Secure Authentication Technologies LLC v. Plaid, Inc.

• Court: District Court, D. Utah
• Decided: April 1, 2026
• Docket: 2:25-cv-00514
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF UTAH

SECURE AUTHENTICATION TECHNOLOGIES LLC, MEMORANDUM DECISION AND ORDER Plaintiff, Case No. 2:25-cv-00514-DAK-JCB vs. Judge Dale A. Kimball PLAID, INC., Defendant. Magistrate Judge Jared C. Bennett

This matter is before the court on Defendant Plaid, Inc.’s Motion to Dismiss [ECF No. 29]. On February 26, 2026, the court held a hearing on the motion. At the hearing, Plaintiff was represented by Todd M. Briggs, Jonathan E. Pickhardt, Christopher R. Sabbagh and Stephen Q. Wood, and Defendant was represented by Brian A. Rosenthal, Juliette P. White, Jaysen S. Chung and Hannah L. Bedard. The court took the motion under advisement. After carefully considering the memoranda filed by the parties and the law and facts pertaining to the motion, the court issues the following Memorandum Decision and Order. BACKGROUND Plaintiff Secure Authentication Technologies LLC is the owner of U.S. Patent No. 11,315,090 titled “System and Method for Automated Optimization of Financial Assets” (the ‘090 patent). The patent relates to technology that enables a third-party to gain secure access to online accounts that are otherwise protected by multi-factor authentication protocol and then enables such access on an ongoing basis regardless of whether the account holder is present. Plaintiff states that this technology solved the problem of maintaining account holder security while allowing access to accounts by financial institutions and management systems that the account holder designates, without having to provide additional authentication that was only accessible by the account holder. Claim 1 of the ‘090 patent explains what the patent does describing: A method for permitting a third-party entity to gain access, in a secure manner, to an online account held by an account holder that is secured by a multi-factor authentication protocol, comprising the following steps performed by the third-party entity:

1. Collecting the account holder’s credentials; 2. Encrypting the account holder’s credentials using one or more processors; 3. Storing the account holder’s encrypted credentials using one or more processors, wherein the encrypted credentials are stored in a data store. 4. Receiving a multifactor authentication request from the online account, the multi- factor authentication request indicating that a response is required from the account holder before further access to the online account is granted; 5. Prompting the account holder for a response and receiving the response thereto from the account holder; and 6. Transmitting the account holder’s response to the online account to satisfy the multi- factor authentication request.

Claim 2 of the patent describes the method in claim 1 comprising the steps of:

1. Storing one or more of the account holder’s endpoints for the online account in a data store associated with the online account; and 2. Utilizing said one or more endpoints to permit the third-party to gain access to the online account, or information pertaining to the online account without requiring a response by the account holder to any subsequent multi-factor authentication requests.

Initially, the patent examiner assigned to evaluate the ‘090 patent found that it was directed to ineligible subject matter under 35 U.S.C. § 101. Plaintiff argued the claims were valid because the solution disclosed in the claimed methods can only be implemented by using specialized computer hardware necessary to power the headless browsers and implement 256-bit bank-level encryption. Upon reexamination, the patent officer found, “[t]he claims, though abstract, apply or use the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment.” ECF No.1 Pl.’s Ex. B at 11. Plaintiff alleges that Defendant is infringing on at least claims 1 and 2 of its ‘090 patent by making, using, selling and/or offering for sell Defendant’s software products called “Link” and “Auth” (collectively, “Accused Products”). As described on Defendant’s website, Link

“handles all aspects of the login and authentication experience, including credential, multi-factor authentication, error handling, and sending account linking confirmation email.” Compl. ¶ 17. Auth works with Link to “[i]instantly verify any bank account anywhere . . . [f]or faster and easier account funding, pay by bank, loan repayments, and everything in between.” Id. at ¶ 18. The website further explains that Auth works by “prompt[ing] the user in Plaid Link to fill in the [one time passcode] and wait[ing] for them to fill it in.” Id. Plaintiff sued under 35 U.S.C. § 271(b) and/or § 271(c). Plaintiff alleges that Defendant knows of the ’090 patent, knows it is infringing on the patent and knowingly induces users of the Accused Products to infringe on the ‘090 patent. Defendant brought this Motion to Dismiss arguing that the ‘090 patent is invalid as a matter of law under 35 U.S.C. § 101 because it does

not claim patent-eligible invention.

STANDARD OF REVIEW

“The court’s function on a Rule 12(b)(6) motion is not to weigh potential evidence that the parties might present at trial, but to assess whether the plaintiff’s complaint alone is legally sufficient to state a claim for which relief may be granted.” Miller v. Glanz, 948 F.2d 1562, 1565 (10th Cir. 1991). “When there are well-pleaded factual allegations [as opposed to legal conclusions], a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678. Allegations must “raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). In the context of patent eligibility, “[c]onclusory allegation or those “wholly divorced” from

the [patent] claims or the specifications, cannot defeat a motion to dismiss.” AI Visualize, Inc. v. Nuance Communications, Inc., 97 F.4th 1371, 1380 (Fed. Cir. 2024) (citations omitted). Moreover, the Federal Circuit has “repeatedly recognized that in many cases it is possible and proper to determine patent eligibility under 35 U.S.C § 101 on a Rule 12(b)(6) motion.” Genetic Technologies Ltd. v. Merial L.L.C., 818 F.3d 1369, 1373 (Fed. Cir. 2016). Furthermore, [i]n many cases [ ] evaluation of a patent claim’s subject matter eligibility under § 101 can proceed even before a formal claim construction.” Id. at 1374.

DISCUSSION To be patent eligible, a claimed invention must be directed to a patentable subject matter as described in 35 U.S.C. § 101. Patentable subject matter is defined as “new and useful process, machine, manufacture or composition of matter, or any new and useful improvement thereof.” Id. Congress intended patent laws to “be given wide scope.” Diamond v. Chakrabarty, 447 U.S. 303, 308 (1980). However, there are exceptions to what may be patented, and it has been long held that “[l]aws of nature, natural phenomena and abstract ideas are not patentable.” Association

for Molecular Pathology v. Myriad Genetics, Inc., 569 U.S. 576, 589 (2013). The Supreme Court has devised a two-step test for determining whether an idea is patent eligible. The inquiry is: (1) whether the claims are directed to a “patent-ineligible concept” (step one), and (2) if so, whether the “elements of each claim” contain an “inventive concept” that “ensure[s] that the patent in practice amounts to significantly more than a patent upon the [ineligible concept] itself” (step two). Alice Corp. v. CLS Bank Int’l, 573 U.S. 208, 217-18 (2014). At step one, “the claims are considered in their entirety to ascertain whether their character as a whole is directed to excluded subject matter.” McRO, Inc. v. Bandai Namco Games AM Inc., 837 F.3d 1299, 1312 (Fed. Cir. 2016) (quoting Internet Pats. Corp. v. Active

Network, Inc., 790 F.3d 1342, 1346 (Fed. Cir. 2015)). At step two the “inventive concept must do more than simply recite ‘well-understood, routine, conventional activity.’” Universal Secure Registry LLC v. Apple, Inc., 10 F.4th 1342, 1346 (Fed. Cir. 2021) (quoting Mayo Collaborative Servs. v. Prometheus Labs., Inc., 566 U.S. 66, 79-80 (2012)). Alice Step One Considering the focus of the claims and their character as a whole, the claims here are directed to circumventing or managing an authentication process to facilitate a third party intermediary transaction by maintaining account access. Reduced to their simplest terms, claims 1and 2 describe collecting various account holder information such as an email address as well as other information used to authenticate an account holder’s identity, encrypting and storing that

information, and then using that information to access various accounts held by the account holder. The claimed invention is not the creation of a new technological mechanism, but rather the use of a computer to perform a longstanding intermediary function – managing authorization and access between parties. This is an abstract concept and therefore, patent ineligible. The claims closely resemble those that both the Supreme Court and Federal Circuit have repeatedly found to be abstract1, including those examined in Alice. In Alice, the Supreme Court

1 See e.g., cxLoyalty, Inc. v. Maritz Holdings Inc., 986 F.3d 1367, 1377 (Fed. Cir. 2021) (holding claims were patent ineligible that were, “directed to facilitating or brokering a commercial transaction…between a purchaser using a first form of value… and a seller transacting in a second form of value.”); Boom! Payments, Inc. v. Stripe, Inc., 839 Fed.App’x 528, 532 (Fed. Cir. 2021) (holding patent ineligible claims directed to “verifying consummation of a transaction before releasing payment by a third party” where the steps only described “passing information back and forth by a computer.”). considered claims directed to a computerized scheme for mitigating settlement risk by employing a third-party intermediary to facilitate financial transactions. Alice, 573 U.S. at 219. The Court held “the concept of intermediate settlement risk is a fundamental economic practice long prevalent in our system of commerce” and therefore an abstract idea. Id. (internal quotation

marks omitted). The Court further emphasized that “the use of a third-party intermediary. . . is also a building block of the modern economy.” Id. at 220. Like the claims in Alice, the ‘090 patent inserts a third-party intermediary between an account holder and a financial account, assigning that intermediary the role of managing authorization using generic computer functions. Whereas the Alice claims addressed settlement risk by facilitating trusted financial exchanges, the ‘090 claims address authentication by facilitating authorized account access. This difference in label does not alter the underlying concept: both sets of claims rely on an intermediary to manage relationships of trust between parties and are directed at an abstract idea. Even more closely analogous to the ‘090 patent claims are the claims at issue in

Universal Secure Registry. There, the Federal Circuit held abstract claims directed to an authentication system that allowed a user to verify identity and complete transactions without disclosing personal information. Universal Secure Registry, 10 F.4th at 1348. The claimed invention relied on a “Universal Secure Registry” – a centralized database that functioned as an intermediary, standing in for “multiple conventional forms of identification” and facilitating authorization across transactions. Id. The claims there included: (1) “receiving” a transaction request with a time-varying multicharacter code and “an indication of” the merchant requesting the transaction; (2) “mapping” the time-varying multicharacter code to the identity of the customer in question; (3) “determining” whether the merchant’s access to the customer’s secure data complies with any restrictions; (4) “accessing” the customer’s account information; (5) “providing” the account identifying information to a third party without providing that information to the merchant; and (6) “enabling or denying” the merchant to perform the transaction without obtaining knowledge of the customer’s identifying information.

Id. at 1349 (internal quotation marks omitted). Although there are differences between the claims in Universal Secure Registry and the claims in the ‘090 patent, the similarities are dispositive. Both are directed at the same fundamental objective: enabling a third-party to access or act on behalf of a user by managing authentication and authorization requirements. Moreover, the ‘090 claims are like the claims in Universal Secure Registry in that they “simply recite[d] conventional actions in a generic way (e.g. receiving a transaction request, verifying the identity of a customer and merchant and allowing a transaction) and d[id] not purport to improve any underlying technology.” Id. at 1349 (quoting Solutran, Inc. v. Elavon, Inc., 931 F.3d 1161, 1168 (Fed. Cir. 2019) (internal quotation marks omitted). Similarly, claim 1 of the ‘090 patent includes equally generic language such as: • collect credentials, • encrypt credentials, • store encrypted credentials, • verify credentials, • receive multi-factor authentication requests, • prompt the account holder, and • transmit a response. These steps are described at a high level of generality and reflect routine data processing and authentication activities. The claims do not explain how these functions are performed, nor do they identify any special technological mechanism for achieving the stated result. Plaintiff relies on this court’s decision in InsidesSales.com, Inc. v. SalesLoft, Inc., 2017 WL 2559932 (D. Utah June 13, 2017) to argue that its claims are directed to a specific technological improvement rather than an abstract idea. This reliance is misplaced. InsideSales considered claims that were directed to technology that enabled tracking of

recipients’ interactions with electronic communications - such as detecting when an email was opened, whether embedded hyperlinks were clicked, and how a user navigated and interacted with a website. Id. at *2. Critically, the claims recited specific arrangements of multiple pieces of software and control logic, that “did not exist until Plaintiff’s invention solved the technical problems associated with how email normally worked.” Id. The InsideSales patent was not directed to an abstract idea at step one because it provided “an Internet-based solution to solve a problem unique to the Internet” which the Federal Circuit has held is not an “unpatentable abstract ideas.” Id. at *3 (quoting Intellectual Ventures I LLC v. Capital One Bank (USA), 792 F.3d 1363,1371 (Fed. Cir. 2017)). The claims at issue here are materially different. Unlike InsideSales, the ‘090 claims are not directed at improving the functioning of a

computer system, network or authentication protocol. They do not enhance the operation of multi-factor authentication systems, nor do they introduce a new method for processing or analyzing data. Instead, they use generic computer components operating in a conventional manner–collecting, encrypting, storing and transmitting information-to perform the longstanding function of managing access to accounts through authentication. Indeed, the claims describe something closely akin to a computerized delegation of authority, allowing a third party to act on behalf of an account holder. That concept is not a technological improvement but rather an abstract arrangement governing access and authorization. As the Federal Circuit has “repeatedly held [ ] mere computer-based implementation, without more, is not sufficient to render claims directed to patent-eligible subject matter at step one.” USAA v. PNC Bank N.A., 139 F.4th 1332, 1337 (Fed. Cir. 2025). Alice Step Two Patent claims directed to an abstract idea may nevertheless be patentable if the claim

elements, considered individually or as an “ordered combination,” describe an “inventive concept.” Alice, 573 U.S. at 217. The inventive concept must amount to “significantly more than a patent upon the [abstract concept] itself.” Id. (quoting Mayo Collaborative Services, 566 U.S. at 73). “In computer-implemented inventions, the computer must perform more than ‘well- understood, routine, conventional activities previously known to the industry.’” CosmoKey Solutions GmbH & Co. KG v. Duo Security LLC, 15 F.4th 1091, 1097 (Fed. Cir. 2021) (quoting Alice, 573 U.S. at 233). “The § 101 inquiry must focus on the language of the Asserted Claims themselves.” Synopsys, Inc. v. Mentor Graphics Corporation, 839 F.3d 1138, 1149 (Fed Cir. 2016). Plaintiff argues that its claims closely resemble those in CosmoKey. In that case, the

Federal Circuit declined to determine if the claims were abstract at Alice step one and instead found them valid at step two.2 CosmoKey, 15 F.4th at 1097. The CosmoKey claims related to verifying an authorized user’s identity when using the internet. Instead of requiring the user to input multiple authentication factors, the patent disclosed an automatic process of “[c]hecking for an activated authentication function” so that “the user may activate the authentication function” through a mobile device. Id. at 1094. The Federal Circuit focused on the specificity of the last four claim steps in the patent to find the inventive concept which included: (1) as a criterion for deciding whether the authentication to the transaction shall be granted

2 In CosmoKey the court held, “[w]e need not answer this question, [whether the claims were abstract] however, because even is we accept the district court’s narrow characterization of the ‘903 patent claims, the claims satisfy Alice step two.” 15 F.4th at 1097. or denied, having the authentication device check whether a predetermined time relation exists between the transmission of the user identification and a response from the second communication channel; (2) ensuring that the authentication function is normally inactive and is activated by the user only preliminarily for the transaction; followed by (3) ensuring that said response from the second communication channel includes information that the authentication function is active; and (4) thereafter ensuring that the authentication function is automatically deactivated.

Id. at 1098. The court there found these steps were not conventional at the time. Id. Further, the court found the claim limitations were “specific and recite an improved method for overcoming hacking by ensuring that the authentication function is normally inactive, activating only for a transaction, communicating the activation within a certain time window, and thereafter ensuring that the authentication function is automatically deactivated.” Id. at 1099. Here, the court finds no such specificity or inventive concept, only claims describing conventional use of a computer to store and encrypt data. Plaintiff contends that the inventive concept is present in the ‘090 patent because the “network implements unique and inventive concepts that permits it to act as a proxy for the user and respond to any multi-factor authentication . . . in a way that does not require user intervention, while simultaneously maintaining rigid security measures to avoid unauthorized access to the user’s accounts by other parties.” ‘090 patent 18:53-60. This is little more than a restatement of the abstract idea the court found in step one coupled with conclusory language such as “unique,” “inventive,” and “rigid.” “As a matter of law, narrowing or reformulating an abstract idea does not add ‘significantly more’ to it” and cannot supply the requisite inventive concept. BSG Tech LLC v. Buyseasons, Inc., 899 F.3d 1281, 1291 (Fed. Cir. 2018). Plaintiff argues that the ‘090 patent uses “specialized computer systems” to “implement 256-bit bank-level encryption” and that “specialized computer hardware is necessary to power the headless browsers.” Compl. ¶ 15. However, the patent claims do not contain any reference to “specialized” computer equipment or technology. “The Supreme Court’s cases focus on the claims, not the specifications, to determine section 101 eligibility.” American Axle Manufacturing, Inc. v. Neapco Holdings LLC, 967 F.3d 1285, 1293 (Fed. Cir. 2020). Moreover, the Federal Circuit has “repeatedly held that features that are not claimed are irrelevant as to step

1 or step 2” of the Alice analysis. Id. Accordingly, allegations of “specialized” equipment untethered to the claim language, cannot supply the inventive concept here. Finally, the court considers whether the claims, viewed “as an ordered combination … transform the nature of the claim into a patent-eligible application.” BASCOM Global Internet Services, Inc. v. AT&T Mobility LLC, 827 F.3d 1341, 1347 (Fed. Cir. 2016) (quoting Alice, 573 U.S. at 217) (internal quotation marks omitted). The sequence of steps outlined in the claims reflect the conventional workflow of authentication systems, specifically: collecting credentials, storing and encrypting them, receiving an authentication request, obtaining a response and transmitting the response. The claims here merely combine conventional elements in a conventional way. Such an arrangement does not amount to “significantly more” under Alice

step two and therefore lacks an inventive concept sufficient to confer patent eligibility. Alice, 573 U.S. at 218. Leave to Amend “[A]lthough leave to amend should be given freely, a district court may dismiss without leave where a plaintiff’s proposed amendment would fail to cure the pleadings deficiencies and amendment would be futile.” Sanderling Mgmt. Ltd. v. Snap Inc., 65 F.4th 698, 705 (Fed Cir. 2023). That is the case here. Plaintiff has not identified how any amendment could alter the conclusion that the ‘090 patent is directed to ineligible subject matter or supply the missing inventive concept. More fundamentally, “[n]o amendment to a complaint can alter what a patent itself states” or does not state, which is the focus of the § 101 analysis. /d. at 706. Because the defects arise from the substance of the claims, not the manner in which they are pleaded, amendment would be futile. Accordingly, Plaintiff is denied leave to amend.

CONCLUSION Based on the above reasoning, Defendant’s Motion to Dismiss is GRANTED and the Complaint is DISMISSED WITH PREJUDICE. DATED this Ist day of April 2026. BY THE COURT: LLG. i Bete DALE A. KIMBALL, United Sates District Judge