Finjan, Inc. v. Juniper Networks, Inc.

387 F. Supp. 3d 1004
CourtDistrict Court, N.D. California
DecidedMay 8, 2019
DocketNo. C 17-05659 WHA
StatusPublished
Cited by3 cases

This text of 387 F. Supp. 3d 1004 (Finjan, Inc. v. Juniper Networks, Inc.) is published on Counsel Stack Legal Research, covering District Court, N.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Finjan, Inc. v. Juniper Networks, Inc., 387 F. Supp. 3d 1004 (N.D. Cal. 2019).

Opinion

William Alsup, United States District Judge

INTRODUCTION

In this patent infringement action, each side moves for summary judgment on one asserted claim. For the reasons stated below, the patent owner's motion for summary judgment of infringement is DENIED . The accused infringer's motion for summary judgment of non-infringement and on damages is GRANTED to the extent stated below and motion to strike is DENIED AS MOOT . The parties are ORDERED TO SHOW CAUSE as to why judgment on the patent owner's motion should not be entered in favor of the accused infringer.

STATEMENT

Plaintiff Finjan, Inc. alleges that defendant Juniper Networks, Inc.'s products infringe its patents, including, inter alia , United States Patent Nos. 8,141,154 ("the '154 patent") and 6,804,780 ("the '780 patent"). These patents broadly relate to computer malware protection.

Pursuant to the second round of early motions for summary judgment, Finjan moves on infringement of Claim 1 of the '154 patent and Juniper moves on non-infringement of Claim 9 of the '780 patent and limitation of damages (Dkt. Nos. 369, 371). Juniper also moves to strike certain infringement theories related to the '154 patent (Dkt. No. 391).

1. THE '154 PATENT .

The '154 patent is directed toward a system and method "for protecting a client computer from dynamically generated malicious content" and statically generated conventional viruses ( '154 patent at Abstract). The specification explains that "a newer type of virus" - namely, "dynamically generated viruses" that are "generated only at run-time" - "take advantage of features of dynamic HTML generation, such as executable code or scripts that are embedded within HTML pages" (id. at 3:32-38).

The specification recounts the disadvantages of "conventional reactive content inspection and conventional gateway level *1007behavioral analysis content inspection" and "desktop anti-virus protection" (id. at 3:65-4:8, 4:18-22). According to the patent, conventional gateway level behavior analysis content inspection cannot detect the new type of virus (id. at 3:65-4:1). For example, a content inspector "will only detect the presence of a call to Document.write( ) with input text [which may involve malicious JavaScript not present in the content prior to runtime] that is yet unknown" (id. at 4:1-4). And, desktop anti-virus protection must expose its vulnerabilities to hackers, among other disadvantages (id. at 4:18-21). The specification then announces that "there is a need for a new form of behavioral analysis, which can shield computers from dynamically generated malicious code without running on the computer itself that is being shielded" (id. at 4:23-26). To that end, the '154 patent uses a "security computer" to inspect potentially malicious code (id. at 4:35).

The basic set up of the '154 patent 's purported invention involves "[t]hree major components": (1) gateway computer, (2) client computer, and (3) security computer (id. at 8:45-46). The "present invention operates through a security computer that is preferably remote from a client computer that is being shielded while processing network content" (id. at 4:35-37). A preferred embodiment describes a gateway computer that intercepts content (e.g. , HTML pages, Java applets) being sent to the client computer for processing (id. at 8:48-51). The gateway computer modifies the content by replacing the call to the original function with a corresponding call to a substitute function, which operates to send the input of the original function to a security computer for inspection (id. at 5:10-12). The gateway computer then transmits "the modified content" to the client computer, which processes the modified content (id. at 5:14-16). When the substitute function is invoked, the client computer transmits the input to the security computer for inspection (id. at 5:16-18). The security computer then inspects the input and transmits "an indicator of whether it is safe for the client computer to invoke the original function with the input" (id. at 5:20-22). The client computer invokes the original function "only if the indicator ... indicates that such invocation is safe" (id. at 5:22-25). Figure 2 illustrates a "simple topology" of this set up (id. at 8:41-44, 62):

*10082. THE '780 PATENT

A prior order has described in detail the '780 patent 's purported invention (Dkt. No. 180). The '780 patent describes generation of an ID for a downloadable ("Downloadable ID") in order to match it against previously encountered suspect downloadables. This saves the malware-protection system from going through an intensive analysis every time that downloadable attempts to enter the user's system. The patent discloses an ID generator that generates a Downloadable ID by fetching components called out by the incoming file, then running a hash function across the combined code.

3. THE ACCUSED PRODUCTS .

A. SRX Gateways.

Juniper's SRX Series Gateways ("SRX") are secure routers that can act as firewalls to protect a computer on a network from receiving malicious content. Once SRX receives content sent from a network such as the Internet, it blocks data already recognized as malicious. If SRX does not recognize the content, it will then send it to the cloud-based Sky Advanced Threat Prevention ("Sky ATP") for analysis.

B. Sky ATP.

Sky ATP, sold as an add-on to SRX, is a cloud-based scanning system that inspects content with its "Malware Analysis Pipeline" to determine the threat level posed by a "Downloadable." The Malware Analysis Pipeline scans an unrecognized Downloadable *1009using static and dynamic analysis. Static analysis involves evaluating the Downloadable's contents without actually running it. Dynamic analysis evaluates the Downloadable's contents by executing and observing the file in a safe environment called the "sandbox." The multi-stage pipeline analysis identifies easily detected malware first (through static analysis), then analyzes progressively harder-to-detect malware process through the pipeline (ending with dynamic analysis). This pipeline renders a "verdict," i.e. , how dangerous the file is.

C. ATP Appliance.

Advanced Threat Prevention Appliance ("ATP Appliance") - a product previously sold by Cyphort (which Juniper acquired in 2017) - operates in a manner similar to Sky ATP. Instead of a cloud-based service, however, ATP Appliance is a local network appliance that includes "collectors" that capture information regarding network traffic by copying files being downloaded from the network such as the Internet. The ATP Appliance hashes a copy of a file being downloaded over the network to determine whether the file has already been analyzed. If the file is not recognized, then it is sent to ATP Appliance's "SmartCore," which performs a multi-stage analysis (including static and dynamic analysis).

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
387 F. Supp. 3d 1004, Counsel Stack Legal Research, https://law.counselstack.com/opinion/finjan-inc-v-juniper-networks-inc-cand-2019.