Virnetx Inc. v. Apple Inc.

Opinion

Case: 22-1523 Document: 77 Page: 1 Filed: 10/20/2023

NOTE: This disposition is nonprecedential.

United States Court of Appeals for the Federal Circuit ______________________

VIRNETX INC., Appellant

v.

APPLE INC., Appellee

KATHERINE K. VIDAL, UNDER SECRETARY OF COMMERCE FOR INTELLECTUAL PROPERTY AND DIRECTOR OF THE UNITED STATES PATENT AND TRADEMARK OFFICE, Intervenor ______________________

2022-1523 ______________________

Appeal from the United States Patent and Trademark Office, Patent Trial and Appeal Board in No. 95/001,682. ______________________

Decided: October 20, 2023 ______________________

IGOR VICTOR TIMOFEYEV, Paul Hastings LLP, Washing- ton, DC, argued for appellant. Also represented by STEPHEN BLAKE KINNAIRD, NAVEEN MODI, JOSEPH PALYS, DANIEL ZEILBERGER. Case: 22-1523 Document: 77 Page: 2 Filed: 10/20/2023

JOSHUA JOHN FOUGERE, Sidley Austin LLP, Washing- ton, DC, argued for appellee. Also represented by THOMAS ANTHONY BROUGHAN, III, JEFFREY PAUL KUSHAN; SCOTT BORDER, Winston & Strawn LLP, Washington, DC.

SARAH E. CRAVEN, Office of the Solicitor, United States Patent and Trademark Office, Alexandria, VA, argued for intervenor. Also represented by THOMAS W. KRAUSE, MONICA BARNES LATEEF, AMY J. NELSON, FARHEENA YASMEEN RASHEED. ______________________

Before LOURIE, BRYSON, and CHEN, Circuit Judges. BRYSON, Circuit Judge. In this appeal from an inter partes reexamination proceeding before the Patent Trial and Appeal Board, the appellant VirnetX Inc. challenges the Board’s decision holding that several claims of VirnetX’s U.S. Patent No. 6,502,135 (“the ’135 patent”) are invalid. We affirm. I The ’135 patent is directed to a system and method for communicating over the Internet and creating a virtual private network following a domain-name server look-up function. 1 Claim 18 of the ’135 patent, which is the principal focus of VirnetX’s appeal, provides as follows: 18. A method of transparently creating a virtual private network (VPN) between a client computer and a target computer, comprising the steps of (1) generating from the client computer a Domain Name Service (DNS) request that requests an IP

1 A domain name server uses a look-up table to cor- relate human-readable domain names to IP addresses and returns the IP address to the user. Case: 22-1523 Document: 77 Page: 3 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 3

address corresponding to a domain name associ- ated with the target computer; (2) determining whether the DNS request trans- mitted in step (1) is requesting access to a secure web site; and (3) in response to determining that the DNS re- quest in step (2) is requesting access to a secure target web site, automatically initiating the VPN between the client computer and the target com- puter, wherein: steps (2) and (3) are performed at a DNS server sep- arate from the client computer, and step (3) com- prises the step of, prior to automatically initiating the VPN between the client computer and the tar- get computer, determining whether the client com- puter is authorized to resolve addresses of non secure target computers and, if not so authorized, returning an error from the DNS request. At the conclusion of the reexamination, the examiner found claim 18, along with several other claims of the ’135 patent, to be invalid for anticipation and obviousness over several references. The Board reversed some of the exam- iner’s rejections but affirmed the rejections of claims 10–14 and 17–18 on various grounds. First, the Board upheld the examiner’s rejection of claim 18 for obviousness over a combination of three refer- ences—Beser, Kent, and Blum. 2 Second, the Board upheld the examiner’s rejection of claim 18 for anticipation based

2 The Beser reference is U.S. Patent No. 6,496,867; the Kent reference is a November 1998 paper entitled “Se- curity Architecture for the Internet Protocol”; and the Blum reference is U.S. Patent No. 6,182,141. Case: 22-1523 Document: 77 Page: 4 Filed: 10/20/2023

on a reference the Board referred to as BinGO. 3 Third, the Board upheld the examiner’s rejection of claims 10 and 12 as anticipated by BinGO. Fourth, the Board upheld the examiner’s rejection of claim 11 as obvious over a combina- tion of BinGO and a reference the Board referred to as Reed. 4 The Board also affirmed the examiner’s rejection of claims 13, 14, and 17, but VirnetX does not challenge the Board’s rulings on those claims. We affirm the Board’s decision on appeal with respect to claims 10, 12, and 18 based on BinGO and, with respect to claim 11, based on the combination of BinGO and Reed. In view of our decisions regarding BinGO and the combina- tion of BinGO and Reed, we do not find it necessary to ad- dress the Board’s reliance on the combination of Beser, Kent, and Blum. 5 II A At the outset of its discussion of BinGO, VirnetX com- plains that the Board “recrafted” claim 18, “ignored the claim language,” and failed to address the limitations set forth in the claim. In particular, VirnetX argues that the Board misconstrued the “wherein” clause of claim 18, omit- ting the “prior to initiating the VPN” limitation and

3 The BinGO reference consists of the BinGO! User’s Guide and the BinGO! Extended Feature Reference. 4 The Reed reference is a paper by Michael G. Reed, Paul F. Syverson, and David M. Goldschlag entitled Prox- ies for Anonymous Routing, presented at the 12th Annual Computer Security Applications Conference in December 1996. 5 We also find it unnecessary to address the Board’s reliance on collateral estoppel with respect to issues con- cerning the combination of Beser and Kent. See J.A. 27– 32. Case: 22-1523 Document: 77 Page: 5 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 5

mischaracterizing the “determining” limitation. As such, VirnetX argues, the Board analyzed only its own version of claim 18, not the actual language of the claim. VirnetX Br. 30. We disagree with VirnetX’s characterization of the Board’s treatment of claim 18. To be sure, claim 18 is writ- ten in a manner that makes it hard to understand, and the Board confessed that it had difficulty in doing so, especially in its effort to map claim 18 on any portion of the ’135 writ- ten description. 6 VirnetX’s quarrel with the Board’s treatment of claim 18 relates to the Board’s statement that it needed to decide “whether, as a general matter, the Beser, Kent, and Blum references would have rendered obvious determining whether a client has permission to access a web site and if not, returning an error message.” J.A. 31. That general characterization of the thrust of claim 18 does not indicate that the Board misunderstood the limitations of the claim, and particularly the “wherein” clause on which VirnetX fo- cuses. In its discussion of obviousness, the Board accu- rately characterized that clause as requiring a determination of “whether a client is authorized to access a non secure target computer and returning an error if the

6 We agree with the Board that claim 18, as drafted, is not easy to understand. Moreover, the Board was correct in stating that the written description of the ’135 patent appears to contain nothing that describes the invention re- cited in claim 18. VirnetX seems to concede as much. As support for the claim, VirnetX points not to the written de- scription, but to a canceled claim that was part of the initial application that ultimately matured into the ’135 patent. Case: 22-1523 Document: 77 Page: 6 Filed: 10/20/2023

client is not authorized to access a non-secure target.” J.A. 32. 7 Later in its decision, when the Board discussed whether BinGO anticipates claim 18, the Board again ac- curately characterized the requirements of claim 18. In that portion of its decision, the Board walked through the limitations of claim 18, pointing out how BinGO satisfied each of them. The Board explained that if a user enters a domain name server request for a website and the destina- tion is unknown to the BinGO! Router, the BinGO! Router will forward the request to a domain name server for do- main name resolution, satisfying steps (1) and (2) of claim 18. J.A. 44–45. If the request from the client computer is for a secure target computer, the Board added, the BinGO! Router sets up a virtual private network consistent with step (3) of the claimed method. J.A. 45. The Board then examined the last limitation of claim 18, which comprises the step of “determining whether the client computer is authorized to resolve addresses of non secure target computers and, if not so authorized, returning an error from the DNS request.” As to that limitation, the Board found that BinGO “discloses authentication of the initiating partner, which would include situations where the requested web-site is non- secure” and that a person of ordinary skill in the art would “have immediately understood that such an authentication failure would result in an error message being returned.”

7 VirtnetX’s contention that the Board ignored the “prior to automatically initiating the VPN” component of the “wherein” limitation overlooks the examiner’s finding, upheld by the Board, that the BinGO! Router “discloses re- quiring authentication before establishing connections to a remote server, by disclosing checking incoming data to de- cide whether the connection should be allowed.” J.A. 37– 38. Case: 22-1523 Document: 77 Page: 7 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 7

Id. Throughout that analysis, contrary to VirnetX’s contention, the Board neither recrafted claim 18 nor misconstrued its limitations. B VirnetX raises two principal contentions regarding the Board’s reliance on BinGO to anticipate claim 18. First, VirnetX notes that the Board’s anticipation analysis was based not only on the instruction manual known as the BinGO! User Guide, but also on the supplemental instruction manual known as the BinGO! Extended Feature Reference. VirnetX contends that the Board’s reliance on two separate references disqualifies anticipation as an invalidating theory, because anticipation requires that all the limitations of a challenged claim be found in a single reference. Second, VirnetX argues that the Board committed error when it found that a person of ordinary skill in the art would have understood that an error message would be returned if the client computer is authorized to resolve addresses of non- secure target computers. VirnetX contends that anticipation cannot rest on a finding that a person of ordinary skill in the art would have envisaged a limitation that is, in fact, missing from the purportedly anticipating reference. Neither argument is persuasive. 1 As for the argument that the BinGO! User Guide and the BinGO! Extended Feature Reference are separate references and that they cannot be combined for purposes of anticipation, the Board found that the User Guide incorporates the Extended Feature Reference and thus the two references must be treated as one for anticipation purposes. That finding is consistent with the law of anticipation. See Advanced Display Sys., Inc. v. Kent State Univ., 212 F.3d 1272, 1282 (Fed. Cir. 2000) (material in a second document is considered incorporated by reference in a host document if the context “makes clear that the Case: 22-1523 Document: 77 Page: 8 Filed: 10/20/2023

material is effectively part of the host document as if it were explicitly contained therein”); see also Callaway Golf Co. v. Acushnet Co., 576 F.3d 1331, 1346 (Fed. Cir. 2019) (incorporation by reference requires that the host document “contain language clearly identifying the subject matter which is incorporated and where it is to be found”) (cleaned up). Whether and to what extent material has been incorporated by reference is a question of law that we review de novo. Advanced Display, 212 F.3d at 1283; Callaway Golf, 576 F.3d at 1346. The BinGO! User Guide repeatedly cites to the BinGO! Extended Feature Reference, instructing the reader to consult the Extended Feature Reference for information about how to configure the virtual private network of the BinGO! Router. The evidence shows that the two documents were “collectively distributed as a single reference document,” and that the User Guide directs users to consult specific parts of the Extended Feature Reference to implement the VPN features of the BinGO! Router. See J.A. 6298 (citing portions of the User Guide). The two documents thus serve in effect as two volumes of a single instruction manual for using the BinGO system. As such, the Board was correct in holding that the BinGO! User Guide incorporates the BinGO! Extended Feature Reference and that the two references can be considered as one for purposes of anticipation. 2 We also reject VirnetX’s argument that the Board improperly found anticipation given its acknowledgement that “BinGO does not expressly disclose returning an error message” as required by claim 18. J.A. 45. This court has made clear that a reference can anticipate, even when it does not expressly recite a claimed limitation, if a person of ordinary skill in the art “would reasonably understand or infer from the prior art reference’s teaching that every claim [limitation] was disclosed in that single reference.” Case: 22-1523 Document: 77 Page: 9 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 9

Genentech, Inc. v. Hospira, Inc., 946 F.3d 1333, 1340–41 (Fed. Cir. 2020) (quoting CRFD Research, Inc. v. Matal, 876 F.3d 1330, 1338 (Fed. Cir. 2017)). On the other hand, a reference that is missing a limitation does not anticipate just because “a skilled artisan would ‘at once envisage’ the missing limitation.” Id. at 1340 (quoting Nidec Motor Corp. v. Zhongshan Board Ocean Motor Co., 851 F.3d 1270, 1274–75 (Fed. Cir. 2017). The core inquiry is whether a person of ordinary skill in the art would understand the reference to disclose the limitation in question, rather than merely “envisage” a limitation that is in fact missing from the reference. In this case, the Board concluded that one of ordinary skill in the art “would have immediately understood” that an authentication failure in the BinGO system “would result in an error message being returned.” J.A. 45 (citing Apple’s Comments Pursuant to 37 C.F.R. § 1.947, J.A. 6299). That is, the limitation in question—returning an error message upon determining that the client computer is not permitted to resolve addresses of non secure target computers—would be understood to be disclosed by the BinGO reference, even though not expressly stated as such in the reference itself. That finding is supported by substantial evidence and is sufficient to satisfy the requirements of anticipation under Genentech. 3 Apart from those two principal challenges to the Board’s use of BinGO as an anticipating reference, VirnetX asserts in passing that BinGO “operates differently than claim 18.” VirnetX Br. 32. The evidence on which VirnetX relies in making that argument consists of statements from its expert’s declaration to the effect that BinGO does not disclose “determining if the user’s PC is authorized to resolve addresses not located” on the network and does not disclose “performing such a determination with respect to ‘non secure target computers.’” Id. (citing J.A. 4122–23). Case: 22-1523 Document: 77 Page: 10 Filed: 10/20/2023

Apple offered contrary evidence, which the examiner credited, and the Board upheld the examiner’s findings on that issue. J.A. 44–45. In particular, Apple offered evidence that in one configuration BinGO requires authentication before the DNS request is resolved, without regard to whether the request specifies a secure or non- secure destination; Apple’s evidence also showed that BinGO discloses routers that establish and maintain connections to multiple networks based on the destination specified in a DNS request. See J.A. 351–52, 6296–97; Right of Appeal Notice pp. 25–26 (Nov. 6, 2019). That is, because BinGO discloses authentication based on target computer security, a person of ordinary skill in the art would understand that BinGO discloses determining whether a user’s computer is authorized to resolve addresses not located on the network, including those of non secure target computers. We conclude that substantial evidence supports the Board’s determination on that issue. For those reasons, we sustain the Board’s ruling that BinGO anticipates claim 18 of the ’135 patent. Because we have upheld the use of the BinGO! User Guide and the BinGO! Extended Feature Reference as a single reference, and because VirnetX has not challenged the rejections of claims 10 and 12 on other grounds in this appeal, we uphold those rejections as well. III VirnetX makes a brief reference to claim 11, arguing that the obviousness rejection of claim 11 based on BinGO and Reed “fails for the same reason” as the rejections of claims 10, 12, and 18 based on BinGO. VirnetX Br. 36. With respect to claim 11, VirnetX makes the same argument that the two BinGO references cannot be considered as one. Because that argument has been rejected for anticipation purposes, it fails a fortiori in the obviousness context. Case: 22-1523 Document: 77 Page: 11 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 11

IV A VirnetX’s final point on appeal relates to the way the Patent and Trademark Office (“PTO”) handled VirnetX’s request for rehearing of the Board’s decision. In its six- page request for rehearing, VirnetX sought reconsideration of various aspects of the Board’s ruling, including a single paragraph devoted to the Board’s reliance on BinGO as an anticipating reference for claim 18. In the concluding paragraph of the request for rehearing, VirnetX stated that “reconsideration of all of VirnetX’s prior arguments, which VirnetX continues to maintain, is also appropriate here given imminent guidance from the Supreme Court regarding the proper remedy for decisions rendered by Board panels whose appointments did not comport with the requirements of the Appointments Clause.” J.A. 7055. Citing this court’s decision in Arthrex, Inc. v. Smith & Nephew, Inc., 941 F.3d 1320 (Fed. Cir. 2019), VirnetX noted that the court had held that the Board’s structure “did not comply with the constitutional requirements because [Board judges] were principal officers of the United States not appointed in conformity with the Appointments Clause’s provisions.” J.A. 7055. VirnetX then pointed out that the Supreme Court “may agree that the remedy [discussed by the Federal Circuit in its Arthrex decision] did not cure the Appointments Clause violation and/or may order a different remedy.” Id. at 7056. In its conclusion, VirnetX stated that “whatever remedy is provided by the Supreme Court should be provided in the present examination.” Id. A week after VirnetX filed its request for rehearing, the Supreme Court issued its decision in Arthrex, in which it agreed with the Federal Circuit that the unreviewable authority wielded by Board judges in inter partes review proceedings is incompatible with the Appointments Clause, but held that an appropriate remedy was to render Case: 22-1523 Document: 77 Page: 12 Filed: 10/20/2023

inoperative the statutory restrictions that prevented the Director of the PTO from reviewing final decisions issued by Board judges during such proceedings. United States v. Arthrex, Inc., 141 S. Ct. 1970 (2021). Considering VirnetX’s express reference to the challenge to the constitutionality of the Board’s structure and VirnetX’s request that it be accorded whatever remedy the Supreme Court provided in its Arthrex decision, the Board treated VirnetX’s request for rehearing as a request for Director review. The Commissioner of Patents, Andrew Hirshfeld, acting on behalf of the Director, then reviewed the request and on January 10, 2022, denied it. J.A. 55– 57. VirnetX now contends that it was improper for the Board to treat the request for rehearing as a request for Director review, and that the Board should itself have ruled on the request for rehearing. As a result, VirnetX argues, this court should remand the case to the Board for a further review of the request for rehearing. Shortly after the Supreme Court’s decision in Arthrex, the PTO issued interim guidance for Director review of Board decisions in inter partes review or post-grant review cases. The guidance explained that in seeking rehearing, a party must choose between asking for rehearing from the Board panel or from the Director and would not be permitted to request both. See Arthrex Q&As, A3, found at https://uspto.gov/patents/patent-trial-and-appeal-board/ procedures/arthrex-qas (“[A] party may request either Director review or rehearing by the original PTAB panel, but may not request both.”). Following the issuance of that guidance, VirnetX did not specify whether it was seeking Director review, Board review, or both. B VirnetX raises several arguments regarding the Board’s handling of the request for rehearing. First, Case: 22-1523 Document: 77 Page: 13 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 13

VirnetX argues that the Board’s failure to render a decision itself on the request for rehearing violated 37 C.F.R. § 41.79(d), which provides that the Board “shall render a decision on the request for rehearing.” Second, VirnetX points to the requirement of the Administrative Procedure Act (“APA”) that an agency “fully and particularly set out the bases upon which it reached [its] decision,” Power Integrations, Inc. v. Lee, 797 F.3d 1318, 1323 (Fed. Cir. 2015), and argues that Commissioner Hirshfeld’s denial order did not adequately explain the basis for his denial of the request for rehearing. VirnetX Br. 38. Third, VirnetX contends that it is unclear whether Commissioner Hirshfeld reviewed the request for rehearing on the merits rather than simply concluding that Director review is unavailable in inter partes reexamination proceedings. VirnetX Br. 41–42. 8 As Apple points out, the subtext of VirnetX’s complaint seems to be that VirnetX should have been permitted to seek both rehearing by the Board and Director review, rather than having to elect one form of review or the other. In the interim guidance provided by the PTO following the Supreme Court’s decision in Arthrex, however, the PTO made clear that a party could choose which form of review to request, but would not be entitled to have a petition for rehearing reviewed by both the Board and the Director. While it is true that the PTO issued its interim guidance

8 VirnetX’s fourth argument is that Commissioner Hirshfeld was not properly appointed as a principal officer of the United States and thus was not qualified to act on behalf of the Director in conducting Director review in this case. Br. 43–44. VirnetX acknowledges that its argument on that issue is foreclosed by this court’s decision in Ar- threx, Inc. v. Smith & Nephew, Inc., 35 F.4th 1328 (Fed. Cir. 2022), and is being raised simply to preserve the issue for en banc or Supreme Court review. Case: 22-1523 Document: 77 Page: 14 Filed: 10/20/2023

after VirnetX filed its request for rehearing, VirnetX could have made clear, following the issuance of that interim guidance, that it wished to have the Board rule on its request for rehearing rather than seeking Director review, but it did not. Contrary to the implications of VirnetX’s position, we do not read section 41.79(d) of the PTO’s regulations to require the PTO to grant the right to two successive reviews of a request for rehearing, one by the Board and the other by the Director. VirnetX cites no authority indicating that such a two-stage review process is required. Nor is the PTO’s position that a party seeking rehearing must choose one or the other of those paths at odds with the text of section 41.79(d), because the PTO could reasonably conclude that a party that elects Director review has waived its right to rehearing by the Board. As for VirnetX’s second argument, neither the PTO regulations (including the PTO’s interim guidance) nor the APA required Commissioner Hirshfeld or the Board to provide an explanation for his decision to deny VirnetX’s request for rehearing. The regulation and the interim guidance do not require such an explanation, 9 and the pertinent portion of the APA, 5 U.S.C. § 555(e), likewise does not require agencies to explain rehearing denials. Rather, the statute expressly states that the requirement of an explanation for agency action does not apply to an agency decision “affirming a prior denial.” See ICC v. Bhd.

9 The regulation provides that the agency’s decision on the request for rehearing “is deemed to incorporate the earlier opinion reflecting its decision for appeal, except for those portions specifically withdrawn . . . .” 37 C.F.R. § 41.79(d). That provision makes it clear that if the agency does not alter the initial decision on rehearing, the expla- nation given in the initial decision will serve as the agency’s final word on the matter. Case: 22-1523 Document: 77 Page: 15 Filed: 10/20/2023

VIRNETX INC. v. APPLE INC. 15

of Locomotive Eng’rs, 482 U.S. 270, 283 (1987) (“The vast majority of denials of reconsideration . . . are made without statement of reasons, since 5 U.S.C. § 555(e) exempts from the normal APA requirement of ‘a brief statement of the grounds for denial’ agency action that consists of ‘affirming a prior denial.’”). There is also no force to VirnetX’s third argument— that Commissioner Hirshfeld’s decision following Director review may not have been based on the merits. If VirnetX can be viewed as having elected Director review, it must be regarded as having accepted the possibility that the Commissioner might decide the request for rehearing on procedural grounds rather than on the merits. Even assuming the PTO erred in treating VirnetX’s request for rehearing as a request for Director review, we conclude that the error was harmless. The bulk of VirnetX’s request for review is addressed to issues not germane to VirnetX’s appeal in this case. The only portion of the request for review that is pertinent here is a single paragraph dealing with claim 18. J.A. 7054–55. In that paragraph, VirnetX argued that the Board erred in holding that the error message limitation could be found in BinGO because a person of ordinary skill in the art would have immediately understood from the BinGO reference that an authentication failure would result in an error message being returned. J.A. 7055. VirnetX does not challenge the Board’s factual finding on that issue, and we have held above that the Board’s legal conclusion flowing from that finding was consistent with our decision in Genentech. It is therefore highly unlikely that the Board’s decision on the request for review would have resulted in relief based on that claim of error. The other ground on which VirnetX challenged the Board’s ruling on claim 18 was VirnetX’s assertion, without elaboration, that the Board “misapprehended” VirnetX’s argument that BinGO does not disclose limitation (3) of Case: 22-1523 Document: 77 Page: 16 Filed: 10/20/2023

claim 18 and the following “wherein” clause of the claim. In our discussion of the Board’s interpretation of claim 18 above, we analyzed and rejected VirnetX’s argument that the Board misunderstood claim 18. For the same reasons, there is no substantial likelihood that the arguments made in VirnetX’s request for rehearing would have led the Board to alter its ruling as to claim 18. We therefore conclude that the PTO’s decision to direct VirnetX’s request for rehearing to Commissioner Hirshfeld rather than the Board was, at most, harmless error, and that a remand for Board consideration of the request is not required. AFFIRMED