Palo Alto Networks, Inc. v. Finjan, Inc.

Opinion

NOTE: This disposition is nonprecedential.

United States Court of Appeals for the Federal Circuit ______________________

PALO ALTO NETWORKS, INC., Appellant

v.

FINJAN, INC., Appellee ______________________

2017-2314, 2017-2315 ______________________

Appeals from the United States Patent and Trade- mark Office, Patent Trial and Appeal Board in Nos. IPR2015-01979, IPR2016-00151, IPR2016-00919, IPR2016-01071. ______________________

Decided: November 19, 2018 ______________________

ORION ARMON, Cooley LLP, Broomfield, CO, argued for appellant.

JAMES R. HANNAH, Kramer Levin Naftalis & Frankel LLP, Menlo Park, CA, argued for appellee. Also repre- sented by PAUL J. ANDRE. ______________________

Before REYNA, SCHALL, and STOLL, Circuit Judges. 2 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

REYNA, Circuit Judge. In this consolidated appeal, Appellant-Petitioner Palo Alto Networks, Inc. challenges the Patent Trial and Appeal Board’s Final Written Decisions upholding the patentability of U.S. Patent No. 8,141,154 in two inter partes review proceedings. 1 For the reasons below, we affirm the Board’s decision in IPR2015-01979. We vacate the decision in IPR2016-00151 and remand for proceed- ings consistent with the Supreme Court’s decision in SAS Institute, Inc. v. Iancu, 138 S. Ct. 1348 (2018). BACKGROUND I. The ’154 Patent Finjan, Inc. (“Finjan”) owns U.S. Patent No. 8,141,154 (“the ’154 patent”), entitled “System and Method for Inspecting Dynamically Generated Executable Code.” The ’154 patent is broadly directed toward computer virus protection against dynamically generated malicious code and conventional viruses that are statically generated. The ’154 patent describes a system that inspects func- tion inputs in content received over a network for poten- tially malicious behavior and halts execution or modifies the input if deemed unsafe. An embodiment of the system claimed by the ’154 patent contains a gateway computer, a client computer, and a security computer. ’154 patent col. 8 ll. 45–47. The gateway computer receives content from a network, such as the Internet, over a communica- tion channel; the content may be in the form of HTML pages, XML documents, Java applets, and other content renderable on a web browser. Id. col. 8 ll. 48–51. A content modifier modifies original content received by the

1 Symantec Corporation, an original appellant, set- tled and withdrew as a party after this appeal was filed. PALO ALTO NETWORKS, INC. v. FINJAN, INC. 3

gateway computer to produce content that includes a layer of protection to combat dynamically generated malicious code. Id. col. 9 ll. 13–16. The ’154 patent has four independent claims (1, 4, 6, and 10), each reciting a system or software program that executes a substitute function. The substitute function inspects the input to an original function to determine if executing the original function with the input violates a security policy. Claim 1 is illustrative: 1. A system for protecting a computer from dy- namically generated malicious content, compris- ing: a content processor (i) for processing content re- ceived over a network, the content including a call to a first function, and the call including an input, and (ii) for invoking a second function with the in- put, only if a security computer indicates that such invocation is safe; a transmitter for transmitting the input to the se- curity computer for inspection, when the first function is invoked; and a receiver for receiving an indicator from the secu- rity computer whether it is safe to invoke the sec- ond function with the input. ’154 patent col. 17 ll. 31–44. In the language of the ’154 patent, the “first function” is the inspection step in which the content is assessed for safety, and the “second function” is when, having been deemed safe, the content is actually run. II. Proceedings Before the Board Palo Alto Networks, Inc. (“Palo Alto”) filed petitions for inter partes review (“IPR”) in IPR2016-00151 (“the -00151 IPR”) and IPR2015-01979 (“the -01979 IPR”), 4 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

challenging the validity of various claims of the ’154 patent under 35 U.S.C. § 103. A. The -00151 IPR In the -00151 IPR, Palo Alto petitioned for IPR of claims 1–8, 10, and 11 of the ’154 patent as obvious under 35 U.S.C. § 103 over U.S. Patent Application Pub. No. 2007/0113282 A1 (“Ross”), and claims 9 and 12 as obvious under § 103 over Ross and U.S. Patent Application Pub. No. 2002/0066022 A1 (“Calder”). J.A. 3358–3409. The Board instituted review of claims 1–8, 10, and 11 under § 103 over Ross, but declined to institute claims 9 and 12. J.A. 3497. The Board issued a Final Written Decision concluding that Ross disclosed every limitation in the asserted claims except a “call to a first function,” and thus concluded that the instituted claims had not been shown to be unpatent- able under § 103. Palo Alto Networks, Inc. v. Finjan, Inc., IPR2016–00151, 2017 WL 1040254, at *5–7, *10 (P.T.A.B. Mar. 15, 2017) (“-00151 IPR FWD”). Palo Alto moved for rehearing, arguing that the Board should construe the term “call to a first function” the same way in the -01979 and -00151 IPRs. J.A. 3967. The Board agreed that the construction for “a call to a first function” must be con- sistent across the IPRs, and updated its -00151 IPR FWD to adopt the construction from the -01979 IPR. Palo Alto Networks, Inc. v. Finjan, Inc., IPR2016–00151, 2017 WL 2211715, at *1 (P.T.A.B. May 19, 2017). The Board concluded that the new construction did not expand the scope of the term, and on that basis did not update its analysis and conclusions of the patentability of the ’154 patent in the -00151 IPR FWD. Id. at *1–2. B. The -01979 IPR In the -01979 IPR, Palo Alto petitioned for IPR of claims 1–5 of the ’154 patent as obvious under 35 U.S.C. § 103 over U.S. Patent Application Pub. No. 2005/0108562 PALO ALTO NETWORKS, INC. v. FINJAN, INC. 5

(“Khazan”) in view of Sirer, 2 and claims 6–8, 10, and 11 as obvious under § 103 over Khazan in view Sirer and U.S. Patent No. 7,437,362 (“Ben-Natan”). J.A. 234. The Board subsequently instituted on all of the petitioned claims and grounds. J.A. 362. i. Khazan Khazan is the only prior art reference relevant to the -01979 IPR on appeal. Khazan discloses a system for detecting malicious code by performing both static and dynamic analysis. Khazan, Abstract. In the static analy- sis phase, Khazan’s instrumentation process wraps (i.e., surrounds) calls to original/target functions contained in an executable application, such that the calls are inter- cepted by a wrapper function. More specifically, during the static analysis portion of the system, to intercept potentially malicious function activity, Khazan’s system replaces the first line of code in the original function with a jump command. Id. ¶¶ 88, 90–91. Once the program is run, the jump command transfers control of the program to a wrapper function to verify the safety of the original function input. Id. ¶ 82. Khazan’s system saves the first instruction of the original function, replaced by the jump command, to be executed after the program is verified to be safe. Id. ¶ 88. In the language of the ’154 patent, Khazan’s wrapper function is the “first” or substitute function and the original or target function is the “second” function. ii. Final Written Decision in the -01979 IPR In the -01979 IPR, the Board construed two terms of the ’154 patent: “content” and “call to a first function.”

2 Emin Gün Sirer, et al., Design and Implementa- tion of a Distributed Virtual Machine for Networked Computers, 33 ACM SIGOPS Operating Systems Review 202 (Dec. 5, 1999) (“Sirer”). 6 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015–01979, 2017 WL 1040259, at *6–7 (P.T.A.B. Mar. 15, 2017) (“-01979 IPR FWD”). The Board construed “content” to mean “data or information, which has been modified and is received over a network.” Id. at *6. The Board con- strued “call to a first function” as “a statement or instruc- tion in the content, the execution of which causes the function to provide a service.” Id. at *7. The Board held that “the definition of ‘call to a first function’ need not define the particular format of the instruction or [provide] further detail regarding its parameters.” Id. at *6. In assessing the patentability of the ’154 patent, the Board determined it was “not persuaded that Khazan teaches the limitation of invoking the second function only if the invocation is safe,” concluding instead that “Khazan continues the operation of the second function, depending on the verification check performed by the pre-monitoring code.” Id. at *21. Thus, “any combination of teachings of Khazan with Sirer would result in the second function being invoked, as taught by Khazan, upon execution of the instrumented content, but not ‘only if’ the invocation is safe, after receiving the indicator.” Id. The Board found that none of the prior art references taught this limitation, and thus concluded that the ’154 patent had not been shown to be unpatentable as obvious under Khazan. Following the Final Written Decision in the -01979 IPR, Palo Alto sought rehearing, arguing, inter alia, that the Board should construe the term “call to a first func- tion” the same way in the -01979 and -00151 IPRs. J.A. 1005. The Board agreed that claim construction between the two IPRs should be consistent, but noted that Palo Alto did not argue for the construction in the -01979 IPR to be changed or altered in any particular way. Palo Alto Networks, Inc. v. Finjan, Inc., IPR2015–01979, 2017 WL 2211714, at *3 (P.T.A.B. May 19, 2017). The Board thus determined that because it had “not been directed to any PALO ALTO NETWORKS, INC. v. FINJAN, INC. 7

particular issue that [it] misapprehended or overlooked in this proceeding concerning claim construction of a ‘call to a first function,’” no change to its construction of that term was required. Id. DISCUSSION We review decisions of the Board under the standard of the Administrative Procedure Act (“APA”). Novartis AG v. Torrent Pharm. Ltd., 853 F.3d 1316, 1323 (Fed. Cir. 2017). We hold unlawful and set aside the actions of the Board if they are “not in accordance with law” or “unsup- ported by substantial evidence.” 5 U.S.C. § 706. I. The -00151 IPR We first address the effects of SAS Institute, Inc. v. Iancu on the -00151 IPR. The Supreme Court held in SAS that if the Director institutes IPR proceedings, the Board’s review must proceed in accordance with or in conformance to the petition, including “‘each claim chal- lenged’ and ‘the grounds on which the challenge to each claim is based.’” Id. at 1355–56 (quoting 35 U.S.C. § 312(a)(3)). After SAS, this court has held that remand to the Board can be appropriate to consider non-instituted grounds as well as non-instituted claims. See BioDelivery Scis. Int’l, Inc. v. Aquestive Therapeutics, Inc., 898 F.3d 1205, 1208 (Fed. Cir. 2018) (collecting cases). We have also declined to find that a party waives its right to seek SAS-based relief due to failure to argue against partial institution before the Board. Id. The Board instituted the -00151 IPR on less than all claims and grounds. J.A. 3497. Prior to oral argument in this appeal, Palo Alto notified the court that in light of SAS, it was seeking vacatur and remand of the Board’s decision in the -00151 IPR on the grounds of partial institution. Palo Alto Networks, Inc. v. Finjan, Inc., No. 17-2314, Dkt. No. 44, at 4 (Fed. Cir. May 29, 2018). Because the -00151 IPR FWD addresses fewer than all 8 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

claims challenged in Palo Alto’s petition to institute inter partes review in the -00151 IPR, and because Palo Alto has not waived its objection to the Board’s failure to address the non-instituted claims, we vacate and remand to allow the Board to issue a Final Written Decision consistent with SAS. II. The -01979 IPR As discussed above, in the -01979 IPR, the Board de- termined it was “not persuaded that Khazan teaches the limitation of invoking the second function only if the invocation is safe,” and that “Khazan continues the opera- tion of the second function, depending on the verification check performed by the pre-monitoring code.” -01979 IPR FWD, 2017 WL 1040259, at *21. On appeal, Palo Alto contends that the Board erred in its construction of “invoke,” and that under the correct construction, substantial evidence does not support the Board’s finding that Khazan does not disclose the “only if” limitation. Palo Alto argues that the Board’s understand- ing of “invoke” is both inconsistent with the Board’s use of that term in the -00151 IPR, and incorrect under the broadest reasonable interpretation standard for claim construction. “The ultimate construction of the claim is a legal question and, therefore, is reviewed de novo.” Info-Hold, Inc. v. Applied Media Techs. Corp., 783 F.3d 1262, 1265 (Fed. Cir. 2015). Claim construction based solely upon intrinsic evidence is a matter of law reviewed de novo. Teva Pharms. USA, Inc. v. Sandoz, Inc., 135 S. Ct. 831, 841 (2015). Claim construction seeks to ascribe the meaning to claim terms as a person of ordinary skill in the art at the time of invention would have understood them. Phillips v. AWH Corp., 415 F.3d 1303, 1312–14 (Fed. Cir. 2005) (en banc). In an IPR proceeding, claims are given their PALO ALTO NETWORKS, INC. v. FINJAN, INC. 9

broadest reasonable interpretation in light of the specifi- cation. 3 In re Cuozzo Speed Techs., LLC, 793 F.3d 1268, 1279 (Fed. Cir. 2015), aff’d sub. nom., Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131 (2016). In construing terms, “the person of ordinary skill in the art is deemed to read the claim term not only in the context of the particu- lar claim in which the disputed term appears, but in the context of the entire patent, including the specification.” Phillips, 415 F.3d at 1313. Indeed, the specification is “the single best guide to the meaning of a disputed term” and “[u]sually, it is dispositive.” Id. Claims must be construed “in view of the specification, of which they are a part.” Id. at 1315. Although the Board did not expressly construe the “invoke” term in either the -00151 IPR or the -01979 IPR, Palo Alto argues that the Board interpreted and applied it differently in each of the IPRs. In the -00151 IPR, the Board concluded that “a call to a function” and “invoking a function” are not equivalent; the Board concluded that

3 On October 11, 2018, the United States Patent and Trademark Office issued a final rule revising the claim construction standard for interpreting claims in IPR, post-grant review, and covered business method patent review proceedings before the Board. Changes to the Claim Construction Standard for Interpreting Claims in Trial Proceedings Before the Patent Trial and Appeal Board, 83 Fed. Reg. 51340 (Oct. 11, 2018) (to be codified at 37 C.F.R. pt. 42). The final rule provides that, for these types of proceedings, the Board will apply the same standard applied in federal courts to construe patent claims—i.e., the Phillips standard—to all petitions filed on or after the effective date of November 13, 2018. Id. Because Palo Alto filed its IPR petitions before the effec- tive date of the rule, we construe the claims under the broadest reasonable interpretation standard. 10 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

“call” refers to a programmatic statement or instruction, whereas “first function is invoked” refers to the effect of that call—i.e., “the effect of the call to the function being executed.” -00151 IPR FWD, 2017 WL 1040254, at *4. In contrast, Palo Alto argues, in the -01979 IPR the Board applied “invoke” more broadly to cover merely making a call to a function, without requiring execution. The Supreme Court has emphasized the “importance of uniformity in the treatment of a given patent.” Mark- man v. Westview Instruments, Inc., 517 U.S. 370, 390 (1996). Such uniformity of treatment is similarly im- portant when construing claims of the same patent across different IPR proceedings. But because the Board’s final decision in the -00151 IPR has been vacated as improper- ly instituted under SAS, Palo Alto’s argument about inconsistent constructions across IPRs is now effectively moot. Having requested and obtained vacatur of the -00151 IPR decision on the grounds that it was im- properly instituted, Palo Alto cannot now point to it as a basis for reversing the decision in the -01979 IPR. Any discussion on constructions adopted in a now-vacated decision would constitute an advisory opinion, and accord- ingly, we do not reach any of Palo Alto’s arguments re- garding the -01979 IPR that rely on the -00151 IPR. See Flast v. Cohen, 392 U.S. 83, 96–97 (1968) (“[T]he oldest and most consistent thread in the federal law of justicia- bility is that the federal courts will not give advisory opinions.” (quoting C. Wright, Federal Courts 34 (1963))). Palo Alto makes only two arguments regarding claim construction that do not wholly rely on the -00151 IPR. First, Palo Alto argues that the Board committed a second claim construction error related to “invoking a second function with the input, only if” such invocation is safe, because its understanding of this term gives no meaning to “with the input.” Appellant’s Br. 62. Palo Alto, howev- er, never argued to the Board that “invoking . . . with the input” should be given any particular meaning, and PALO ALTO NETWORKS, INC. v. FINJAN, INC. 11

accordingly, this argument is waived. See Conoco, Inc. v. Energy & Envtl. Int’l, L.C., 460 F.3d 1349, 1358–59 (Fed. Cir. 2006) (“[A] party may not introduce new claim con- struction arguments on appeal or alter the scope of the claim construction positions it took below.”). Second, Palo Alto argues that the Board in the -01979 IPR did not apply the claim limitation “invoking a second function with the input” properly under the broadest reasonable interpretation standard. Specifically, Palo Alto argues that the Board applied an “overly broad” interpretation of the “invoke” term that covers merely initiating a call to a function, regardless of whether the function is executed. Appellant’s Br. 51. Palo Alto’s argument in support of a perceived inconsistency again largely relies on the Board’s approach to the “invoke” terms in the -00151 IPR decision. Appellant’s Br. 2–4, 26–27, 46–52. Palo Alto makes no independent argument based on the ’154 patent as to why the Board’s under- standing of the “invoke” term in the -01979 IPR is incor- rect under the broadest reasonable interpretation standard. See id.; see also Phillips, 415 F.3d at 1313–15. On review of the ’154 patent, we find nothing in the claims or the specification that supports Palo Alto’s contention that “invoking” a function limitation always means that the function is executed. Claim 1 and claim 4 both recite that the content processor invokes “a second function with the input, only if” a security computer or indicator “indicates that such invocation is safe.” ’154 patent col. 17 ll. 36–38, col. 18 ll. 2–3. The specifica- tion describes various instances where a function or function call may be invoked. E.g., id. col. 15 ll. 61–64, col. 16 ll. 24–26. In some instances, the specification describes “invok- ing” a function and the effect of that function being achieved. E.g., id. col. 12 l. 64–col. 13 l. 3 (“This guaran- tees that when content processor 270 begins to process the 12 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

modified input, it will again invoke the substitute func- tion for Document.write( ), which in turn passes the input . . . to security computer 215 for inspection.”). But, because the claims are not so limited, such references in the specification do not require, under the broadest rea- sonable interpretation standard, that “invoking” requires execution of the function. See Owens Corning v. Fast Felt Corp., 873 F.3d 896, 901 (Fed. Cir. 2017) (“It is true that the preferred embodiments . . . focus on roofing materials that are or will be coated or saturated with asphalt or asphalt mix. But that is not enough to narrow the claim scope in the IPR. The claims are plainly not so limited.”). Palo Alto further maintains that this understanding of “invoke” is inconsistent with the meaning of “call to a first function,” which the Board construed to mean “a statement or instruction in the content, the execution of which causes the function to provide a service.” Appel- lant’s Br. 51. But Palo Alto makes only conclusory state- ments to argue that “invoking a function” requires that the function be executed. Id. at 51 (“[The Board’s] con- struction [of “call to a first function”] also recognizes that calling (i.e., invoking) a function requires ‘execution [of the function] which causes the function to provide a service.’” (emphasis added) (last alteration in original)). And although Palo Alto criticizes the Board for not con- struing “invoke” or being unclear as to what “invoke” means, neither Palo Alto nor Finjan sought construction of the “invoke” terms during the -01979 IPR. J.A. 238–42; 454–56. We conclude that the Board did not err in its under- standing of the “invoke” terms in the -01979 IPR FWD. In light of this decision, we do not reach whether, under a different construction, substantial evidence supports the Board’s decision upholding the patentability of the ’154 patent in the -01979 IPR. PALO ALTO NETWORKS, INC. v. FINJAN, INC. 13

CONCLUSION Based on the foregoing, we vacate the Board’s decision in the -00151 IPR and remand for proceedings consistent with the Supreme Court’s decision in SAS Institute. We affirm the Board’s decision in the -01979 IPR that the ’154 patent was not shown to be unpatentable as obvious under § 103. AFFIRMED-IN-PART, VACATED AND REMANDED-IN-PART COSTS No costs.