CUPP Cybersecurity LLC v. Trend Micro Inc

• Court: District Court, N.D. Texas
• Decided: December 6, 2021
• Docket: 3:18-cv-01251
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF TEXAS DALLAS DIVISION

CUPP CYBERSECURITY, LLC, and CUPP § COMPUTING AS, § §

§ Plaintiffs, §

§ Civil Action No. 3:18-cv-1251-M v. §

§ (Consolidated with TREND MICRO, INC., TREND MICRO § Civil Action No. 3:20-cv-03206-M) AMERICA, INC., and TREND MICRO § INCORPORATED, § Defendants. § §

CLAIM CONSTRUCTION MEMORANDUM OPINION AND ORDER This Order addresses the claim construction disputes presented by Plaintiffs CUPP Cybersecurity, LLC, and CUPP Computing AS, and Defendants Trend Micro, Inc., Trend Micro America, Inc., and Trend Micro Incorporated.1 The parties submitted opening and responsive claim construction briefs (ECF Nos. 53, 55, 57, 58), and the Court held a claim construction hearing in 2019. Later in 2019, the case was stayed pending resolution of seven petitions for inter partes review (“IPR”) related to this case. After the stay was lifted, the parties submitted supplemental claim construction briefs to address potential prosecution disclaimer during the IPR proceedings and claim construction issues as to two newly asserted claims. (ECF Nos. 93, 94, 96). Having considered the arguments and evidence presented by the parties, the Court issues this Order.

1 On November 1, 2021, this case was consolidated with CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv-03206-M (CUPP2). This Order addresses claim construction disputes presented in Case No. 3:18-cv-1251- M prior to consolidation. The Court will issue a separate order discussing the claim construction disputes presented in CUPP2. I. BACKGROUND Plaintiffs CUPP Cybersecurity, LLC and CUPP Computing AS (together, “CUPP”) are security providers for mobile devices, which have “a robust portfolio of innovative technology relating to mobile device security, [addressing] problems found in mobile device management, network security, DMZ (‘demilitarized zone’) security, and endpoint security.” ECF No. 55 at 1;

ECF No. 1 (“Compl.”) ¶ 8. Defendants Trend Micro, Inc., Trend Micro America, Inc., and Trend Micro Incorporated (together, “Trend Micro”) make a number of products falling into several categories: user protection products (i.e., Smart Protection Complete Suit), network defense products (i.e., Advance Threat Protection), hybrid cloud security products (i.e., Deep Security), worry-free products (i.e., Worry-Free Standard), home products (i.e., Antivirus for Mac), Trend Micro Portable Security, Trend Micro Mobile Security, control manager technology (which supports hybrid cloud security, network defense, and user protection products), XGen security technology (which powers hybrid cloud security, user protection, worry-free, and network defense products), smart protection network technology, and power management technology (i.e., Power Management Module). Compl. ¶¶ 34–48.

CUPP alleges that Trend Micro’s products infringe four of CUPP’s patents: United States Patent Nos. 9,756,079 (“the ’079 patent”), 9,747,444 (“the ’444 patent”), 8,365,272 (“the ’272 patent”), and 8,789,202 (“the ’202 patent”).2 Specifically, CUPP asserts the following eight claims: claim 7 of the ’079 patent, claims 11 and 21 of the ’444 patent, claim 16 of the ’272

2 CUPP initially asserted four additional patents, United States Patent Nos. 8,631,488 (“the ’488 patent”), 9,106,683 (“the ’683 patent”), 9,843,595 (“the ’595 patent”), and 9,781,164 (“the ’164 patent”). Following IPR, the Patent Trial and Appeal Board (“PTAB”) found unpatentable all challenged claims of the ’488, ’683, ’595, and ’164 patents. See ECF No. 72. patent, and claims 1, 11, 16, and 21 of the ’202 patent.3 The parties identify one agreed construction and five disputed terms for the Court’s resolution.4 A. The ’444 Patent. The ’444 patent is titled “System and Method for Providing Network Security to Mobile

Devices.” CUPP submits the ’444 patent generally describes protecting mobile devices against attacks and malicious code. ECF No. 55 at 3. The patent claims a security system that can identify whether a mobile device is in a protected or unprotected network. Id. If the security system detects that network traffic is unsafe, the system will forward the data to the system’s processor, which will then scan the data for malicious content before determining whether to send the data to the mobile device. Id. The abstract of the ’444 patent states, A small piece of hardware connects to a mobile device and filters out attacks and malicious code. Using the piece of hardware, a mobile device can be protected by greater security and possibly by the same level of security offered by its associated corporation/enterprise. In one embodiment, a mobile security system includes a connection mechanism for connecting to a data port of a mobile device and for communicating with the mobile device; a network connection module for acting as a gateway to a network; a security policy for determining whether to forward content intended for the mobile device to the mobile device; and a security engine for executing the security policy.

3 Pursuant to the Court’s scheduling order, by December 18, 2018, CUPP narrowed its infringement case to twenty asserted claims. ECF No. 39, at 3-5. The PTAB’s final written decisions on the seven IPR petitions filed in connection with this case subsequently invalidated fourteen of those twenty claims. See ECF No. 72. After the stay was lifted, the Court granted leave for CUPP to assert two previously unasserted claims as to a single accused product: claims 1 and 21 of the ’202 patent as to the OfficeScan 10.6. ECF No. 87 at 7. Accordingly, CUPP currently asserts eight claims. 4 During the initial exchange of claim construction briefing and Markman hearing in this case, the parties raised disputes as to the meaning of terms in claims that have since been invalidated by the PTAB. See, e.g., ECF No. 48, Ex. A at 1 (Joint Claim Construction and Prehearing Statement) (requesting construction of terms in the ’488 and ’683 patents); id. at 13, 15 (requesting construction of “A computer, comprising” and “A computer system, comprising,” terms which appear only in the since-invalidated claim 1 of the ’272 patent, and claim 1 of the ’079 patent, respectively). Accordingly, given that the claims in which these disputed terms appear have been invalidated, the parties’ dispute as to the construction of these terms is moot, and the Court will not address them. ’444 patent, Abstract. Claim 21 of the ’444 patent claims: A security system comprising: security system memory storing a security policy identifying one or more trusted networks and defining when to forward network data intended for a mobile device to the mobile device for processing by at least one mobile device processor of the mobile device, the at least one mobile device processor of the mobile device being different than a security system processor of the security system, the security policy defining that when the mobile device does not reside on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will scan the network data for malicious content to decide whether the network data should be forwarded to the mobile device, the security policy defining that when the mobile device resides on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will allow the network data to be forwarded to the mobile device without the security system processor of the security system scanning for the malicious content; means for receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device; and security code configured to implement the security policy as it relates to the particular network data received from the mobile device, the security code configured to modify at least a portion of the particular network data before delivering the particular network data as modified to the mobile device. ’444 patent, cl. 21. No petitions for IPR of the ’444 patent were filed before the PTAB. B. The ’272 and ’079 Patents The ’079 Patent is a continuation of United States Patent No. 9,391,956, which is a continuation of the ’272 Patent. The ’272 and ’079 patents are both titled “System and Method for Providing Network and Computer Firewall Protection with Dynamic Address Isolation to a Device,” and the specifications of both the ’272 and ’079 patents are nearly identical. CUPP submits that these patents claim the protection of a mobile device using an application associated with an application address, a network address translation engine, and a

firewall. ECF No. 93 at 6–7. The application sends out a request to a network. Id. The application address is translated to a public address by the Network Address Translation (“NAT”) engine so that any unprotected network only sees a public address. Id. When the computer receives data from the unprotected network in response to the request, the data is provided to a firewall that inspects the traffic according to a security policy before the data is executed on the computer. Id. Thus, the system can determine whether the data associated with an application requires scanning and subsequent blocking. Id. The abstract of the ’272 patent states: A computer performs dynamic address isolation. The computer comprises an application associated with an application address, a network interface coupled to receive incoming data packets from and transmit outgoing data packets to an external network, a network address translation engine configured to translate between the application address and a public address, and a driver for automatically forwarding the outgoing data packets to the network address translation engine to translate the application address to the public address, and for automatically forwarding the incoming data packets to the network address translation engine to translate the public address to the application address. The computer may communicate with a firewall configured to handle both network-level security and application-level security. ’272 patent, Abstract. Claim 16 of the ’272 patent claims the following: A method within a computer of processing outgoing data, the method comprising: receiving the outgoing data from an application, the application being associated with an internal address; translating, using a network address translation engine within the computer, the internal address into a public address; routing, using a driver within the computer, at least a subset of the outgoing data to an external network using the public address, thereby dynamically isolating the internal address from the external network; and providing, using a network interface within the computer, the subset of the outgoing data to the external network. ’272 patent, cl. 16. Claim 7 of the ’079 patent claims the following: A system comprising: a network interface configured to be coupled to an external network; a firewall in communication with the network interface, the firewall configured to perform both network-level security and application-level security on incoming data packets, the firewall being further configured to reject the incoming data packets if the incoming data packets include malicious content according to a security policy, the firewall being configured to allow the incoming data packets to pass to one or more applications if the incoming data packets do not include malicious content according to the security policy; a computer system in communication with the firewall, the computer system having one or more applications associated with at least one application address, the computer system being configured to send to the firewall outgoing data packets including an application identifier identifying a particular application of the one or more applications to the firewall; and an address translation engine configured to translate the at least one application address associated with the particular application of the one or more applications to an external address, thereby dynamically isolating the particular application of the one or more applications from the external network. ’079 patent, cl. 7. The ’272 and ’079 patents were the subject of IPR proceedings before the PTAB in IPR2019-00561 (the “’272 patent IPR”) and IPR2019-00641 (the “’079 patent IPR”). The PTAB issued decisions instituting review of the ’272 and ’079 patents,5 and final written decisions finding unpatentable certain claims in the ’272 and ’079 patents.6 As relevant here, the PTAB provided preliminary and final constructions of “dynamically isolating,” a term appearing in claim 16 of the ’272 patent and claim 7 of the ’079 patent. See ’272 patent IPR Inst., slip op.

at 12–13; ’272 patent IPR FWD, slip op. at 20–24; ’079 patent IPR Inst., slip op. at 12–14; ’079 patent IPR FWD, slip op. at 19–24. The PTAB also provided preliminary and final constructions of the terms “subset” and “the subset of the outgoing data,” both of which appear in claim 16 of the ’272 patent. See ’272 patent IPR Inst., slip op. at 25–26; ’272 patent IPR FWD, slip op. at 24–25. C. The ’202 Patent. The ’202 patent is titled “Systems and Methods for Providing Real Time Access Monitoring of a Removable Media Device.” The ’202 patent describes systems and methods to provide data and device security in connection with a removable media device—such as, for example, a USB flash drive—and a digital device. The specification describes how, according to

the prior art, non-secured and secured USB flash drives lacked certain features to increase security, such as user authentication and file filtering to limit or restrict access, content screening, and audit trails to track access or changes to the data on the flash drive. ’202 patent, at 18:35–42, 19:7–27. The ’202 patent describes embodiments of the invention that overcome these limitations of the prior art, including a method comprising detecting a removable media

5 Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, paper 7 (PTAB July 26, 2019) (“’272 patent IPR Inst.”); Trend Micro Inc. v. CUPP Computing AS, IPR2019-00641, paper 7 (PTAB July 26, 2019) (“’079 patent IPR Inst.”). 6 Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, paper 27 (PTAB July 6, 2020) (“’272 patent IPR FWD”); Trend Micro Inc. v. CUPP Computing AS, IPR2019-00641, paper 26 (PTAB July 6, 2020) (“’079 patent IPR FWD”). device coupled to a digital device, authenticating a password to access the removable media device, injecting redirection code into the digital device, intercepting, with the redirection code, a request for data, determining to allow the request for data based on a security policy, and providing the data based on the determination. Id. at 2:4–52. The method may further comprise

selecting the security policy from a plurality of security policies based, at least in part, on the password and/or filtering the content of the requested data. Id. Claim 1 of the ’202 patent is representative of claim 21 for purposes of this Order,7 and claims: A method, comprising: detecting a removable media device coupled to a digital device; injecting redirection code into the digital device after detecting the removable media device is coupled to the digital device, the redirection code configured to intercept a first function call and configured to execute a second function call in place of the first function call; intercepting, with the redirection code, a request for data on the removable media device; determining whether to allow the intercepted request for data based on a security policy, the security policy implementing content analysis and risk assessment algorithms; and providing requested data based on the determination. ’202 patent, cl. 1. Claim 11 of the ’202 patent claims: A removable media device comprising: a login engine configured to detect coupling to a digital device, the login engine further configured to inject redirection code into the digital device after detecting the coupling to the digital device, the redirection code being

7 With the exception of each claim’s respective preamble, claims 1 and 21 are identical and do not differ in their use of the disputed claim terms, “injecting redirection code into the digital device” and “a request for data on the removable media device.” Nor do the parties make any arguments specific to either claim in particular. configured to intercept a first function call and configured to execute a second function call in place of the first function call; and a controller configured to intercept a request for the data, determine whether to allow the request for the data based on a security policy, the security policy implementing content analysis and risk assessment algorithms, and provide requested data based on the determination. Id. cl. 11. The ’202 patent was the subject of inter partes review before the U.S. Patent and Trademark Office in IPR2019-00803 (the “’202 patent IPR”). The PTAB instituted review of the ’202 patent, and issued a final written decision, concluding that none of the challenged claims were unpatentable. II. LEGAL PRINCIPLES A. General Principles of Claim Construction The construction of disputed claims is a question of law for the court. Markman v. Westview Instruments, Inc., 52 F.3d 967, 971–72 (Fed. Cir. 1995), aff’d, 517 U.S. 370 (1996). “Ultimately, the interpretation to be given a term can only be determined and confirmed with a full understanding of what the inventors actually invented and intended to envelop with the claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (en banc) (citation omitted). Accordingly, a proper construction “stays true to the claim language and most naturally aligns with the patent’s description of the invention.” Id. (citation omitted). “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004)). Courts first “look to the words of the claims themselves . . . to define the scope of the patented invention.” Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996) (citation omitted). The claim terms are “generally given their ordinary and customary meaning,” but “a patentee may choose to be his own lexicographer and use terms in a manner other than their ordinary meaning, as long as the special definition of the term is clearly stated in the patent specification or file history.” Id. (citation omitted). The “ordinary and customary meaning” of

the terms in a claim is “the meaning that the term[s] would have to a person of ordinary skill in the art in question at the time of the invention.” Phillips, 415 F.3d at 1313. When the meaning of a term to a person of ordinary skill in the art is not apparent, a court is required to consult other sources, including “the words of the claims themselves, the remainder of the specification, the prosecution history, extrinsic evidence concerning relevant scientific principles, the meaning of technical terms, and the state of the art.” Id. (citation omitted). A court must consider the context in which the term is used in an asserted claim or related claims in the patent, being mindful that “the person of ordinary skill in the art is deemed to read the claim term not only in the context of the particular claim in which the disputed term appears, but in the context of the entire patent, including the specification.” Id. The specification is “always highly

relevant to the claim construction analysis” and is “the single best guide to the meaning of a disputed term.” Id. at 1315 (quoting Vitronics, 90 F.3d at 1582). For example, should the specification reveal that a claim term has been given a special definition by the patentee that is different from the ordinary meaning of the term, the inventor’s lexicography is controlling. Id. at 1316. Furthermore, if the specification reveals an intentional disclaimer or disavowal of claim scope by the patentee, the claim scope dictated by the specification is controlling. Id. Finally, in construing claims, a court may consult extrinsic evidence, including “expert and inventor testimony, dictionaries, and learned treatises.” Phillips, 415 F.3d at 1317 (citing Markman, 52 F.3d at 980). Technical dictionaries may assist a court in “‘better understand[ing] the underlying technology’ and the way in which one of skill in the art might use the claim terms.” Id. at 1318 (quoting Vitronics, 90 F.3d at 1584 n.6). Expert testimony may also be helpful to “provide background on the technology at issue, to explain how an invention works, to ensure that the court’s understanding of the technical aspects of the patent is consistent with that

of a person of skill in the art, or to establish that a particular term in the patent or the prior art has a particular meaning in the pertinent field.” Id. (citation omitted). Although extrinsic evidence may “shed useful light on the relevant art,” it is considered “less significant than the intrinsic record.” Phillips, 415 F.3d at 1317 (quoting C.R. Bard, Inc. v. U.S. Surgical Corp., 388 F.3d 858, 862 (Fed. Cir. 2004)). More simply, “extrinsic evidence may be useful to the court, but it is unlikely to result in a reliable interpretation of patent claim scope unless considered in the context of the intrinsic evidence.” Id. at 1319. Accordingly, “a court should discount any expert testimony ‘that is clearly at odds with the claim construction mandated by the claims themselves, the written description, and the prosecution history, in other words, with the written record of the patent.’” Id. at 1318 (quoting Key Pharms. v. Hercon Labs.

Corp., 161 F.3d 709, 716 (Fed. Cir. 1998)). III. AGREED CONSTRUCTION The parties have agreed to the following construction set forth in their Supplemental Joint Claim Construction and Prehearing Statement (ECF No. 92): Term Agreed Construction “A removable media device comprising:” The preamble is limiting. • ’202 patent, claim 11

IV. CONSTRUCTION OF DISPUTED TERMS A. “means for receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device” / “means for receiving”

Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “means for receiving from the mobile Governed by 35 U.S.C. Governed by 35 U.S.C. device particular network data before § 112(f) § 112(f) the at least one mobile device processor of the mobile device processes the Function: receiving Function: receiving particular network data, the particular from the mobile device network data having been forwarded to Structure: hardware particular network data the security system by the at least one and/or software that before the at least one mobile device processor of the mobile enable(s) mobile device processor device” / “means for receiving” communication, of the mobile device • ’444 patent, claim 21 including through processes the particular adapters, ports, drivers, network data, the WiFi, WiMAX, CDMA, particular network data GSM, Ethernet, having been forwarded BlueTooth, PCMCIA, to the security system modem, USB, or NIC. by the at least one mobile device processor of the mobile device

Structure: USB connection 1020

The parties agree that the “means for . . .” limitation of claim 21 of the ’444 patent is a means-plus-function limitation governed by § 112(f). See Wenger Mfg., Inc. v. Coating Mach. Sys., Inc., 239 F.3d 1225, 1232 (Fed. Cir. 2001) (“[I]n determining whether a claim limitation is a means-plus-function limitation, the use of the word ‘means’ creates a presumption that § 112[f] applies.”). A means-plus-function claim element triggers 35 U.S.C. § 112(f), which allows an applicant to express a claim limitation “as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof,” and provides that “such claim[s] shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.” 35 U.S.C. § 112(f); see also Ergo Licensing, LLC v. CareFusion 303, Inc., 673 F.3d 1361, 1363 (Fed. Cir. 2012). In other words, a means-plus- function claim element allows the patentee to use a generic means to express a claim limitation, but the specification must disclose the corresponding structure. Ergo Licensing, LLC, 673 F.3d at 1363 (quoting Biomedino, LLC v. Waters Techs. Corp., 490 F.3d 946, 948 (Fed. Cir. 2007)).

Thus, construction of a means-plus-function limitation consists of two steps: (1) identifying the claimed function, and (2) determining what, if any, structure in the specification corresponds with that function. Cardiac Pacemakers, Inc. v. St. Jude Med., Inc., 296 F.3d 1106, 1113 (Fed. Cir. 2002). The court must construe the function to include only those limitations in the claim language. Id. “It is improper to narrow the scope of the function beyond claim language” or to broaden the scope by disregarding limitations in the claims themselves. Id. (indicating further that “[o]rdinary principles of claim construction govern interpretation of the claim language used to describe the function”). Here, because the “means for . . . ” limitation in claim 21 of the ’444 patent recites a function, but not a structure for performing that function, the limitation falls under § 112(f).

Accordingly, the Court must both identify the claimed function and determine what structure, if any, in the specification corresponds with that function. 1. Function The Parties’ Positions CUPP argues that “receiving” is the function and the language after the word “receiving” describes other actions that the “receiving” element performs, citing to the testimony of its expert, Dr. Medvidovic, to support its argument that a person of ordinary skill in the art “would define that function as receiving.” Trend Micro responds that this construction unduly broadens the specifics of the claim. ECF No. 53 at 23 (citing Joovy LLC v. Baby Trend, 3:06-cv-0616-P, 2007 WL 5688725, at *3 (N.D. Tex. Feb. 14, 2008) (“The Court must not narrow or broaden the specifics of the claim due to a means-plus-function interpretation.”)). Trend Micro argues that the function includes all the

language after “means for,” because the limitation does not include a “whereby” clause, a clause that states a result, or a clause that “adds nothing to the substance of the claim,” and all of the limitations following the preposition “for” are substantive. ECF No. 53 at 20. For example, the particular network data must come from the mobile device, must not have been processed by the mobile device, and must have been forwarded by the mobile device. See ’444 patent, at 18:12–1. Trend Micro cites case law where courts have found that the function of a means-plus-function limitation is set forth by all of the limitations after the preposition “for.” See, e.g., Spherix Inc. v. Vtech Telecoms, Ltd., No. 3:13-cv-3494-M, 2015 WL 9311489, at *17 (N.D. Tex. Mar. 19, 2015) (finding the function included all of the limitations after the preposition “for”: “first processor means at the handset for displaying keyed alphanumeric data on the screen and

concurrently transmitting the alphanumeric data and commands to the base station”). CUPP argues that the cases cited by Trend Micro are distinguishable, because “they relate to examples where the function is described in the context of what the component at issue does—not what other components in the system are doing.” ECF No. 57 at 15. For example, in Lockheed Martin Corp. v. Space Systems/Loral Inc., the court identified the function as emphasized below: Means for rotating said wheel in accordance with a predetermined rate schedule which varies sinusoidally over the orbit at the orbital frequency of the satellite whereby the altitude of said satellite is offset in response to the effect of said rotating wheel by the direction of the pitch axis being changed with respect to said momentum vector. 324 F.3d 1308 (Fed. Cir. 2003) (emphasis added). CUPP asserts that the italicized function concerns how the function of rotating is done, unlike here, where the language after “receiving” does not relate to how the receiving is done, but rather describes other components in the system and how they operate.

Analysis The Court concludes that the function of the means-plus-function limitation in claim 21 of the ’444 patent includes all of the words after the word “for,” i.e., the function is receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device. Contrary to CUPP’s argument, the words after “for” relate to the mobile security system doing the “receiving,” and do not merely describe what other components in the system are doing. Specifically, the language describes from where the data is received (“the mobile device”; “having been forwarded to the security system by the at least one mobile device

processor of the mobile device”), what data is received (“particular network data . . . having been forwarded to the security system by the at least one mobile device processor of the mobile device”); and when the data is received (“before the at least one mobile device processor . . . processes the particular network data”). ’444 patent, at 18:12–17. These limitations clearly modify the “receiving” function, and ignoring them would improperly broaden the claim’s scope. See Lockheed Martin, 324 F.3d at 1319 (“[N]either may the function be improperly broadened by ignoring the clear limitations contained in the claim language. The function of a means-plus- function claim must be construed to include the limitations contained in the claim language.”). 2. Structure Having identified the function, the Court must now determine the corresponding structure. “A disclosed structure is corresponding only if the specification or the prosecution history clearly links or associates that structure to the function recited in the claim.” Omega

Eng’g, Inc., v. Raytek Corp., 334 F.3d 1314, 1321 (Fed. Cir. 2003). The Parties’ Positions CUPP argues that the structure for performing the function in claim 21 is “hardware and/or software that enable(s) communication, including through adapters, ports, drivers, WiFi, WiMAX, CDMA, GSM, Ethernet, Bluetooth, PCMCIA, modem, USB, or NIC.” ECF No. 55 at 16; ECF No. 57 at 17. CUPP contends that a person of ordinary skill in the art would recognize that those structures are capable of performing the function of “receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device,” citing for

support various parts of the ’444 patent specification, including Figures 10A, 10B, and 10C. See ’444 patent, at 2:49–52, 57–64 (“In an embodiment, a mobile security system includes a connection mechanism for connecting to a data port of a mobile device . . .” and that “the connection mechanism may include a network interface card that implements WiFi, WiMAX, GPRS, GSM, UMTS, CDMA, Generation 3, other cell phone internet connection protocols, etc.”), 7:19–20, 14:43–44, figs. 10A, 10B, 10C. Trend Micro replies that Figures 10B and 10C do not disclose a structure clearly linked to the limitation’s function because in those embodiments, the mobile security system receives data from the Internet, not the mobile device, in contrast to the portion of the function that recites “receiving from the mobile device particular network data . . . .” ’444 patent, cl. 21. In addition, Trend Micro contends that the mobile security systems in Figures 10B and 10C send data to the mobile device rather than receive data from the mobile device. Trend Micro asserts that the only structure disclosed in the ’444 patent’s specification that is clearly linked to, or associated with,

this limitation’s function is “USB connection 1020,” shown in Figure 10A. ECF No. 53 at 23– 24. In that embodiment, the mobile security system receives internet traffic from the mobile device via a USB connection. Trend Micro further contends that the fact that other structures for connecting to a network are disclosed in the specification is irrelevant under Medtronic, Inc. v. Advanced Cardiovascular Sys., Inc., 248 F.3d 1303 (Fed. Cir. 2001). There, the Federal Circuit held that even though the specification disclosed four structures capable of performing a function, because the specification clearly linked or associated only one of the four structures with the means-plus- function limitation’s recited function, the three remaining structures were excluded from the limitation’s construction. Id. at 1311–15.

Analysis The Court concludes that the corresponding structure for the function in claim 21 of the ’444 Patent is “connection mechanisms for USB, Ethernet, WiFi, WiMAX, GSM, CDMA, BlueTooth, PCMCIA, modem, or NIC.” ’444 patent, at 7:35–41. Although Figure 10A is the only embodiment or part of the specification where the mobile security system “receives particular network data from the mobile device,” the specification emphasizes that it does so via a USB connection as merely an example. See id. at 14:49–67 (“Other connection architectures are also possible. The foregoing description of the preferred embodiments of the present invention is by way of example only, and other variations and modifications of the above- described embodiments and methods are possible in light of the foregoing teaching. . . . Components may be implemented using a programmed general purpose digital computer, using application specific integrated circuits, or using a network of interconnected conventional components and circuits. Connections may be wired, wireless, modem, etc.”).

Because the specification states that the mobile security system can connect to and receive data from the mobile device via a number of connection mechanisms, see, e.g., id.; see also id. at 7:19–20, the Court will not limit the structure in the means-plus-function element of claim 21 to a USB connection. Medtronic is distinguishable in this regard. There, the specification disclosed other structures, but made clear that the structures had other, alternative functions. 248 F.3d at 1313; see also id. at 1310 (“[T]he specification itself described the straight wire and hooks as ‘means to prevent longitudinal overstretch’ and did not refer to these structures as means for [the claimed function of] connecting adjacent elements.”). Accordingly, in light of the foregoing, the Court construes the means-plus-function limitation in claim 21 of the ’444 patent as follows: the function is “receiving from the mobile

device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device,” and the associated structure is connection mechanisms for USB, Ethernet, WiFi, WiMAX, GSM, CDMA, BlueTooth, PCMCIA, modem, or NIC. B. “subset” / “the subset of the outgoing data” Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “subset” / “the subset of the outgoing The plain and ordinary Less than all / less than data” meaning should apply. all of the outgoing data • ’272 patent, claim 16 “Subset” means “any portion of,” and “the subset of the outgoing data” means “any portion of the outgoing data” The Parties’ Positions CUPP submits that “subset” should be construed according to its plain and ordinary meaning, namely that a “subset” means “any portion of,” and “the subset of the outgoing data” means “any portion of the outgoing data.” ECF No. 93 at 8. Specifically, CUPP contends that a “subset” can be both a portion of the full set, as well as all of the items in the set. For support, CUPP points to claim 16 of the ’272 patent, which recites “routing . . . at least a subset of the outgoing data”; the inclusion of “at least,” according to CUPP, provides that “subset” can include any portion of the outgoing data, up to and including all of the outgoing data. In addition, CUPP points to dictionary definitions and other court opinions to distinguish between a “subset” and a “proper subset,” which refers to less than the full set. Id. at 9 (citing In re Townshend Pat. Litig., No. C 02-04833 JF, 2004 WL 1920049, at *17 (N.D. Cal. Aug. 26, 2004) (“The additional limitation of deriving a subset remains meaningful even if the subset, in some instances, is identical to the set.”)). CUPP also cites the PTAB’s final written decision in the ’272 patent IPR, in which the PTAB construed subset “to read on providing any portion of the outgoing data, up to and including all the data, and not a proper subset.” ’272 patent IPR FWD, slip op. at 25. In construing “subset” this way, the PTAB adopted the construction argued by Trend Micro, and accordingly, CUPP argues that Trend Micro is now judicially estopped from arguing for a different construction. In response, Trend Micro argues that because CUPP advocated for a narrower construction before the PTAB—namely, that “subset” in claim 16 of the ’272 patent means a

“proper subset”—under the doctrine of prosecution disclaimer, CUPP disclaimed the broader claim scope. Trend Micro contends its proposed construction is a faithful reflection of the disclaimer of claim scope CUPP made before the PTAB, and that CUPP’s disclaimer warrants departing from the plain and ordinary meaning of the claim language. Analysis The Court notes that the parties have reversed positions and are each arguing the opposite of what they advocated to the PTAB; CUPP sought a narrower construction from the PTAB, yet now argues for plain and ordinary meaning, whereas Trend Micro argued plain meaning, but now seeks the narrower construction previously urged by CUPP. Each party also argues that its opponent is legally precluded from their respective positions, either by judicial estoppel (as to

Trend Micro) or prosecution disclaimer (as to CUPP). Other than prosecution disclaimer, Trend Micro provides no basis to depart from the plain and ordinary meaning of the claim language, and accordingly, this dispute turns on the application of prosecution disclaimer and whether, by arguing for a narrower construction ultimately rejected by the PTAB, CUPP disclaimed the scope of “subset” and “the subset of the outgoing data,” such that instead of having their plain meaning, these terms mean “less than all” and “less than all of the outgoing data,” respectively. The doctrine of prosecution disclaimer is “well established in Supreme Court precedent, precluding patentees from recapturing through claim interpretation specific meanings disclaimed during prosecution.” Omega, 334 F.3d at 1323. Under this doctrine, “when the patentee unequivocally and unambiguously disavows a certain meaning to obtain a patent, the doctrine of prosecution history disclaimer narrows the meaning of the claim consistent with the scope of the claim surrendered.” Biogen Idec, Inc. v. GlaxoSmithKline LLC, 713 F.3d 1090, 1095 (Fed. Cir.

2013). In claim construction, prosecution disclaimer “promotes the public notice function of the intrinsic evidence and protects the public’s reliance on definitive statements made during prosecution.” Omega, 334 F.3d at 1323–24. Ultimately, the doctrine of prosecution disclaimer ensures that claims are not “construed one way in order to obtain their allowance and in a different way against accused infringers.” Southwall Techs., Inc. v. Cardinal IG Co., 54 F.3d 1570, 1576 (Fed. Cir. 1995). The Federal Circuit has applied prosecution disclaimer to statements made during IPR proceedings. Aylus Networks, Inc. v. Apple Inc., 856 F.3d 1353, 1360 (Fed. Cir. 2017). Trend Micro contends that statements made by CUPP during the ’272 patent IPR

constitute prosecution disclaimer. In its preliminary response to Trend Micro’s petition to institute the ’272 patent IPR, CUPP argued that Trend Micro had not provided any analysis as to how Sikdar, an asserted prior art reference, satisfied the claim element of “routing, using a driver within the computer, at least a subset of the outgoing data to an external network using the public address.” Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, Patent Owner’s Preliminary Response, slip op. at 24 (PTAB May 6, 2019) (emphasis in original). In its institution decision, the PTAB rejected this argument, noting “[t]he inclusion of ‘at least’ modifying ‘subset’ expands the phrase to read on providing any portion of the outgoing data, up to and including all the data.” ’272 patent IPR Inst., slip op. at 24–25. In its response following institution, CUPP again argued that argued that Sikdar could not meet claim 16’s routing limitation “on the basis that the routing limitation can be met by routing all of the outgoing data,” because “the plain language of the claims requires that what is provided to the external network is a subset of the outgoing data.” Trend Micro Inc. v. CUPP Computing AS, IPR2019-

00561, Patent Owner’s Response, slip op. at 3 (PTAB Oct. 21, 2019). CUPP argued that, based on the difference between “subset” and “at least a subset,” “a POSITA would recognize . . . the claimed ‘subset’ is a ‘proper subset’ because only a subset (i.e., ‘a subset that is not all’) of the packets received by, for example, the hybrid firewall, is sent to the external network.” Id. at 45– 47. The PTAB expressly rejected CUPP’s argument, and instead, relying on dictionary definitions and the claim language, the PTAB construed the references to “subset” in claim 16 of the ’272 patent “to read on providing any portion of the outgoing data, up to and including all the data, and not a proper subset.” ’272 patent IPR FWD, slip op. at 25. CUPP concedes that it argued to the PTAB that a subset must be a proper subset, but contends that because the PTAB rejected its argument, prosecution disclaimer does not apply.

The Court agrees. At most, this case presents a case of attempted disclaimer: CUPP requested a narrower interpretation of “subset,” which was rejected by the PTAB in favor of the broader plain and ordinary meaning of the term. Put differently, CUPP attempted to disavow a certain meaning of “subset”—namely, that a subset can encompass “all” outgoing data for purposes of claim 16 of the ’272 patent—but was precluded from surrendering that claim scope when the PTAB rejected its proposed construction. See Biogen, 713 F.3d at 1095. The fact that the PTAB adopted the broader construction of “subset’ undermines any notice function served by prosecution disclaimer, and distinguishes this case from those where the patentee affirmatively and successfully disclaims claim scope during prosecution. See Power Integrations, Inc. v. ON Semiconductor Corp., 396 F. Supp. 3d 851, 866 (N.D. Cal. 2019) (“[T]he public notice function served by prosecution disclaimer functions much differently where the claim scope [urged by the patentee] is rejected. When the scope is rejected, the adjudicative body’s final decision rejecting the claim scope provides notice to the public that the claim scope is different than what the

patentee argued—i.e., that the patentee’s claim scope is wrong.”). Trend Micro cites no authority indicating that prosecution disclaimer applies to arguments expressly considered and rejected during prosecution. On the contrary, numerous district courts have refused to find disclaimer where the patent office rejected the purported disclaimer. See Vertical Tank, Inc. v. BakerCorp, No. 118CV00145LJOJLT, 2019 WL 2207668, at *11 (E.D. Cal. May 22, 2019) (collecting cases). Instead, Trend Micro repeatedly emphasizes the Federal Circuit’s statement in Greenliant that “[i]t does not matter whether the examiner or the Board adopted a certain argument for allowance; the sole question is whether the argument was made.”8 Greenliant Sys., Inc. v. Xicor LLC, 692 F.3d 1261, 1271 (Fed. Cir. 2012). The Court interprets the Federal Circuit’s statement in Greenliant not as a blanket rule

mandating disclaimer based on any argument advanced by the patentee during prosecution, but rather acknowledgment of other Federal Circuit guidance that a patentee can surrender claim scope even if the examiner does not expressly rely on its disclaimer. See id. (citing Springs Window Fashions LP v. Novo Indus., L.P., 323 F.3d 989, 995 (Fed. Cir. 2003) (holding that though “it is not clear from the record why the examiner allowed the claims,” the examiner’s reasons for allowance “do not negate the effect of the applicant’s disclaimer”)); see also Laitram Corp. v. Morehouse Indus., Inc., 143 F.3d 1456, 1462 (Fed. Cir. 1998) (“The fact that an

8 Indeed, Trend Micro quotes this sentence from the Federal Circuit’s Greenliant opinion six times in its brief. examiner placed no reliance on an applicant’s statement distinguishing prior art does not mean that the statement is inconsequential for purposes of claim construction.”). The rule that an examiner need not necessarily rely on a patentee’s statement for disclaimer to attach stems from the notice function of prosecution disclaimer, namely that competitors should be able to rely on

the patentee’s representations concerning the scope and the meaning of the claims when assessing potential infringement liability, even if not ultimately addressed by the patent office. See Hockerson–Halberstadt, Inc. v. Avia Group Int’l, Inc., 222 F.3d 951, 957 (Fed. Cir. 2000) (“[C]ompetitors are entitled to rely on [patentee’s] representations when ascertaining the degree of lawful conduct.”). Here, there is no concern that a competitor might rely on CUPP’s arguments regarding the meaning of “subset” to conclude that it did not infringe, as the PTAB expressly rejected those arguments. Indeed, adopting CUPP’s urged construction would confuse—rather than clarify— the scope of the ’272 patent. See Power Integrations, 396 F. Supp. 3d at 866 (“It would be an odd outcome indeed if the patentee was required to maintain an argument in a later adjudication

when everyone, including the alleged infringer, is on notice that the argument is incorrect.”). In addition, Trend Micro neither addresses nor alleviates concerns that, should the Court adopt Trend Micro’s proposals, a different construction will apply for determining patentability before the PTAB versus assessing infringement before this Court, contrary to Federal Circuit guidance. See Amazon.com, Inc. v. Barnesandnoble.com, Inc., 239 F.3d 1343, 1351 (Fed. Cir. 2001) (“[T]he claims must be interpreted and given the same meaning for purposes of both validity and infringement analyses.”). In sum, the Court concludes that prosecution disclaimer does not apply. Because Trend Micro identifies no other basis to depart from the plain and ordinary meaning of subset, the Court hereby construes “subset” and “the subset of the outgoing data” to have their plain meaning, where “subset” means “any portion of, up to and including all of,” and “the subset of the outgoing data” means “any portion of the outgoing data, up to and including all of the data.” C. “dynamically isolating”

Disputed Term CUPP’s Proposed Trend Micro’s Proposed Construction Construction “dynamically isolating” The plain and ordinary Dynamically isolating • ’272 patent, claim 16 meaning should apply. requires: • ’079 patent, claim 7 Plain and ordinary generally (1) The use of DHCP or other means “dynamically dynamic source of isolating” is “separating when addresses in connection and as needed” with a NAT engine to translate IP addresses; and (2) The use of a dynamic address protocol to isolate applications.

The Parties’ Positions

CUPP submits that “dynamically isolating” should be given its plain and ordinary meaning, citing definitions and the specifications of the ’272 and ’079 patents to support its interpretation that “dynamically” means an operation that occurs “when and as needed,” and “isolating” means “separating.” ECF No. 93 at 13. CUPP disputes Trend Micro’s proposed construction as having no support in the intrinsic record because Trend Micro’s proposal rewrites the claim language; according to CUPP, “dynamically isolating” in the claims describes how the isolating is achieved—“dynamically isolating the internal address from the external network” (’272 patent, cl. 16), and “dynamically isolating the particular application of the one or more applications from the external network” (’079 patent, cl. 7)—whereas Trend Micro’s proposal incorporates additional limitations of a type of protocol and source address, unsupported by the claim language or specifications. In particular, the phrases “dynamic source of addresses” and “dynamic address protocol” do not appear anywhere in the specifications of the ’272 and ’079 patents. In addition, contrary to the doctrine of claim differentiation, CUPP argues that Trend Micro’s proposed construction imports limitations from dependent claims, namely specific references to “Dynamic Host Configuration Protocol,” which does not appear in the asserted

independent claims. See ’272 patent, cl. 17; ‘079 patent, cl. 12. CUPP further maintains that Trend Micro is judicially estopped from seeking its proposed construction, given that Trend Micro successfully convinced the PTAB to reject the same constructions for which Trend Micro now advocates. In response, Trend Micro contends that CUPP disclaimed the construction of “dynamically isolating” having its plain and ordinary meaning. ECF No. 94 at 32. Trend Micro points to statements made by CUPP to the PTAB during the ’272 and ’079 patent IPRs, indicating that a POSITA would understand “dynamically isolating” to require “the use of DHCP or other dynamic source of addresses,” and “the use of a dynamic address protocol to isolate applications.” Id.

Analysis

The issue in dispute again distills to whether, by arguing a narrower construction ultimately rejected by the PTAB, CUPP disclaimed the scope of “dynamically isolating” in the ’272 and ’079 patents to mean something narrower than the phrase’s plain and ordinary meaning. In instituting both the ’272 patent IPR and ’079 patent IPR, the PTAB construed “dynamically isolating” as “including the use of DHCP or other source of addresses in connection with a NAT engine to translate IP addresses,” and construed “dynamically” as “referring to an operation that occurs ‘when and as needed.’” ’272 patent IPR Inst., slip op. at 12–13; ’079 patent IPR Inst., slip op. at 13–14. Following institution, CUPP advocated for different constructions, both of which were rejected by the PTAB. Specifically, in the ’272 patent IPR, CUPP argued that “‘dynamically isolating’ means ‘the use of DHCP or other dynamic source of addresses in connection with a NAT engine to translate IP addresses.’” Trend Micro Inc. v. CUPP Computing AS, IPR2019-00561, Patent Owner’s Response, slip op. at 14

(PTAB Oct. 21, 2019) (emphasis in original). CUPP also argued against the PTAB’s construction that “dynamically isolating” occurs “when and as needed,” arguing that under this construction, “dynamically isolating” could encompass any other source of address. Id. In its Final Written Decision, the PTAB addressed CUPP’s criticisms of its construction and expressly rejected that. See ’292 patent IPR FWD, slip op. at 24 (“We disagree with Patent Owner’s arguments and, therefore, do not adopt Patent Owner’s proposed construction in place of our original construction.”). Similarly, in the ’079 patent IPR, CUPP argued that “‘dynamically isolating’ means ‘the use of a dynamic address protocol to isolate application [sic].’” Trend Micro Inc. v. CUPP Computing AS, IPR2019-00641, Patent Owner’s Response, slip op. at 13 (PTAB Oct. 21, 2019). The PTAB expressly rejected this construction. ’079 patent IPR FWD,

slip op. at 21–22 (“After considering Patent Owner’s arguments, we are still persuaded that, for the reasons given in our Institution Decision and summarized supra, our initial construction is correct.”). As with the “subset” terms construed previously, in light of the PTAB’s express rejection of CUPP’s attempted narrowing of its claims, the Court declines to find prosecution disclaimer here. Trend Micro provides no basis for its proposed constructions other than prosecution disclaimer. Accordingly, the Court construes “dynamically isolating” to have its plain and ordinary meaning. D. “injecting redirection code into the digital device” Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “injecting redirection code into the The plain and ordinary The redirection code is digital device” meaning should apply. injected from outside • ’202 patent, claims 1, 21 the digital device into the digital device

The Parties’ Position

CUPP posits that “injecting redirection code into the digital device” should be given its plain and ordinary meaning, as the meaning of this phrase is readily discernible and requires no additional explanation. Specifically, CUPP contends that injection of the code into the digital device “places the redirection code into the digital device in an active and usable state on the digital device.” ECF No. 96 at 14. CUPP further contends that the ’202 patent specification counsels against Trend Micro’s proposed construction, and points to an embodiment described in Figure 22 and step 2210 of the specification, in which the “redirection code” is injected from an application already present on the digital device into another process running on the same device. According to CUPP, Trend Micro’s proposed construction would exclude this embodiment, and there is no prosecution disclaimer or definition in the ’202 patent to support reading out this preferred embodiment. Trend Micro contends that the claim language, specification, and dictionary definitions all support a construction that specifies that the redirection code is injected from outside the digital device into the digital device. Specifically, Trend Micro points to the claim language “injecting” and “into,” as indicating that the code is being moved into the device and argues that such language would not be necessary if the redirection code were already present on the device. Trend Micro also argues that the redirection code is injected only after the removable media device is coupled to the digital device, indicating that the code is moved from outside to inside of the digital device. Trend Micro also cites portions of the specification indicating that the source of the redirection code is outside of the digital device. See ECF No. 94 at 21 (citing ’202 patent, at 20:1–3, 21:24–25). Trend Micro further quotes four definitions of “inject,” all using the word “introduce” in the definition, as extrinsic evidence that the redirection code is moved from

outside the digital device into the digital device. Finally, Trend Micro argues that construction of this term is necessary in light of CUPP’s infringement contentions for the OfficeScan software product, and that the parties’ dispute as to the claim scope cannot be resolved by adopting the plain and ordinary meaning. Analysis The issue in dispute is whether the “injecting redirection code into the digital device” limitation in claims 1 and 21 of the ’202 patent requires that the redirection code is injected from outside the digital device. The Court concludes that it does. The Court begins with the claim language. Phillips, 415 F.3d at 1312. The Court notes that although both claim 1 and claim 21 require “injecting redirection code into the digital device

after detecting the removable media device is coupled to the digital device,” the claims themselves do not specify that the origin of the redirection code is the removable media device; instead, coupling of the removable media device to the digital device is simply a condition precedent for injecting the redirection code. See ’202 patent, cls. 1, 21 (emphasis added). Neither claim 1 nor claim 21 of the ’202 patent specify where the “redirection code” is housed. Thus, the only support in the claim language for Trend Micro’s proposed construction is the claims’ use of the “injecting . . . into” language, which strongly implies some sort of directional movement, i.e., the injected redirection code is crossing some threshold by moving into the digital device. Put differently, “injecting the redirection code into the digital device” would not be necessary if the redirection code were already present on the digital device. Even without additional support in the claims, this ordinary understanding of “injecting . . . into,” conveys such a strong connotation of introduction or movement across a

boundary of the redirection code that any alternative reading is strained and artificial. The Court is not convinced by CUPP’s argument that a POSITA would understand this “injecting the code into the digital device” language to mean the activation or calling up of otherwise dormant, unused code, or “introduc[ing] in a manner that adds a feature.” See ECF No. 96 at 14–15. CUPP points to nothing to support this other purported meaning of “injecting,” and does not account for the implications of the word “into”; if redirection code already present on the digital device is merely being activated from an otherwise dormant state, the requirement that code be injected “into” the digital device is rendered superfluous. Indeed, the Court concludes that CUPP’s proposed reading is so detached from the ordinary and plain meaning of “injecting . . . into” that this purported meaning would not be

obvious to a POSITA, let alone the public writ large. See Dayco Prod., Inc. v. Total Containment, Inc., 258 F.3d 1317, 1324 (Fed. Cir. 2001) (“If an argument offered in support of a particular claim construction is so convoluted and artificial that it would not be apparent to a skilled artisan reading the patent and the prosecution history, the argument is simply unhelpful to the performance of our task.”); see also White v. Dunbar, 119 U.S. 47, 52 (1886) (“[I]t is unjust to the public . . . to construe [a claim] in a manner different from the plain import of its terms.”). Had the patentee wished to convey such a meaning, it could have omitted the word “into,” or chosen language with weaker connotations of movement, such as “installing” or “activating.” As such, the plain language of the claims support Trend Micro’s proposed construction. The specification does not warrant a contrary construction. The specification does not define “injecting,” but uses it in the context of injecting redirection code into the digital device, using substantively similar language as the claims. See id. at 2:43 (“injecting redirection code into the digital device”), 2:53–55 (“Injecting redirection code into the digital device may

comprise temporarily replacing one or more dlls within the digital device.”), 3:5–7. Elsewhere, the specification describes embodiments that specify that the redirection module is “injected from the removable media device,” consistent with the claim language describing redirection code injected into the digital device. Id. at 20:1–3 (emphasis added); see also id. at 21:24–26 (“In various embodiments, the application 1912 may inject code from the removable media device 1904 into the digital device 1902.”). CUPP’s reliance on Figure 22 and step 2210 is misplaced. Figure 22 and step 2210 describe how, after coupling of the digital device and removable media device, an application and one or more dll(s) are copied from the removal media device to the digital device, and then subsequently, “[i]n step 2210, the application injects one or more dll(s) to the enumerated user

processes,” which may constitute the redirection module. Id. at 25:25–41, 25:51–52. However, the fact that the application subsequently injects dll(s) to the user process after being copied from the removable media device does not negate the fact that the application and dll(s) were initially moved from the removable media device into the digital device (i.e., “injected into” the digital device). The specification itself recognizes that “[i]njecting redirection code into the digital device may comprise temporarily replacing one or more dlls within the digital device.” Id. at 2:53–55. Moreover, claim 7, which depends on claim 1, explicitly recites “receiving injected Dynamic Link Libraries (DLLs) to the enumerated user processes.” Id. cl. 7. Indeed, the specification describes instances in which code is injected into something besides the digital device, indicating that the patentee was aware of the distinction between injecting code into “the digital device” as a whole versus some subcomponent of the device, such as memory or user processes. E.g., id. at 22:10 (“The application may perform code injection into memory.”). Accordingly, the Court concludes that construing “injecting redirection code into the digital

device” as requiring the redirection code be injected from outside the digital device does not read out the embodiment described in Figure 22 and step 2210. The Court notes that although it is relying on the plain and ordinary meaning of “injecting . . . into” to reach its construction, merely adopting the plain and ordinary meaning of this term will not resolve the parties’ dispute. See O2 Micro Int'l Ltd. v. Beyond Innovation Tech. Co., 521 F.3d 1351, 1360 (Fed. Cir. 2008). Accordingly, for the foregoing reasons, the Court construes “injecting redirection code into the digital device” to mean “the redirection code is injected from outside the digital device into the digital device.” E. “a request for data on the removable media device” / “a request for the data”

Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “a request for data on the removable The plain and ordinary A request for data media device” meaning should apply. located on the • ’202 patent, claims 1, 21 removable media device “a request for the data”’ • ’202 patent, claim 11 The Parties’ Position CUPP contends that both “a request for data on the removable media device,” in claims 1 and 21 of the ’202 patent, and “a request for the data,” in claim 11, should have their plain and ordinary meaning. Specifically, CUPP argues that Trend Micro’s proposed addition that the request for data “located on the removable device” adds nothing to clarify the scope of claims 1 and 21 beyond what is already apparent from the claim language (i.e., “on the removable device”), and improperly adds a limitation into claim 11 that does not include such a requirement. ECF No. 93 at 20–21. Trend Micro responds that construction of “a request for data on the removable media device” in claims 1 and 21 is necessary in light of CUPP’s infringement contentions; according

to Trend Micro, although CUPP seemingly concedes in its brief that claims 1 and 21 require that the data be located on the removable media device, in its contentions CUPP maps this element onto a request for data that is not located on the removable media device, but instead the digital device (or, in the language of CUPP’s contentions, “the computer”). ECF No. 94 at 14 (citing Def. App. 134–35 (“[Trend Micro’s] Device Control . . . intercept[s] with its redirection code the malicious automatic function calls on the external device that request data from the computer to run application. . . . Device Control regulates the external device’s access to the computer by blocking malicious, or potentially malicious, function calls from requesting data from the operating system.”). According to Trend Micro, construing “a request for data on the removable media device” as subject to its plain and ordinary meaning will not resolve the parties’ dispute.

Trend Micro argues that both the claim language and specification support its construction that, for claims 1 and 21, the request for data is for data located on the removable media device. As for claim 11, Trend Micro argues that prosecution disclaimer applies to narrow the claim scope in light of statements made by CUPP during the ’202 patent IPR. Specifically, Trend Micro points to statements made by CUPP to distinguish the prior art that purportedly reveal CUPP’s interpretation that the data being requested must be located on a removable media device. ECF No. 94 at 19. Trend Micro also argues that the claim language and the specification support its proposed construction. In response, CUPP contends that its arguments to the PTAB do not constitute a clear and unequivocal disavowal of claim scope, and that Trend Micro has waived this proposed construction, given that claim 11 was asserted during the initial round of claim construction but Trend Micro did not raise these arguments. ECF No. 93 at 5-6; see also Jan. 21, 2021, Order (ECF No. 87) (ordering supplemental claim construction briefing to “address potential prosecution disclaimer during the IPR proceedings and potentially as to the

addition of asserted claims 1 and 21 of the ’202 patent”). Analysis The Court construes the term “a request for data on the removable media device” in claims 1 and 21 to have its plain and ordinary meaning. The parties appear to agree that the plain language of the claims require that the data requested be located on the removable media device. ECF No. 93 at 20 (CUPP agreeing that Trend Micro’s proposed construction does not change the meaning of the terms from what the element already states, because “the claims already state that the data is ‘on the removable media device’”). In addition, CUPP represents that its infringement contentions are based on an assertion that “the data requested is on the removable media device.” ECF No. 96 at 17. Accordingly, based on CUPP’s representation that the data

being requested is on the removable media device and its representation that its infringement contentions are consistent with such a construction, the Court concludes that no clarifying construction is necessary.9 Regarding claim 11, CUPP’s statements to the PTAB that Trend Micro identifies as the basis for its prosecution disclaimer argument do not rise to the level of unequivocal and

9 The Court notes that because it is agreeing with CUPP’s proposed construction and relying on CUPP’s representations in reaching this decision, CUPP is judicially estopped from adopting a position inconsistent with its representations. See In re 3 Star Properties, L.L.C., 6 F.4th 595, 605 (5th Cir. 2021) (application of judicial estoppel relies on several factors, including whether “a party’s later position [is] ‘clearly inconsistent’ with its earlier position,” “whether the party has succeeded in persuading a court to accept that party's earlier position,” and whether absent estoppel “the party seeking to assert an inconsistent position would derive an unfair advantage or impose an unfair detriment on the opposing party” (quoting New Hampshire v. Maine, 532 U.S. 742, 749–50 (2001)). unambiguous disavowal of claim scope. See ECF No. 94 at 19 (citing Def. App. 46, 50, 51, 87). Instead, CUPP’s statements consist of describing the prior art (Def. App. 46) or challenging Trend Micro’s prima facie case that the combination of two prior art references discloses certain claim elements (Def. App. 50–51, 87). See, e.g., Def. App. 87 (“Aside from Aussel’s transparent

redirection process demonstrating that every example disclosed in Aussel involves a request for data on the terminal being rerouted to the USB key, it also demonstrates that applications are not aware of, and cannot directly request data from the USB key.”). What is notably missing from these cited passages is any discussion by CUPP of what claim 11 or the ’202 patent does or does not cover. Admittedly, some of these statements use language resembling the claims and requests for data on removable media devices, but given that some of the claims challenged in the ’202 patent IPR included the limitation “a request for data on the removable media device,”10 CUPP’s use of this language is neither surprising nor sufficient to establish disclaimer for claim 11, particularly where CUPP does not even specify that the statements at issue apply to claim 11. Thus, the Court declines to find prosecution disclaimer based on the statements identified

by Trend Micro. To the extent Trend Micro is arguing that claim 11 of the ’202 patent should be construed based on other reasons, it has waived those arguments by not raising them during the initial round of claim construction briefing. Accordingly, for the foregoing reasons, the Court construes “a request for the data” in claim 11 of the ’202 patent to have its plain and ordinary meaning. V. CONCLUSION The Court adopts the constructions set forth above, as summarized in the following table. The parties are ORDERED not to refer, directly or indirectly, to each other’s claim construction

10 Trend Micro challenged claims 1, 3, 4, 6, 10, 11, 13, 14, 16, 20, and 21 of the ‘202 patent in the ’202 patent IPR. positions in the presence of the jury. Likewise, the parties ace ORDERED to refrain from mentioning any portion of this opinion, other than the actual definitions adopted by the Court, in the presence of the jury. Any reference to claim construction proceedings is limited to informing the jury of the definitions adopted by the Court.

e °202 patent, claim 11 “means for receiving from the mobile device | Function: receiving from the mobile device particular network data before the at least one | particular network data before the at least one mobile device processor of the mobile device | mobile device processor of the mobile device processes the particular network data, the processes the particular network data, the particular network data having been particular network data having been forwarded to the security system by the at forwarded to the security system by the at least one mobile device processor of the least one mobile device processor of the mobile device” / “means for receiving” mobile device e °444 patent, claim 21 Structure: connection mechanisms for USB, Ethernet, WiFi, WiMAX, GSM, CDMA, BlueTooth, PCMCIA, modem, or NIC. “subset” / “the subset of the outgoing data” Plain and ordinary meaning. e °272 patent, claim 16 “Subset” means “any portion of,” and “the subset of the outgoing data” means “any portion of the outgoing data.” “dynamically isolating” Plain and ordinary meaning. e °272 patent, claim 16 e °079 patent, claim 7 “injecting redirection code into the digital The redirection code is injected from outside e ’202 patent, claims 1 and 21 “a request for data on the removable media Plain and ordinary meaning. see arate ries’ e °202 patent, claims 1, 11, and 21 SO ORDERED. December 6, 2021. i 1, [Titra VIAL Lys (BARBARA M.G.LYNN © {IEF JUDGE