Okta, Inc. v. Biogy, Inc.

• Court: District Court, N.D. California
• Decided: February 23, 2026
• Docket: 3:25-cv-03329
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 OKTA, INC., Case No. 25-cv-03329-AMO

8 Plaintiff, ORDER DENYING MOTION TO 9 v. DISMISS

10 BIOGY, INC., Re: Dkt. No. 32 Defendant. 11

12 13 Plaintiff Okta, Inc. (“Okta”) brings this action seeking a declaration of patent non- 14 infringement. Defendant Biogy, Inc.’s (“Biogy”) motion to dismiss was heard before this Court 15 on November 6, 2025. Having read the papers filed by the parties and carefully considered their 16 arguments therein and those made at the hearing, as well as the relevant legal authority, the Court 17 hereby DENIES Biogy’s motion for the following reasons. 18 I. BACKGROUND 19 Biogy is the owner of United States Patent No. 7,669,236 (“the ’236 Patent”), entitled 20 “Determining Whether to Grant Access to a Passcode Protected System.” First Am. Compl. (Dkt. 21 No. 29, “FAC”), Ex. A. The ’236 Patent issued on February 23, 2010, and generally relates to a 22 method of issuing passcodes that are only valid for a limited time. Such passcodes are sometimes 23 referred to as Time-Based One-Time Passcodes, which is often abbreviated as “TOTP” or 24 “TOTPs.” Such systems are commonly used as one form of multi-factor or two-factor 25 authentication. 26 After the application that matured into the ’236 Patent was filed, an industry trade group 27 promulgated a standard relating to the issuance of a particular type of TOTP passcodes. The 1 specific method to generate TOTP codes. See Berten Decl., Ex. 1. Biogy asserts that passcodes 2 issued in compliance with the RFC 6238 Standard infringe at least claims 5, 12, 14, and 24 of the 3 ’236 Patent. Biogy does not assert that all TOTP passcodes infringe the ’236 Patent; it has only 4 asserted that passcodes issued to users in conformance with the RFC 6238 Standard infringe the 5 patent. See, e.g., Berten Decl. ¶ 6; Dkt. No. 29-2 at 2 (“To the extent Albertson’s use of two- 6 factor authentication is using one-time passcodes that comply with the TOTP standard, that use 7 infringes the ’236 Patent.”); see also Berten Decl., Ex. 2 (Complaint in Albertson’s Action) ¶ 16 8 (“The specific solution[s] claimed in the claims of the ’236 Patent do not claim the entire field of 9 ‘multi-factor authentication’ or ‘two factor authentication.’ For example, there are other methods 10 for multifactor authentication that do not involve sending temporary one-time passcodes that are 11 created using a passcode generator that perturbs.”). 12 On April 24, 2024, counsel for Biogy sent to Okta’s customer Albertsons Companies, Inc. 13 (“Albertson’s”) a “Notice of Infringement Letter” regarding the ’236 Patent and Albertson’s 14 suspected use of the RFC 6238 Standard for TOTPs. Compl. ¶ 20; see also id., Ex. B (Dkt. No. 15 29-2). The letter included a claim chart mapping the ’236 Patent to the TOTP RFC 6238 Standard 16 and cited an example of an Albertson’s temporary one-time passcode. Compl., Ex. C (Dkt. No. 17 29-3). Albertson’s never responded to the letter. Berten Decl. ¶ 13. After Albertson’s ignored 18 Biogy’s letter for nearly six months, on October 17, 2024, Biogy filed an action for infringement 19 of the ’236 Patent against Albertson’s Companies, Biogy, Inc. v. Albertsons Companies, Inc. et al., 20 No. 2:24-cv-00838 (E.D. Tex.) (the “Albertson’s Action”). Berten Decl. ¶ 14; see also FAC ¶ 12. 21 Okta brings this action for declaratory relief of non-infringement based at least in part on 22 Biogy’s letter-writing campaign to enforce the ’236 Patent against its customers. See generally 23 FAC. Microsoft Corporation (“Microsoft”) brings a similar action seeking a declaration of non- 24 infringement of the ’236 Patent. See Microsoft Corporation v. Biogy, Inc., N.D. Cal. Case No. 25 3:25-cv-4957. The Court related the two cases and heard Biogy’s identical motions to dismiss in a 26 single hearing. See Dkt. Nos. 34, 50. The Court issues its order in the Microsoft action this same 27 day. 1 II. DISCUSSION 2 Biogy moves to dismiss the declaratory relief action for lack of subject matter 3 jurisdiction – Biogy asserts that Okta lacks Article III standing. The Court sets forth the legal 4 standard for assessing a motion under Federal Rule of Civil Procedure 12(b)(1) before turning to 5 the parties’ arguments. 6 A. Legal Standard 7 The law of the Federal Circuit governs “review as to whether an actual controversy exists 8 under the Declaratory Judgment Act when the underlying merits of an action involve patent 9 infringement and/or validity.” Microchip Tech. Inc. v. Chamberlain Grp., Inc., 441 F.3d 936, 940 10 (Fed. Cir. 2006). However, for the standards to assess legal issues that are not patent specific, 11 such as the standards applicable for analyzing Rule 12(b)(1) motions, the district court still relies 12 on the law of the regional circuit – here, the Ninth Circuit. Mitek Sys., Inc. v. United Servs. Auto. 13 Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”). 14 Motions to dismiss pursuant to Federal Rule of Procedure 12(b)(1) challenge a court’s 15 subject matter jurisdiction and may be facial or factual. A facial attack presumes the truth of the 16 plaintiff’s allegations but asserts that they “are insufficient on their face to invoke federal 17 jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Facial attacks 18 are reviewed akin to Rule 12(b)(6) motions in that all allegations of the complaint are taken as 19 true, and all reasonable inferences are drawn in favor of the plaintiff. Love v. United States, 915 20 F.2d 1242, 1245 (9th Cir. 1990). A factual attack “contests the truth of the plaintiff’s factual 21 allegations, usually by introducing evidence outside the pleadings.” Leite v. Crane Co., 749 F.3d 22 1117, 1121 (9th Cir. 2014) (quoting Safe Air for Everyone, 373 F.3d at 1039). In resolving a 23 factual challenge, once the defendant contests the truth of the plaintiff’s factual allegations, the 24 plaintiff has the burden to support its allegations with competent proof. Friends of the Earth v. 25 Sanderson Farms, Inc., 992 F.3d 939, 944 (9th Cir. 2021) (quoting Leite, 749 F.3d at 1121). In 26 resolving such a challenge, when the “jurisdictional issues are ‘intertwined with an element of the 27 merits of the plaintiff’s claim,’ the court must treat the motion like a motion for summary 1 Energizer Holdings, Inc., 118 F.4th 1134, 1143 (9th Cir. 2024) (quoting Leite, 749 F.3d at 1122). 2 But when allegations relating to standing are “separable from the merits of the case,” the court is 3 free to “resolv[e] factual disputes if necessary.” Jones v. L.A. Cent. Plaza LLC, 74 F.4th 1053, 4 1057 n.2 (9th Cir. 2023). 5 B. Patent Infringement 6 Under the Declaratory Judgment Act, courts only have jurisdiction over matters that 7 present an “actual controversy.” 28 U.S.C. § 2201(a). “[T]he phrase ‘case of actual controversy’ 8 in the Act refers to the types of ‘Cases’ and ‘Controversies’ that are justiciable under Article III of 9 the Constitution.” MedImmune v. Genentech, Inc., 549 U.S. 118, 127 (2007) (citation omitted). 10 An Article III controversy may exist where a party seeks a declaration that its product does not 11 infringe a patent. See, e.g., Danisco U.S. Inc. v. Novozymes A/S, 744 F.3d 1325, 1330 (Fed. Cir. 12 2014). It is the plaintiff’s burden to show an actual controversy existed at the time the declaratory 13 action was filed. AIDS Healthcare Found., Inc. v. Gilead Scis., Inc., 890 F.3d 986, 990 (Fed. Cir. 14 2018). “[L]ater events may not create jurisdiction where none existed at the time of filing.” GAF 15 Building Materials Corp. v. Elk Corp. of Dallas, 90 F.3d 479, 483 (Fed. Cir. 1996). 16 A “case of actual controversy” is one that is “substantial . . . between parties having 17 adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory 18 judgment.” Allied Min. Prods., Inc. v. Osmi, Inc., 870 F.3d 1337, 1139 (Fed. Cir. 2017) (quoting 19 MedImmune, 549 U.S. at 127). The dispute must be “definite and concrete,” not based on “a 20 hypothetical state of facts.” Id. at 1339, 1341. Courts must determine whether “the facts alleged, 21 under all the circumstances, show that there is a substantial controversy, between parties having 22 adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory 23 judgment.” MedImmune, 549 U.S. at 127. The Federal Circuit has explained that “jurisdiction 24 generally will not arise merely on the basis that a party learns of the existence of a patent owned 25 by another or even perceives such a patent to pose a risk of infringement, without some 26 affirmative act by the patentee.” Prasco, LLC v. Medicis Pharm. Corp., 537 F.3d 1329, 1339 27 (Fed. Cir. 2008) (citation omitted). In essence, a controversy exists where a patentee’s actions 1 Balsam Brands Inc., 787 F. App’x 691, 700 (Fed. Cir. 2019). Specifically, declaratory judgment 2 jurisdiction requires “both (1) an affirmative act by the patentee related to the enforcement of his 3 patent rights” directed at the plaintiff and “(2) meaningful preparation to conduct potentially 4 infringing activity.” Finisar Corp. v. Capella Photonics, Inc., No. 20-cv-07629-EMC, 2021 WL 5 810227, at *4 (N.D. Cal. Mar. 3, 2021). 6 Given that declaratory judgment jurisdiction requires “some affirmative act by the 7 patentee” to enforce its patents against the plaintiff, a plaintiff’s “fear of a future infringement suit 8 is insufficient to confer jurisdiction.” Allied Min., 870 F.3d at 1139. There is no bright-line rule 9 that any particular conduct is either necessary or sufficient for a showing of an affirmative act. 10 Proofpoint, Inc. v. InNova Pat. Licensing, LLC, 2011 WL 4915847, at *3 (N.D. Cal. Oct. 17, 11 2011). For example, while “[a]n affirmative act requires more than a communication from a 12 patent owner to another party,” Finisar, 2021 WL 810227 at *4, “direct communication between a 13 patentee and a declaratory plaintiff is not necessary to confer standing,” Arris Grp., Inc. v. Brit. 14 Telecomms. PLC, 639 F.3d 1368, 1378 (Fed. Cir. 2011); see also UCP Int’l, 787 F. App’x at 700 15 (“[J]urisdiction does not turn on whether the patentee specifically communicated with the 16 declaratory judgment plaintiff.”). 17 Through two opinions invoked in the papers here, the Federal Circuit somewhat recently 18 considered a district court’s exercise of jurisdiction over an action in which a plaintiff sought a 19 declaratory judgment establishing its non-infringement of the defendant’s patent. See Mitek Sys., 20 Inc. v. United Servs. Auto. Ass’n, 34 F.4th 1334, 1343 (Fed. Cir. 2022) (“Mitek I”); Mitek Sys., Inc. 21 v. United Servs. Auto. Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”). In Mitek I, the 22 Federal Circuit reversed and remanded the lower court’s determination that the plaintiff lacked 23 standing to pursue such declaratory relief on the basis that the lower court failed to fully assess the 24 existence of a dispute between the parties, the scope of the plaintiff’s indemnification obligations 25 to its customers arising from the potentially infringing product, and a declination of jurisdiction. 26 Mitek I, 34 F.4th at 1341-48. In Mitek II, after the district court permitted jurisdictional discovery 27 and conducted a more exacting analysis of the plaintiff’s purported basis for standing, the Federal 1 court stated that a determination of whether the declaratory judgment plaintiff “reasonably might 2 be liable for infringement requires ‘look[ing] to the elements of the potential cause of action’ and 3 considering both the patent claims at issue and the alleged facts concerning Mitek and its 4 customers in light of those elements.” Id. at 1343 (citing Microsoft Corp. v. DataTern, Inc., 755 5 F.3d 899, 903-05 (Fed. Cir. 2014)). Further, the Mitek II court identified that district courts are 6 required to consider whether there exist allegations by the patentee establishing a “reasonable 7 potential” that infringement claims could be brought against the plaintiff, including under each of 8 the separate types of infringement. Mitek II, 139 F.4th at 1343.1 Finally, the Mitek II court 9 considered and affirmed the district court’s determination that, even if a live controversy existed, it 10 would decline to exercise jurisdiction over the declaratory judgment action as a matter of 11 discretion. Id. at 1355-57. 12 A party who “makes, uses, offers to sell, or sells” a patented invention “without authority” 13 directly infringes a patent. 35 U.S.C. § 271(a). To state a claim for direct infringement, a plaintiff 14 must plead facts that give the alleged infringer fair notice of the claim and the accused 15 misconduct. Disc Disease Sols. Inc. v. VGH Sols., Inc., 888 F.3d 1256, 1260 (Fed. Cir. 2018). 16 Here, Biogy’s alleged infringement “claim charts” included in “Notice of Infringement” 17 letters sent to Okta’s customers explicitly accuse them of infringing by using TOTPs. Okta FAC 18 ¶¶ 20-28; cf. SanDisk Corp. v. STMicroelectronics, Inc., 480 F.3d 1372, 1381-83 (Fed. Cir. 2007) 19 (holding there is a “substantial controversy” warranting declaratory judgement jurisdiction where 20 a patentee “assert[ed] rights” through written accusations of infringement). Biogy’s motion to 21 dismiss does not dispute or acknowledge Biogy’s identification of Okta’s source code as alleged 22 evidence of infringement in Biogy’s claim charts. Further, Biogy alleges that Okta’s products use 23 RFC 6238 to generate one-time passcodes, and Biogy also alleges that all such uses of RFC 6238 24 infringe the ’236 Patent. FAC ¶¶ 29-30. Indeed, even the exhibits Biogy cites in its motions to 25

26 1 At the hearing, counsel for both sides confirmed that the Court need not address each of the potential theories of patent infringement in making this assessment – if Plaintiffs establish 27 standing to pursue direct patent infringement, for example, the Court need not also address 1 dismiss establish that Biogy has charged infringement in this form. Compare, e.g., FAC ¶ 35 with 2 Dkt. No. 32-5 at 6-8 (supporting the allegation that Biogy’s counsel alleged that use of “the 3 algorithm standardized at RFC 6238 infringe[s] the patent” and that “[a]mong the algorithms Okta 4 uses to supply codes are those based on the FRC-6238 [sic] standard”). Biogy’s motion concedes 5 that Okta’s complaint “allege[s] that Biogy asserts that” the one-time passcodes issued by Okta 6 comply with the standard that Biogy accuses of infringement. Mot. at 7. Plaintiffs thus properly 7 allege that Biogy accuses them of directly infringing the ’236 patent. Biogy’s letter writing 8 campaign alleging patent infringement establishes Okta’s standing to proceed in this declaratory 9 relief action. 10 C. Defense and Indemnity Obligations 11 Declaratory judgment plaintiffs may establish that a live case or controversy exists where 12 indemnity agreements create a “reasonable potential” for their indemnification liability. See Mitek 13 II, 139 F.4th at 1345-47 (citing Mitek I, 34 F.4th at 1346) (focusing on whether there was “a 14 ‘reasonable potential’ of [the declaratory judgment plaintiff’s] indemnification liability, with that 15 potential giving [the declaratory judgment plaintiff] the required concrete stake in litigating the 16 underlying customers’ freedom from infringement liability to [the patent holder]”). 17 Here, Okta alleges in the FAC that “[m]ultiple Okta customers have made indemnity 18 requests to Okta, requesting that Okta defend and indemnify these customers against Biogy’s 19 infringement allegations.” FAC ¶ 32. “Biogy’s infringement allegations against Okta’s customers 20 are effectively accusations that Okta itself infringes the ’236 patent, both directly (through use of 21 the Okta Accused Products.” FAC ¶ 36. In its opposition brief, Okta identifies Parker Hannifin 22 Corporation (“Parker”) as a customer that received a Biogy letter and seeks indemnification. See 23 Dkt. No. 43 at 9. Okta provides the letter that Biogy sent to Parker and the “Master Subscription 24 Agreement” between Okta and Parker containing the “Okta Indemnification Obligation” at § 9.1 25 of that agreement. See Brenckman Decl. ¶¶ 2-4, Exs. A-B; see also FAC at ¶¶ 25-26. As laid out 26 in the Master Subscription Agreement, “Okta will defend Customer from any and all claims, 27 demands, suits or proceedings brought against Customer by a third party alleging that the Service, 1 indemnify Customer . . . in connection with an Infringement Claim.” Brenckman Decl., Ex. B 2 (“Master Subscription Agreement”) § 9.1 (“Okta Indemnification Obligation”). This includes 3 allegations that an Okta Product “infringe[s] any patent” – the very accusations that Biogy has 4 leveled against Parker due to Parker’s use of an Okta product, which Biogy identifies in its claim 5 chart. See Brenckman Decl. ¶ 2, Ex. A (“Notice of Apparent Infringement of U.S. Patent Number 6 7,669,236” with accompanying “claim chart”). Okta therefore shows a “reasonable potential of 7 indemnification liability” based on Biogy’s allegations against Okta to its customers. See Mitek II, 8 139 F.4th at 1353. This is sufficient to establish Okta’s standing to bring this declaratory relief 9 action. 10 D. Discretionary Declination of Jurisdiction Over Declaratory Action 11 “Given the Declaratory Judgment Act’s use of the word ‘may,’ 28 U.S.C. § 2201(a), the 12 Supreme Court has stated that a district court has ‘unique and substantial discretion in deciding 13 whether to declare the rights of litigants.’ ” Mitek I, 34 F.4th at 1347 (quoting Wilton v. Seven 14 Falls Co., 515 U.S. 277, 286 (1995)). “[A]s long as a district court acts in accordance with the 15 purposes of the Declaratory Judgment Act and the principles of sound judicial administration, [it] 16 has broad discretion to refuse to entertain a declaratory judgment action.” Mitek I, 34 F.4th at 17 1347 (citation and internal quotation marks omitted). However, “[t]here must be well-founded 18 reasons for declining to entertain a declaratory judgment action.” Mitek I, 34 F.4th at 1347 19 (quoting Capo, Inc. v. Dioptics Medical Products, 387 F.3d 1352, 1355 (Fed. Cir. 2004)). For 20 example, “[w]hile the existence of another adequate remedy does not necessarily bar a declaratory 21 judgment, district courts may refuse declaratory relief where an alternative remedy is better or 22 more effective.” Mitek I, 34 F.4th at 1347 (quoting Ford Motor Co. v. United States, 811 F.3d 23 1371, 1379-80 (Fed. Cir. 2016)). 24 Here, Biogy avers that the Court should follow the course set by the district court in 25 Mitek II and dismiss Okta’s declaratory relief case to instead permit Okta to intervene in the next 26 litigation, if any, brought by Biogy against an Okta customer. See Dkt. No. 12 at 18; see also 27 Mitek II, 139 F.4th at 1355 (affirming the district court’s determination that “the ‘best’ way for ] litigation, if any, brought by USAA against a Mitek customer which asserts the [patents-in-suit].’ ” 2 || (citation omitted)). Okta distinguishes the facts here from those in Mitek, noting that Biogy’s 3 claims of infringement challenge its products as they currently stand, unlike the charges of 4 || infringement based on a customer’s customization of a software product in Mitek. See Dkt. No. 43 5 at 21-22. Indeed, in Mitek, to assess whether the accused products potentially infringed, a factual 6 || analysis of the products’ customization for an end user was necessary, requiring at least one of the 7 || plaintiff's customers to be involved in the case — the district court and the Federal Circuit 8 determined that the dispute would prove better suited for adjudication if the declaratory judgment 9 || plaintiff waited for the patentee to bring an enforcement action against one of the customers. 10 || Mitek IT, 139 F.4th at 1347. Given this distinction and the claims of direct infringement Biogy has 11 lobbed against Okta’s TOTP products as distributed (not as customized), this case is already ripe 12 || for adjudication. The Court does not decline jurisdiction as a matter of discretion.

13 || I. CONCLUSION

Y 14 For the foregoing reasons, the Court finds that Okta has standing to pursue this action

15 seeking a declaration of patent non-infringement. The Court therefore DENIES Biogy’s motion A 16 to dismiss.

Z 18 IT IS SO ORDERED. 19 || Dated: February 23, 2026 20 □□ 21 : ARACELI MARTINEZ-OLGUIN 22 United States District Judge 23 24 25 26 27 28