1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 TRUSTED KNIGHT CORPORATION, Case No. 19-cv-01206-EMC
8 Plaintiff, ORDER RE CLAIM CONSTRUCTION 9 v.
10 INTERNATIONAL BUSINESS MACHINES CORPORATION (IBM), 11 Defendant. 12 13 14 15 I. INTRODUCTION 16 Plaintiff Trusted Knight Corporation (“Trusted Knight”) brings this action against 17 Defendant International Business Machines Corporation (“IBM”), accusing IBM of infringing 18 Trusted Knight’s United States Patent No. 9,503,473 (“the ’473 Patent”). On June 2, 2020, the 19 parties appeared before the Court for a claim construction hearing, and on June 9, 2020, the parties 20 submitted supplemental briefing on the role that predecessor claims play in the construction of 21 subsequent claims. The parties have asked the Court to construe only one term, which appears in 22 claims 1, 11, 22, and 26 of the ’473 patent.1 23 24 25 1 Originally, the parties asked the Court to construe two terms, but shortly before the claim 26 construction hearing, the parties notified the Court that they had agreed to construe the term “an Application Programming Interface (API) stack,” as “an API stack, accessed by a web browser 27 application, including web browser and operating system APIs.” See Transcript of June 2, 2020 1 II. BACKGROUND 2 A. The ’473 Patent 3 Trusted Knight filed this lawsuit against IBM on March 5, 2019, alleging infringement of 4 its ’473 patent, which issued on November 22, 2016. See Docket No. 1. The ’473 patent is 5 entitled “Apparatus, System, and Method for Protecting Against Keylogging Malware,” and it 6 “relates to systems and methods for preventing key logger malware that utilizes form grabbing 7 techniques to steal financial and identity information from users’ browsers.” See ’473 Patent at 8 1:21–24. The patent contends that “[k]ey logging is a method of capturing keyboard input to a 9 computer or computing device,” which “is a common technique for obtaining passwords and 10 sensitive information using unauthorized software.” Id. at 1:50–53. This is the second patent 11 infringement case between the parties, as Trusted Knight explains: “The first case involved U.S. 12 Patent No. 8,316,445 (‘the ’445 Patent’) which is an ancestor of the ’473 Patent. The ’473 Patent 13 incorporates by reference the entire disclosure of the ’445 Patent.” See Opening Claim 14 Construction Brief (“Opening Brief”) at 4, Docket No. 62. 15 On March 28, 2019, IBM filed an answer and counterclaim against Trusted Knight, 16 seeking a declaration of patent non-infringement and a declaration of patent invalidity. See 17 Docket No. 16. Claim construction briefing was completed on May 1, 2020. See Docket Nos. 62, 18 67, and 71. The Court held a tutorial via Zoom webinar on May 15, 2020. See Docket No. 77. 19 B. The Relevant Claims 20 The text of the relevant claims is provided below (with term to be construed in bold). 21 1. Claim 1 22 1. A method for preventing software key logging executable by a microprocessor, 23 comprising: 24 installing and maintaining an anti-key lodger [sic] at a most privileged access level 25 for browser events in an Application Programming Interface (API) stack; detecting, 26 by the anti-key logger, a browser form Submission initiation call event associated 27 with data inputs entered by a user, wherein the form submission initiation call event 1 inputs to a designated entity; and clearing, by the anti-key logger, confidential data 2 from the data inputs to protect against the threat of key logging malware capturing 3 the confidential data. 4 2. Claim 11 5 11. A computer program product to prevent Software key logging including computer program 6 code embedded in a non-transitory microprocessor-readable storage medium executable by 7 a microprocessor, which when executed on the microprocessor, implements a method, 8 comprising: 9 installing and maintaining an anti-key logger at a most privileged access level for 10 browser events in an Application Programming Interface (API) stack; detecting, by 11 the anti-key logger, a browser form Submission initiation call event associated with 12 data inputs entered by a user, wherein the form submission initiation call event is 13 an OnSubmit call event or a Before Navigate call event; submitting the data inputs 14 to a designated entity; and clearing, by the anti-key logger, confidential data from 15 the data inputs, thereby protecting against the threat of key logging malware 16 capturing the confidential data. 17 3. Claim 22 18 22. A method for preventing software key logging executable by a microprocessor, 19 comprising: 20 installing and maintaining an anti-key logger at a most privileged access level for 21 browser events in an Application Programming Interface (API) stack; detecting, by 22 the anti-key logger, a browser form Submission initiation call event associated with 23 data inputs entered by a user in a user input area of a web page, wherein the form 24 submission initiation call event is an OnSubmit call event or a BeforeNavigate call 25 event; submitting the data inputs to a designated entity; identifying form input 26 fields on the web page having confidential data; clearing, by the anti-key logger, 27 the confidential data to prevent capture of the confidential data by key logging 1 of whether or not key logging malware is present. 2 4. Claim 26 3 26. A computer program product to prevent Software key logging including computer program 4 code embedded in a non-transitory microprocessor-readable storage medium executable by 5 a microprocessor, which when executed on the microprocessor, implements a method, 6 comprising: 7 installing and maintaining an anti-key logger at a most privileged access level for 8 browser events in an Application Programming Interface (API) stack; detecting, by 9 the anti-key logger, a browser form Submission initiation call event associated with 10 data inputs entered by a user in a user input area of a web page, wherein the form 11 submission initiation call event is an OnSubmit call event or a BeforeNavigate call 12 event; submitting the data inputs to a designated entity; identifying form input 13 fields on the web page having confidential data; clearing, by the anti-key logger, 14 the confidential data to prevent capture of the confidential data by key logging 15 malware; and wherein the clearing of the confidential data is performed regardless 16 of whether or not key logging malware is present. 17 III. DISCUSSION 18 A. Legal Standard 19 Claim construction is a question of law, although it may have factual underpinnings. See 20 Icon Health & Fitness, Inc. v. Polar Electro Oy, 656 Fed. App’x 1008, 1013 (Fed. Cir. 2016); see 21 also Multilayer Stretch Cling Film Holdings, Inc. v. Berry Plastics Corp., 831 F.3d 1350, 1357 22 (Fed. Cir. 2016). It “serves to define the scope of the patented invention and the patentee’s right 23 to exclude.” HTC Corp. v. Cellular Communs. Equip., LLC, 877 F.3d 1361, 1367 (Fed. Cir. 24 2017); see also O2 Micro Int’l Ld. v. Beyond Innovation Tech. Co., 521 F.3d 1351, 1360 (Fed. Cir. 25 2008) (stating that the purpose of claim construction is “to determin[e] the meaning and scope of 26 the patent claims asserted to be infringed”) (internal quotation marks omitted). 27 Claim construction proceeds according to important principles of interpretation. First, “the 1 Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004).
Free access — add to your briefcase to read the full text and ask questions with AI
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 TRUSTED KNIGHT CORPORATION, Case No. 19-cv-01206-EMC
8 Plaintiff, ORDER RE CLAIM CONSTRUCTION 9 v.
10 INTERNATIONAL BUSINESS MACHINES CORPORATION (IBM), 11 Defendant. 12 13 14 15 I. INTRODUCTION 16 Plaintiff Trusted Knight Corporation (“Trusted Knight”) brings this action against 17 Defendant International Business Machines Corporation (“IBM”), accusing IBM of infringing 18 Trusted Knight’s United States Patent No. 9,503,473 (“the ’473 Patent”). On June 2, 2020, the 19 parties appeared before the Court for a claim construction hearing, and on June 9, 2020, the parties 20 submitted supplemental briefing on the role that predecessor claims play in the construction of 21 subsequent claims. The parties have asked the Court to construe only one term, which appears in 22 claims 1, 11, 22, and 26 of the ’473 patent.1 23 24 25 1 Originally, the parties asked the Court to construe two terms, but shortly before the claim 26 construction hearing, the parties notified the Court that they had agreed to construe the term “an Application Programming Interface (API) stack,” as “an API stack, accessed by a web browser 27 application, including web browser and operating system APIs.” See Transcript of June 2, 2020 1 II. BACKGROUND 2 A. The ’473 Patent 3 Trusted Knight filed this lawsuit against IBM on March 5, 2019, alleging infringement of 4 its ’473 patent, which issued on November 22, 2016. See Docket No. 1. The ’473 patent is 5 entitled “Apparatus, System, and Method for Protecting Against Keylogging Malware,” and it 6 “relates to systems and methods for preventing key logger malware that utilizes form grabbing 7 techniques to steal financial and identity information from users’ browsers.” See ’473 Patent at 8 1:21–24. The patent contends that “[k]ey logging is a method of capturing keyboard input to a 9 computer or computing device,” which “is a common technique for obtaining passwords and 10 sensitive information using unauthorized software.” Id. at 1:50–53. This is the second patent 11 infringement case between the parties, as Trusted Knight explains: “The first case involved U.S. 12 Patent No. 8,316,445 (‘the ’445 Patent’) which is an ancestor of the ’473 Patent. The ’473 Patent 13 incorporates by reference the entire disclosure of the ’445 Patent.” See Opening Claim 14 Construction Brief (“Opening Brief”) at 4, Docket No. 62. 15 On March 28, 2019, IBM filed an answer and counterclaim against Trusted Knight, 16 seeking a declaration of patent non-infringement and a declaration of patent invalidity. See 17 Docket No. 16. Claim construction briefing was completed on May 1, 2020. See Docket Nos. 62, 18 67, and 71. The Court held a tutorial via Zoom webinar on May 15, 2020. See Docket No. 77. 19 B. The Relevant Claims 20 The text of the relevant claims is provided below (with term to be construed in bold). 21 1. Claim 1 22 1. A method for preventing software key logging executable by a microprocessor, 23 comprising: 24 installing and maintaining an anti-key lodger [sic] at a most privileged access level 25 for browser events in an Application Programming Interface (API) stack; detecting, 26 by the anti-key logger, a browser form Submission initiation call event associated 27 with data inputs entered by a user, wherein the form submission initiation call event 1 inputs to a designated entity; and clearing, by the anti-key logger, confidential data 2 from the data inputs to protect against the threat of key logging malware capturing 3 the confidential data. 4 2. Claim 11 5 11. A computer program product to prevent Software key logging including computer program 6 code embedded in a non-transitory microprocessor-readable storage medium executable by 7 a microprocessor, which when executed on the microprocessor, implements a method, 8 comprising: 9 installing and maintaining an anti-key logger at a most privileged access level for 10 browser events in an Application Programming Interface (API) stack; detecting, by 11 the anti-key logger, a browser form Submission initiation call event associated with 12 data inputs entered by a user, wherein the form submission initiation call event is 13 an OnSubmit call event or a Before Navigate call event; submitting the data inputs 14 to a designated entity; and clearing, by the anti-key logger, confidential data from 15 the data inputs, thereby protecting against the threat of key logging malware 16 capturing the confidential data. 17 3. Claim 22 18 22. A method for preventing software key logging executable by a microprocessor, 19 comprising: 20 installing and maintaining an anti-key logger at a most privileged access level for 21 browser events in an Application Programming Interface (API) stack; detecting, by 22 the anti-key logger, a browser form Submission initiation call event associated with 23 data inputs entered by a user in a user input area of a web page, wherein the form 24 submission initiation call event is an OnSubmit call event or a BeforeNavigate call 25 event; submitting the data inputs to a designated entity; identifying form input 26 fields on the web page having confidential data; clearing, by the anti-key logger, 27 the confidential data to prevent capture of the confidential data by key logging 1 of whether or not key logging malware is present. 2 4. Claim 26 3 26. A computer program product to prevent Software key logging including computer program 4 code embedded in a non-transitory microprocessor-readable storage medium executable by 5 a microprocessor, which when executed on the microprocessor, implements a method, 6 comprising: 7 installing and maintaining an anti-key logger at a most privileged access level for 8 browser events in an Application Programming Interface (API) stack; detecting, by 9 the anti-key logger, a browser form Submission initiation call event associated with 10 data inputs entered by a user in a user input area of a web page, wherein the form 11 submission initiation call event is an OnSubmit call event or a BeforeNavigate call 12 event; submitting the data inputs to a designated entity; identifying form input 13 fields on the web page having confidential data; clearing, by the anti-key logger, 14 the confidential data to prevent capture of the confidential data by key logging 15 malware; and wherein the clearing of the confidential data is performed regardless 16 of whether or not key logging malware is present. 17 III. DISCUSSION 18 A. Legal Standard 19 Claim construction is a question of law, although it may have factual underpinnings. See 20 Icon Health & Fitness, Inc. v. Polar Electro Oy, 656 Fed. App’x 1008, 1013 (Fed. Cir. 2016); see 21 also Multilayer Stretch Cling Film Holdings, Inc. v. Berry Plastics Corp., 831 F.3d 1350, 1357 22 (Fed. Cir. 2016). It “serves to define the scope of the patented invention and the patentee’s right 23 to exclude.” HTC Corp. v. Cellular Communs. Equip., LLC, 877 F.3d 1361, 1367 (Fed. Cir. 24 2017); see also O2 Micro Int’l Ld. v. Beyond Innovation Tech. Co., 521 F.3d 1351, 1360 (Fed. Cir. 25 2008) (stating that the purpose of claim construction is “to determin[e] the meaning and scope of 26 the patent claims asserted to be infringed”) (internal quotation marks omitted). 27 Claim construction proceeds according to important principles of interpretation. First, “the 1 Inc., 381 F.3d 1111, 1115 (Fed. Cir. 2004). The words of a claim are generally given their 2 “ordinary and customary meaning,” which is the “meaning that the term would have to a person of 3 ordinary skill in the art in question at the time of the invention.” Phillips, 415 F.3d at 1312–13. 4 “The inquiry into how a person of ordinary skill in the art understands a claim term provides an 5 objective baseline from which to begin claim interpretation.” Id. at 1313. Such a person “read[s] 6 the claim term not only in the context of the particular claim in which the disputed term appears, 7 but in the context of the entire patent, including the specification.” Id. 8 “In some cases, the ordinary meaning of claim language as understood by a person of skill 9 in the art may be readily apparent even to lay judges, and claim construction in such cases 10 involves little more than the application of the widely accepted meaning of commonly understood 11 words.” Id. at 1314. In other instances, however, claim language requires interpretation. In 12 construing claim language, the court looks to “those sources available to the public that show what 13 a person of skill in the art would have understood disputed claim language to mean,” including 14 “the words of the claims themselves, the remainder of the specification, the prosecution history, 15 and extrinsic evidence concerning relevant scientific principles, the meaning of technical terms, 16 and the state of the art.” Id. (quotations and citations omitted). 17 “[T]he claims themselves provide substantial guidance as to the meaning of particular 18 claim terms.” Id. at 1314. The “context in which a term is used in the asserted claim,” “[o]ther 19 claims of the patent in question, both asserted and unasserted,” and “[d]ifferences among claims” 20 are all instructive. Id. “The claims, of course, do not stand alone” and instead “must be read in 21 view of the specification,” which is “[u]sually . . . dispositive” and “the single best guide to the 22 meaning of a disputed term.” Id. at 1315. 23 Courts “normally do not interpret claim terms in a way that excludes disclosed examples in 24 the specification.” Verizon Servs. Corp. v. Vonage Holdings Corp., 503 F.3d 1295, 1305 (Fed. 25 Cir. 2007). However, in general, “limitations from the specification are not to be read into the 26 claims.” Comark Commc'ns, Inc. v. Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998). That is 27 because “the purposes of the specification are to teach and enable those of skill in the art to make 1 effect and force of specifications varies. “[U]pon reading the specification in that context, it will 2 become clear whether the patentee is setting out specific examples of the invention to accomplish 3 those goals, or whether the patentee instead intends for the claims and the embodiments in the 4 specifications to be strictly coextensive.” Id. 5 In addition to consulting the specification, “the court should also consider the patent’s 6 prosecution history.” Markman v. Westview Instruments, Inc., 52 F.3d 967, 980 (Fed. Cir. 1995), 7 aff’d, 517 U.S. 370 (1996) (citing Graham v. John Deere Co., 383 U.S. 1, 33 (1966)). However, 8 because the “prosecution history represents an ongoing negotiation between the [Patent and 9 Trademark Office] and the applicant,” it “often lacks the clarity of the specification” and therefore 10 “is less useful.” Phillips, 415 F.3d at 1317. 11 Though intrinsic evidence—the claims, specification, and prosecution history—is more 12 significant and reliable than extrinsic evidence, courts may also consider the extrinsic record in 13 claim construction, including expert and inventor testimony, dictionaries, and learned treatises. Id. 14 at 1317–18. “Within the class of extrinsic evidence, . . . dictionaries and treatises,” “especially 15 technical dictionaries . . . can assist the court in determining the meaning of particular terminology 16 to those of skill in the art” because they “endeavor to collect the accepted meanings of terms used 17 in various fields of science and technology.” Id. at 1318. 18 Further, expert testimony can “provide background on the technology at issue, to explain 19 how an invention works, to ensure that the court’s understanding of the technical aspects of the 20 patent is consistent with that of a person of skill in the art, or to establish that a particular term in 21 the patent or the prior art has a particular meaning in the pertinent field.” Id. However, 22 “conclusory, unsupported assertions” are not useful, nor should the court accept expert testimony 23 “that is clearly at odds with the claim construction mandated by the claims themselves, the written 24 description, and the prosecution history.” Id. (quotation and citation omitted). 25 /// 26 /// 27 /// 1 B. Analysis 2 Trusted Knight’s No construction necessary. Proposal 3 If construed, the term means “position so that it prevents malware from having a superior level of access.” 4 IBM’s Proposal “kernel level” 5 6 The term to be construed is “most privileged access level.” Trusted Knight maintains that 7 the term does not require construction, as it “can be readily understood by a person of ordinary 8 skill in the art as having its plain and ordinary meaning without the need for any special 9 construction.” Opening Brief at 1. However, it also provides a proposed construction, should the 10 Court determine that construction is necessary. Id. at 2. For its part, IBM believes that claim 11 construction is necessary, and it urges the Court to construe the claims more narrowly than 12 Trusted Knight believes is appropriate. 13 In particular, Trusted Knight proposes that if construction is necessary, the term should be 14 construed as “position so that it prevents malware from having a superior level of access.” Id. at 15 10. IBM contends that the term has no plain and ordinary meaning and should be construed as 16 “kernel level.” IBM’s Responsive Claim Construction Brief (“Responsive Brief”) at 6–7, Docket 17 No. 67. In essence, Trusted Knight asks the Court to furnish the term with a relative meaning 18 (“position so that it prevents malware from having a superior level of access”), while IBM asks the 19 Court to adopt an absolute construction of the term (“kernel level”). It is Trusted Knight’s 20 contention that IBM’s construction is an attempt to “narrow” or “limit the scope of the claims to 21 avoid infringement.” Opening Brief at 10. 22 The parties clearly disagree about the scope of this term, which presents the Court with a 23 dispute it must resolve. “It is not the meaning of the words that determines whether a term needs 24 to be construed; rather, it is whether there is an actual dispute over the scope of the term.” 25 Simpson Strong-Tie Co., Inc. v. Oz-Post Int’l, LLC, 373 F. Supp. 3d 1288, 1294 (N.D. Cal. 2019); 26 O2 Micro, 521 F.3d at 1362 (“When the parties present a fundamental dispute regarding the scope 27 of a claim term, it is the court’s duty to resolve it.”). 1 whether “most privileged access level” has a plain and ordinary meaning or whether claim 2 construction is necessary. While it may sometimes be “readily apparent” that a term has an 3 “ordinary meaning . . . as understood by a person of skill in the art,” the Court does not find a 4 plain and ordinary mean of the term “most privileged access level” to be “readily apparent” such 5 that nothing “more than the application of the widely accepted meaning of commonly understood 6 words” will be required. Id. at 1313–14. The declaration submitted by Trusted Knight does not 7 convince the Court that a person of ordinary skill in the art would conclude otherwise. The 8 declaration from Adam Sorini, a computer scientist at Exponent (an engineering and scientific 9 consulting firm), states:
10 No construction is needed for the term “most privileged access level.” This term has a plain and ordinary meaning that is readily 11 understood by a POSITA to a reasonable degree of certainty. In the context of the ’473 Patent and its invention for protecting against 12 form grabbing malware, “most privileged access level” refers to a level of access superior to any other software components (including 13 malware, if present) accessing sensitive data in the browser memory space. 14 15 Declaration of Adam Sorini (“Sorini Decl.”) ¶ 46, Docket No. 62-1. 16 However, Mr. Sorini’s allegation is conclusory, and offers the Court little more than his 17 conclusion that the tern “has a plain and ordinary meaning that is readily understood by a 18 POSITA.” Id.; see also id. ¶ 53 (“[I]t is my opinion that the term ‘most privilege [sic] access 19 level’ does not require construction.”). For its part, IBM has submitted a declaration from Patrick 20 McDaniel, a computer science professor (at Pennsylvania State University), who testified that 21 “‘most privileged access level’ is meaningless to a person having ordinary skill in the art.” 22 Declaration of Patrick McDaniel (“McDaniel Decl.”) ¶ 6, Docket No. 69. In support of that 23 contention, he noted that the term is not “commonly used,” does not have a “commonly 24 understood meaning,” lacks a “dictionary definition,” and that, were a person of ordinary skill in 25 the art to see the term in isolation, he or she “would be forced to ask: the ‘most privileged access 26 level of what?’” Id. ¶¶ 58, 59. The lack of a readily apparent plain and ordinary meaning – 27 combined with Trusted Knight’s failure to present any convincing evidence that a person of 1 – requires the Court to construe the term. To do so, it looks to “those sources available to the 2 public that show what a person of skill in the art would have understood disputed claim language 3 to mean,” including “the words of the claims themselves, the remainder of the specification, the 4 prosecution history, and extrinsic evidence concerning relevant scientific principles, the meaning 5 of technical terms, and the state of the art.” Phillips, 415 F.3d at 1314. 6 First, the Court looks to the words of the claims themselves. Phillips, 415 F.3d at 1314. 7 On this issue, the Court notes the term disputed by the parties is “most privileged access level,” 8 not “more privileged access level.” While the word most does not necessarily foreclose the 9 construction advanced by Trusted Knight (“position so that it prevents malware from having a 10 superior level of access”), it suggests reference to the zero-ring level for two reasons: (1) because 11 the word most is a superlative word which typically refers to one thing – that which enjoys 12 supremacy above all else, and (2) because, the zero-ring level is, as the ’473 Patent states, “the 13 level with the most privileges . . . also known as the kernel level.” ’473 Patent 8:50–53 (emphasis 14 added). Put differently, if the zero-ring level is without dispute literally the level with the most 15 privileges and access,2 it is thus the “most privileged access level.” 16 Indeed, the parties reached a conclusion involving these very claim terms in earlier 17 litigation. In 2015, the parties participated in a claim construction proceeding regarding several 18 disputed terms in the predecessor ’445 Patent. See Trusted Knight Corp. v. Int’l Bus. Machines 19 Corp., No. CV 14-1063-LPS-CJB, 2015 WL 7307134 (D. Del. Nov. 19, 2015), judgment entered 20 sub nom. Trusted Knight Corp. v. Int’l Bus. Machines Corp. & Trusteer, Inc., No. 21 CV141063LPSCJB, 2015 WL 13123196 (D. Del. Dec. 23, 2015), and aff’d, 681 F. App’x 898 22 (Fed. Cir. 2017) (available at Docket No. 62-5 in this case). In that proceeding, the parties agreed 23 to construe the term “0-ring level” (which the parties agree here is synonymous with “kernel 24 level”) as “most privileged access level.” Id. at *7. Trusted Knight argues IBM should not now 25
26 2 As the patents indicate, and as the parties explained both in their briefing and at the technology tutorial, computer operating systems have different “ring levels” at which different programs 27 operate. The “kernel level” or “zero-ring level” (or Ring 0 level) is considered the most privileged; 1 be permitted to “revers[e] course and argu[e] that this claim is somehow unclear or indefinite.” 2 Reply Claim Construction Brief (“Reply”) at 13. Instead, Trusted Knight asks the Court to ignore 3 the fact that the parties previously agreed to equate the meaning of these two terms. When asked 4 to clarify why the parties had previously agreed to construe the term “zero-ring level,” IBM 5 explained that the parties previously believed it “was not a terminology . . . amenable to a jury” 6 and so the parties sought language that would be more “readily understood.” Transcript at 29. 7 Trusted Knight did not meaningfully disagree this contention. See, e.g., id. at 7 (“Here’s this term 8 in the claim. We want to make it understandable. We think that ‘zero-ring level,’ in the context of 9 the claim, is not understandable. It’s confusing.”). The parties’ prior agreement equating “zero- 10 ring level” with “most privileged access level,” is consistent with IBM’s current construction. 11 Construction of the predecessor ’473 Patent is highly informative to the dispute herein. 12 Trusted Knight argues that the invention taught by the ’473 can operate at different levels, 13 including at the ring-three level and thus the operation of invention would be inconsistent with 14 IBM’s construction. See Transcript at 24–25. However, the invention described in the ’473 15 Patent can be installed at the zero-ring level but operate at the three-ring level. See Transcript at 16 52, 54, 63. Indeed, Trusted Knight highlights this distinction in its supplemental briefing, noting 17 that “[t]he Court recognized that in order to encompass the anti-form-grabbing embodiments 18 covered by the ’473 Patent’s claims, the anti-key logger necessarily may ‘operate’ or be 19 ‘embodied’ in user space and still be ‘installed’ in the kernel level.” Docket No. 88 at 4. 20 IBM’s construction is supported by the specifications. First, all of the embodiments in the 21 ’473 Patent describe the zero-ring level, and none show installation other than at the zero-ring 22 level. While the Court is mindful that importing limitations from the specification is 23 inappropriate, see, e.g., Teleflex, Inc. v. Ficosa N. Am. Corp., 299 F.3d 1313, 1328 (Fed. Cir. 24 2002) (noting that the district court erred by important a limitation from the specification into the 25 claim); CollegeNet, Inc.v. ApplyYourself, Inc., 418 F.3d 1225, 1231 (Fed. Cir. 2005) (“[T]his 26 court will not at any time import limitations from the specification into the claims.”), it also 27 notes that it is appropriate to consider the specification for proper context about the meaning of a 1 F.3d 1374, 1382 (Fed. Cir. 2005) (looking to “[t]he combined teachings within the specification” 2 for evidence of how one of ordinary skill in the art would understand a term). Here, the fact that 3 all of the embodiments in the ’473 Patent describe installation at the zero-ring level suggests that 4 installation at the zero-ring level is what is contemplated by the ’473 Patent. Put differently, there 5 is no indication from the embodiments that the patentee meant to cover anything other than 6 installation at the zero-ring level. 7 Second, the patent also purports to protect against all of the following:
8 Window title enumeration using FindWindow( ) BHO or Firefox Browser Extension hooks 9 LSP (Layered Service Provider) DDE (Dynamic Data Exchange) using WWW GetWin dowinfo 10 topic OLE (Object Linking and Embedding) using IWeb Browser2 11 API Hooking (e.g. Wininet HttpSendRequest) Windows Hooking (e.g. SetWindowsHookEx, WH GET 12 MESSAGE/WH KEYBOARD) Form grabber key loggers 13 Browser location (current URL) gatherers
14 ’473 Patent 9:25–38. However, at the hearing, IBM argued that protection against at least some of 15 the listed threats would require installation at the zero-ring level. See Transcript at 48–50. 16 Although Trusted Knight challenged the notion that protection against all of these threats would 17 require installation at the zero-ring level, it conceded that protection against some of them would 18 require installation at that level: 19 THE COURT: Well, but let me ask you. To protect against API 20 hooking, you need protection, I assume, at the zero-ring level. Correct? 21 MR. GUPTA: And, Your Honor, Diagram 7 -- if you could pull 22 that up, please, Max -- you know, I think makes this pretty clearly. So, yeah, for hook-based keyloggers, Your Honor, that’s where they 23 live, and that’s where you want the protection in the kernel space, and that's the relevant most privileged access level. 24 Id. at 58. In addition, Trusted Knight did not challenge the fact that, as for threats that do not 25 require installation at the zero-ring level, protection could still be provided if installation occurred 26 there. Id. at 52–53. Hence the embodiments highlighted by Trusted Knight would not be 27 categorically excluded if installation were to be required at the kernel- or zero-ring level. Id. 1 Finally, the scope of the ’445 Patent also indicates that the invention is installed at the 2 zero-ring level. See, e.g. ’445 Patent at 7:39–43 (“This invention protects against malicious form- 3 grabbing software and stops it from capturing passwords and other data. Initially, software in 4 accordance with the present invention installs itself at the 0 ring level for all browser events within 5 a stack.”) (emphasis added). Trusted Knight seeks to disavow the force of the ’445 Patent and its 6 specifications, arguing that the prior claims of the ’445 Patent were “absolutely not relevant.” 7 Transcript, at 63. Trusted Knight contends that “the claims of a predecessor patent are not binding 8 on the scope of a successor patent,” see Docket No. 88 at 1, and that the scope of the ’473 Patent is 9 in fact different from the scope of the ’445 Patent, id. at 2. Specifically, it contends that “[t]he 10 ’473 Patent’s claims are specifically tailored to defeating form-grabbing keyloggers in user space, 11 whereas the (now invalid) ’445 Patent’s claims were tailored to defeating both hook-grabbing key 12 loggers and form-grabbing key loggers.” Id. at 3. This makes it “inappropriate to look to 13 references in the ’445 Patent’s specification and claims when interpreting the scope and proper 14 construction of the ’473 Patent’s claims.” Id. at 4. However, this position is directly contradicted 15 by arguments advanced by Trusted Knight at the claim construction hearing:
16 THE COURT: Let me stop you right there. So when you say -- as I understand, what you're saying is that this was an attempt to really 17 bring clarity to the ’445 on this point, not to change the nature or the scope of the invention? 18 MR. GUPTA: Oh, absolutely not, no. I mean, Your Honor, I’m 19 sure that my brothers here representing IBM would never allow a scope in the change, nor would that be appropriate. 20 . . . 21 THE COURT: All right. How do you explain -- going to the ’445, 22 which is relevant because that defines the scope. You can't exceed the scope of the ’445. 23 MR. GUPTA: Correct. 24 . . . 25 MR. GUPTA: We should absolutely be held to the specification of 26 the ’445 because it’s the same specification in the ’473. 27 Transcript at 8, 60, 64. Trusted Knight agrees the ’473 Patent does not exceed the scope of the 1 an API stack, see, e.g., “445 Patent at 11:37—39, counsels strongly in favor of construing the term 2 || “most privileged access level” to mean “zero-ring level.”* 3 IV. CONCLUSION 4 For the foregoing reasons, the Court construes the term “most privileged access level” to 5 || mean “zero-ring level.” As noted above, the parties agree that “kernel level” and “zero-ring level” 6 || are the same thing; the Court adopts the term “zero-ring level” because that was the term agreed to 7 || by the parties in their prior litigation and its meaning will be comprehensible to the jury. 8 9 IT IS SO ORDERED. 10 11 Dated: July 2, 2020 a 12
2B Maes ED M. CHEN 14 United States District Judge 15
(«17
Z 18 19 20 71 3 To be sure, several of the claim terms of the ’°445 Patent were found to be indefinite, and several 22 || claims were invalidated on that basis. See Trusted Knight, 2015 WL 7307134, at *7 (finding “In response to the software key logging through the API stack to an internet communication port” 3 and “a process of passing the encrypted data to a 3-ring level where a hook inserted by a hook- based key logger” to be indefinite); see also Trusted Knight Corp. v. Int'l Bus. Machines Corp., 24 681 F. App'x 898, 904 (Fed. Cir. 2017) (affirming district court ruling and holding that claims 21 and 23 were invalid for indefiniteness). However, those determinations were not made on grounds 25 || relevant here. Invalidated claims do not “cease to be a part of the intrinsic record merely because they are invalid.” Docket No. 87 (IBM’s Supplemental Brief) at 2 (citing Texas Digital Sys., Inc. 26 || ¥. Telegenix, Inc., 308 F.3d 1193, 1202 (Fed. Cir. 2002) (“When a patent is granted, prosecution is concluded, the intrinsic record is fixed, and the public is placed on notice of its allowed claims.”)). 97 || Likewise, “district courts have considered indefinite claims when construing other claims in the same patent.” Jd. (citing Network-I Sec. Sols., Inc. v. Cisco Sys., Inc., 692 F. Supp. 2d 632, 640, 28 643 (E.D. Tex. 2010) (citing language in indefinite claims 1 and 4 for constructions of two of the terms to be construed)).