CUPP Cybersecurity LLC v. Trend Micro Inc

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF TEXAS DALLAS DIVISION

CUPP CYBERSECURITY, LLC, and CUPP § COMPUTING AS, § §

§ Plaintiffs, §

§ Civil Action No. 3:18-cv-1251-M v. §

§ (Consolidated with TREND MICRO, INC., TREND MICRO § Civil Action No. 3:20-cv-03206-M) AMERICA, INC., and TREND MICRO § INCORPORATED, § Defendants. § §

CLAIM CONSTRUCTION MEMORANDUM OPINION AND ORDER This Order addresses the claim construction disputes presented by Plaintiffs CUPP Cybersecurity, LLC, and CUPP Computing AS, and Defendants Trend Micro, Inc., Trend Micro America, Inc., and Trend Micro Incorporated, in CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv-03206-M.1 The parties submitted opening and responsive claim construction briefs, and on November 8, 2021, the Court held a claim construction hearing. Having considered the arguments and evidence presented by the parties, the Court issues this Order. I. BACKGROUND Plaintiffs CUPP Cybersecurity, LLC and CUPP Computing AS (together, “CUPP”) are security providers for mobile devices, and have “a robust portfolio of inventions related to, inter alia, mobile devices and removable media, and has invested millions in pioneering new forms of security for these devices. CUPP’s inventions cover software and hardware based solutions to

1 On November 1, 2021, CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:18-cv-01251-M (“CUPP1”) was consolidated with CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv-03206-M (“CUPP2”). This Order addresses claim construction disputes presented in CUPP2 prior to consolidation. The Court has already issued a separate order discussing the claim construction disputes presented in CUPP1. See ECF No. 150. problems in mobile device management, network security, DMZ security, and endpoint security.” Am. Compl. (CUPP2 ECF No. 412) ¶ 8. Defendants Trend Micro, Inc., Trend Micro America, Inc., and Trend Micro Incorporated (together, “Trend Micro”) make a number of products falling into several categories: user protection products (e.g., Smart Protection

Complete Suit), network defense products (e.g., Advance Threat Protection and Intrusion Protection), hybrid cloud security products (e.g., Deep Security), worry-free products (e.g., Worry-Free Standard), mobile security technology products (e.g., Dr. Safety), control manager technology, XGen security technology, smart protection network technology, and XDR and managed XDR technology. Id. ¶¶ 43–54. CUPP alleges that Trend Micro’s products infringe nine of CUPP’s patents: U.S. Patent No. 10,417,400 (the “’400 patent”); U.S. Patent No. 10,089,462 (the “’462 patent”); U.S. Patent No. 10,417,421 (the “’421 patent”); U.S. Patent No. 10,621,344 (the “’344 patent”); U.S. Patent No. 10,291,656 (the “’656 patent”); U.S. Patent No. 10,666,688 (the “’688 patent”); U.S. Patent No. 10,162,975 (the “’975 patent”); U.S. Patent No. 10,496,834 (the “’834 patent”); U.S. Patent

No. 10,951,632 (the “’632 patent”). The parties identify one agreed construction and four disputed terms for the Court’s resolution. The patents containing disputed terms are discussed below. a. The ’688 and ’656 patents. Both the ’688 and ’656 patents are titled “Systems and methods for providing network security using a secure digital device.” The ’688 patent is a continuation of the ’656 patent and shares the same specification. The parties agree that the ’688 patent is representative of the ’656 patent for purposes of claim construction.

2 Citations to “CUPP2 ECF” refer to the docket in CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv- 03206-M. Trend Micro describes the ’688 patent as broadly disclosing “a mechanism for intercepting network traffic, analyzing the data in the network traffic to determine if the data is malicious, and allowing the network traffic to proceed on its original course if the data is determined not to be malicious.” Resp. (CUPP2 ECF No. 66) at 7. Specifically, the ’688 and

’656 patents describe a security system that can intercept network traffic of a host device, a traffic virtualization module to generate a virtual file containing the intercepted network traffic, and modules for enforcing security policies on the network traffic. Br. (CUPP2 ECF No. 62) at 7. The parties dispute two claim terms appearing in the ’688 and ’656 patents, both of which appear in claim 1 of the ’688 patent, which claims: 1. A secure digital security system comprising: a data store; a file management module configured to receive a transfer file from a host device over a virtual file interface configured to assist in transferring data at file transfer speeds between the host device and the secure digital security system, the transfer file possibly containing a data store command or a virtual file containing network traffic intercepted at the host device, the transfer file including header information indicating whether the transfer file includes the data store command or the virtual file containing the network traffic, the network traffic including one of incoming network traffic to the host device or outgoing network traffic from the host device, the data store command including a particular command to retrieve or store data in the data store; a controller configured to manage the data store command by retrieving or storing the data in the data store; a security policy management module configured to evaluate the network traffic in the virtual file for compliance with a security policy; a traffic access determination module configured to generate a security indication whether to allow or to deny the network traffic in accordance with the evaluation; and a module configured to provide to the host device over the virtual file interface the security indication whether to allow or to deny the network traffic. ’688 patent, cl.1. b. The ’975 and ’834 patents. Both the ’975 and ’834 patents are titled “Secure computing system.” The ’834 patent is a continuation of the ’975 patent, and shares the same specification. The parties agree that the ’975 patent is representative of the ’834 patent for purposes of claim construction. The parties dispute one term in the ’975 and ’834 patents. The ’975 patent is directed towards a computer system with multiple security levels,

based, in part, on three independent “security aspects”: confidentiality, integrity, and availability. ’975 patent, at 1:62–65. The computer system described by the ’975 patent has multiple security levels, comprising high-power and low-power processing devices, and an interface unit comprising functions for moving classified information between the devices according to formal rules governing the security aspects of confidentiality and/or integrity. Id. at 6:29–39. Claim 1 of the ’975 patent recites: 1. A system comprising: a virtual machine engine for generating one or more virtual machines, each virtual machine being generated having a virtual machine confidentiality level and a virtual machine integrity level, the virtual machine confidentiality level being selected from at least a higher confidentiality level and a lower confidentiality level, the virtual machine integrity level being selected from at least a higher integrity level and a lower integrity level, a first virtual machine with the higher confidentiality level requiring a stronger confidentiality process than a second virtual machine with the lower confidentiality level, a third virtual machine with the higher integrity level requiring a stronger integrity process than a fourth virtual machine with the lower integrity level; a first program; a second program; a first datastore or data set associated with a first data confidentiality level and a first data integrity level; a second datastore or data set associated with a second data confidentiality level and a second data integrity level; at least one hardware processor configured to: receive a request to use the first program; execute a particular virtual machine with a particular virtual machine confidentiality level and a particular virtual machine integrity level; use a particular confidentiality process and a particular integrity process before or while operating the first program by the particular virtual machine, the particular confidentiality process being associated with the particular virtual machine confidentiality level, the particular integrity process being associated with the particular virtual machine integrity level; allow the first program to read the first data set or from the first datastore, only if the first data confidentiality level is equal to or lower than the particular virtual machine confidentiality level, and only if the first data integrity level is equal to or higher than the particular virtual machine integrity level; and allow the first program to write to the first datastore or data set, only if the first data confidentiality level is equal to or higher than the particular virtual machine confidentiality level, and only if the first data integrity level is equal to or lower than the particular virtual machine integrity level. ’975 patent, cl.1. c. The ’400 patent. The ’400 patent is titled “Systems and methods for providing real time security and access monitoring of a removable media device.” The “400 patent describes systems and methods to provide data and device security in connection with a removable media device coupled to a media device. The abstract of the ’400 patent states: In various embodiments, a method comprises detecting a removable media device coupled to a digital device, authenticating a password to access the removable media device, injecting redirection code into the digital device, intercepting, with the redirection code, a request for data, determining to allow the request for data based on a security policy, and providing the data based on the determination. The method may further comprise selecting the security policy from a plurality of security policies based, at least in part, on the password and/or filtering the content of the requested data. Filtering the content may comprise scanning the data for malware. Filtering the content may also comprise scanning the data for confidential information. ’400 patent, Abstract. The parties dispute the meaning of one claim term in claim 9 of the ’400 patent, which reads: 9. A system comprising: an operating system of a digital device configured to detect a removable media device being coupled to an external device port of the digital device; one or more processors; memory coupled to the one or more processors, the memory storing instructions to instruct the one or more processors to implement: a login module configured to cause, after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device, the redirection code including an interceptor, a data security policy, and a data security process, the interceptor configured to intercept a first function call to the operating system of the digital device before the first function call is executed by the operating system, the first function call including a request of the operating system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application, the data security process configured to perform a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the data security policy configured to evaluate data on the removable security device for malware, and the data security policy configured to determine whether to allow the first function call based at least on results of the data security process. ’400 patent, cl. 9. II. LEGAL PRINCIPLES A. General Principles of Claim Construction The construction of disputed claims is a question of law for the court. Markman v. Westview Instruments, Inc., 52 F.3d 967, 971–72 (Fed. Cir. 1995), aff’d, 517 U.S. 370 (1996). “Ultimately, the interpretation to be given a term can only be determined and confirmed with a full understanding of what the inventors actually invented and intended to envelop with the claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (en banc) (citation omitted). Accordingly, a proper construction “stays true to the claim language and most naturally aligns with the patent’s description of the invention.” Id. (citation omitted). “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention

to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004)). Courts first “look to the words of the claims themselves . . . to define the scope of the patented invention.” Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996) (citation omitted). The claim terms are “generally given their ordinary and customary meaning,” but “a patentee may choose to be his own lexicographer and use terms in a manner other than their ordinary meaning, as long as the special definition of the term is clearly stated in the patent specification or file history.” Id. (citation omitted). The “ordinary and customary meaning” of the terms in a claim is “the meaning that the term[s] would have to a person of ordinary skill in the art in question at the time of the invention.” Phillips, 415 F.3d at 1313.

When the meaning of a term to a person of ordinary skill in the art is not apparent, a court is required to consult other sources, including “the words of the claims themselves, the remainder of the specification, the prosecution history, extrinsic evidence concerning relevant scientific principles, the meaning of technical terms, and the state of the art.” Id. (citation omitted). A court must consider the context in which the term is used in an asserted claim or related claims in the patent, being mindful that “the person of ordinary skill in the art is deemed to read the claim term not only in the context of the particular claim in which the disputed term appears, but in the context of the entire patent, including the specification.” Id. The specification is “always highly relevant to the claim construction analysis” and is “the single best guide to the meaning of a disputed term.” Id. at 1315 (quoting Vitronics, 90 F.3d at 1582). For example, should the specification reveal that a claim term has been given a special definition by the patentee that is different from the ordinary meaning of the term, the inventor’s lexicography is controlling. Id. at 1316. Furthermore, if the specification reveals an intentional disclaimer or disavowal of claim

scope by the patentee, the claim scope dictated by the specification is controlling. Id. Finally, in construing claims, a court may consult extrinsic evidence, including “expert and inventor testimony, dictionaries, and learned treatises.” Phillips, 415 F.3d at 1317 (citing Markman, 52 F.3d at 980). Technical dictionaries may assist a court in “‘better understand[ing] the underlying technology’ and the way in which one of skill in the art might use the claim terms.” Id. at 1318 (quoting Vitronics, 90 F.3d at 1584 n.6). Expert testimony may also be helpful to “provide background on the technology at issue, to explain how an invention works, to ensure that the court’s understanding of the technical aspects of the patent is consistent with that of a person of skill in the art, or to establish that a particular term in the patent or the prior art has a particular meaning in the pertinent field.” Id. (citation omitted).

Although extrinsic evidence may “shed useful light on the relevant art,” it is considered “less significant than the intrinsic record.” Id. at 1317 (quoting C.R. Bard, Inc. v. U.S. Surgical Corp., 388 F.3d 858, 862 (Fed. Cir. 2004)). More simply, “extrinsic evidence may be useful to the court, but it is unlikely to result in a reliable interpretation of patent claim scope unless considered in the context of the intrinsic evidence.” Id. at 1319. Accordingly, “a court should discount any expert testimony ‘that is clearly at odds with the claim construction mandated by the claims themselves, the written description, and the prosecution history, in other words, with the written record of the patent.’” Id. at 1318 (quoting Key Pharms. v. Hercon Labs. Corp., 161 F.3d 709, 716 (Fed. Cir. 1998)). III. AGREED CONSTRUCTION The parties have agreed to the following construction set forth in their Joint Claim Construction Chart (CUPP2, ECF No. 68): Term Agreed Construction “power management mode” A mode where the mobile device conserves power • ’632 patent, claims 1, 16

IV. CONSTRUCTION OF DISPUTED TERMS A. “file transfer speeds”

Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “file transfer speeds” Plain and ordinary Indefinite • ’688 patent, claims 1, 6 meaning. • ’656 patent, claims 1, 10 The Parties’ Positions CUPP argues that “file transfer speeds” should be construed according to its plain and ordinary meaning, because a POSITA would know, based on the specification and prosecution history, that this term means “the speed a file is transferred.” Reply (ECF No. 69) at 5. According to CUPP, the speed a file is transferred would depend on the particular device at issue. CUPP further argues that in the context of the specification, this term means “the speed that does not cause errors or timeouts in the underlying computer system.” Id. at 6. For support, CUPP points to the declaration and deposition testimony of its expert, Dr. Goodrich, as well as a dictionary definition defining “file transfer” as “[t]he process of moving or transmitting a file from one location to another, as between two programs or over a network.” CUPP App. Vols. I, II (ECF Nos. 63, 64) at Pltf. App. 137, 156, 315. Trend Micro argues that the term “file transfer speeds” as it appears in the claims of the ’688 and ’656 patents is indefinite, because the claims, specifications, and file histories do not inform a POSITA about the scope of the invention with reasonable certainty. Trend Micro notes that both sides’ experts agree that “file transfer speed” is not a term of art, and that the only guidance regarding the meaning of “file transfer speeds” is from the following passage of the specification:

Portable electronic devices, such as Android® smartphones and tablet devices, often use secure digital (SD) devices, e.g., SD cards, to store and retrieve files and other data. Secure digital devices typically do not support network traffic for host devices, or at best only support network traffic at transfer speeds that are unreasonably slow (e.g., 100’s kb/s), especially compared to the file transfer speeds of these secure storage devices (e.g., 10’s MB/s). ’688 patent, at 4:2–6 (emphasis added). Based on this passage, Trend Micro states a POSITA would only know that “10’s MB/s” would qualify as a file transfer speed, but “100’s kb/s” would not. Without additional data points or information, the specification does not provide reasonable certainty about the bounds of the claim—i.e., what would qualify as “file transfer speeds” capable of satisfying the claim. Trend Micro further argues that to adopt CUPP’s proposal would effectively read out the requirement in the claims that the files in question be transferred at “file transfer speeds.” According to Trend Micro, CUPP’s proposed construction renders this limitation meaningless, because it would permit any speed at which a file is transferred to qualify as a “file transfer speed,” making the claim language superfluous. Analysis The issue presented is whether, based on the specification and prosecution history, claims 1 and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent are indefinite because the term “file transfer speeds” used in those claims fails to inform a POSITA about the scope of the claimed invention with reasonable certainty. The Court concludes that the term “file transfer speeds” is indefinite. Title 35, § 112(b) of the United States Code requires that a patent specification shall “conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.” The Supreme Court has held this definiteness provision “to require that a patent’s claims, viewed in light of the

specification and prosecution history, inform those skilled in the art about the scope of the invention with reasonable certainty.” Nautilus, Inc. v. Biosig Instruments, Inc., 572 U.S. 898, 910 (2014). “The claims, when read in light of the specification and the prosecution history, must provide objective boundaries for those of skill in the art.” Interval Licensing LLC v. AOL, Inc., 766 F.3d 1364, 1371 (Fed. Cir. 2014). If a claim does not satisfy these requirements, it is invalid as indefinite under § 112. Nautilus, 572 U.S. at 901. “[I]ndefiniteness is a question of law and in effect part of claim construction.” ePlus, Inc. v. Lawson Software, Inc., 700 F.3d 509, 517 (Fed. Cir. 2012). Claim 1 of the ’688 patent, which the parties agree is representative for purposes of claim construction, describes a secure digital security system comprising, in part, “a file management

module configured to receive a transfer file from a host device over a virtual file interface configured to assist in transferring data at file transfer speeds between the host device and the secure digital security system.” ’688 patent, cl.1. Thus, the claim describes an interface that assists with data being transferred between the host device and the secure digital security system not at any speed, but specifically “at file transfer speeds.” Omitting this phrase would give the claim a broader meaning, and accordingly, the “at file transfer speeds” language is a narrowing limitation. See Bicon, Inc. v. Straumann Co., 441 F.3d 945, 950 (Fed. Cir. 2006) (“[C]laims are interpreted with an eye toward giving effect to all terms in the claim.”). CUPP first contends that “file transfer speeds” means the speed at which a file is transferred, and at oral argument, contended that, for a given device, any speed at which a file is transferred would satisfy the limitation. However, construing “file transfer speeds” simply to mean the speed at which any given file is transferred would render that language purely

descriptive, as opposed to limiting; in effect, the claim term would amount to nothing more than an observation that files should be transferred at the speed at which they are transferred. As interpreted by CUPP, this language is effectively meaningless; indeed, during oral argument, when pressed by the Court as to what limitation would be removed if the words “at file transfer speeds” were omitted from the claim under its proposed construction, CUPP had no response. Having drafted the claim to include this language, CUPP cannot now argue that “at file transfer speeds” is merely descriptive; to do would render the scope of the patent ambiguous, “leaving examiners and the public to guess about which claim language the drafter deems necessary to his claimed invention and which language is merely superfluous, nonlimiting elaboration.” Bicon, 441 F.3d at 950.

CUPP’s alternative proposal—that “file transfer speed” refers to the speed that does not cause errors or timeouts in the underlying computer system—fares no better. Nothing in the specification references timeouts or errors, the parties’ experts agree that “file transfer speed” is not a term of art, and CUPP points to no dictionary or treatise to support its proposal. Instead, the only evidence in the record supporting this interpretation is deposition testimony from CUPP’s expert, Dr. Goodrich, which the Court concludes is not specific or certain enough to suggest a POSITA would reach the same conclusion regarding the meaning of “file transfer speeds” in the patents. See Pltf. App. 137 (“Q: Okay. So what is the plain and ordinary meaning of file transfer speed. A: . . . I would say, just sitting here today, it’s the speed at which a file can be transferred without there being an errors or timeouts in the system.” (emphasis added)). Having concluded that “file transfer speeds” must mean something beyond merely the speed at which files are transferred, and that CUPP’s alternative proposal lacks support, the

Court looks to the specification. Apart from the claims, the only references to “file transfer speeds,” “speed,” or “speeds” in the patents is a single passage in the specification, quoted previously, that distinguishes between “unreasonably slow” transfer speeds in the hundreds of kilobits per second range, and file transfer speeds of secure digital devices in the tens of megabytes per second range. See ’688 patent, at 4:2–6. The specification next states that, “[a]ccordingly, various embodiments . . . capitalize on the rapid file transfer capabilities of secure digital devices to scan and evaluate network traffic for compliance with security policies.” Id. at 4:7–10. Based on this disclosure, a POSITA would understand that speeds of “10’s MB/s” qualify as a “file transfer speed” as that term is used in the claim. Beyond that, the specification

provides no clear guidance as to its bounds. Speeds of “100’s kb/s” are distinguished from “file transfer speeds” as being unreasonably slow; Dr. Goodrich, CUPP’s expert, agreed that a POSITA would realize that “going at that alternative slow speed, that’s not a file transfer speed.” Pltf. App. 137. However, the distinction between “slow,” “unreasonably slow,” and “file transfer speeds” is undefined, and made further unclear by the fact that the sole data points provided in the specification—100 kb/s and 10 MB/s—are described as being merely exemplary. In sum, the specification does not provide sufficient guidance of the meaning of transferring data “at file transfer speeds” to give notice to the public of the boundaries between infringing and innocent activity. Accordingly, the Court concludes that the specifications of the ’688 and ’656 patents do not inform a POSITA about the scope of “file transfer speeds” with reasonable certainty. Trend Micro has proven that claims 1 and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent are each indefinite under § 112.

B. “virtual file” Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “virtual file” Plain and ordinary Indefinite • ’688 patent, claims 1, 6 meaning • ’656 patent, claims 1, 10 The dispute regarding the term “virtual file” in the ’688 and ’656 patents is whether, based on the specification and prosecution history, claims 1 and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent are indefinite because the term “virtual file” fails to inform a POSITA about the scope of the claimed invention with reasonable certainty. CUPP argues that “virtual file” should be construed according to its plain and ordinary meaning, whereas Trend Micro responds that it is indefinite under § 112. However, the Court has already concluded that these claims are each indefinite under § 112 for including the term “file transfer speeds,” and accordingly, does not reach the parties’ dispute as to whether these claims are indefinite for including the term “virtual file.” C. “a login module configured to case . . . at least a portion of redirection code to be generated on the digital device” Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “a login module configured to cause, Plain and ordinary § 112 ¶ 6 (pre-AIA) after detecting the removable media meaning device being coupled to the external Function: Configured to device port of the digital device, at least cause, after detecting a portion of redirection code to be the removable media generated on the digital device” device being coupled to • ’400 patent, claim 9 the external device port of the digital device, at least a portion of the redirection code to be generated on the digital device.

Structure: None disclosed/indefinite The parties dispute whether the “a login module . . .” term in claim 9 of the ’400 patent is a means-plus-function claim element. A means-plus-function claim element triggers 35 U.S.C. § 112 ¶ 6 (pre-AIA) / § 112(f) (AIA),3 which allows an applicant to express a claim limitation “as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof,” and provides that “such claim[s] shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.” 35 U.S.C. § 112 ¶ 6; see also Ergo Licensing, LLC v. CareFusion 303, Inc., 673 F.3d 1361, 1363 (Fed. Cir. 2012). In other words, a means-plus-function claim element allows the patentee to use a generic means to express a claim limitation, but the specification must disclose the corresponding structure. Ergo Licensing, LLC, 673 F.3d at 1363 (quoting Biomedino, LLC v. Waters Techs. Corp., 490 F.3d 946, 948 (Fed. Cir. 2007)). Thus, construction of a means-plus-

3 The ’400 patent claims priority to Application No. 12/622,386, which was filed on November 19, 2009. Accordingly, because the priority date of the ’400 patent predates the March 16, 2013, effective date of the AIA, the ’400 patent is subject to the pre-AIA § 112 ¶ 6. function limitation consists of two steps: (1) identifying the claimed function, and (2) determining what, if any, structure in the specification corresponds with that function. Cardiac Pacemakers, Inc. v. St. Jude Med., Inc., 296 F.3d 1106, 1113 (Fed. Cir. 2002). The court must construe the function to include only those limitations in the claim language. Id. “It is improper

to narrow the scope of the function beyond claim language” or to broaden the scope by disregarding limitations in the claims themselves. Id. (indicating further that “[o]rdinary principles of claim construction govern interpretation of the claim language used to describe the function”). The Parties’ Positions CUPP argues that the “a login module . . .” limitation is not a means-plus-function term because the claim language describes the operation of the login module sufficiently such that the structure is in the claim itself. In addition, CUPP points to statements made by the examiner during prosecution indicating that the structure of the login module is software. Trend Micro argues that the “a login module . . .” term in claim 9 of the ’400 patent

should be construed as a means-plus-function limitation, and that it does not disclose sufficient structure and is therefore indefinite. Trend Micro points to the claim’s use of the word “module,” which the Federal Circuit has recognized is a “well-known nonce word that can operate as a substitute for ‘means,’” and the fact that “login module” has no established meaning in the industry. See Resp. at 29 (quoting Rain Computing, Inc. v. Samsung Elecs. Am., Inc., 989 F.3d 1002, 1006 (Fed. Cir. 2021)). Trend Micro contends that the “a login module . . .” limitation discloses two functions—“detecting the removable media device being coupled to the external device port of the digital device” and, after detection, a “generating” function, namely causing at “least a portion of redirection code to be generated on the digital device”—and that because neither the claim nor the specification provide the associated structure for performing those functions, the claim is indefinite. Analysis The parties’ first dispute is whether the “a login module . . .” claim term is a means-plus-

function limitation subject to § 112 ¶ 6. The Court concludes that it is not. The claim does not use the word “means.” The Federal Circuit has held that avoidance of the word “means” creates a rebuttable presumption that § 112 ¶ 6 does not apply. See Zeroclick, LLC v. Apple Inc., 891 F.3d 1003, 1007 (Fed. Cir. 2018). To overcome that presumption, Trend Micro must demonstrate by a preponderance of the evidence that the claim term fails to recite sufficiently definite structure or recites function without reciting structure for performing that function. See id.; Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1348 (Fed. Cir. 2015) (en banc). “[T]he mere fact that the disputed limitations incorporate functional language does not automatically convert the words into means for performing such functions.” Zeroclick, 891 F.3d at 1008. Instead, the inquiry “depends on whether persons skilled in the art would understand

the claim language to refer to structure, assessed in light of the presumption that flows from the drafter’s choice not to employ the word ‘means.’” Samsung Elecs., Am., Inc. v. Prisua Eng’g Corp., 948 F.3d 1342, 1354 (Fed. Cir. 2020). “That determination must be made under the traditional claim construction principles, on an element-by-element basis, and in light of evidence intrinsic and extrinsic to the asserted patents.” Zeroclick, 891 F.3d at 1007. Here, the limitation at issue does not use the word “means,” but rather “module”; § 112 ¶ 6 presumptively does not apply unless Trend Micro establishes that the claim term fails to describe sufficiently definite structure.4 See id. Claim 9 recites a system comprising an operating system of a digital device configured to detect a removable media device being coupled to the digital device, one or more processors, and memory coupled to said processor(s) storing instructions to instruct the processor(s) to implement “a login module . . . ,” the term at

issue here. CUPP maintains that the structure of the login module is software, pointing to a statement by the patent examiner during prosecution, recognizing that “the processor implements the login module” and “[a]s such the examiner has interpreted the structure [of the] module[] to be software.”5 Pltf. App. 190. Similarly, the declaration of Trend Micro’s expert, Dr. Jakobsson, states that “around 2008, a POSITA might have assumed that a ‘login module’ refers to software that requires a username and/or password to allow access to a device or software.” Trend Micro App. (ECF No. 67) at Def. App. 63. Dr. Jakobsson goes on to challenge that assumption in the context of claim 9 of the ’400 patent,6 but seemingly concedes that a POSITA would understand “login module,” as it is used in the context of the claim, to refer to software. CUPP’s expert, Dr.

Goodrich, likewise states in his declaration that a POSITA would understand “module” to refer

4 The Court notes that several of the cases holding that “module” was used a nonce word, and a substitute for “means,” did so based on the patentee’s express acknowledgment that, as used in the claim, “module” was a nonce word or had no commonly understood meaning and was not known by a POSITA to connote a particular structure. See Rain Computing, Inc. v. Samsung Elecs. Am., Inc., 989 F.3d 1002, 1006 (Fed. Cir. 2021); Williamson, 792 F.3d at 1350–51. CUPP makes no such concession here, and accordingly, the fact that the Federal Circuit has previously recognized “module” as a nonce word similar to means is not dispositive. 5 The examiner initially rejected the claim under § 112 ¶ 6 “because it uses . . . a generic placeholder ‘module’ coupled with functional language “login . . .” without reciting sufficient structure to achieve the function” and “the generic placeholder is not preceded by a structural modifier.” Pltf. App. 362. The claim was subsequently amended to add the limitations “one or more processors” and “memory coupled to the one or more processors, the memory storing instructions to instruct the processor to implement:” a login module. See U.S. Patent Application Serial No. 14/337,101, Docket No. 18EL-202029, Amendment and Response to Non-Final Office Action, at cl.11 (Dec. 1, 2015). 6 Specifically, Dr. Jakobsson states that the claimed function of the “login module” does not require verification of a user’s identity or password, and thus “[a]n assumption that the ‘login module’ verifies a username and/or password therefore would be incorrect.” Def. App. 64. However, Dr. Jakobsson does not contend that a POSITA’s assumption that the login module refers to software is incorrect. to “a collection of commands or statements in a computer program to be executed by a processor with . . . predefine[d] routines and instructions.” Pltf. App. 317. Trend Micro argues that, even if the login module is software, the claim still lacks sufficient structure because the term is “untethered to any structure in the specification and

followed by purely functional claim language.” Resp. at 33. Admittedly, in claim 9, “a login module . . .” is followed by language denoting some function; it describes how the module is configured to cause, “after detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device.” ’400 patent, cl.9. However, the inclusion of functional language does not alone transform the claim into a means-plus-function limitation. See Zeroclick, 891 F.3d at 1008. Moreover, when construing the limitation in context, the Court disagrees that the language is untethered to any structure. For instance, Trend Micro argues that the login module performs the function of “detecting” the coupling of the removable media device to the external device port of the digital device; however, the claim makes clear that the operating system on the digital device is capable of performing that exact function.7 Similarly, the claim specifies the structure and

capabilities of the redirection code generated by the login module, namely that the redirection code includes an interceptor, a data security policy, and a data security process, and that the interceptor is configured to intercept function calls to the operating system of the digital device and perform other function calls in response, in accordance with the specific language of the

7 In addition, unlike other claims in the ’400 patent which specify that the login module is not located on the digital device, where the operating system is located, there is no such limitation in claim 9. Compare ’400 patent, cl.1 (“the removable media device having a login module”), id. cl.17 (“the removable media device having a login module”), with id. cl.9. claim.8 See ’400 patent, cl.9. Put differently, the claim provides the algorithm—i.e., structure— of the redirection code.9 Moreover, the Court concludes that, reading “login module” in the context of the specification, there is sufficient structure such that the presumption against § 112 ¶ 6 is not

rebutted. For instance, the specification describes various means by which the login module generates redirection code: The login module 1920 detects when the removable media device 1904 is coupled with the digital device 1902 and executes instructions to generate the redirection module 1910. In some embodiments, the login module 1920 requires that the user provides a password and/or a user name prior to the generation of the redirection module 1910. The login module 1920 may then execute a set up program to generate the redirection module 1910 on the digital device 1902. In one example, when the removable media device 1904 is coupled to the digital device 1902, the digital device 1902 may see the removable media device 1904 as a CD. The login module 1920 may provide an extended login executable file (e.g., EXT-login. Exe 1922) which may be auto-run by the digital device 1902 which generates the redirection module 1910. ’400 patent, at 22:31–45. Accordingly, the Court concludes that Trend Micro has not established that claim 9 fails to describe sufficiently definite structure for the challenged “a login module . . .” limitation, and therefore § 112 ¶ 6 does not apply. The parties raise no other claim construction dispute related

8 Specifically, claim 9 specifies that the interceptor is configured to “to intercept a first function call to the operating system of the digital device before the first function call is executed by the operating system, the first function call including a request of the operating system to retrieve data from or write data to the removable media device, the first function call being initiated by a particular user or a particular application, the data security process configured to perform a set of one or more second function calls in response to intercepting the first function call, the set of one or more second function calls not including the first function call, the data security policy configured to evaluate data on the removable security device for malware, and the data security policy configured to determine whether to allow the first function call based at least on results of the data security process.” ’400 patent, cl.9. 9 The Court notes that computer-implemented claims do not necessarily need to provide an algorithm in the claims to avoid the application of § 112 ¶ 6. See, e.g., Mad Dogg Athletics, Inc. v. Peloton Interactive, Inc., No. 2:20-CV- 00382-JRG, 2021 WL 3200994, at *15 (E.D. Tex. July 28, 2021) (“[T]he claims themselves do not necessarily need to provide an algorithm for a computer-directed claim term to avoid the ambit” of § 112 ¶ 6 (citing Apple Inc. v. Motorola, Inc., 757 F.3d 1286, 1298 (Fed. Cir. 2014)). to this limitation, and accordingly, the Court construes ““a login module . . .” according to its plain and ordinary meaning. D. “integrity level” Disputed Term CUPP’s Proposed Trend Micro’s Construction Proposed Construction “integrity level” Plain and ordinary A value, separate from • ’975 patent, claims 1, 13 meaning. the confidentiality level, • ’834 patent, claims 1, 15 that indicates reliability The Parties’ Position CUPP argues that “integrity level” should be construed according to its plain and ordinary meaning, namely a measure of the trustworthiness or reliability of information. According to CUPP, because the patent recites both an “integrity level” and a “confidentiality level,” a POSITA would already understand that the two concepts are distinct. CUPP argues that including the word “separate” in the construction would read out an embodiment of the invention described in the specification, citing the following passage in which security aspects are expressed as a related pair: As noted above, different aspects of security, e.g. confidentiality, integrity and availability, are independent of each other. Thus, if there are two levels of integrity, e.g. {low, high} and two levels of confidentiality, e.g. {public, restricted} there could be four different virtual machines running {low, public}, {low, restricted}, {high, public} and {high, restricted} respectively. ’975 patent, at 12:50–56; see Br. at 22–23. In addition, based on testimony from its expert, Dr. Goodrich, CUPP contends that Trend Micro’s proposed construction is incorrect because security aspects, while being distinct, may still be related. CUPP further contends that Trend Micro’s inclusion of the word “value” in its proposed construction unnecessarily adds confusion. Trend Micro responds that while the parties agree that “integrity” levels indicate reliability, the parties disagree as to whether the recited integrity level must be separate from the confidentiality level recited in the claims. Trend Micro points to the ’975 patent’s description of the confidentiality, integrity, and availability security aspects, and in particular the observation

that “[i]t should also be understood that all aspects of security herein are independent of each other.” ’975 patent, 1:67–2:4. Trend Micro also points to a disclaimer in the specification of prior art security models that combined integrity and confidentiality, noting that such an approach is “a confusion of terms” and, in contrast, “[i]n this disclosure, integrity and confidentiality are regarded as completely independent of each other.” Id. at 2:49–55. Accordingly, because the claims and specification consistently treat the integrity level and confidentiality level separately, Trend Micro contends that the Court should construe the integrity level to be separate—i.e., a separate and distinct value—from the confidentiality level. Analysis The issue in dispute is whether the “confidentiality level” and “integrity level” are

separate. The Court concludes that they are. The specification makes abundantly clear that integrity and confidentiality describe different concepts and are “completely independent” of each other; the specification describes how “information may be more or less reliable regardless of its level of confidentiality, and that a computer process may be assigned clearance along a confidentiality axis regardless of its assigned clearance along an integrity axis.” Id. at 2:52–60. In addition, the integrity and confidentiality levels are treated as separate and independent by the claims. For example, claim 1 of the ’975 patent describes an engine for generating virtual machines, each with a virtual machine confidentiality level and integrity level, the confidentiality level “being selected from at least a higher confidentiality level and a lower confidentiality level,” and the integrity level “being selected from at least a higher integrity level and a lower integrity level.” Id. at cl.1. It is clear from these disclosures that the confidentiality and integrity levels are assigned separately and independently—i.e., selection of a particular confidentiality level has no effect on

the selection of the integrity level. Moreover, there is no support in either the specification or the claims to suggest that the confidentiality and integrity levels are not represented separately within the system. Instead, the security aspects are referred to as separate values; for example, the specification describes an embodiment with two levels of integrity (“{low, high}”) and two levels of confidentiality (“{public, restricted}”), which results in four potential combinations, {low, public}, {low, restricted}, {high, public}, {high, restricted}. Id. at 12:50–56. CUPP points to nothing to suggest that a single level—for example, {low}—could represent both the confidentiality level and the integrity level, while maintaining the requisite independence articulated by the patent. In addition, CUPP’s concern that the fact that confidentiality and integrity can be described as paired variables means they are not separate from each other is

unsupported; on the contrary, the specification makes clear that these different security aspects can be presented as pairs but remain independent. See id. In sum, the Court agrees with Trend Micro that based on the claims and the specification of the ’975 and’834 patents, the “integrity level” is separate from the confidentiality level and indicates reliability. However, the Court declines to introduce unnecessary ambiguity by using the word “value” in its construction, and accordingly construes “integrity level” to mean “a security aspect, separate from the confidentiality level, that indicates reliability.” V. CONCLUSION The Court adopts the constructions set forth above, as summarized in the following table. The Court further finds that claims | and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent are each indefinite under § 112 because of the inclusion of the term “‘file transfer speeds.” The parties are ORDERED not to refer, directly or indirectly, to each other’s claim construction positions in the presence of the jury. Likewise, the parties are ORDERED to refrain from mentioning any portion of this opinion, other than the actual definitions adopted by the Court, in the presence of the jury. Any reference to claim construction proceedings is limited to informing the jury of the definitions adopted by the Court.

“power management mode” A mode where the mobile device conserves e °632 patent, claims 1, 16 power “a login module configured to cause, after Plain and ordinary meaning detecting the removable media device being coupled to the external device port of the digital device, at least a portion of redirection code to be generated on the digital device” e °400 patent, claim 9 “integrity level” A security aspect, separate from the e °975 patent, claims 1, 13 confidentiality level, that indicates reliability e °834 patent, claims 1, 15 SO ORDERED. December 10, 2021. i □□ Pata Mik] Lp /SABBARA M.G.LYNN QO {IEF JUDGE