.” Omega
Eng’g, Inc., v. Raytek Corp., 334 F.3d 1314, 1321 (Fed. Cir. 2003).
The Parties’ Positions
CUPP argues that the structure for performing the function in claim 21 is “hardware
and/or software that enable(s) communication, including through adapters, ports, drivers, WiFi,
WiMAX, CDMA, GSM, Ethernet, Bluetooth, PCMCIA, modem, USB, or NIC.” ECF No. 55 at
16; ECF No. 57 at 17. CUPP contends that a person of ordinary skill in the art would recognize
that those structures are capable of performing the function of “receiving from the mobile device
particular network data before the at least one mobile device processor of the mobile device
processes the particular network data, the particular network data having been forwarded to the
security system by the at least one mobile device processor of the mobile device,” citing for
support various parts of the ’444 patent specification, including Figures 10A, 10B, and 10C. See
’444 patent, at 2:49–52, 57–64 (“In an embodiment, a mobile security system includes a
connection mechanism for connecting to a data port of a mobile device . . .” and that “the
connection mechanism may include a network interface card that implements WiFi, WiMAX,
GPRS, GSM, UMTS, CDMA, Generation 3, other cell phone internet connection protocols,
etc.”), 7:19–20, 14:43–44, figs. 10A, 10B, 10C.
Trend Micro replies that Figures 10B and 10C do not disclose a structure clearly linked to
the limitation’s function because in those embodiments, the mobile security system receives data
from the Internet, not the mobile device, in contrast to the portion of the function that recites

16

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 17 of 36 PageID 6522

“receiving from the mobile device particular network data . . . .” ’444 patent, cl. 21. In addition,
Trend Micro contends that the mobile security systems in Figures 10B and 10C send data to the
mobile device rather than receive data from the mobile device. Trend Micro asserts that the only
structure disclosed in the ’444 patent’s specification that is clearly linked to, or associated with,
this limitation’s function is “USB connection 1020,” shown in Figure 10A. ECF No. 53 at 23–
24. In that embodiment, the mobile security system receives internet traffic from the mobile
device via a USB connection.
Trend Micro further contends that the fact that other structures for connecting to a
network are disclosed in the specification is irrelevant under Medtronic, Inc. v. Advanced
Cardiovascular Sys., Inc., 248 F.3d 1303 (Fed. Cir. 2001). There, the Federal Circuit held that
even though the specification disclosed four structures capable of performing a function, because
the specification clearly linked or associated only one of the four structures with the means-plusfunction limitation’s recited function, the three remaining structures were excluded from the
limitation’s construction. Id. at 1311–15.
Analysis
The Court concludes that the corresponding structure for the function in claim 21 of the
’444 Patent is “connection mechanisms for USB, Ethernet, WiFi, WiMAX, GSM, CDMA,
BlueTooth, PCMCIA, modem, or NIC.” ’444 patent, at 7:35–41. Although Figure 10A is the
only embodiment or part of the specification where the mobile security system “receives
particular network data from the mobile device,” the specification emphasizes that it does so via
a USB connection as merely an example. See id. at 14:49–67 (“Other connection architectures
are also possible. The foregoing description of the preferred embodiments of the present
invention is by way of example only, and other variations and modifications of the above-

17

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 18 of 36 PageID 6523

described embodiments and methods are possible in light of the foregoing
teaching. . . . Components may be implemented using a programmed general purpose digital
computer, using application specific integrated circuits, or using a network of interconnected
conventional components and circuits. Connections may be wired, wireless, modem, etc.”).
Because the specification states that the mobile security system can connect to and receive data
from the mobile device via a number of connection mechanisms, see, e.g., id.; see also id. at
7:19–20, the Court will not limit the structure in the means-plus-function element of claim 21 to
a USB connection. Medtronic is distinguishable in this regard. There, the specification
disclosed other structures, but made clear that the structures had other, alternative functions. 248
F.3d at 1313; see also id. at 1310 (“[T]he specification itself described the straight wire and
hooks as ‘means to prevent longitudinal overstretch’ and did not refer to these structures as
means for [the claimed function of] connecting adjacent elements.”).
Accordingly, in light of the foregoing, the Court construes the means-plus-function
limitation in claim 21 of the ’444 patent as follows: the function is “receiving from the mobile
device particular network data before the at least one mobile device processor of the mobile
device processes the particular network data, the particular network data having been forwarded
to the security system by the at least one mobile device processor of the mobile device,” and the
associated structure is connection mechanisms for USB, Ethernet, WiFi, WiMAX, GSM,
CDMA, BlueTooth, PCMCIA, modem, or NIC.

18

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

B.

Page 19 of 36 PageID 6524

“subset” / “the subset of the outgoing data”
Disputed Term

“subset” / “the subset of the outgoing
data”
• ’272 patent, claim 16

CUPP’s Proposed
Construction
The plain and ordinary
meaning should apply.

Trend Micro’s
Proposed Construction
Less than all / less than
all of the outgoing data

“Subset” means “any
portion of,” and “the
subset of the outgoing
data” means “any
portion of the outgoing
data”
The Parties’ Positions
CUPP submits that “subset” should be construed according to its plain and ordinary
meaning, namely that a “subset” means “any portion of,” and “the subset of the outgoing data”
means “any portion of the outgoing data.” ECF No. 93 at 8. Specifically, CUPP contends that a
“subset” can be both a portion of the full set, as well as all of the items in the set. For support,
CUPP points to claim 16 of the ’272 patent, which recites “routing . . . at least a subset of the
outgoing data”; the inclusion of “at least,” according to CUPP, provides that “subset” can include
any portion of the outgoing data, up to and including all of the outgoing data. In addition, CUPP
points to dictionary definitions and other court opinions to distinguish between a “subset” and a
“proper subset,” which refers to less than the full set. Id. at 9 (citing In re Townshend Pat. Litig.,
No. C 02-04833 JF, 2004 WL 1920049, at *17 (N.D. Cal. Aug. 26, 2004) (“The additional
limitation of deriving a subset remains meaningful even if the subset, in some instances, is
identical to the set.”)). CUPP also cites the PTAB’s final written decision in the ’272 patent IPR,
in which the PTAB construed subset “to read on providing any portion of the outgoing data, up
to and including all the data, and not a proper subset.” ’272 patent IPR FWD, slip op. at 25. In
construing “subset” this way, the PTAB adopted the construction argued by Trend Micro, and

19

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 20 of 36 PageID 6525

accordingly, CUPP argues that Trend Micro is now judicially estopped from arguing for a
different construction.
In response, Trend Micro argues that because CUPP advocated for a narrower
construction before the PTAB—namely, that “subset” in claim 16 of the ’272 patent means a
“proper subset”—under the doctrine of prosecution disclaimer, CUPP disclaimed the broader
claim scope. Trend Micro contends its proposed construction is a faithful reflection of the
disclaimer of claim scope CUPP made before the PTAB, and that CUPP’s disclaimer warrants
departing from the plain and ordinary meaning of the claim language.
Analysis
The Court notes that the parties have reversed positions and are each arguing the opposite
of what they advocated to the PTAB; CUPP sought a narrower construction from the PTAB, yet
now argues for plain and ordinary meaning, whereas Trend Micro argued plain meaning, but
now seeks the narrower construction previously urged by CUPP. Each party also argues that its
opponent is legally precluded from their respective positions, either by judicial estoppel (as to
Trend Micro) or prosecution disclaimer (as to CUPP).
Other than prosecution disclaimer, Trend Micro provides no basis to depart from the
plain and ordinary meaning of the claim language, and accordingly, this dispute turns on the
application of prosecution disclaimer and whether, by arguing for a narrower construction
ultimately rejected by the PTAB, CUPP disclaimed the scope of “subset” and “the subset of the
outgoing data,” such that instead of having their plain meaning, these terms mean “less than all”
and “less than all of the outgoing data,” respectively.
The doctrine of prosecution disclaimer is “well established in Supreme Court precedent,
precluding patentees from recapturing through claim interpretation specific meanings disclaimed

20

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 21 of 36 PageID 6526

during prosecution.” Omega, 334 F.3d at 1323. Under this doctrine, “when the patentee
unequivocally and unambiguously disavows a certain meaning to obtain a patent, the doctrine of
prosecution history disclaimer narrows the meaning of the claim consistent with the scope of the
claim surrendered.” Biogen Idec, Inc. v. GlaxoSmithKline LLC, 713 F.3d 1090, 1095 (Fed. Cir.
2013).
In claim construction, prosecution disclaimer “promotes the public notice function of the
intrinsic evidence and protects the public’s reliance on definitive statements made during
prosecution.” Omega, 334 F.3d at 1323–24. Ultimately, the doctrine of prosecution disclaimer
ensures that claims are not “construed one way in order to obtain their allowance and in a
different way against accused infringers.” Southwall Techs., Inc. v. Cardinal IG Co., 54 F.3d
1570, 1576 (Fed. Cir. 1995). The Federal Circuit has applied prosecution disclaimer to
statements made during IPR proceedings. Aylus Networks, Inc. v. Apple Inc., 856 F.3d 1353,
1360 (Fed. Cir. 2017).
Trend Micro contends that statements made by CUPP during the ’272 patent IPR
constitute prosecution disclaimer. In its preliminary response to Trend Micro’s petition to
institute the ’272 patent IPR, CUPP argued that Trend Micro had not provided any analysis as to
how Sikdar, an asserted prior art reference, satisfied the claim element of “routing, using a
driver within the computer, at least a subset of the outgoing data to an external network using
the public address.” Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, Patent Owner’s
Preliminary Response, slip op. at 24 (PTAB May 6, 2019) (emphasis in original). In its
institution decision, the PTAB rejected this argument, noting “[t]he inclusion of ‘at least’
modifying ‘subset’ expands the phrase to read on providing any portion of the outgoing data, up
to and including all the data.” ’272 patent IPR Inst., slip op. at 24–25. In its response following

21

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 22 of 36 PageID 6527

institution, CUPP again argued that argued that Sikdar could not meet claim 16’s routing
limitation “on the basis that the routing limitation can be met by routing all of the outgoing
data,” because “the plain language of the claims requires that what is provided to the external
network is a subset of the outgoing data.” Trend Micro Inc. v. CUPP Computing AS, IPR201900561, Patent Owner’s Response, slip op. at 3 (PTAB Oct. 21, 2019). CUPP argued that, based
on the difference between “subset” and “at least a subset,” “a POSITA would recognize . . . the
claimed ‘subset’ is a ‘proper subset’ because only a subset (i.e., ‘a subset that is not all’) of the
packets received by, for example, the hybrid firewall, is sent to the external network.” Id. at 45–
47. The PTAB expressly rejected CUPP’s argument, and instead, relying on dictionary
definitions and the claim language, the PTAB construed the references to “subset” in claim 16 of
the ’272 patent “to read on providing any portion of the outgoing data, up to and including all the
data, and not a proper subset.” ’272 patent IPR FWD, slip op. at 25.
CUPP concedes that it argued to the PTAB that a subset must be a proper subset, but
contends that because the PTAB rejected its argument, prosecution disclaimer does not apply.
The Court agrees. At most, this case presents a case of attempted disclaimer: CUPP requested a
narrower interpretation of “subset,” which was rejected by the PTAB in favor of the broader
plain and ordinary meaning of the term. Put differently, CUPP attempted to disavow a certain
meaning of “subset”—namely, that a subset can encompass “all” outgoing data for purposes of
claim 16 of the ’272 patent—but was precluded from surrendering that claim scope when the
PTAB rejected its proposed construction. See Biogen, 713 F.3d at 1095. The fact that the PTAB
adopted the broader construction of “subset’ undermines any notice function served by
prosecution disclaimer, and distinguishes this case from those where the patentee affirmatively
and successfully disclaims claim scope during prosecution. See Power Integrations, Inc. v. ON

22

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 23 of 36 PageID 6528

Semiconductor Corp., 396 F. Supp. 3d 851, 866 (N.D. Cal. 2019) (“[T]he public notice function
served by prosecution disclaimer functions much differently where the claim scope [urged by the
patentee] is rejected. When the scope is rejected, the adjudicative body’s final decision rejecting
the claim scope provides notice to the public that the claim scope is different than what the
patentee argued—i.e., that the patentee’s claim scope is wrong.”).
Trend Micro cites no authority indicating that prosecution disclaimer applies to
arguments expressly considered and rejected during prosecution. On the contrary, numerous
district courts have refused to find disclaimer where the patent office rejected the purported
disclaimer. See Vertical Tank, Inc. v. BakerCorp, No. 118CV00145LJOJLT, 2019 WL 2207668,
at *11 (E.D. Cal. May 22, 2019) (collecting cases). Instead, Trend Micro repeatedly emphasizes
the Federal Circuit’s statement in Greenliant that “[i]t does not matter whether the examiner or
the Board adopted a certain argument for allowance; the sole question is whether the argument
was made.” 8 Greenliant Sys., Inc. v. Xicor LLC, 692 F.3d 1261, 1271 (Fed. Cir. 2012).
The Court interprets the Federal Circuit’s statement in Greenliant not as a blanket rule
mandating disclaimer based on any argument advanced by the patentee during prosecution, but
rather acknowledgment of other Federal Circuit guidance that a patentee can surrender claim
scope even if the examiner does not expressly rely on its disclaimer. See id. (citing Springs
Window Fashions LP v. Novo Indus., L.P., 323 F.3d 989, 995 (Fed. Cir. 2003) (holding that
though “it is not clear from the record why the examiner allowed the claims,” the examiner’s
reasons for allowance “do not negate the effect of the applicant’s disclaimer”)); see also Laitram
Corp. v. Morehouse Indus., Inc., 143 F.3d 1456, 1462 (Fed. Cir. 1998) (“The fact that an

8

Indeed, Trend Micro quotes this sentence from the Federal Circuit’s Greenliant opinion six times in its
brief.

23

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 24 of 36 PageID 6529

examiner placed no reliance on an applicant’s statement distinguishing prior art does not mean
that the statement is inconsequential for purposes of claim construction.”). The rule that an
examiner need not necessarily rely on a patentee’s statement for disclaimer to attach stems from
the notice function of prosecution disclaimer, namely that competitors should be able to rely on
the patentee’s representations concerning the scope and the meaning of the claims when
assessing potential infringement liability, even if not ultimately addressed by the patent office.
See Hockerson–Halberstadt, Inc. v. Avia Group Int’l, Inc., 222 F.3d 951, 957 (Fed. Cir. 2000)
(“[C]ompetitors are entitled to rely on [patentee’s] representations when ascertaining the degree
of lawful conduct.”).
Here, there is no concern that a competitor might rely on CUPP’s arguments regarding
the meaning of “subset” to conclude that it did not infringe, as the PTAB expressly rejected those
arguments. Indeed, adopting CUPP’s urged construction would confuse—rather than clarify—
the scope of the ’272 patent. See Power Integrations, 396 F. Supp. 3d at 866 (“It would be an
odd outcome indeed if the patentee was required to maintain an argument in a later adjudication
when everyone, including the alleged infringer, is on notice that the argument is incorrect.”).
In addition, Trend Micro neither addresses nor alleviates concerns that, should the Court
adopt Trend Micro’s proposals, a different construction will apply for determining patentability
before the PTAB versus assessing infringement before this Court, contrary to Federal Circuit
guidance. See Amazon.com, Inc. v. Barnesandnoble.com, Inc., 239 F.3d 1343, 1351 (Fed. Cir.
2001) (“[T]he claims must be interpreted and given the same meaning for purposes of both
validity and infringement analyses.”).
In sum, the Court concludes that prosecution disclaimer does not apply. Because Trend
Micro identifies no other basis to depart from the plain and ordinary meaning of subset, the

24

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 25 of 36 PageID 6530

Court hereby construes “subset” and “the subset of the outgoing data” to have their plain
meaning, where “subset” means “any portion of, up to and including all of,” and “the subset of
the outgoing data” means “any portion of the outgoing data, up to and including all of the data.”
C.

“dynamically isolating”

Disputed Term
“dynamically isolating”
• ’272 patent, claim 16
• ’079 patent, claim 7

CUPP’s Proposed
Construction
The plain and ordinary
meaning should apply.

Trend Micro’s Proposed
Construction
Dynamically isolating
requires:

Plain and ordinary generally
(1) The use of DHCP or other
means “dynamically
dynamic source of
isolating” is “separating when
addresses in connection
and as needed”
with a NAT engine to
translate IP addresses; and
(2) The use of a dynamic
address protocol to isolate
applications.
The Parties’ Positions
CUPP submits that “dynamically isolating” should be given its plain and ordinary
meaning, citing definitions and the specifications of the ’272 and ’079 patents to support its
interpretation that “dynamically” means an operation that occurs “when and as needed,” and
“isolating” means “separating.” ECF No. 93 at 13. CUPP disputes Trend Micro’s proposed
construction as having no support in the intrinsic record because Trend Micro’s proposal rewrites
the claim language; according to CUPP, “dynamically isolating” in the claims describes how the
isolating is achieved—“dynamically isolating the internal address from the external network”
(’272 patent, cl. 16), and “dynamically isolating the particular application of the one or more
applications from the external network” (’079 patent, cl. 7)—whereas Trend Micro’s proposal
incorporates additional limitations of a type of protocol and source address, unsupported by the
claim language or specifications. In particular, the phrases “dynamic source of addresses” and

25

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 26 of 36 PageID 6531

“dynamic address protocol” do not appear anywhere in the specifications of the ’272 and ’079
patents. In addition, contrary to the doctrine of claim differentiation, CUPP argues that Trend
Micro’s proposed construction imports limitations from dependent claims, namely specific
references to “Dynamic Host Configuration Protocol,” which does not appear in the asserted
independent claims. See ’272 patent, cl. 17; ‘079 patent, cl. 12. CUPP further maintains that
Trend Micro is judicially estopped from seeking its proposed construction, given that Trend
Micro successfully convinced the PTAB to reject the same constructions for which Trend Micro
now advocates.
In response, Trend Micro contends that CUPP disclaimed the construction of
“dynamically isolating” having its plain and ordinary meaning. ECF No. 94 at 32. Trend Micro
points to statements made by CUPP to the PTAB during the ’272 and ’079 patent IPRs,
indicating that a POSITA would understand “dynamically isolating” to require “the use of DHCP
or other dynamic source of addresses,” and “the use of a dynamic address protocol to isolate
applications.” Id.
Analysis
The issue in dispute again distills to whether, by arguing a narrower construction
ultimately rejected by the PTAB, CUPP disclaimed the scope of “dynamically isolating” in the
’272 and ’079 patents to mean something narrower than the phrase’s plain and ordinary meaning.
In instituting both the ’272 patent IPR and ’079 patent IPR, the PTAB construed
“dynamically isolating” as “including the use of DHCP or other source of addresses in
connection with a NAT engine to translate IP addresses,” and construed “dynamically” as
“referring to an operation that occurs ‘when and as needed.’” ’272 patent IPR Inst., slip op. at
12–13; ’079 patent IPR Inst., slip op. at 13–14. Following institution, CUPP advocated for

26

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 27 of 36 PageID 6532

different constructions, both of which were rejected by the PTAB. Specifically, in the ’272
patent IPR, CUPP argued that “‘dynamically isolating’ means ‘the use of DHCP or other
dynamic source of addresses in connection with a NAT engine to translate IP addresses.’” Trend
Micro Inc. v. CUPP Computing AS, IPR2019-00561, Patent Owner’s Response, slip op. at 14
(PTAB Oct. 21, 2019) (emphasis in original). CUPP also argued against the PTAB’s
construction that “dynamically isolating” occurs “when and as needed,” arguing that under this
construction, “dynamically isolating” could encompass any other source of address. Id. In its
Final Written Decision, the PTAB addressed CUPP’s criticisms of its construction and expressly
rejected that. See ’292 patent IPR FWD, slip op. at 24 (“We disagree with Patent Owner’s
arguments and, therefore, do not adopt Patent Owner’s proposed construction in place of our
original construction.”). Similarly, in the ’079 patent IPR, CUPP argued that “‘dynamically
isolating’ means ‘the use of a dynamic address protocol to isolate application [sic].’” Trend
Micro Inc. v. CUPP Computing AS, IPR2019-00641, Patent Owner’s Response, slip op. at 13
(PTAB Oct. 21, 2019). The PTAB expressly rejected this construction. ’079 patent IPR FWD,
slip op. at 21–22 (“After considering Patent Owner’s arguments, we are still persuaded that, for
the reasons given in our Institution Decision and summarized supra, our initial construction is
correct.”).
As with the “subset” terms construed previously, in light of the PTAB’s express rejection
of CUPP’s attempted narrowing of its claims, the Court declines to find prosecution disclaimer
here. Trend Micro provides no basis for its proposed constructions other than prosecution
disclaimer. Accordingly, the Court construes “dynamically isolating” to have its plain and
ordinary meaning.

27

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

D.

Page 28 of 36 PageID 6533

“injecting redirection code into the digital device”
Disputed Term

“injecting redirection code into the
digital device”
• ’202 patent, claims 1, 21

CUPP’s Proposed
Construction
The plain and ordinary
meaning should apply.

Trend Micro’s
Proposed Construction
The redirection code is
injected from outside
the digital device into
the digital device

The Parties’ Position
CUPP posits that “injecting redirection code into the digital device” should be given its
plain and ordinary meaning, as the meaning of this phrase is readily discernible and requires no
additional explanation. Specifically, CUPP contends that injection of the code into the digital
device “places the redirection code into the digital device in an active and usable state on the
digital device.” ECF No. 96 at 14. CUPP further contends that the ’202 patent specification
counsels against Trend Micro’s proposed construction, and points to an embodiment described in
Figure 22 and step 2210 of the specification, in which the “redirection code” is injected from an
application already present on the digital device into another process running on the same device.
According to CUPP, Trend Micro’s proposed construction would exclude this embodiment, and
there is no prosecution disclaimer or definition in the ’202 patent to support reading out this
preferred embodiment.
Trend Micro contends that the claim language, specification, and dictionary definitions
all support a construction that specifies that the redirection code is injected from outside the
digital device into the digital device. Specifically, Trend Micro points to the claim language
“injecting” and “into,” as indicating that the code is being moved into the device and argues that
such language would not be necessary if the redirection code were already present on the device.
Trend Micro also argues that the redirection code is injected only after the removable media
device is coupled to the digital device, indicating that the code is moved from outside to inside of
28

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 29 of 36 PageID 6534

the digital device. Trend Micro also cites portions of the specification indicating that the source
of the redirection code is outside of the digital device. See ECF No. 94 at 21 (citing ’202 patent,
at 20:1–3, 21:24–25). Trend Micro further quotes four definitions of “inject,” all using the word
“introduce” in the definition, as extrinsic evidence that the redirection code is moved from
outside the digital device into the digital device. Finally, Trend Micro argues that construction
of this term is necessary in light of CUPP’s infringement contentions for the OfficeScan software
product, and that the parties’ dispute as to the claim scope cannot be resolved by adopting the
plain and ordinary meaning.
Analysis
The issue in dispute is whether the “injecting redirection code into the digital device”
limitation in claims 1 and 21 of the ’202 patent requires that the redirection code is injected from
outside the digital device. The Court concludes that it does.
The Court begins with the claim language. Phillips, 415 F.3d at 1312. The Court notes
that although both claim 1 and claim 21 require “injecting redirection code into the digital device
after detecting the removable media device is coupled to the digital device,” the claims
themselves do not specify that the origin of the redirection code is the removable media device;
instead, coupling of the removable media device to the digital device is simply a condition
precedent for injecting the redirection code. See ’202 patent, cls. 1, 21 (emphasis added).
Neither claim 1 nor claim 21 of the ’202 patent specify where the “redirection code” is housed.
Thus, the only support in the claim language for Trend Micro’s proposed construction is the
claims’ use of the “injecting . . . into” language, which strongly implies some sort of directional
movement, i.e., the injected redirection code is crossing some threshold by moving into the

29

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 30 of 36 PageID 6535

digital device. Put differently, “injecting the redirection code into the digital device” would not
be necessary if the redirection code were already present on the digital device.
Even without additional support in the claims, this ordinary understanding of
“injecting . . . into,” conveys such a strong connotation of introduction or movement across a
boundary of the redirection code that any alternative reading is strained and artificial. The Court
is not convinced by CUPP’s argument that a POSITA would understand this “injecting the code
into the digital device” language to mean the activation or calling up of otherwise dormant,
unused code, or “introduc[ing] in a manner that adds a feature.” See ECF No. 96 at 14–15.
CUPP points to nothing to support this other purported meaning of “injecting,” and does not
account for the implications of the word “into”; if redirection code already present on the digital
device is merely being activated from an otherwise dormant state, the requirement that code be
injected “into” the digital device is rendered superfluous.
Indeed, the Court concludes that CUPP’s proposed reading is so detached from the
ordinary and plain meaning of “injecting . . . into” that this purported meaning would not be
obvious to a POSITA, let alone the public writ large. See Dayco Prod., Inc. v. Total
Containment, Inc., 258 F.3d 1317, 1324 (Fed. Cir. 2001) (“If an argument offered in support of a
particular claim construction is so convoluted and artificial that it would not be apparent to a
skilled artisan reading the patent and the prosecution history, the argument is simply unhelpful to
the performance of our task.”); see also White v. Dunbar, 119 U.S. 47, 52 (1886) (“[I]t is unjust
to the public . . . to construe [a claim] in a manner different from the plain import of its terms.”).
Had the patentee wished to convey such a meaning, it could have omitted the word “into,” or
chosen language with weaker connotations of movement, such as “installing” or “activating.”
As such, the plain language of the claims support Trend Micro’s proposed construction.

30

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 31 of 36 PageID 6536

The specification does not warrant a contrary construction. The specification does not
define “injecting,” but uses it in the context of injecting redirection code into the digital device,
using substantively similar language as the claims. See id. at 2:43 (“injecting redirection code
into the digital device”), 2:53–55 (“Injecting redirection code into the digital device may
comprise temporarily replacing one or more dlls within the digital device.”), 3:5–7. Elsewhere,
the specification describes embodiments that specify that the redirection module is “injected
from the removable media device,” consistent with the claim language describing redirection
code injected into the digital device. Id. at 20:1–3 (emphasis added); see also id. at 21:24–26
(“In various embodiments, the application 1912 may inject code from the removable media
device 1904 into the digital device 1902.”).
CUPP’s reliance on Figure 22 and step 2210 is misplaced. Figure 22 and step 2210
describe how, after coupling of the digital device and removable media device, an application
and one or more dll(s) are copied from the removal media device to the digital device, and then
subsequently, “[i]n step 2210, the application injects one or more dll(s) to the enumerated user
processes,” which may constitute the redirection module. Id. at 25:25–41, 25:51–52. However,
the fact that the application subsequently injects dll(s) to the user process after being copied from
the removable media device does not negate the fact that the application and dll(s) were initially
moved from the removable media device into the digital device (i.e., “injected into” the digital
device). The specification itself recognizes that “[i]njecting redirection code into the digital
device may comprise temporarily replacing one or more dlls within the digital device.” Id. at
2:53–55. Moreover, claim 7, which depends on claim 1, explicitly recites “receiving injected
Dynamic Link Libraries (DLLs) to the enumerated user processes.” Id. cl. 7. Indeed, the
specification describes instances in which code is injected into something besides the digital

31

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 32 of 36 PageID 6537

device, indicating that the patentee was aware of the distinction between injecting code into “the
digital device” as a whole versus some subcomponent of the device, such as memory or user
processes. E.g., id. at 22:10 (“The application may perform code injection into memory.”).
Accordingly, the Court concludes that construing “injecting redirection code into the digital
device” as requiring the redirection code be injected from outside the digital device does not read
out the embodiment described in Figure 22 and step 2210.
The Court notes that although it is relying on the plain and ordinary meaning of
“injecting . . . into” to reach its construction, merely adopting the plain and ordinary meaning of
this term will not resolve the parties’ dispute. See O2 Micro Int'l Ltd. v. Beyond Innovation
Tech. Co., 521 F.3d 1351, 1360 (Fed. Cir. 2008). Accordingly, for the foregoing reasons, the
Court construes “injecting redirection code into the digital device” to mean “the redirection code
is injected from outside the digital device into the digital device.”
E.

“a request for data on the removable media device” / “a request for the data”
Disputed Term

“a request for data on the removable
media device”
• ’202 patent, claims 1, 21
“a request for the data”’
• ’202 patent, claim 11

CUPP’s Proposed
Construction
The plain and ordinary
meaning should apply.

Trend Micro’s
Proposed Construction
A request for data
located on the
removable media device

The Parties’ Position
CUPP contends that both “a request for data on the removable media device,” in claims 1
and 21 of the ’202 patent, and “a request for the data,” in claim 11, should have their plain and
ordinary meaning. Specifically, CUPP argues that Trend Micro’s proposed addition that the
request for data “located on the removable device” adds nothing to clarify the scope of claims 1
and 21 beyond what is already apparent from the claim language (i.e., “on the removable

32

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 33 of 36 PageID 6538

device”), and improperly adds a limitation into claim 11 that does not include such a
requirement. ECF No. 93 at 20–21.
Trend Micro responds that construction of “a request for data on the removable media
device” in claims 1 and 21 is necessary in light of CUPP’s infringement contentions; according
to Trend Micro, although CUPP seemingly concedes in its brief that claims 1 and 21 require that
the data be located on the removable media device, in its contentions CUPP maps this element
onto a request for data that is not located on the removable media device, but instead the digital
device (or, in the language of CUPP’s contentions, “the computer”). ECF No. 94 at 14 (citing
Def. App. 134–35 (“[Trend Micro’s] Device Control . . . intercept[s] with its redirection code the
malicious automatic function calls on the external device that request data from the computer to
run application. . . . Device Control regulates the external device’s access to the computer by
blocking malicious, or potentially malicious, function calls from requesting data from the
operating system.”). According to Trend Micro, construing “a request for data on the removable
media device” as subject to its plain and ordinary meaning will not resolve the parties’ dispute.
Trend Micro argues that both the claim language and specification support its construction that,
for claims 1 and 21, the request for data is for data located on the removable media device.
As for claim 11, Trend Micro argues that prosecution disclaimer applies to narrow the
claim scope in light of statements made by CUPP during the ’202 patent IPR. Specifically,
Trend Micro points to statements made by CUPP to distinguish the prior art that purportedly
reveal CUPP’s interpretation that the data being requested must be located on a removable media
device. ECF No. 94 at 19. Trend Micro also argues that the claim language and the
specification support its proposed construction. In response, CUPP contends that its arguments
to the PTAB do not constitute a clear and unequivocal disavowal of claim scope, and that Trend

33

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 34 of 36 PageID 6539

Micro has waived this proposed construction, given that claim 11 was asserted during the initial
round of claim construction but Trend Micro did not raise these arguments. ECF No. 93 at 5-6;
see also Jan. 21, 2021, Order (ECF No. 87) (ordering supplemental claim construction briefing to
“address potential prosecution disclaimer during the IPR proceedings and potentially as to the
addition of asserted claims 1 and 21 of the ’202 patent”).
Analysis
The Court construes the term “a request for data on the removable media device” in
claims 1 and 21 to have its plain and ordinary meaning. The parties appear to agree that the plain
language of the claims require that the data requested be located on the removable media device.
ECF No. 93 at 20 (CUPP agreeing that Trend Micro’s proposed construction does not change the
meaning of the terms from what the element already states, because “the claims already state that
the data is ‘on the removable media device’”). In addition, CUPP represents that its
infringement contentions are based on an assertion that “the data requested is on the removable
media device.” ECF No. 96 at 17. Accordingly, based on CUPP’s representation that the data
being requested is on the removable media device and its representation that its infringement
contentions are consistent with such a construction, the Court concludes that no clarifying
construction is necessary. 9
Regarding claim 11, CUPP’s statements to the PTAB that Trend Micro identifies as the
basis for its prosecution disclaimer argument do not rise to the level of unequivocal and

9

The Court notes that because it is agreeing with CUPP’s proposed construction and relying on CUPP’s
representations in reaching this decision, CUPP is judicially estopped from adopting a position
inconsistent with its representations. See In re 3 Star Properties, L.L.C., 6 F.4th 595, 605 (5th Cir. 2021)
(application of judicial estoppel relies on several factors, including whether “a party’s later position [is]
‘clearly inconsistent’ with its earlier position,” “whether the party has succeeded in persuading a court to
accept that party's earlier position,” and whether absent estoppel “the party seeking to assert an
inconsistent position would derive an unfair advantage or impose an unfair detriment on the opposing
party” (quoting New Hampshire v. Maine, 532 U.S. 742, 749–50 (2001)).

34

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 35 of 36 PageID 6540

unambiguous disavowal of claim scope. See ECF No. 94 at 19 (citing Def. App. 46, 50, 51, 87).
Instead, CUPP’s statements consist of describing the prior art (Def. App. 46) or challenging
Trend Micro’s prima facie case that the combination of two prior art references discloses certain
claim elements (Def. App. 50–51, 87). See, e.g., Def. App. 87 (“Aside from Aussel’s transparent
redirection process demonstrating that every example disclosed in Aussel involves a request for
data on the terminal being rerouted to the USB key, it also demonstrates that applications are not
aware of, and cannot directly request data from the USB key.”). What is notably missing from
these cited passages is any discussion by CUPP of what claim 11 or the ’202 patent does or does
not cover. Admittedly, some of these statements use language resembling the claims and
requests for data on removable media devices, but given that some of the claims challenged in
the ’202 patent IPR included the limitation “a request for data on the removable media device,” 10
CUPP’s use of this language is neither surprising nor sufficient to establish disclaimer for claim
11, particularly where CUPP does not even specify that the statements at issue apply to claim 11.
Thus, the Court declines to find prosecution disclaimer based on the statements identified
by Trend Micro. To the extent Trend Micro is arguing that claim 11 of the ’202 patent should be
construed based on other reasons, it has waived those arguments by not raising them during the
initial round of claim construction briefing. Accordingly, for the foregoing reasons, the Court
construes “a request for the data” in claim 11 of the ’202 patent to have its plain and ordinary
meaning.
V.

CONCLUSION
The Court adopts the constructions set forth above, as summarized in the following table.

The parties are ORDERED not to refer, directly or indirectly, to each other’s claim construction

10

Trend Micro challenged claims 1, 3, 4, 6, 10, 11, 13, 14, 16, 20, and 21 of the ‘202 patent in the ’202 patent IPR.

35

Case 3:18-cv-01251-M Document 150 Filed 12/06/21

Page 36 of 36 PageID 6541

positions in the presence of the jury. Likewise, the parties are ORDERED to refrain from
mentioning any portion of this opinion, other than the actual definitions adopted by the Court, in
the presence of the jury. Any reference to claim construction proceedings is limited to informing
the jury of the definitions adopted by the Court.
Term
“A removable media device comprising:”
• ’202 patent, claim 11
“means for receiving from the mobile device
particular network data before the at least one
mobile device processor of the mobile device
processes the particular network data, the
particular network data having been
forwarded to the security system by the at
least one mobile device processor of the
mobile device” / “means for receiving”
• ’444 patent, claim 21

“subset” / “the subset of the outgoing data”
• ’272 patent, claim 16

“dynamically isolating”
• ’272 patent, claim 16
• ’079 patent, claim 7
“injecting redirection code into the digital
device”
• ’202 patent, claims 1 and 21
“a request for data on the removable media
device” / “a request for the data”
• ’202 patent, claims 1, 11, and 21

Construction
The preamble is limiting.
Function: receiving from the mobile device
particular network data before the at least one
mobile device processor of the mobile device
processes the particular network data, the
particular network data having been
forwarded to the security system by the at
least one mobile device processor of the
mobile device
Structure: connection mechanisms for USB,
Ethernet, WiFi, WiMAX, GSM, CDMA,
BlueTooth, PCMCIA, modem, or NIC.
Plain and ordinary meaning.
“Subset” means “any portion of,” and “the
subset of the outgoing data” means “any
portion of the outgoing data.”
Plain and ordinary meaning.

The redirection code is injected from outside
the digital device into the digital device.
Plain and ordinary meaning.

SO ORDERED.
December 6, 2021.

BARBARA M. G. LYNN
CHIEF JUDGE

36