Finjan, Inc. v. Blue Coat Sys., LLC
This text of 283 F. Supp. 3d 839 (Finjan, Inc. v. Blue Coat Sys., LLC) is published on Counsel Stack Legal Research, covering District Court, N.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.
Opinion
BETH LABSON FREEMAN, United States District Judge
Before the Court are the parties' respective motions for summary judgment. Plaintiff Finjan, Inc. ("Finjan") seeks summary judgment that Defendant Blue Coat Systems, Inc.'s ("Blue Coat") Internet security software products infringe one of its patents and that several of its patents are not invalid. Blue Coat seeks summary judgment that certain of its products do not infringe several of Finjan's patents. After careful consideration, Finjan's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART and Blue Coat's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART.
I. BACKGROUND
A. The Technology and the Asserted Patents
Finjan asserts ten patents against Blue Coat:
i. Content-Based Security
At a high level, content-based security identifies, isolates, and neutralizes actually or potentially malicious code in files downloaded from the Internet based on the detected behavior and characteristics of the code in those files, rather than scanning and maintaining a list of known viruses and actual malicious code signatures.
The '844 patent claims a system and methods of network protection where an inspector reviews a "Downloadable" for suspicious code or behavior according to a set of rules. '844 patent, col. 2 ll. 3-19. A *845"Downloadable" is "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 180 at 1. The inspector generates a profile characterizing the areas of suspicion and then attaches that profile to the Downloadable.
The '494 patent also relates to inspecting a "Downloadable" for suspicious behavior. '494 patent, Abstract. Its claims, however, are directed to a narrower aspect of this, which involve the solution of: (1) intercepting an incoming Downloadable; (2) scanning the Downloadable and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable;" and (3) storing the "security profile data" in a "database."
The '086 patent also concerns a discrete aspect of inspecting a "Downloadable" for suspicious behavior. '086 patent, Abstract. Similar to the '494 patent, its claims recite (1) receiving an incoming Downloadable and (2) scanning it and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable."
The '731 patent describes systems and methods of operating computer and network gateways that protect an intranet of computers. '731 patent, Abstract. The claimed inventions provide for caching of security information and policies at the gateway.
The '968 patent is directed to policy-based caching, and more specifically to the management of multiple caches. '968 patent, Abstract. Content from the Internet can be cached so that the same web page does not have to be retrieved each time a user on the network requests the page. See
Free access — add to your briefcase to read the full text and ask questions with AI
BETH LABSON FREEMAN, United States District Judge
Before the Court are the parties' respective motions for summary judgment. Plaintiff Finjan, Inc. ("Finjan") seeks summary judgment that Defendant Blue Coat Systems, Inc.'s ("Blue Coat") Internet security software products infringe one of its patents and that several of its patents are not invalid. Blue Coat seeks summary judgment that certain of its products do not infringe several of Finjan's patents. After careful consideration, Finjan's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART and Blue Coat's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART.
I. BACKGROUND
A. The Technology and the Asserted Patents
Finjan asserts ten patents against Blue Coat:
i. Content-Based Security
At a high level, content-based security identifies, isolates, and neutralizes actually or potentially malicious code in files downloaded from the Internet based on the detected behavior and characteristics of the code in those files, rather than scanning and maintaining a list of known viruses and actual malicious code signatures.
The '844 patent claims a system and methods of network protection where an inspector reviews a "Downloadable" for suspicious code or behavior according to a set of rules. '844 patent, col. 2 ll. 3-19. A *845"Downloadable" is "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 180 at 1. The inspector generates a profile characterizing the areas of suspicion and then attaches that profile to the Downloadable.
The '494 patent also relates to inspecting a "Downloadable" for suspicious behavior. '494 patent, Abstract. Its claims, however, are directed to a narrower aspect of this, which involve the solution of: (1) intercepting an incoming Downloadable; (2) scanning the Downloadable and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable;" and (3) storing the "security profile data" in a "database."
The '086 patent also concerns a discrete aspect of inspecting a "Downloadable" for suspicious behavior. '086 patent, Abstract. Similar to the '494 patent, its claims recite (1) receiving an incoming Downloadable and (2) scanning it and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable."
The '731 patent describes systems and methods of operating computer and network gateways that protect an intranet of computers. '731 patent, Abstract. The claimed inventions provide for caching of security information and policies at the gateway.
The '968 patent is directed to policy-based caching, and more specifically to the management of multiple caches. '968 patent, Abstract. Content from the Internet can be cached so that the same web page does not have to be retrieved each time a user on the network requests the page. See
The '786 patent provides systems and methods for protecting devices on an internal network from code, applications, and/or information downloaded from the Internet that performs malicious operations. '786 patent, Abstract. At a high level, the disclosed embodiments describe a protection engine that generally resides on a network server and inspects incoming downloads for executable code.
*846see also Blue Coat I , ECF 118 at 5. At the destination, the downloadable-information is executed, typically within a sandboxed environment, and malicious or potentially malicious operations that run or attempt to run are intercepted and neutralized by the MPC according to set protection policies.
The '621 and '755 patents relate to the use of operating system probes to monitor the behavior of a system during runtime. '621 patent, col. 21 ll. 33-53; '755 patent, col. 22 ll. 30-63. Certain detected information or operations can be compared against a security policy and, as appropriate, trigger responsive action.
The '408 patent is directed towards using a "parse tree" to scan content to detect malicious code, known as exploits. '408 patent, Abstract. A "parse tree" is "a hierarchical structure of interconnected nodes built from scanned content." ECF 180 at 2. When the system of the '408 patent receives an incoming stream of content to be scanned, it sequentially reads in tokens1 from the stream, organizes the tokens into a parse tree, and analyzes the tree to determine if it contains any patterns/structures that indicate the existence of an exploit. See generally '408 patent, col. 6 l. 14-col. 9 l. 58. To do this, it uses tokenizer, parser, and analyzer components which are specific to a particular "programming language" or "content language."
ii. Secure Sockets Layer ("SSL") Communication
SSL is a protocol that is used to send encrypted, secure communications between a client and a server. Id ., col. 1 ll. 10-12. In order to set up a secure SSL connection, the client and the server must first perform a series of initial exchanges, commonly referred to as the "SSL handshake." Ex. 5 to Blue Coat Mot. at BC2-0024371, ECF 225-5; Ex. 21 to Blue Coat Mot. at 16:11-19:15, ECF 226-24; Ex. 17 to Finjan Opp. at BC2-0778678, ECF 240-26. The handshake begins when the client sends a request to initiate an SSL connection, or a "client hello."
The '580 patent relates to methods and systems for efficiently providing an SSL connection between a client and server where one or several intermediate gateway computers lie in the transmission path. '580 patent, Abstract. Prior art solutions enabled SSL communication between a client and a server in these networks by maintaining an SSL connection at every step in the transmission chain:2
*847
The '580 patent purports to solve this problem by "splitting" the SSL connection between the client and the server, so that the client and the server can communicate using SSL without requiring an SSL connection throughout:
Setting up this split SSL connection works as follows: a client sends a request to initiate an SSL connection (i.e., a "client hello"), which gets received by the next computer in the chain, the first security computer.
The end result is a system that, in operation, works as follows: the client will encrypt information using the first security computer's public key (received from the "proxy signed certificate"). See
A final aspect of this system is that the first security computer maintains a cache of the server certificates it receives, so that the second security computer does not always have to send server certificates to the first security computer.
B. Accused Products
Finjan accuses Blue Coat's ProxySG, Content Analysis System ("CAS"), Advanced Secure Gateway ("ASG"), Web Security Service ("WSS"), SSL Visibility Appliance ("SSLV"), Malware Analysis Appliance ("MAA"), and WebPulse service of infringing various claims of the asserted patents. ProxySG is a proxy server that provides, among other things, web security through policy control. CAS is a content inspection appliance that ProxySG can use for additional analysis of files. ASG is a single appliance that combines the functionality of ProxySG and CAS. WSS is a product that combines the functionality of ProxySG and CAS as a web-hosted service.
SSLV is a stand-alone appliance that performs SSL inspection, decryption, and management. It can be deployed by itself in a network or in-line with other appliances, such as a ProxySG. Finjan accuses a configuration where SSLV is deployed in-line with ProxySG of infringing the '580 patent.
MAA is an appliance that provides a customizable sandboxing environment. It can integrate with CAS (which, in turn, can integrate with ProxySG) or ASG. Finjan accuses a combination of ProxySG, CAS, and MAA, as well as a combination of ASG and MAA, of infringing the '844, '731, '968, '494, '621, '755, and '786 patents. Blue Coat also offers MAA functionality as a cloud-based service, referred to as MAS, which can be used in conjunction with WSS. Finjan accuses a combination of WSS and MAS of infringing the '844, '731, '968, '086, '494, '621, and '755 patents.
WebPulse is a cloud-based infrastructure that categorizes web pages and runs background processes, some of which look for evidence of malware activity. It is provided as part of Blue Coat's Global Intelligence Network ("GIN"), which is an umbrella name for Blue Coat's suite of intelligence services. WebPulse contains a real-time content analyzer component called the Dynamic Real-Time Rating ("DRTR") service. WebPulse or "WebPulse/GIN," either alone or in combination with WSS, is accused of infringing all of the Asserted Patents except for the '580 patent.
*849As helpfully provided by the parties, the following chart illustrates the patents, asserted claims, and accused products and product combinations at issue:
Patent Asserted Claims Accused Products '844 1, 7.15 WebPulse/GIN, WSS with WebPulse/GIN, WSS with ALAS: ASG with MAA. SA with MAA '731 1, 2 ASG with MAN, WSS with WebPulse/GIN, WSS with MAS '968 1 ASG with MAA, WSS with WebPulse/GIN, WSS with MAS '986 24 WebPulse/GIN, WSS with WebPulse/GIN, WSS with MAS, SA with MAA '494 10, 14, 16 WebPulse/GIN, WSS with WebPulse/GIN, WSS with MAS: ASG with MAA, ProxySG and CAS with MAA; SA with MAA '621 1, 10 WebPulse/GIN, WSS with MAS; ProxySG and CAS with MAA, ASG with MAA '755 3 ProxySG and CAS with MAA, ASG with MAA '786 1 WebPulse/GIN, WSS with MAS, ProxySG and CAS with MAA, ASG with MAA '580 1 SSLVA with ProxySG '408 22 WebPulse, WSS with WebPulse
C. Procedural History
The parties in this dispute are neither unfamiliar with each other nor this Court. On August 28, 2013, Finjan initiated a first patent infringement action, Case No. 5:13-CV-03999-BLF ("Blue Coat I "), against Blue Coat, alleging that Blue Coat infringed the '844, '968, and '731 patents, as well as U.S. Patent Nos. 6,804,780 ("the '780 patent"), 7,058,822 ("the '822 patent"), and 7,647,633 ("the '633 patent"). The parties tried all six patents before a jury who, on August 4, 2015, found that Blue Coat infringed the '844, '968, '731, '633, and '780 patents and awarded Finjan a total of $39,528,487 in lump-sum damages. Blue Coat I , ECF 438 at 2-3, 6-7. The Court entered final judgment on July 18, 2016. Blue Coat I , ECF 556.
On July 7, 2015, five days before the beginning of trial in Blue Coat I , Finjan initiated the instant suit. ECF 1. The parties have amended their pleadings several times. ECF 39, 46, 47, 62, 63, 65, 155, 161, 171.
On July 28, 2016, ten days after the Court entered final judgment in Blue Coat I , Finjan moved for a preliminary injunction, seeking to enjoin Blue Coat's alleged infringement of the '494 patent through the DRTR component. ECF 71. The Court denied Finjan's motion. ECF 149. On September 16, 2016, Blue Coat moved for judgment on the pleadings that the '494 patent was invalid for failure to claim patent-eligible subject matter under
On January 31, 2017, the parties filed a joint stipulation notifying the Court that they had resolved all pending claim construction disputes and stipulating to certain agreed-upon constructions for six terms. ECF 175. The Court granted the parties' stipulation. ECF 178. The parties have since filed a further stipulation stating that they agree that certain additional terms should be given their plain and ordinary meaning. ECF 270.
The parties filed the instant motions for summary judgment on May 17, 2017. ECF 224, 228. The Court heard argument on June 22, 2017. ECF 273.
*850II. LEGAL STANDARDS
Federal Rule of Civil Procedure 56 governs motions for summary judgment. Summary judgment is appropriate if the evidence and all reasonable inferences in the light most favorable to the nonmoving party "show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Celotex Corp. v. Catrett ,
The moving party "bears the burden of showing there is no material factual dispute," Hill v. R+L Carriers, Inc. ,
Where the moving party will have the burden of proof on an issue at trial, it must affirmatively demonstrate that no reasonable trier of fact could find other than for the moving party. Celotex , 477 U.S. at 325,
III. FINJAN'S MOTION
Finjan seeks summary judgment that WebPulse/GIN and certain combinations of gateway products-(1) ProxySG and CAS with MAA and (2) ASG with MAA-infringe claim 10 of the '494 patent. Finjan also seeks summary judgment that its patents are not invalid3 because:
*851(1) Blue Coat did not challenge the validity of the '731 and '580 patents in its expert reports; (2) Blue Coat is estopped under
A. The '494 Patent
Finjan accuses WebPulse/GIN, ProxySG and CAS with MAA, and ASG with MAA of infringing claim 10 of the '494 patent. Claim 10 recites:
10. A system for managing Downloadables, comprising:
a receiver for receiving an incoming Downloadable;
a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and
a database manager coupled with said Downloadable scanner, for storing the Downloadable security profile data in a database.
'494 patent, col. 22 ll. 7-17. A "Downloadable" is "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 180 at 1. A "database" is "a collection of interrelated data organized according to a database schema to serve one or more applications."
i. WebPulse/GIN
Finjan seeks summary judgment that "WebPulse/GIN"4 infringes claim 10. The parties only substantially dispute whether WebPulse/GIN satisfies the final two limitations of claim 10.5 According to Finjan, WebPulse/GIN has "a Downloadable scanner ... for deriving security profile data ..." because DRTR scans and profiles content, [Redacted] Finjan Mot. 7-8. Finjan argues the "database manager ... for storing the Downloadable security profile data in a database" limitation is satisfied by either of two components: [Redacted] Finjan Mot. 8-9; see also Ex. 26 to Finjan Mot. (Cole Rpt.) ¶¶ 1464-70, ECF 227-6. Under Finjan's infringement theory, [Redacted *852]
Blue Coat, on the other hand, disagrees that some of the alleged "security profile data," [Redacted] "includ[es] a list of suspicious computer operations." Blue Coat Opp. 3-5. Blue Coat also argues there are at least disputed issues of fact as to whether the alleged [Redacted] are "databases."
The Court agrees that summary judgment is inappropriate, at least for the reason that disputed questions of fact remain as to whether the "database manager ..." limitation is satisfied by either [Redacted] the Court notes, as an initial matter, that the parties appear to disagree as to the scope of "database:" Finjan argues that "database" encompasses key-value pairings [Redacted] whereas Blue Coat argues it does not. Compare Finjan Mot. 8-9, Finjan Reply 4-5, with Blue Coat Opp. 6-7. On this point, the Court agrees with Finjan that key-value pairing can be a "database" within the context of the '494 patent. The parties stipulated that "database" should be construed as "a collection of interrelated data organized according to a database schema." ECF 180 at 1. Key-value pairings are a way of organizing interrelated data-keys to their related values. To the extent that "schema" implies a greater level of organization and/or relation between data than this, the Court finds it inappropriate to restrict the scope of "database" in this way. The plain language of claim 10 simply recites "database," and nothing in the specification suggests that "database" should be restricted to any certain degree of data organization. See Phillips v. AWH Corp. ,
Nevertheless, [Redacted] disputed questions of fact remain as to whether it satisfies the remainder of the limitation. Claim 10 requires that the "database" store "security profile data," which must include a "list of suspicious computer operations." The parties disagree as to whether [Redacted] See Ex. 30 to Finjan Mot. at BC2-1884319, ECF 227-14. On one hand, Blue Coat's engineer testified that [Redacted]
[Redacted]
Ex. 3 to Finjan Reply at 66:8-22, ECF 249-10. However, construing this evidence in the light most favorable to Blue Coat, this excerpt only suggests that [Redacted] Further, the parties' experts appear to disagree as to whether the source code confirms that [Redacted] Compare Ex. 26 to Finjan Mot. (Cole Rpt.) ¶¶ 1276, 1465-66, ECF 227-6 [Redacted] with Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 318, ECF 227-8 [Redacted] Thus, based on the evidence before it, the Court cannot rule out that there are no material factual disputes as to whether [Redacted] is an infringing "database." As such, summary judgment of infringement is inappropriate.
*853[Redacted] the parties do not dispute that this constitutes a "database." Compare Finjan Mot. 9, Finan Reply 4, with Blue Coat Opp. 7. The parties also do not substantially disagree as to what [Redacted] Compare Finjan Mot. 9-10, with Blue Coat Opp. 7-8; see also Ex. 26 to Finjan Mot. (Cole Rpt.) ¶ 1469, ECF 227-6; Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 319, ECF 227-8. Instead, the parties dispute whether PDF Labels and YARA rule hits constitute "security profile data ... including a list of suspicious operations." Both of these issues are factual questions for the jury. For example, with respect to PDF Labels, Blue Coat's own expert acknowledges that at least some of the labels that can be assigned to PDFs indicate the existence of certain operations within the PDF. See, e.g Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 141, ECF 227-8 [Redacted] However, whether these are suspicious operations, whether PDF Labels are sufficiently comprehensive to amount to a "security profile data ... including a list of suspicious operations," and other open factual questions remain. Similarly, with respect to YARA rule hits, [Redacted] See, e.g. , Ex. 31 to Finjan Mot. at BC2-1884474, ECF 227-16. However, whether these are suspicious operations, whether YARA rules are sufficiently comprehensive to amount to a "security profile data ... including a list of suspicious operations," and/or [Redacted] amounts to a "security profile data ... including a list of suspicious operations," and other open factual questions remain. Accordingly, material disputes as to whether [Redacted] is an infringing "database." As such, summary judgment of infringement is inappropriate.
In sum, material questions of fact remain at least as to whether the WebPulse/GIN infringes the "database manager ..." limitation of claim 10. Finjan's motion for summary judgment is DENIED.
ii. Gateway Products
Finjan also seeks summary judgment that "the accused combinations of gateway products-(1) ProxySG and CAS with MAA and (2) ASG with MAA-infringe claim 10. The parties only substantially dispute whether the accused combinations satisfy the final limitation of claim 10.6 Finjan argues that this limitation is satisfied by any one of three components: [Redacted] Finjan Mot. 11-14.
Blue Coat responds that there is at least a material factual dispute as to whether any of these components are infringing "databases." Specifically, [Redacted] Blue Coat argues that it does not "stor[e] ... security profile data" which "includ[es] a list of suspicious operations" [Redacted] Blue Coat Opp. 8-10. With respect to the [Redacted] Blue Coat argues that it also does not "stor[e] ... security profile data" [Redacted] Id. at 10-11. With respect to [Redacted] Blue Coat argues that this cannot be a "database" that is part of a "system for managing Downloadables" because it is instead only used [Redacted] Id. at 11-13. Blue Coat points out that this is underscored by the fact that [Redacted] which is an unacceptable substitute for the required "security profile data." Id. at 12.
The Court addresses each of Blue Coat's challenges in turn. Turning to [Redacted] the Court agrees with Blue Coat that there are at least disputed questions of material fact as to whether this comprises *854a "database" that "stor[es] ... security profile data." By the plain language of claim 10, "security profile data" must "includ[e] a list of suspicious operations." Reading this limitation in light of the specification makes it clear that the "security profile data" must include (in addition to, for example, other types of metadata) a selective list of suspicious operations, not an indiscriminate list of all operations. See, e.g. , '194 patent at col. 9 ll. 34-37 (describing how "if the code scanner ... determines that the resolved command is suspect, then the code scanner ... decodes and registers the suspicious command and its command parameters as DSP data"). Indeed, Finjan has itself taken a similar position before the PTAB. See Ex. 4 to Blue Coat Opp. at 16, ECF 237-4 ("Simply listing every operation, regardless of whether it is suspicious, does not create a list of suspicious computer operations without the additional step of deeming certain operations as suspicious."). Whether [Redacted] meets this bar is at least a disputed question of fact. On one hand, Mr. Runald, a Blue Coat employee, [Redacted] Ex. 4 to Finjan Reply at 201:19-202:9, ECF 249-12. On the other hand [Redacted] are not themselves "suspicious operations." For example, [Redacted] See Ex. 8 to Blue Coat Opp. at 56:1-5, 197:1-4, ECF 238-11; Ex. 6 to Blue Coat Opp. at BC2-0070332, ECF 237-6; Ex. 7 to Blue Coat Opp. at BC2-0426163, ECF 238-10. Thus, the Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
Turning to [Redacted] the Court also finds that there are material questions of fact as to whether this is a "database" which "stor[es] ... security profile data" within the meaning of claim 10. For example, [Redacted] Ex. 45 to Finjan Mot. at BC2-1895322, ECF 227-34. However, pattern data used for matching is not the same as matches of suspicious operations that have been located for a particular file. Further, [Redacted] See, e.g. , Ex. 8 to Blue Coat Opp. at 210:16-22, ECF 238-11 [Redacted] Ex. 9 to Blue Coat Opp. at 29:3-11, ECF 238-12 [Redacted] Thus, there are at least disputed questions of fact as to whether [Redacted] "stor[es] ... security profile data" which includes a "list of suspicious operations," not all operations. Accordingly, the Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
Turning to the [Redacted] the Court also finds that there are material questions of fact as to whether this comprises a "database" that "stor[es] ... security profile data." For example, [Redacted] Ex. 48 to Finjan Mot. at 90:8-18, ECF 227-36; see also Ex. 6 to Finjan Reply at 253:15-17. However, there is conflicting evidence as to whether these patterns amount to a "list of suspicious operations." See, e.g. , Ex. 5 to Finjan Reply at 48:20-25, ECF 249-16 [Redacted] Accordingly, this is a factual dispute that must be left for the jury. The Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
In sum, material questions of fact remain at least as to whether the accused combinations of gateway products infringe the "database manager ..." limitation of claim 10. Finjan's motion for summary judgment is DENIED.
B. Validity
i. '731 and '580 Patents : Lack of Expert Opinion
Finjan moves for summary judgment that the '731 and '580 patents are not invalid because Blue Coat has not disclosed any expert opinion on their validity. Finjan Mot. 16-17. Blue Coat responds that a finding of invalidity need not be supported by expert testimony, and points out that it has at least provided invalidity contentions and prior art reference elections *855for these patents. Blue Coat Opp. 21-22.
Blue Coat's arguments are unconvincing. This is not a case where the "references and [Blue Coat's] invention[s] are easily understandable without the need for expert explanatory testimony." Union Carbide Corp. v. Am. Can Co. ,
ii. '494 and '408 Patents : IPR Estoppel
Finjan seeks summary judgment that the '494 and '408 patents are not invalid on the basis that Blue Coat is estopped from asserting invalidity under
Patent Grounds in Petition Instituted Final Written Decision (IPR) Grounds '494 patent Swimmer (§§ 102, § 103) Swimmer Swimmer (§ 103): some (IPR2015-1892) Cline in view of Ji '600 (§ 103) (§ 103) claims unpatentable, Forrest in view of Ji '600 (§ 103) other claims not unpatentable '494 patent Touboul (§§ 102. § 103) Swimmer Swimmer (§ 103): some (IPR2016-00159) Touboul in view of Swimmer (§ 103) (§ 103) claims unpatentable; Touboul in view of Ji '600 (§ 103) Swimmer other claims not Swimmer (§ 103) and unpatentable Swimmer in view of Martin (§ 103) Martin Swimmer and Martin (§ (§ 103) 103): no claims unpatentable '408 patent Chandnani and Kolawa (§ 103) All All grounds: no claims (IPR2015-2001) Chandnani, Kolawa, and Walls (§ 103) grounds unpatentable Chandnani, Kolawa, and Huang (§ 103) (IPR2016-00157) Chandnani, Kolawa, Walls, and Huang (§ 103)
Here, Blue Coat challenges claims 10, 14, and 16 of the '494 patent as obvious over Griffin, Ji '348, and Nachenberg. Ex. 12 to Blue Coat Opp. at 126, ECF 237-12. Blue Coat challenges claim 22 of the '408 patent as obvious over (1) Kolawa and Necula '774 and (2 Kolawa, Li, and Chandnani.
Finjan argues that, because Blue Coat was a party (through joinder) to the above-listed IPRs, § 315(e)(2) precludes it from asserting prior art that it raised or reasonably could have raised during these proceedings. Finjan argues that all of the references currently asserted by Blue Coat fall within this because they are "patents *856or printed publications"-types of prior art which can be raised in IPR petitions. Finjan Mot. 19. In addition, Finjan argues that Blue Coat could have reasonably known about and raised the Griffin, Ji '348, and Nachenberg references for the '494 patent because they are listed on the face of the '494 patent.
Blue Coat does not dispute that it was a party to the above-listed IPRs, but nevertheless argues that it is not bound by § 315(e)(2) estoppel because, under the Federal Circuit's decision in Shaw Indus. Grp., Inc. v. Automated Creel Sys., Inc. ,
Under § 315(e)(2), "[t]he petitioner in an [IPR] ... that results in a final written decision ... or the real party in interest or privy of the petitioner, may not assert ... in a civil action ... that [a] claim is invalid on any ground that the petitioner raised or reasonably could have raised during" IPR.
Since Shaw , a number of district courts-including at least one in this District-have interpreted § 315(e)(2) estoppel as applying only to grounds that were both raised in the IPR petition and instituted in the IPR proceeding. See, e.g. , Verinata Health, Inc. v. Ariosa Diagnostics, Inc , No. 12-CV-05501-SI,
The Court adopts the approach of its sister court in this District and follows the broader interpretation of Shaw : § 315(e)(2) estoppel applies only to grounds that were both raised in the IPR petition and instituted in the IPR proceeding. Applied to the facts here, Blue Coat is not estopped under § 315(e)(2) from pursuing any of the invalidity combinations that it currently asserts against the '494 and '408 patents. None of the IPRs were *857instituted on these precise combinations. Accordingly, Finjan's motion is DENIED.
iii. '844, '968, and '731 Patents : Collateral Estoppel
Finjan argues that collateral estoppel bars Blue Coat from challenging the validity of the '844, '968, and '731 patents because it challenged the validity of these patents in Blue Coat I and lost. Finjan Mot. 21-22. Finjan argues that all of the elements of collateral estoppel are met here: the issue-validity-is identical, Blue Coat I ended in a final judgment on the merits, and Blue Coat was a party in the first proceeding.
Blue Coat responds that, under the Federal Circuit's decision in Nasalok Coating Corp. v. Nylok Corp. ,
Blue Coat's rebuttal is unconvincing. Collateral estoppel and res judicata are separate concepts. See Roche Palo Alto LLC v. Apotex, Inc. ,
Collateral estoppel bars re-litigation of issues adjudicated in an earlier proceeding if: (1) the issue necessarily decided at the previous proceeding is identical to the one which is sought to be re-litigated; (2) the first proceeding ended with a final judgment on the merits; and (3) the party against whom collateral estoppel is asserted was a party or in privity with a party at the first proceeding. See Reyn's Pasta Bella, LLC v. Visa USA, Inc. ,
In the context of patent validity, the Federal Circuit has not definitively addressed what constitutes an "issue" for the purposes of collateral estoppel. Rudolph Techs., Inc. , No. 15-CV-1246,
The Court is persuaded by the reasoning of the latter cases and adopts this majority view. Accordingly, because the ultimate issue of the validity of the '844, '968, and '731 patents was litigated in Blue Coat I , Blue Coat is estopped from re-litigating it here. Finjan's motion for summary judgment that the '844, '968, and '731 patents are not invalid is GRANTED.
iv. '844, '968, '731, and '086 Patents : Estoppel Due to Denied IPR Petitions
Finjan argues that Blue Coat should be estopped from challenging the validity of the '844, '968, '731, and '086 patents because it filed IPR petitions for these patents and the PTAB denied institution under a lower evidentiary standard. Finjan Mot. 22. Blue Coat responds that Finjan is wrong as a matter of law, and that none of the institution decisions even have persuasive effect because the prior art combinations asserted here are different. Blue Coat Opp. 17-18.
The Court agrees with Blue Coat. Finjan cites no authority for the proposition that denying institution creates estoppel, and the Court is aware of none. Further, because the asserted combinations differ, the PTAB's decisions have little relevance to the validity issues before the Court. Accordingly, Finjan's motion is DENIED.
v. '494 Patent : Invalidity Theories Relying on Nachenberg Reference
Finjan seeks summary judgment that the '494 patent is not invalid over any theory relying on the Nachenberg reference because Blue Coat cannot prove that it is a printed publication that was publicly available before the priority date of the '494 patent. Finjan Mot. 21-22. Blue Coat does not substantively rebut Finjan's arguments, but instead offers to drop the Nachenberg reference from the combination of Griffin, Ji '348, and Nachenberg that it has asserted against the '494 patent. Blue Coat Opp. 20-21. In reply, Finjan objects that Blue Coat's proposal is in direct contravention of the Court's scheduling order, which states that "references for a single obviousness theory shall not be changed or revised for subsequent election of asserted prior art" and that "obviousness combination A, B, C, and D" "may not be changed or revised to the combination A, B, and C." ECF 41 n.3.
The Court agrees with Finjan that, pursuant to its scheduling order, Blue Coat cannot now revise its invalidity theory of obviousness over Griffin, Ji '348, and Nachenberg to obviousness over Griffin and Ji '348. Further, because Blue Coat provides no rebuttal for Finjan's arguments *859that Nachenberg is not a printed publication, the Court adopts Finjan's view. As such, any obviousness combination that includes the Nachenberg reference-including Blue Coat's proposed combination of Griffin and Ji '348-is not a valid obviousness combination and Blue Coat may not seek to invalidate the '494 patent on those grounds. Finjan's motion for summary judgment that the '494 patent is not invalid over any theory relying on the Nachenberg reference is GRANTED.
vi. '086 Patent : Priority Date
Finjan argues that summary judgment that the '086 is not invalid should be granted for any theory relying on Ji '348 because Ji '348 is not prior art to the '086 patent. Finjan Mot. 24-25. On November 28, 2016, the PTO issued a reexamination certificate for the '086 patent, which newly reflected that the '086 patent could claim the benefit of a priority date to U.S. Provisional Application No. 60/030,639 ("the '639 provisional application"), filed on November 8, 1996. Finjan argues that, in light of the reexamination certificate, Ji '348 is not prior art to the '086 patent, as Ji '348 claims a priority date of September 10, 1997. Finjan also points out that the PTAB found the reexamination certificate persuasive in IPR2016-01444, as it determined that, in light of this reexamination certificate, Blue Coat had not shown a reasonable likelihood of prevailing in establishing that the priority date of the '086 patent was no earlier than November 6, 1997. Id .; Ex. 25 to Finjan Mot. at 3, 6-9, ECF 229-25.
Blue Coat responds that summary judgment is inappropriate, as there are disputed questions of fact as to whether the '639 provisional application discloses claim 24's "transmitter" element. Blue Coat Opp. 18. In reply, Finjan argues that this is unpersuasive, as the PTAB found that there was support for the elements of claim 24 in its decision. Finjan Reply 14.
Both parties' arguments on this issue are unconvincing: Finjan effectively argues that the Court should award an earlier priority date to the '086 patent because the PTAB did so, while Blue Coat baldly asserts lack of written description support without offering any supporting argument or evidence. However, because Finjan, as the moving party, bears the initial burden, its shortcomings govern. Finjan has not met its burden of showing that it is entitled to summary judgment that the '086 is not invalid under invalidity theories relying on Ji '348. Accordingly, Finjan's motion is DENIED.
vii. Summary
In summary, for one or several reasons discussed above, Finjan's motion for summary judgment of no invalidity is GRANTED with respect to the '731, '580, '844, '968, and '494 (for theories relying on Nachenberg) patents. Finjan's motion for summary judgment of no invalidity is DENIED with respect to the '408, '086, and '494 (for all other theories) patents.
IV. BLUE COAT'S MOTION
Blue Coat seeks summary judgment that: (1) SSLV with ProxySG does not infringe claim 1 of the '580 patent ; (2) WebPulse, alone or in combination with WSS, does not infringe claim 22 of the '408 patent ; (3) WebPulse/GIN, WSS with MAS, ProxySG and CAS with MAA, and ASG with MAA do not infringe claim 1 of the '786 patent ; and (4) "WebPulse/GIN sandboxing" does not infringe any of the Asserted Patents. Finjan opposes summary judgment on all of these grounds. The Court addresses each issue in turn.
A. The '580 Patent
Finjan accuses SSLV, in conjunction with ProxySG, of infringing claim 1 of the '580 patent. Claim 1 recites:
*8601. A system for secure communication, comprising:
a first security computer comprising:
a certificate creator, (i) for receiving attributes of a server computer's signed certificate within a reply message generated by a second security computer and communicated to the first security computer, the signed certificate being used to authenticate the server computer, and (ii) for creating a proxy signed certificate from the received attributes;
a certificate cache for storing and retrieving the attributes of the server computer's signed certificate; and
a first SSL connector, for connecting to a client computer and for performing a first SSL handshake with the client computer using the proxy signed certificate created by said certificate creator; and
a second security computer communicatively coupled with said first security computer via a non-SSL connection for receiving a connection request message therefrom, the connection request message including cached attributes of the signed certificate, comprising:
a second SSL connector, for connecting to the server computer, for receiving current attributes of the signed certificate from the server computer, for performing a second SSL handshake with the server computer using the signed certificate, and for generating the reply message communicated to said first security computer in response to the connection request message;
a certificate comparator for comparing the cached attributes of the signed certificate with the current attributes of the signed certificate; and
a protocol appender, for appending the current attributes of the signed certificate within the reply message communicated to said first security computer, when said certificate comparator determines that the cached attributes of the signed certificate do not match the current attributes of the signed certificate.
'580 patent, col. 7 l. 46-col. 8 l. 20 (emphasis added). According to Finjan, SSLV is the "first security computer" and ProxySG is the "second security computer." Finjan Opp. 6.
Blue Coat argues that the combination of SSLV and ProxySG does not infringe claim 1 for several reasons: (1) SSLV and ProxySG do not "communicate" to each other; (2) SSLV and ProxySG do not communicate a "reply message" or a "connection request message including cached attributes of the signed server certificate" to each other and do not have a "certificate comparator;" (3) SSLV and ProxySG do not share a "non-SSL connection;" and (4) SSLV does not perform an "SSL handshake with the client computer." Blue Coat Mot. at 5-14. The Court finds that summary judgment is appropriate for at least two of these reasons, which it discusses in detail below.
i. SSLV and ProxySG do not share the claimed "non-SSL connection"
One critical aspect of the system recited in claim 1 is that the "first security computer" and "second security computer" share a "non-SSL connection." This distinguishes the invention of claim 1 from prior art systems, which required an SSL connection throughout. See '580 patent at col. 1 ll. 35-37, 49-53.
Blue Coat argues that the accused combination of SSLV and ProxySG does not meet this limitation because, instead, SSLV and ProxySG-the accused "first security computer" and "second security computer," respectively-communicate using *861an SSL connection. Blue Coat Mot. 11-13. Blue Coat argues this is the case because SSLV and ProxySG must each independently decrypt and re-encrypt the SSL traffic that pass through them.
Finjan responds that SSLV and ProxySG do share a non-SSL connection because, in its view, "the SSLV sends intercepted plaintext (i.e., unencrypted) to the ProxySG, resulting in a non-SSL connection." Finjan Opp. 11. As support, Finjan cites to its expert Dr. Cole's report and deposition testimony, where he opines that a non-SSL connection exists between SSLV and ProxySG because SSLV sends an unencrypted connection request message to the ProxySG. Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 1796, ECF 240-6 ("the SSLV create a non-SSL connection between them to transfer information including a connection request message using the ProxySG as the second security computer"); Ex. 10 to Finjan Opp. at 240:12-241:7, ECF 240-16. Finjan also cites to several excerpts from Blue Coat's documentation which describe how, after SSLV has decrypted intercepted traffic, it can pass that decrypted intercepted traffic to other attached security appliances. Ex. 15 to Finjan Opp. at BC-0024354, ECF 241-16 ("sending non-SSL flows to the attached security appliances"); Ex. 9 to Finjan Opp. at BC2-0025898, ECF 241-10 ("Intercepted plaintext is delivered to attached devices as a valid regenerated TCP stream via the SSL Visibility's network ports.").
There is no genuine dispute that SSLV and ProxySG do not share a "non-SSL connection." Instead, all of the evidence cited by the parties agrees that, when SSLV and ProxySG are deployed in combination, they share an SSL connection. The "Blue Coat Systems V2800 and SV3800 Administration and Deployment Guide" relied on by Finjan explains how, when SSLV is deployed in a cooperative configuration with a "proxy device" (such as a ProxySG) to inspect outgoing traffic, each use certificate re-sign to gain access to the encrypted traffic. Ex. 9 to Finjan Opp. at BC2-0025920, ECF 241-10 ("The existing proxy re-signs the original server certificate and then the SSL Visibility re-signs the modified server certificate it receives."); see also Ex. 1 to Finjan Opp. at BC2-0024727, ECF 241-2 ("The existing proxy re-signs the original server certificate and then the SSL Visibility re-signs the modified server certificate it receives."). This means that SSLV and the proxy device perform an SSL handshake: as part of the certificate resigning technique, the proxy, after it receives a certificate from the server, will re-sign the server's certificate and replace the server's public key with its own public key and send that to the SSLV. See
*862connection. The testimony of Blue Coat's employee David Wells also confirms that, when SSLV and ProxySG are deployed in combination, traffic is decrypted and re-encrypted at every step. Ex. 24 to Blue Coat Mot. at 90:12-22, ECF 226-26. This also suggests that SSLV and ProxySG share an SSL connection.
None of the evidence cited by Finjan contradicts this. First, the only evidence of a "non-SSL connection" that Dr. Cole cites is the "connection request message" that SSLV sends to ProxySG. Ex. 3 to Finjan Opp. at ¶ 1796, ECF 240-6; Ex. 10 to Finjan Opp. at 240:12-241:7, ECF 240-16. However, as Dr. Cole admitted, this is simply an initial message that is sent "before the session between the client and the server." Ex. 21 to Blue Coat Mot. at 75:3-9, ECF 226-24. All SSL connections begin with an unencrypted initial message (e.g., the "client hello" in the SSL handshake, see Ex. 21 to Blue Coat Mot. at 16:11-19:15, ECF 226-24), so this initial "connection request message" gives no indication that SSLV and ProxySG do not share an SSL connection. Second, the excerpts that Finjan cites from Blue Coat's documentation (Ex. 15 to Finjan Opp. at BC-0024354, ECF 241-16 and Ex. 9 to Finjan Opp. at BC2-0025898, ECF 241-10) refer to the unencrypted traffic that SSLV can pass to attached security devices, which are separate from the ProxySG in the SSLV/ProxySG combination that Finjan accuses. Thus, these excerpts are irrelevant. Accordingly, Finjan has failed to raise a genuine dispute that SSLV and ProxySG share a "non-SSL connection." Summary judgment of noninfringement is appropriate for at least this reason.
ii. SSLV and ProxySG do not communicate a "connection request message including cached attributes of the signed server certificate"
Another critical aspect of the system recited in claim 1 is that the "first security computer" maintains a cache of server certificates, which improves overall performance by saving the second security computer from always having to send the full server certificate to the first security computer. '580 patent, col. 5 ll. 14-16. To enable this, claim 1 requires that when a client sends a request to initiate an SSL connection with a server, the first security computer sends a "connection request message including cached attributes of the signed server certificate ."
Blue Coat argues that the accused combination of SSLV and ProxySG do not meet the "connection request message including cached attributes of the signed server certificate" limitation because SSLV, as a transparent proxy, does not itself send a connection request. Blue Coat Mot. 10. Instead, according to Blue Coat, the client sends a connection request message and it invisibly passes through SSLV.
Finjan responds that SSLV does indeed send a "connection request message" to ProxySG because "otherwise the products could not operate together" and "the connection request would never be forwarded to the web server." Finjan Opp. 9-10. It does not, however, cite any supporting evidence for these arguments. Finjan also argues that the "connection request message"
*863sent from SSLV includes "cached attributes of the signed server certificate," "such as the expiration date of the certificate." Id. at 10-11. As support, Finjan cites to Dr. Cole's report, which states, in addressing the "connection request" element, that "the SSLV create [sic] a non-SSL connection between them to transfer information including a connection request message using the ProxySG as the second security computer." Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 1796, ECF 240-6. Finjan also cites to portions of Dr. Cole's deposition, where he testified on redirect:
Q Can you explain-I believe you were cut off earlier. Can you please provide your full explanation of why this contains the cache attributes in the connection request message.
* * *
A So element 1f, the connection request message has to include cached attributes of the signed certificate, and that's exactly what's happening here. There's a non-SSL connection between the SSLV and the ProxySG and transferring information, including a connection request message, which includes the cached attributes of the signed certificate. So that fully satisfies that element of claim 1f.
Q And what is the signed certificate? Is that the certificate that is enabling the SSL connection?
A Yes, that's the signed certificate and other relevant information from the SSL server that's needed to communicate from the ProxySG to the SSLV.
Ex. 10 to Finjan Opp. at 240:2-241:14, ECF 240-16. Finjan further cites7 to excerpts that relate to the "connection request" element in varying degrees, including: portions of Dr. Cole's report that address the "certificate comparator" and "cached attributes" elements, Ex. 3 to Finjan Opp. (Cole Rpt.) ¶¶ 1843-45, ECF 240-6; excerpts that discuss the SSLV's ability to import certificates, Ex. 2 to Finjan Opp. at BC2-0024427, ECF 241-3, Ex. 3 to Finjan Opp. (Cole Rpt.) ¶¶ 1725-1726, ECF 240-6; testimony discussing the SSLV's ability to send decrypted information to attached security devices, Ex. 14 to Finjan Opp. at 112:1-14, ECF 240-24; and testimony about the handshake request passing through the SSLV, Ex. 12 to Finjan Opp. at 86:2-22, ECF 240-20.
As an initial matter, the Court finds that a genuine dispute exists as to whether SSLV communicates a "connection request message" to ProxySG. Several pieces of evidence describe how SSLV forwards a request sent from the client to initiate an SSL session (i.e., the "client hello" in the SSL handshake). See, e.g. , Ex. 12 to Finjan Opp. at 86:2-22, ECF 240-20 (testimony from David Wells agreeing that "the handshake request will go through the SSL Visibility Appliance to the SSL server"); Ex. 24 to Blue Coat Mot. at 35:18-36:1, ECF 226-26 (testimony from David Wells discussing how the client hello message passes through the SSLV to the server). Blue Coat also does not appear to dispute that SSLV forwards this request. See Blue Coat Mot. 10. This at least raises a material question of fact as to whether SSLV communicates a "connection request message" to the ProxySG.
However, there is no genuine dispute that, even if SSLV communicates a "connection request message," it does not "includ[e] cached attributes of the signed server certificate." Even construing all of the evidence in favor of Finjan, there is *864simply no evidence of this claim element. Indeed, David Wells explicitly testified to the contrary:
An important point with the Visibility Appliance is that the handshake message from the client to the server that initiates the handshake, the client hello message, is passed through without being modified , and that means that the server will see exactly what it would have seen if the Visibility Appliance wasn't present, and it will choose its responses to that handshake in the same way it would have done if the Visibility Appliance wasn't present either.
Ex. 24 to Blue Coat Mot. at 35:18-36:1, ECF 226-26 (emphasis added). Other evidence submitted by the parties also confirms that, when SSLV forwards a request from the client to initiate an SSL session to the ProxySG (i.e., a "client hello"), it does not "includ[e] cached attributes of the signed server certificate" in this request. See, e.g. , Ex. 9 to Finjan Opp. at BC2-0025916-21, ECF 241-10; Ex. 15 to Finjan Opp., ECF 241-16; Ex. 16 to Finjan Opp., ECF 241-17.
None of the evidence cited by Finjan raises a genuine material dispute on this point. Neither of the excerpts from Dr. Cole's report or deposition testimony which address the "connection request ..." element (Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 1796, ECF 240-6 and Ex. 10 to Finjan Opp. at 240:2-241:14, ECF 240-16) point to any evidence of a "connection request message" (let alone one that "includ[es] cached attributes of the signed server certificate"). Instead, Dr. Cole just makes the bare assertion that this element exists. Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 1796, ECF 240-6; Ex. 10 to Finjan Opp. at 240:2-241:14, ECF 240-16. This is insufficient as a matter of law. Expert opinions are not evidence; thus, an expert's unsupported assertion that an accused product contains a claim element is not sufficient to raise a material dispute. See Rohm and Haas Co. v. Brotech Corp. ,
The remaining excerpts cited by Finjan also do not raise any material question of fact that SSLV sends "cached attributes of the signed server certificate." Dr. Cole's report at ¶¶ 1843-45 relates to caching and comparing certificate attributes at the ProxySG (the alleged "second security computer") and does not address the contents of any "connection request message" that is sent from SSLV to ProxySG. The excerpt at Ex. 2 to Finjan Opp. at BC2-0024427, ECF 241-3 and Dr. Cole's report at Ex. 3 to Finjan Opp. (Cole Rpt.) ¶¶ 1725-1726, ECF 240-6 discuss SSLV's ability to import certificates, which is an initial configuration setting which allows SSLV to decrypt traffic coming from the ProxySG and does not relate to any "connection request message" that is sent from SSLV to ProxySG. The testimony at Ex. 14 to Finjan Opp. at 112:1-14, ECF 240-24 discusses how SSLV sends decrypted information to attached security devices. This is unrelated to communications between SSLV and ProxySG. Finally, the testimony from David Wells at Ex. 12 to Finjan Opp. at 86:2-22, ECF 240-20 actually agrees that "the handshake request [from the client] will just go directly through the SSL Visibility Appliance to the SSL server," which, if anything, supports an inference that, when SSLV forwards a request sent from the client to initiate an SSL session, the request is unmodified and does not include "cached attributes of the signed server certificate." Thus, none of the evidence cited by Finjan raises a material dispute that the SSLV does not communicate a "connection request *865message including cached attributes of the signed server certificate." Summary judgment of noninfringement is appropriate for at least this reason.
iii. Conclusion
For at least the two independent reasons discussed above, the Court finds that Blue Coat is entitled to summary judgment. The Court need not reach the remaining reasons supplied by Blue Coat and declines to do so. Blue Coat's motion for summary judgment of noninfringement for claim 1 of the '580 patent is GRANTED.
B. The '408 Patent
Finjan accuses the DRTR component of WebPulse, alone or in combination with WSS, of infringing claim 22 of the '408 patent. Claim 22 recites:
22. A non-transitory computer-readable storage medium storing program code for causing a computer to perform the steps of:
receiving an incoming stream of program code;
determining any specific one of a plurality of programming languages in which the incoming stream is written;
instantiating a scanner for the specific programming language, in response to said determining, the scanner comprising parser rules and analyzer rules for the specific programming language, wherein the parser rules define certain patterns in terms of tokens, tokens being lexical constructs for the specific programming language, and wherein the analyzer rules identify certain combinations of tokens and patterns as being indicators of corresponding exploits, exploits being portions of program code that are malicious;
identifying individual tokens within the incoming stream ;
dynamically building, while said receiving receives the incoming stream , a parse tree whose nodes represent tokens and patterns in accordance with the parser rules;
dynamically detecting, while said dynamically building builds the parse tree, combinations of nodes in the parse tree which are indicator or potential exploits, based on the analyzer rules; and
indicating the presence of potential exploits within the incoming stream , based on said dynamically detecting.
'480 patent, col. 21 ll. 22-67 (emphasis added).
Blue Coat argues that DRTR does not infringe claim 22 for three reasons: (1) DRTR does not "determin[e] any specific one of a plurality of programming languages;" (2) DRTR does not "instantiat[e] a scanner ... in response;" and (3) DRTR does not analyze an "incoming stream" of program code. Blue Coat Mot. 14-18. The Court finds that none of these reasons warrant summary judgment. It discusses each below.
i. Disputed questions of fact remain as to whether DRTR "determin[es] any specific one of a plurality of programming languages"
Claim 22 requires "determining any specific one of a plurality of programming languages." The parties do not colorably disagree as to how the portions of DRTR relevant to this limitation operate: [Redacted] Blue Coat Mot. 16; Finjan Opp. 14; see Ex. 29 to Blue Coat Mot. at ll. 175-190, ECF 226-36; Ex. 11 to Blue Coat Mot. at 120:5-21, ECF 226-12. [Redacted] Blue Coat Mot. 16-17; Finjan Opp. 15; Ex. 34 to Finjan's Mot. at ll. 203-17, 326-66, ECF 227-20; see also Ex. 11 to Blue Coat Mot. at 70:10-17, ECF 226-12. [Redacted] Blue Coat Mot. 16-17; Finjan Opp. 15-16; see, e.g. , Ex. 34 to Finjan Opp. at ll. 3848-3979, *866ECF 240-42; Ex. 30 to Finjan Opp. at ll. 166, 365-573, ECF 240-38.
Blue Coat argues that this functionality does not satisfy the "determining any specific one of a plurality of programming languages" limitation of claim 22 [Redacted] Blue Coat Mot. 15-17. Blue Coat contends that, because a file type is not a "programming language," DRTR does not "determin[e] ... a ... programming language[ ]." Id. at 15-16. Blue Coat also argues that, [Redacted] this cannot infringe claim 22 [Redacted] Id. at 16-17.
Finjan, on the other hand, contends that determining file type is determining a "programming language," at least within the context of the '408 patent. Specifically, Finjan points out that the '408 patent discloses JavaScript, Visual Basic Script, HTML, URI, and URL as examples of "programming languages," and also states that "the present invention is ... applicable to parse and analyze binary content and EXE files." Finjan Opp. 14 (citing '408 patent, col. 1 l. 66-col. 2 l. 2, col 4 ll. 2-5, col. 6 ll. 17-23, col. 9 ll. 7-15, col. 16 ll. 10-13). Finjan also emphasizes that [Redacted] Finjan Opp. 14-16; see Ex. 7 to Finjan Opp. at 119:5-10, 181:18-23, ECF 240-14; Ex. 20 to Finjan Opp. at BC0005745-46, ECF 240-32 [Redacted] Ex. 34 to Finjan Opp. at ll. 3715-3738, ECF 240-42; see also Ex. 34 to Finjan Mot. at ll. 333, ECF 227-20 [Redacted] Ex. 4 to Finjan Opp. (Mitzenmacher Rpt.) ¶¶ 114, 953, 955-60, ECF 240-8. Finjan also argues that [Redacted] constitute "determining any specific one of a plurality of programming languages" because they search specifically for JavaScript code. Finjan Opp. 15.
At the time of the hearing, the parties agreed that there was no fundamental dispute as to the meaning of "programming language" and that it may be given its plain and ordinary meaning. ECF 270. However, the parties appear to have different conceptions of what this plain and ordinary meaning may encompass: Blue Coat contends that file types such as text, EXE, PDF, ZIP, XML, GZIP, or RAR are not "programming languages," whereas Finjan contends they are. Compare Blue Coat Mot. 15-16, with Finjan Opp. 14. The parties' experts, purported persons of ordinary skill in the art, also appear to disagree as to whether a file type can be a "programming language." Compare Ex. 30 to Blue Coat Mot. at 111:23-113:22, ECF 226-38 (testimony from Dr. Nielson, Blue Coat's expert, that "identification of file type does not identify programming languages"), with Ex. 28 to Blue Coat Mot. at 195:3-196:23, ECF 226-34 (testimony from Dr. Mitzenmacher, Finjan's expert, that [Redacted] it will determine which programming language the program code appears to be"). Thus, before turning to questions of infringement, the Court must first clarify the scope of "programming language."
While the Court agrees with Blue Coat that, in the most typical case, "programming language" refers to languages such as C, C++, Python, Java, or Perl, it agrees with Finjan that, within the context of the '408 patent, "programming language" carries a broader meaning. Claim 22 requires that, after a "programming language" is "determin[ed]," a "scanner" is "instantiat[ed]" for that "programming language," which includes "parser rules" which "define certain patterns in terms of tokens, tokens being lexical constructs for the specific programming language" and "analyzer rules" which "identify certain combinations of tokens and patterns." '408 patent, col. 21 ll. 48-57. Thus, a "programming language" must at least be something that has "lexical constructs" which can be recognized as "tokens" and put together in detectable "patterns." The specification gives several examples of such "programming languages:" JavaScript, HTML, Visual Basic script, and *867"URI content." Id. , col. 4 ll. 3-5, col. 6 ll. 20-23, col. 15 ll. 39-43. However, the specification also discloses that "the present invention is ... applicable to parse and analyze binary content and EXE files." Id. , col. 19 ll. 10-12. Thus, it must also be the case that "determining any specific one of a plurality of programming languages" includes detecting that a file is a binary file. See Vitronics Corp. v. Conceptronic, Inc. ,
In light of this, the Court finds that there are material questions of fact as to whether DRTR "determin[es] any specific one of a plurality of programming languages." Although it seems odd (and likely incorrect) to say that every file type is its own "programming language" even within the meaning of the '408 patent, the Court cannot conclude, construing the evidence in the light most favorable to Finjan, [Redacted] As discussed above, this will turn on whether they have "tokens" which could be put together in detectable "patterns," both of which are factual determinations that must be left for the jury.
Further, the parties do not dispute that DRTR includes code specific to at least some of the explicit examples of "programming languages" given in the '408 specification: HTML and JavaScript. '408 patent, col. 1 l. 66-col. 2 l. 2, col 4 ll. 2-5, col. 6 ll. 17-23, col. 9 ll. 7-15, col. 16 ll. 10-13. Although the Court agrees with Blue Coat that [Redacted] there may be no prior determination of a programming language, it cannot rule out, on summary judgment, that DRTR's logic of processing content does not somehow include a "determin[ation]" of a "programming language." For example, the source code and other evidence submitted by the parties shows that, [Redacted] DRTR can determine that it is a text file that potentially contains HTML (or, said another way, is potentially an HTML file). See Ex. 34 to Finjan Mot. at ll. 272-366, ECF 227-20; see also
ii. Disputed questions of fact remain as to whether DRTR "instantiat[es] a scanner for the specific programming language"
Claim 22 also requires "instantiating a scanner for the specific programming language." The parties dispute whether DRTR satisfies this limitation for the same reasons they advance with respect to the "determining ..." limitation: in Blue Coat's view, DRTR does not practice this limitation because it only "instantiat[es]" scanners for file types, which are not programming languages. Blue Coat Mot. 17. Finjan, on the other hand, argues that file types are programming languages, so the fact that DRTR selects scanners based on file type at least creates a triable issue of fact. Finjan Opp. 16-17. Finjan also argues that DRTR satisfies this limitation [Redacted] Id. at 17.
Because disputed questions remain as to whether DRTR "determin[es] any specific *868one of a plurality of programming languages," disputed questions remain as to whether it "instantiat[es] a scanner for the specific programming language." Thus, the Court cannot grant summary judgment of noninfringement on the basis of this limitation.
iii. Disputed questions of fact remain as to whether DRTR receives and analyzes an "incoming stream" of program code
Claim 22 also requires that its receiving and analysis steps be performed on an "incoming stream" of program code. Blue Coat argues that, because DRTR begins processing a file only after the full or partial download has been completed, it does not operate on an "incoming stream" of program code. Blue Coat Mot. 17-18. According to Blue Coat, when DRTR receives a new URL to rate and categorize, [Redacted] Id. at 17-18; see also Ex. 11 to Blue Coat Mot. at 120:5-21, 116:1-25, ECF 226-12; Ex. 27 to Blue Coat Mot. at ll. 570-583, ECF 226-32. [Redacted] DRTR begins its analysis. Blue Coat Mot. 18; see also Ex. 11 to Blue Coat Mot. at 120:5-21, ECF 226-12; Ex. 27 to Blue Coat Mot. at ll. 570-583, ECF 226-32.
[Redacted] See Finjan Opp. 17-19. Finjan nevertheless argues that DRTR analyzes an "incoming stream" for two reasons: (1) it dynamically rates the URL before its content is downloaded to a client computer, id. at 17; and (2) [Redacted] as incoming content is being received. Id. at 17-18; Ex. 4 to Finjan Opp. (Mitzenmacher Rpt.) ¶¶ 856, 1025, 1028, 1038, ECF 240-8.
At the time of the hearing, the parties agreed that there was no fundamental dispute as to the meaning of "incoming stream" and that it may be given its plain and ordinary meaning. ECF 270. However, the parties appear to have different views of what this plain and ordinary meaning may encompass: Blue Coat appears to interpret "incoming stream" as a byte stream that must come from an external source (i.e., a byte stream that is actively being downloaded), whereas Finjan appears to view "incoming stream" as a byte stream that can also come from a local source, such as a buffer.
The Court agrees with Finjan that an "incoming stream" need not be from an external source. The '408 patent does not place any restriction on where an "incoming stream" is read from and in fact itself discloses an example of an "incoming stream" that is read from a local buffer. See, e.g. , '408 patent, col. 14 ll. 23-25 ("At step 500, the parser calls a tokenizer, such as tokenizer 210, to retrieve a next token from an incoming byte stream."). Thus, "incoming stream" must at least be as broad. See Vitronics Corp. ,
Blue Coat's noninfringement arguments are only based on its assumption that "incoming stream" must be coming from an external source. Because the Court disagrees with this view, Blue Coat is not entitled to summary judgment of noninfringement on this basis.
iv. Conclusion
Disputed questions of material fact remain with respect to all of the limitations for which Blue Coat argues it is entitled to summary judgment. Accordingly, Blue Coat's motion for summary judgment of noninfringement of claim 22 of the '408 patent is DENIED.
C. The '786 Patent
Finjan accuses the following combinations of infringing claim 1 of the '786 patent : (1) ProxySG, CAS, and MAA, (2) ASG with MAA, (3) WSS with MAS, and (4) WebPulse/GIN. Claim 1 recites:
*8691. A processor-based method, comprising:
receiving at a host server downloadable-information including a combination of non-executable and executable code;
analyzing by a detection engine the downloadable-information to detect the executable code; and
causing by a packaging engine mobile protection code to be communicated to at least one information-destination of the downloadable-information, when the executable code is detected in the downloadable-information,
wherein the causing mobile protection code to be communicated comprises forming the packaging engine a sandboxed package including the mobile protection code and the downloadable-information, and causing the sandboxed package to be communicated to the at least one information-destination .
'786 patent, col. 21 ll. 33-48 (emphasis added). "Mobile protection code" is "code that, at runtime, monitors or intercepts actually or potentially malicious code operations." ECF 180 at 1; see also Blue Coat I , ECF 118 at 5.
Blue Coat argues that it neither infringes this claim literally nor under the doctrine of equivalents. The Court addresses each in turn.
i. Literal Infringement
Blue Coat argues that it does not literally infringe claim 1 because all of the accused combinations have fundamentally different architectures from what is required by claim 1. According to Blue Coat, claim 1 requires that a "sandboxed package including the mobile protection code" be delivered to the "information destination" so that the "downloadable-information" can be executed in a sandboxed environment at the "information destination." Blue Coat Mot. 18-21. Blue Coat argues that "information destination" refers to the client user device, the machine which requested the "downloadable-information." Id. at 21-22. By contrast, Blue Coat argues, there is no sandboxed package that is delivered to the client device in the accused combinations. Id. at 18-22. Instead, all of the sandboxing happens at the MAA before the downloaded information reaches the client device. Id. at 18-22.
Finjan does not dispute that, in the accused combinations, sandboxing happens on the MAA, rather than the client user device. However, Finjan maintains that the accused combinations infringe claim 1 because the MAA receives potentially suspicious content to sandbox from the ASG or CAS by way of a remote API, which includes parameters which influence how the MAA sandboxes the content. According to Finjan, these "API directions" are "mobile protection code" because they cause the MAA to monitor or intercept potentially suspicious operations of the downloaded content. Id. Finjan also argues that, in the accused combinations, the MAA (or MAS) is the "information-destination," and that the meaning of "information-destination" is broad enough to include any information destination, such as a firewall, server, the MAA, or a client user device. Id. at 21-22. As support for its infringement position, Finjan relies on Blue Coat documentation, which explains how the MAA's remote API can be used to submit sample files to the MAA or create a task to be queued and performed by the MAA. Ex. 24 to Finjan Opp. at BC2-0003335, 37, ECF 241-25. Finjan also relies on the report of its expert, Dr. Cole, who opined that the ASG and CAS "communicate" a "sandboxed package including the mobile protection code" because they send digital content to be sandboxed to an MAA via an API call, then "submit mobile protection code to the MAA via another API call which is run by the MAA to monitor the behavior of the sample," and that the API "allows for the *870MAA to receive updated system software and base images that are used in the MAA for the processing" as well as "patterns used as part of the sandboxed package." Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 2173, ECF 240-6; see also id. ¶¶ 2172-74.
As an initial matter, the Court notes that the parties do not appear to fundamentally disagree as to how the relevant portions of the accused combinations work: Finjan agrees with Blue Coat that the MAA (not the user client device) performs sandboxing, and Blue Coat agrees with Finjan that the MAA can receive files to sandbox from an ASG or CAS by way of a remote API, the parameters of which can affect how the MAA sandboxes the file. Finjan Opp. 19-21; Ex. 24 to Finjan Opp. at BC2-0003335, 37, ECF 241-25; see Blue Coat Mot. 20-21. Instead, the parties' dispute turns on two discrete issues: (1) whether the MAA is an "information-destination;" and (2) whether an API call is "mobile protection code."
The Court finds that at least this second issue entitles Blue Coat to summary judgment.8 As previously noted, the Court construed "mobile protection code" to mean "code that, at runtime, monitors or intercepts actually or potentially malicious code operations." ECF 180 at 1; see also Blue Coat I , ECF 118 at 5. At the time of the hearing, the parties agreed that there was no fundamental dispute as to the meaning of "code" and that it may be given its plain and ordinary meaning. ECF 270. However, the parties appear to have different views of what this plain and ordinary meaning may encompass: Blue Coat contends that "code" must be limited to executable code, whereas Finjan views it as broad enough to include API calls. Compare Blue Coat Mot. 21, Blue Coat Reply 11-12, with Finjan Opp. 21.
The Court agrees with Blue Coat that "code" in "mobile protection code" is executable code. The specification consistently describes "mobile protection code" as something that is executed. See, e.g. , id. , col. 18 ll. 7-46, col. 20 ll. 44-65. This makes sense given that one cited advantage of the '786 patent is that it "does not require pre-installation of security code within a Downloadable destination;" instead, the mobile protection code can provide its own package of security code that can be run at the destination. Id. , col. 4 ll. 61-62. This also comports with the testimony of Finjan's experts, Drs. Cole and Medvidovic, who described "code" as something that executes. See Ex. 22 to Blue Coat Mot. at 70:20-75:16, ECF 225-22 (Dr. Medvidovic describing how "typically, you'll provide the code that implements that method inside of a block that's delimited by open curly brace"); Ex. 21 to Blue Coat Mot. at 186:24-187:2, ECF 226-24 (Dr. Cole referring to "code to run"). Moreover, as Blue Coat points out, the Court implicitly addressed this question in its claim construction order in Blue Coat I , where it rejected the notion that mobile protection code includes anything other than the code that itself operates to monitor and intercept suspicious operations. See Blue Coat I , ECF 118 at 7-8 (explicitly excluding "protection policies ... 'for causing one or *871more predetermined operations to be performed' " from construction of mobile protection code). Thus, for these reasons, the "code" in "mobile protection code" must be executable code.
In light of this clarification, there is no material factual dispute that the API calls that CAS and ASG use to submit sample files to the MAA are not "mobile protection code." As the parties agree, these API calls just provide the interface that CAS or ASG can use to launch the execution of sandboxing routines that already reside on the MAA; the API calls are not themselves the executable code. See Finjan Opp. 20 ("parameters that cause the MAA to monitor or intercept operations"); Ex. 21 to Blue Coat Mot. at 182:23-25, ECF 226-24 ("It [MAA] absolutely has code that would monitor or intercept potentially malicious code operations."). Thus, the accused combinations do not satisfy this element. For at least this reason, Blue Coat is entitled to summary judgment. Blue Coat's motion for summary judgment of no literal infringement of claim 1 of the '786 patent is GRANTED.
ii. Doctrine of Equivalents
Blue Coat also moves for summary judgment that it does not infringe claim 1 under the doctrine of equivalents. To prove doctrine of equivalents at trial, Finjan must "show[ ] on a limitation-by-limitation basis that the accused product performs substantially the same function in substantially the same way with substantially the same result as each claim limitation of the patent[ ] ...." Wavetronix LLC v. EIS Electronic Integrated Systems ,
Blue Coat argues that it does not infringe claim 1 under the doctrine of equivalents because the accused products do not provide the same function, the same way, and with the same result as the limitations of claim 1. Blue Coat Mot. 22-23. Specifically, Blue Coat argues that the accused combinations do not provide the same function because the function of claim 1 is to prevent malicious attacks by files already received at the destination computer, whereas the function of the accused combinations is to gather information about a potentially suspicious file and determine whether it is dangerous before sending it to the destination.
Finjan argues that there are at least disputed issues of fact as to whether Blue Coat infringes under doctrine of equivalents, citing its expert Dr. Cole's report as providing "ample evidence" to support this. Finjan Opp. 22 (citing Ex. 3 to Finjan Opp. (Cole Rpt.) ¶¶ 2159-66, 2235-41, ECF 240-6). Finjan cites to no other "evidence" outside its expert's report.
The Court finds that there is no material dispute that Blue Coat does not infringe under the doctrine of equivalents. Dr. Cole's opinion is based entirely on his assumption that the API calls that ASG or CAS make to the MAA are "mobile protection code." See Ex. 3 to Finjan Opp. (Cole Rpt.) ¶¶ 2159-66, 2235-41, ECF 240-6. As discussed above, this is incorrect based on undisputed facts. Finjan cites to no other "evidence" that Blue Coat infringes under the doctrine of equivalents; thus, it fails to *872raise a material dispute as to this issue. Accordingly, Blue Coat is entitled to summary judgment. Blue Coat's motion for summary judgment of no infringement of claim 1 of the '786 patent under the doctrine of equivalents is GRANTED.
D. WebPulse/GIN Sandboxing
BlueCoat moves for summary judgment that "WebPulse/GIN sandboxing" does not infringe the '844, '494, '786, '621, and '086 patents. Blue Coat Mot. 23-25. According to Blue Coat, one necessary component of Finjan's allegations with respect these patents is that "WebPulse/GIN" sends content to MAA(s) to sandbox. Id. at 23. [Redacted] Id. Blue Coat argues that infringement is impossible in both of these cases because these MAA(s) do not send their results to GIN. Id. [Redacted] Id. at 24 (citing Ex. 13 to Blue Coat Mot. at 282:18-21, ECF 226-14). Id. at 24-25. [Redacted] Id. at 25.
Finjan responds that there are disputed questions of fact as to whether WebPulse/GIN uses any of these MAAs, and hence, includes sandboxing. Finjan Opp. 23. [Redacted] Id. at 24-25 (citing Ex. 7 to Finjan Opp. at 106:8-13, 17:14-18:3, 18:18-19:2, ECF 225-7). [Redacted] Id. at 23-24. [Redacted] Id. at 25.
The Court finds that disputed questions of fact remain as to whether "WebPulse/GIN" uses sandboxing through either of the identified MAA(s). [Redacted] different Blue Coat employees provided varying testimony on this MAA and its relation to GIN. See Ex. 13 to Blue Coat Mot. at 282:18-21, ECF 226-14; Ex. 7 to Finjan Opp. at 106:8-13, 17:14-18:3, 18:18-19:2, ECF 225-7. The credibility of this testimony and whether, in light of this, [Redacted] are factual determinations for the jury. Accordingly, summary judgment is inappropriate. [Redacted] including the possibility that their results are provided to GIN. See, e.g. , Ex. 8 to Finan Opp., ECF 241-9; Ex. 27 to Finjan Opp., ECF 241-28; Ex. 6 to Finjan Opp. at 36:17-38:23, ECF 240-12; Ex. 5 to Finjan Opp. at 87:2-89:25, ECF 240-10. The credibility of this testimony and whether, in light of this and Finjan's other evidence, [Redacted] are factual determinations for the jury. In addition, although the Court agrees that, as a matter of law, [Redacted] NTP, Inc. v. Research In Motion, Ltd. ,
V. CONCLUSION
For the foregoing reasons, IT IS HEREBY ORDERED that:
1. Finjan's motion for summary judgment is DENIED as to whether WebPulse/GIN and the identified combinations of gateway products (ProxySG and CAS with MAA; ASG with MAA) infringe claim 10 of the '494 patent ;
2. Finjan's motion for summary judgment is GRANTED as to whether the '731, '580, '844, '968, and '494 (for theories relying on Nachenberg) patents are not invalid and DENIED as to whether the '408, '086, and '494 (for all other theories) patents are not invalid:
a. Finjan's motion for summary judgment is GRANTED as to whether the '731 and '580 patents are not invalid due to Blue Coat's failure to challenge their validity in its expert reports;
b. Finjan's motion for summary judgment is DENIED as to whether the '494 and '408 patents are not invalid because Blue Coat is estopped under *87335 U.S.C. § 315 (e)(2) from challenging their validity;
c. Finjan's motion for summary judgment is GRANTED as to whether the '844, '968, and '731 patents are not invalid because Blue Coat is collaterally estopped from challenging their validity;
d. Finjan's motion for summary judgment is DENIED as to whether the '844, '968, '731, and '086 are not invalid because the PTAB declined to institute IPR for these patents;
e. Finjan's motion for summary judgment is GRANTED as to whether the '494 patent is not invalid over any theory relying on the Nachenberg reference;
f. Finjan's motion for summary judgment is DENIED as to whether the '086 patent is not invalid over any theory relying on Ji '348.
3. Blue Coat's motion for summary judgment is GRANTED as to whether SSLV in conjunction with ProxySG infringes claim 1 of the '580 patent ;
4. Blue Coat's motion for summary judgment is DENIED as to whether WebPulse, alone or in combination with WSS, infringes claim 22 of the '408 patent ;
5. Blue Coat's motion for summary judgment is GRANTED as to whether (1) ProxySG, CAS, and MAA, (2) ASG with MAA, (3) WSS with MAS, and (4) WebPulse/GIN infringe claim 1 of the '786 patent ; and
6. Blue Coat's motion for summary judgment is DENIED as to whether "WebPulse/GIN sandboxing" infringes the '844, '494, '786, '621, and '086 patents.
IT IS SO ORDERED.
Related
Cite This Page — Counsel Stack
283 F. Supp. 3d 839, Counsel Stack Legal Research, https://law.counselstack.com/opinion/finjan-inc-v-blue-coat-sys-llc-cand-2017.