Finjan LLC v. Palo Alto Networks, Inc.

N.D. California

Finjan LLC v. Palo Alto Networks, Inc.

District Court, N.D. California·Decided June 14, 2024·No. 3:14-cv-04908·Unknown

Opinion

FINJAN, LLC, Case No. 14-cv-04908-RS Plaintiff, v. ORDER CONSTRUING CLAIMS PALO ALTO NETWORKS, INC., Defendant.

Plaintiff Finjan, LLC, holds patents that generally relate to protecting computers and/or mobile devices from malicious software (or “malware”), such as viruses, worms, and “Trojans,” particularly in the context of the development in the mid-1990s of “mobile code.” Before then, computer viruses typically spread by infected floppy disks or other removable media. As usage of the internet was becoming more widespread, Sun Microsystems released the Java programming language, which gave developers the means to build platform-independent applications that could run on any computer or device, regardless of the underlying operating system or hardware architecture. Java’s ability to run code on a remote system—“mobile code”—however, also facilitated the spread of malware. Finjan’s patents disclose “methods and systems” designed to prevent such malware from infecting a user’s computers. While the parties suggest construction of more claims ultimately may be necessary, they construction process, they reached agreement as to three of those terms, leaving seven to be construed at this juncture. As will appear, in several instances the dispute is not over competing constructions, but as to whether construction is necessary, or whether instead the “plain language” used in the claims needs no further explication. Furthermore, with respect to the term the parties agree is most significant, the issue differs from typical claim construction because the dispute is whether an obvious drafting or “typographical” error can be remedied through a claim construction order, or whether instead the mistake renders the claim invalid, absent the filing of a certificate of correction with the Patent and Trademark Office. The parties’ disputes will be resolved as set out below.1 Finjan presently asserts infringement by defendant Palo Alto Networks, Inc. (“PAN”) of four patents: • U.S. Patent No. 7,418,731 (“the ’731 Patent), entitled “Method and system for caching at secure gateways.” It discloses systems and methods for scanning incoming files from the internet and deriving security profiles from those files. • U.S. Patent No. 7,647,633 (“the ’633 Patent”), entitled “Malicious mobile code runtime monitoring system and methods.” It relates to executing files (such as potential malware) in a protected environment, known as a sandbox. If the file is observed performing malicious activities, it can be blocked and discarded. • U.S. Patent No. 8,141,154 (“the ’154 Patent’), entitled “System and method for inspecting dynamically generated executable code.” It describes systems and methods for protecting computer systems from dynamically generated malicious content, such as using a security computer for providing a security decision. The incoming content is analyzed and aspects 1 The motion of defendant Palo Alto Networks, Inc. (“PAN”) for leave to submit supplemental claim construction authority is granted, and that material as well as the additional material offered by Finjan has been considered. As will appear, none of it is dispositive. of that content are checked against a security computer to determine whether the software is malicious. If the software is determined to be safe, it is allowed to execute. • U.S. Patent No. 8,225,408 (“the ’408 Patent”), entitled “Method and system for adaptive rule-based content scanners.” It provides a technique for scanning incoming content, under different programming languages, to analyze potential exploits (e.g., malicious portions of code) within the content. The patent further describes generating a “parse tree” based on “tokens” and then identifying exploits within the parse tree. Claim construction is a question of law to be determined by the courts. See Markman v. Westview Instruments, Inc., 52 F.3d 967, 979 (Fed. Cir. 1995). “Ultimately, the interpretation to be given a term can only be determined and confirmed with a full understanding of what the inventors actually invented and intended to envelop with the claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (quoting Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1250 (Fed. Cir. 1998)). Accordingly, a claim should be construed in a manner “most naturally align[ed] with the patent’s description of the invention.” Id. The first step in claim construction is to look to the language of the claims themselves. “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004)). A disputed claim term should be construed in a manner consistent with its “ordinary and customary meaning,” which is “the meaning that the term would have to a person of ordinary skill in the art in question at the time of the invention, i.e., as of the effective filing date of the patent application.” Id. at 1312–13. The ordinary and customary meaning of a claim term may be determined solely by viewing the term within the context of the claim’s overall language. See id. at 1314 (“[T]he use of a term within the claim provides a firm basis for construing the term.”). Additionally, the use of the term in other claims may provide guidance regarding its proper construction. See id. (“Other claims of the patent in question, both asserted and unasserted, can also be valuable sources of enlightenment as to the meaning of a claim term.”). A claim should also be construed in a manner consistent with the patent’s specification. See Markman, 52 F.3d at 979 (“Claims must be read in view of the specification, of which they are a part.”). Typically, the specification is the best guide for construing the claims. See Phillips, 415 F.3d at 1315 (“The specification is . . . the primary basis for construing the claims.”); Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996) (“[T]he specification is always highly relevant to the claim construction analysis. Usually, it is dispositive; it is the single best guide to the meaning of a disputed term.”). In limited circumstances, the specification may be used to narrow the meaning of a claim term that otherwise would appear to be susceptible to a broader reading. See SciMed Life Sys., Inc. v. Advanced Cardiovascular Sys., Inc., 242 F.3d 1337, 1341 (Fed. Cir. 2001). Precedent forbids, however, term construction imposing limitations not found in the claims or supported by an unambiguous restriction in the specification or prosecution history. See Laitram Corp. v. NEC Corp., 163 F.3d 1342, 1347 (Fed. Cir. 1998) (“[A] court may not import limitations from the written description into the claims.”); Comark Commc’ns., Inc. v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998) (“[W]hile . . . claims are to be interpreted in light of the specification, it does not follow that limitations from the specification may be read into the claims.”); SRI Int’l v. Matsushita Elec. Corp. of Am., 775 F.2d 1107, 1121 (Fed. Cir. 1985) (en b

Free access — add to your briefcase to read the full text and ask questions with AI

FINJAN, LLC, Case No. 14-cv-04908-RS Plaintiff, v. ORDER CONSTRUING CLAIMS PALO ALTO NETWORKS, INC., Defendant.

Plaintiff Finjan, LLC, holds patents that generally relate to protecting computers and/or mobile devices from malicious software (or “malware”), such as viruses, worms, and “Trojans,” particularly in the context of the development in the mid-1990s of “mobile code.” Before then, computer viruses typically spread by infected floppy disks or other removable media. As usage of the internet was becoming more widespread, Sun Microsystems released the Java programming language, which gave developers the means to build platform-independent applications that could run on any computer or device, regardless of the underlying operating system or hardware architecture. Java’s ability to run code on a remote system—“mobile code”—however, also facilitated the spread of malware. Finjan’s patents disclose “methods and systems” designed to prevent such malware from infecting a user’s computers. While the parties suggest construction of more claims ultimately may be necessary, they construction process, they reached agreement as to three of those terms, leaving seven to be construed at this juncture. As will appear, in several instances the dispute is not over competing constructions, but as to whether construction is necessary, or whether instead the “plain language” used in the claims needs no further explication. Furthermore, with respect to the term the parties agree is most significant, the issue differs from typical claim construction because the dispute is whether an obvious drafting or “typographical” error can be remedied through a claim construction order, or whether instead the mistake renders the claim invalid, absent the filing of a certificate of correction with the Patent and Trademark Office. The parties’ disputes will be resolved as set out below.1 Finjan presently asserts infringement by defendant Palo Alto Networks, Inc. (“PAN”) of four patents: • U.S. Patent No. 7,418,731 (“the ’731 Patent), entitled “Method and system for caching at secure gateways.” It discloses systems and methods for scanning incoming files from the internet and deriving security profiles from those files. • U.S. Patent No. 7,647,633 (“the ’633 Patent”), entitled “Malicious mobile code runtime monitoring system and methods.” It relates to executing files (such as potential malware) in a protected environment, known as a sandbox. If the file is observed performing malicious activities, it can be blocked and discarded. • U.S. Patent No. 8,141,154 (“the ’154 Patent’), entitled “System and method for inspecting dynamically generated executable code.” It describes systems and methods for protecting computer systems from dynamically generated malicious content, such as using a security computer for providing a security decision. The incoming content is analyzed and aspects 1 The motion of defendant Palo Alto Networks, Inc. (“PAN”) for leave to submit supplemental claim construction authority is granted, and that material as well as the additional material offered by Finjan has been considered. As will appear, none of it is dispositive. of that content are checked against a security computer to determine whether the software is malicious. If the software is determined to be safe, it is allowed to execute. • U.S. Patent No. 8,225,408 (“the ’408 Patent”), entitled “Method and system for adaptive rule-based content scanners.” It provides a technique for scanning incoming content, under different programming languages, to analyze potential exploits (e.g., malicious portions of code) within the content. The patent further describes generating a “parse tree” based on “tokens” and then identifying exploits within the parse tree. Claim construction is a question of law to be determined by the courts. See Markman v. Westview Instruments, Inc., 52 F.3d 967, 979 (Fed. Cir. 1995). “Ultimately, the interpretation to be given a term can only be determined and confirmed with a full understanding of what the inventors actually invented and intended to envelop with the claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (quoting Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1250 (Fed. Cir. 1998)). Accordingly, a claim should be construed in a manner “most naturally align[ed] with the patent’s description of the invention.” Id. The first step in claim construction is to look to the language of the claims themselves. “It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004)). A disputed claim term should be construed in a manner consistent with its “ordinary and customary meaning,” which is “the meaning that the term would have to a person of ordinary skill in the art in question at the time of the invention, i.e., as of the effective filing date of the patent application.” Id. at 1312–13. The ordinary and customary meaning of a claim term may be determined solely by viewing the term within the context of the claim’s overall language. See id. at 1314 (“[T]he use of a term within the claim provides a firm basis for construing the term.”). Additionally, the use of the term in other claims may provide guidance regarding its proper construction. See id. (“Other claims of the patent in question, both asserted and unasserted, can also be valuable sources of enlightenment as to the meaning of a claim term.”). A claim should also be construed in a manner consistent with the patent’s specification. See Markman, 52 F.3d at 979 (“Claims must be read in view of the specification, of which they are a part.”). Typically, the specification is the best guide for construing the claims. See Phillips, 415 F.3d at 1315 (“The specification is . . . the primary basis for construing the claims.”); Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996) (“[T]he specification is always highly relevant to the claim construction analysis. Usually, it is dispositive; it is the single best guide to the meaning of a disputed term.”). In limited circumstances, the specification may be used to narrow the meaning of a claim term that otherwise would appear to be susceptible to a broader reading. See SciMed Life Sys., Inc. v. Advanced Cardiovascular Sys., Inc., 242 F.3d 1337, 1341 (Fed. Cir. 2001). Precedent forbids, however, term construction imposing limitations not found in the claims or supported by an unambiguous restriction in the specification or prosecution history. See Laitram Corp. v. NEC Corp., 163 F.3d 1342, 1347 (Fed. Cir. 1998) (“[A] court may not import limitations from the written description into the claims.”); Comark Commc’ns., Inc. v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998) (“[W]hile . . . claims are to be interpreted in light of the specification, it does not follow that limitations from the specification may be read into the claims.”); SRI Int’l v. Matsushita Elec. Corp. of Am., 775 F.2d 1107, 1121 (Fed. Cir. 1985) (en banc) (“It is the claims that measure the invention.”) (emphasis in original). A final source of intrinsic evidence is the prosecution record and any statements made by the patentee to the PTO regarding the scope of the invention. See Markman, 52 F.3d at 980. Courts may also consider extrinsic evidence, such as expert testimony, dictionaries, or technical treatises, especially if such sources are “helpful in determining ‘the true meaning of language used in the patent claims.’” Phillips, 415 F.3d at 1318 (quoting Markman, 52 F.3d at 980). Ultimately, while extrinsic evidence may aid the claim construction analysis, it cannot be used to contradict the plain and ordinary meaning of a claim term as defined within the intrinsic record. See id. at 1322–23. A. Stipulated constructions In their Final Amended Joint Claim Construction and Pre-Hearing Statement (Dkt. 164), the parties stipulated to construction for seven terms, including one term identified as disputed in their initial statement. Those stipulated constructions are hereby adopted, without prejudice to further consideration as to whether any of the wording should be further clarified or simplified for purposes of jury instructions. At the Technology Tutorial, the parties reported having reached agreement that Finjan’s proposals could be adopted as to two additional terms. Pursuant to that agreement, Term 4— “mobile protection code” (’633 Patent Claim 14)—will be construed as “code that, at runtime, monitors or intercepts actually or potentially malicious code operations without modifying the executable code.” Term 8—“lexical constructs for the specific programming language” (’408 Patent Claims 1, 3-8, 22)—will not be construed beyond its plain and ordinary meaning. Again, these stipulations are accepted without prejudice to further consideration at the time of jury instructions. B. Disputed terms Term 1: “file cache” (’731 Patent Claims 1, 3, 14, 17) Finjan’s Proposed Construction PAN’s Proposed Construction “a memory for holding a file, at least “data structure to temporarily store files” temporarily” The ’731 patent discloses computer gateways for an intranet of computers (e.g., computers within an office building) that scan and cache incoming and outgoing files for computer viruses. These gateways scan the files for suspicious computer commands and derive a file identifier and a security profile for each file. (’731 patent at Abstract, claim 1.) The security profiles are indexed in a cache by file identifier and list commands that the files are programmed to perform. The computer gateway may also have a security policy cache for storing security policies (e.g., lists of restrictions) for client computers within an intranet. (Id. at Abstract.) The gateway can determine whether a particular file, security profile or security policy is in the gateway’s file cache. At first glance, the parties’ competing proposed constructions for “file cache” appear quite similar.2 PAN initially argues a cache should be construed to be a “data structure” rather than a “memory” as advocated by Finjan because, according to PAN, the ’731 patent is “focused on software-implemented, rather than hardware-implemented, caches.” PAN, however, has also proposed as “compromise” construction: “software or hardware to temporarily store files for faster retrieval later.” Because PAN recognizes the claim reaches software or hardware implementations of caches, regardless of the “focus” of the patent, there is no reason to use the less clear term “data structure” rather than “memory.” The parties’ remaining dispute is whether the construction should indicate a cache can only store files “temporarily.” PAN insists that by stating the file is held “at least temporarily,” Finjan’s proposed construction is overbroad, and potentially encompasses any kind of memory, including memory that stores files permanently. Finjan has not explained how a particular memory could be used to store a file permanently and still be used as a cache in the sense described in the ’731 patent. While Finjan points to language in the specification suggesting that a cache need not be “purged” at certain specific points in time, its proposed construction does not capture the point it appears to be trying to make. Moreover, it has not shown how simply construing cache as memory for holding a file temporarily (as opposed to “at least temporarily”) imposes any limitations as to when or how the file must be deleted, purged, overwritten, or otherwise removed from memory. At the hearing, Finjan acknowledged that its proposed language arguably reached storage in memory “forever,” which it agreed was not “precisely” its intention. Finjan instead argued that “temporarily” should not be seen as implying any particular time period. Nothing in this 2 PAN originally proposed a construction that would expressly reach the related terms “security profile cache” and “security policy cache.” Finjan apparently believes those terms should be addressed separately, and they are not part of the present claims construction. construction order is to the contrary. PAN’s proposed compromise construction very well may be a correct description of the purpose of a cache as described in the patent. There is no basis, however, for explicitly listing that purpose as a limitation in the claim. Accordingly, “file cache” will be construed simply as “a memory for temporarily holding a file.” Term 2: “incoming files from the Internet” (’731 Patent Claims 1-3) Finjan’s Proposed Construction PAN’s Proposed Construction No construction necessary; plain and ordinary “files requested by an intranet computer from meaning. the Internet”

The independent claim at issue uses the term “incoming files from the Internet,” without further explication of why or how the files may happen to be arriving from the internet. Again, PAN’s proposal may correctly recite the circumstances under which a file most typically will be arriving from the internet in the embodiments described in the specification, but there is no basis to import an additional limitation into the claim that the incoming file must have been requested by one of the computers in the intranet.3 Whether or not there could be circumstances under which unsolicited files arrive from the internet is unclear, but PAN has not shown the claim language would exclude such instances. Finjan’s proposal that the term be given no construction beyond its plain and ordinary meaning will be adopted.4 3 Finjan points out dependent claim 6 and independent claim 7 both discuss processing of “requests” for files. The context of those claims is too different to draw much under the doctrine of claim differentiation or any other principle of claim construction. Finjan’s proposal, however, to give the term its plain and ordinary meaning without any additional limitations remains sound. 4 In Finjan LLC v. Qualys Inc. Case No. 4:18-cv-07229 (N.D. Cal.) at Dkt. No. 74, the court adopted the defendant’s request to include a limitation that the incoming file is one requested by an intranet computer. Although the order pointed to examples of such requests in the embodiments described in the specification, the conclusion in Qualys that the claim is thereby limited will not be followed here. Term 3: Preamble of Claim 14 (’633 Patent Claim 14) The disputed preamble reads: A computer program product, comprising a computer usable medium having a computer readable program code therein, the computer readable program code adapted to be executed for computer security, the method comprising . . . . (emphasis added). Finjan’s Proposed Construction PAN’s Proposed Construction The typographical error in the preamble is Indefinite for claiming mixed corrected to read: statutory classes and/or lacking antecedent basis “A computer program product, comprising a computer usable medium having a computer readable program code therein, the computer readable program code adapted to be executed for computer security, comprising:” This issue was first addressed in Finjan, Inc. v. Blue Coat Sys., Inc., No. 13-cv-03999- BLF, 2014 WL 5361976, at *7 (N.D. Cal. Oct. 20, 2014), which held the preamble could and should be corrected in the manner Finjan requests. Later, both Finjan, Inc. v. Cisco Sys. Inc., No. 17-CV-00072-BLF, 2019 WL 452038, at *4- 5 (N.D. Cal. Feb. 5, 2019) and Finjan, Inc. v. Sonicwall, Inc., No. 17-CV-04467-BLF, 2019 WL 1369938, at *5 (N.D. Cal. Mar. 26, 2019) followed Blue Coat to reach the same result. Blue Coat eventually went to trial, and resulted in a verdict for damages on claim 14, among others. While Finjan challenged the damages award and various other aspects of the trial result, the construction of claim 14 was not appealed. Stipulated dismissals were entered in Cisco and Sonicwall, so the Federal Circuit has not addressed the construction of claim 14. When a patentee seeks a correction of claim language, “a district court can do so only if (1) the correction is not subject to reasonable debate based on consideration of the claim language and the specification and (2) the prosecution history does not suggest a different interpretation of the claims.” Novo Indus., L.P. v. Micro Molds Corp., 350 F.3d 1348, 1354 (Fed. Cir. 2003). Here, Finjan asserts the record shows that the preamble was amended to its present form as part of a clear attempt to make the claim into a Beauregard claim,5 and that the reference to “method” was retained by simple mistake. A sliver of uncertainty arguably arises because the patentee affirmatively added the word “the” preceding “method,” and failed to amend three dependent claims each of which refer to “the method of claim 14. While the addition of the definite article “the” was grammatically required when the patentee neglected to delete “method,” it does compound the issue of sloppy claim drafting. Nevertheless, PAN’s contention that it would be equally reasonable to “fix” the claim by rewriting as a method claim as opposed to a “computer program product” claim—and that therefore there is a “reasonable debate” precluding Finjan’s proposed correction—is not persuasive. The preamble was specifically amended to claim, “A computer program product . . . .” in lieu of the prior claim for “A processor-based method . . . .” See Lee Decl. Ex. 6 at 6-7. The decisions in Blue Coat, Cisco, and Sonicwall will be followed here, and Finjan’s proposal will be adopted. With the removal of the words “the method,” PAN’s argument that the claim is indefinite under IPXL Holdings, L.L.C. v. Amazon.com, Inc., 430 F.3d 1377 (Fed. Cir. 2005) because it is directed to mixed statutory subject matter fails. PAN’s cursory assertion that the claim remains indefinite even with “the method” excised is not persuasive. Furthermore, whether or not the dependent claims referring to “the method of claim 14” become invalid as a result of the correction to claim 14 or can similarly be corrected is a question for another day. All that said, this claim construction deleting “the method,” which accepts Finjan’s argument that the patentee intended Claim 14 to be a Beauregard claim, is without prejudice to 5 Computer-readable media claims—such as claims covering programs encoded on tangible computer-readable media—are commonly referred to as Beauregard claims. See In re Beauregard, 53 F.3d 1583 (Fed. Cir. 1995). any subsequent argument that the claim is not valid under Beauregard or otherwise. Term 4: “mobile protection code” (’633 Patent Claim 14) As noted above, this term will be construed pursuant to the parties’ stipulation announced at the Technology Tutorial. Term 5: “downloadable-information destination” (’633 Patent Claim 14) Finjan’s Proposed Construction PAN’s Proposed Construction “a device or process that is capable of “user device that includes one or more devices receiving and initiating or otherwise or processes that are capable of receiving and hosting a mobile code execution” initiating or otherwise hosting a mobile code execution” Finjan proposes the construction for “downloadable-information destination” that was adopted by the court in Finjan, Inc., v. Proofpoint, Inc., No. 13-CV-05808-HSG, 2015 WL 7770208, at *5 (N.D. Cal. Dec. 3, 2015). The Proofpoint court found the specification dispositive because it stated:

A suitable information-destination or “user device” can further include one or more devices or processes (such as email, browser or other clients) that are capable of receiving and initiating or otherwise hosting a mobile code execution.

’633 Patent at 7:60-65.6 Nevertheless, the Proofpoint court’s construction did not expressly include a reference to a “user device.” In Finjan, Inc. v. Cisco Sys., Inc., No. 17-CV-00072-BLF, 2018 WL 3537142, at *20 (N.D. Cal. July 23, 2018), the court relied on the same definition in the specification as dispositive, and adopted the construction now proposed here by PAN, which includes the reference to “user device.” Cisco described its construction as “consistent” with that

6 Proofpoint cited the specification of U.S. Patent No. 7,058,822, which is identical to that of the ’633 patent. adopted in Proofpoint, noting the deference that should be given when possible to a prior claim construction order issued in the same jurisdiction. Id. (citing Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG, 2017 WL 550453, at *3 (N.D. Cal. Feb. 10, 2017)). Although Finjan complains including a reference to “user device” is potentially confusing, it does not contend it creates an unsupported limitation or is otherwise incorrect. PAN’s construction, identical to that adopted in Cisco, will be utilized here. Term 6: “parse tree” (’408 Patent Claims 1, 3-8, 22) The parties’ Final Amended Joint Claim Construction and Pre-Hearing Statement (Dkt. 164) stipulated to construe this term as “a hierarchical structure of interconnected nodes built from scanned content.” As stated above, that construction will be adopted, without prejudice to further clarification or simplification for purposes of jury instructions. Term 7: “programming language” (’408 Patent Claims 1, 3-8, 22) Finjan’s Proposed Construction PAN’s Proposed Construction No construction necessary; plain and ordinary indefinite meaning. PAN acknowledges that at least outside the context of the ’408 patent, “programming language” has a well-understood meaning. PAN contends its use in the patent is indefinite, however, because dependent claims 7 and 21 recite that Universal Resource Indicator (“URI”) is the “specific programming language” of independent claims 1 and 9, respectively, and dependent claims 6 and 20 recite that the “specific programming language” is hypertext markup language (“HTML”). PAN insists that a person of ordinary skill in the art would not ordinarily understand URI or HTML to be a programming language. Even if PAN is correct that URI or HTML might not always be thought of as programming languages, effectively defining them as such for the purpose of specific dependent claims does not create an indefiniteness problem. Rather, it resolves any ambiguity that otherwise might exist as to whether the claims encompass use of URI and HTML. PAN’s contention that a person of ordinary skill in the art would then be uncertain as to whether something else, not mentioned in the specification or the claim, might also be a “programming language,” is not persuasive. No further construction is warranted at this juncture. Term 8: “lexical constructs for the specific programming language” (’408 Patent Claims 1, 3-8, 22) As noted above, pursuant to the parties’ stipulation announced at the Technology Tutorial, this term will not be construed beyond its plain and ordinary meaning at this juncture.

Terms 9 and 10 Terms 9 and 10 will be discussed together. They both appear in the ’154 patent, which is directed toward a system and method “for protecting a client computer from dynamically generated malicious content” and statically generated conventional viruses (’154 patent at Abstract). The specification explains that “a newer type of virus” — namely, “dynamically generated viruses” that are “generated only at run-time” — “take advantage of features of dynamic HTML generation, such as executable code or scripts that are embedded within HTML pages” (id. at 3:32–38). Term 9: “content processor” (’154 Patent Claims 1, 2, 6, 7) Finjan’s Proposed Construction PAN’s Proposed Construction No construction necessary; plain and ordinary “an application on the protected client/user meaning. computer that processes modified content”

To the extent the Court construes this claim term, Finjan proposes: “a processor that processes content.”

Term 10: “content” (’154 Patent Claims 1, 2, 4, 6, 7, 10) Finjan’s Proposed Construction PAN’s Proposed Construction No construction necessary; plain and “data or information, which has been ordinary meaning. modified and is received over a network” The primary controversy between the parties as to these terms is whether the “content” described in the claims must already have been “modified.” Several prior decisions have concluded plain and ordinary meaning suffices and have not construed the terms to require the content to have previously been modified, although they do not appear to have been asked to resolve this specific issue. See, e.g., Finjan, Inc. v. Proofpoint, Inc., No. 4:13-cv-05808-HSG, Dkt. No. 267, at 18 (N.D. Cal. Dec. 3, 2015) (“[T]he term [‘content processor’] does not require any construction beyond its plain and ordinary meaning.”); Finjan, Inc. v. Symantec Corp., No. 4:14- cv-02998-HSG, Dkt. No. 170, at 18 (N.D. Cal. Feb. 10, 2017) (“Accordingly, the Court finds that ‘content processor’ should be given its plain and ordinary meaning ....”); Finjan, Inc. v. Bitdefender Inc., No. 4:17-cv-04790-HSG, Dkt. No. 101, at 21 (N.D. Cal. Feb. 14, 2019) (“In turn, the Court again finds that no construction is necessary for this term and that ‘content processor’ has sufficiently specific structure based on the claim language and specification.”).] In Finjan, Inc. v. Juniper Networks, Inc., 387 F. Supp. 3d 1004, 1011 (N.D. Cal. 2019), aff’d, 825 F. App’x 922 (Fed. Cir. 2020), however, the court expressly addressed whether the claims should be construed as referring to modified “contents.” Juniper stated:

That the “content” being processed in Claim 1 has been modified is made evident by the claim language and specification. The United States Court of Appeals for the Federal Circuit has explained that the ’154 patent “has four independent claims (1, 4, 6, and 10), each reciting a system or software program that executes a substitute function . . . . In the language of the ’154 patent, the ‘first function’ is the inspection step in which the content is assessed for safety, and the ‘second function’ is when, having been deemed safe, the content is actually run.” Palo Alto Networks, Inc. v. Finjan, Inc., 752 F. App’x 1017, 1018 (Fed. Cir. 2018); see also Finjan, Inc. v. Cisco Systems, Inc., 2018 WL 3537142, at *20–23 (N.D. Cal. July 23, 2018) (Judge Beth Labson Freeman) (construing the terms “first function” to mean “substitute function” and “second function” as “original function, which is different than the first function”). The claimed “first function” then clearly involves the “substitute function,” which sends the content’s input to the security computer for inspection once invoked. According to the specification, the substitute function exists only after the original content is modified at the gateway computer (see, e.g., ’154 patent at 9:13–28). Accordingly, the claimed “content” necessarily refers to modified content. Id. Nearly a year after Juniper was decided, but without mentioning it, the District of Delaware reached the conclusion that the claims do not require that the content has previously been modified. See Finjan, Inc. v. Rapid7, Inc., 2020 WL 565377, at *7 (D. Del. Feb. 5, 2020). The Rapid7 court based its conclusion on its earlier finding that the “first function” and “second function” need not be different. Id. Because the Juniper decision is more persuasive, its conclusion 1 that “content” should be construed to mean “modified content” will be adopted.’ 2 That said, PAN has not made a showing to support an additional limitation that the content 3 processor be located on the protected client computer, or that the arguably narrower term 4 “application” should be substituted for “processor”—issues which Juniper did not reach. 5 Accordingly, “content” will be construed as “data or information, which has been modified and is 6 received over a network” and “content processor” will be construed as “a processor that processes 7 modified content.” 8 9 The stipulated and contested patent terms will be construed as set out above. 10 11 IT ISSO ORDERED. 12

13 Dated: June 14, 2024 a 14 RICHARD SEEBORG 15 Chief United States District Judge 16

= 17

18 19 20 21 22 23 24 25 26 □ 7 Although it is not necessary to decide conclusively, this result is likely also mandated as a matter 27 of collateral estoppel given the Juniper decision. 28 CASE No. 14-cv-04908-RS

Finjan LLC v. Palo Alto Networks, Inc., (N.D. Cal. 2024).

Pincite

Finjan LLC v. Palo Alto Networks, Inc. (Finjan LLC v. Palo Alto Networks, Inc.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Opinion

Related