UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`ZSCALER, INC.,
`Petitioner,
`
`v.
`
`SYMANTEC CORPORATION,
`Patent Owner.
`____________
`
`Case IPR2017-01345
`Patent No. 7,392,543
`____________
`
`
`Mail Stop PATENT BOARD
`Patent Trial and Appeal Board
`U.S. Patent and Trademark Office
`P.O. Box 1450
`Alexandria, Virginia 22313-1450
`
`Submitted Electronically via the Patent Review Processing System
`
`
`PATENT OWNER’S PRELIMINARY RESPONSE
`UNDER 37 C.F.R. § 42.107
`
`

`

`
`
`I. 
`
`II. 
`
`TABLE OF CONTENTS
`
`
`
`INTRODUCTION ........................................................................................... 1 
`
`OVERVIEW OF THE ’543 PATENT ............................................................ 6 
`
`III. 
`
`PERSON OF ORDINARY SKILL IN THE ART .......................................... 7 
`
`IV.  THE BOARD SHOULD DENY INSTITUTION UNDER § 325(d)
`BECAUSE THE PATENT OFFICE PREVIOUSLY CONSIDERED ALL
`OF THE RELIED-UPON REFERENCES. ..................................................... 8 
`
`V.  OVERVIEW OF ALLEGED PRIOR ART .................................................. 14 
`
`VI.  CLAIM CONSTRUCTION .......................................................................... 15 
`
`A. 
`
`B. 
`
`C. 
`
`“packet” ............................................................................................... 16 
`
`“caller’s address” ................................................................................. 23 
`
`“malicious code signature” .................................................................. 23 
`
`VII.  PETITIONER HAS FAILED TO DEMONSTRATE A REASONABLE
`LIKELIHOOD THAT ANY OF THE CHALLENGED CLAIMS ARE
`UNPATENTABLE ........................................................................................ 25 
`
`A.  Ground 1: Petitioner has failed to demonstrate a reasonable
`likelihood that Arnold anticipates Claims 1-3, 5-8, 20, 22, 26,
`and 29-31 ............................................................................................. 26 
`
`1. 
`
`2. 
`
`Petitioner has failed to establish that Arnold anticipates Claims
`1-3, 5-8, 20, 22, 26, and 29-31 at least because Petitioner has
`failed to show that Arnold discloses a “malicious code packet”
` ................................................................................................... 27 
`
`Petitioner has failed to establish that Arnold anticipates Claims
`1-3, 5, and 30 at least because Petitioner has failed to show that
`Arnold discloses “extracting a specific number of bytes
`backwards from said caller’s address” ...................................... 41 
`
`
`
`i
`
`

`

`
`
`B. 
`
`Grounds 2-4: Petitioner has failed to demonstrate a reasonable
`likelihood that Claims 4, 9-19, 20-21, 23-25, and 27-29 are
`obvious in view of one or more of Arnold, Nachenberg, and
`White .................................................................................................... 57 
`
`1. 
`
`2. 
`
`The Board should deny institution of all claims in Grounds 2-4
`because they rely exclusively on the flawed inherency analysis
`of Ground 1 and do not present an obviousness argument for
`the claim term “malicious code packet” ................................... 57 
`
`The Board should deny institution of Claim 4 in Ground 2
`because it relies exclusively on the flawed inherency analysis of
`Ground 1 and does not present an obviousness argument for the
`claim term “extracting a specific number of bytes backwards
`from said caller’s address” ........................................................ 63 
`
`VIII.  CONCLUSION .............................................................................................. 64 
`
`
`
`ii
`
`
`
`

`

`
`
`
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`CASES
`Apple Inc. v. ContentGuard Holdings, LLC,
`IPR2015-00446, Paper 11 (P.T.A.B. July 10, 2015) .............................. 30, 31, 47
`
`Baker Hughes Inc. v. LiquidPower Specialty Prods. Inc.,
`IPR2016-01905, Paper 10 (P.T.A.B. Apr. 10, 2017) ................................... 15, 25
`
`Benitec Biopharma Ltd. v. Cold Spring Harbor Lab.,
`IPR2016-00014, Paper 7 (P.T.A.B. Mar. 23, 2016) ........................................... 11
`
`Cisco Sys., Inc. v. C-Cation Techs., LLC,
`IPR2014-00454, Paper 12 (P.T.A.B. Aug. 29, 2014) ................................... 30, 47
`
`Continental Can Co. v. Monsanto Co.,
`948 F.2d 1264 (Fed. Cir. 1991) ..................................................26, 28, 42, 49, 54
`
`Cuozzo Speed Techs., LLC v. Lee,
`136 S. Ct. 2131 (2016) ........................................................................................ 15
`
`DeSilva v. DiLeanoardi,
`181 F.3d 865 (7th Cir. 1999) ........................................................................ 30, 47
`
`Ford Motor Co. v. Paice LLC,
`IPR2015-00800, Paper 32 (P.T.A.B. Sept. 26, 2016) ......................................... 15
`
`In re Kahn,
`441 F.3d 977 (Fed. Cir. 2006) ............................................................................ 57
`
`In re Magnum Oil Tools Int’l, Ltd.,
`829 F.3d 1364 (Fed. Cir. 2016) .......................................................................... 29
`
`In re NTP, Inc.,
`654 F.3d 1279 (Fed. Cir. 2011) .............................................................. 16, 21, 37
`
`In re Oelrich,
`666 F.2d 578 (CCPA 1981) .......................................................................... 26, 28
`
`
`
`iii
`
`

`

`
`
`In re Suitco Surface, Inc.,
`603 F.3d 1255 (Fed. Cir. 2010) .............................................................. 16, 21, 37
`
`In re Translogic Tech., Inc.,
`504 F.3d 1250 (Fed. Cir. 2007) .......................................................................... 15
`
`InTouch Technologies, Inc. v. VGO Commc'ns, Inc.,
`751 F.3d 1327 (Fed. Cir. 2014) .......................................................................... 54
`
`KSR Int’l Co. v. Teleflex Inc.,
`550 U.S. 398 (2007) ............................................................................................ 57
`
`Metalcraft of Mayville, Inc. v. The Toro Company,
`848 F.3d 1358 (Fed. Cir. 2017) .......................................................................... 54
`
`Microsoft Corp. v. Proxyconn, Inc.,
`789 F.3d 1292 (Fed. Cir. 2015) .............................................................. 16, 21, 37
`
`Nu-Mark v., Fontem Holdings 1, B.V.
`IPR2016-01309, Paper 11 (P.T.A.B. December 15, 2016) ................................ 13
`
`Skechers USA, Inc. v. Adidas AG,
`IPR2017-00322, Paper 9 (P.T.A.B. May 30, 2017) ........................................... 13
`
`Summit 6, LLC v. Samsung Electronics Co., Ltd.,
`802 F.3d 1283 (Fed. Cir. 2015) .......................................................................... 26
`
`SuperGuide Corp. v. DirectTV Enters., Inc.,
`358 F.3d 870 (Fed. Cir. 2004) ............................................................................ 15
`
`Transclean Corp. v. Bridgewood Servs., Inc.,
`290 F.3d 1364 (Fed. Cir. 2002) .............................................................. 26, 42, 49
`
`United States Patents Inc., v. Intellectual Ventures I LLC,
`IPR2016-01643, Paper 9 ..................................................................................... 29
`
`Verlander v. Garner,
`348 F.3d 1359 (Fed. Cir. 2003) .......................................................................... 32
`
`Vivid Techs., Inc. v. Am. Sci. & Eng’g, Inc.,
`200 F.3d 795 (Fed. Cir. 1999) ............................................................................ 25
`
`
`
`iv
`
`

`

`
`
`OTHER AUTHORITIES
`
`37 C.F.R. § 42.6(a)(3) ......................................................................29, 30, 31, 46, 48
`
`37 C.F.R. § 42.100(b) .............................................................................................. 15
`
`37 C.F.R. § 325(d) ........................................................................................... 1, 8, 13
`
`77 Fed. Reg. at 48,763 II.A.4 ................................................................................... 32
`
`
`
`v
`
`

`

`2001
`
`2002
`
`2003
`
`2004
`
`2005
`
`2006
`
`2007
`
`2008
`
`
`
`
`
`
`
`
`
`LIST OF EXHIBITS
`
`Declaration of Dr. Sandeep Chatterjee
`
`’543 Patent File History excerpts
`
`“Dictionary of Computer Science Engineering and Technology”
`(2001) edited by Phillip A. Laplante, PE, Ph.D.
`
`“Microsoft Computer Dictionary” Fifth Edition (2002)
`
`Library of Congress “First telegraphic message --- 24 May 1844”
`available at www.loc.gov/item/mmorse000107 (last accessed on Aug.
`11, 2017)
`
`the Internet” available at
`the Origins of
`“Paul Baran and
`www.rand.org/about/history/baran.list.html (last accessed on Aug. 11,
`2017)
`
`“Newton’s Telecom Dictionary” Fifth Edition (1992)
`
`“Basic Definitions” available at https://www.epo.org/searching-for-
`patents/helpful-resources/first-time-here/definitions.html
`(last
`accessed Aug. 14, 2017)
`
`vi
`
`

`

`
`
`I. INTRODUCTION
`The Board should not institute inter partes review of any challenged claims
`
`of U.S. Patent No. 7,392,543 (the “’543 Patent”), because Petitioner Zscaler, Inc.
`
`has not shown a reasonable likelihood of prevailing on any of its asserted grounds
`
`of unpatentability. Petitioner relies on three references in four asserted grounds:
`
`U.S. Patent No. 5,440,723 (“Arnold”), U.S. Patent No. 6,357,008 (“Nachenberg”),
`
`and “Anatomy of a Commercial-Grade Immune System” by Steven R. White et al.
`
`(“White”).
`
`Grounds 1-4 – § 325(d)
`
`The Board should deny institution of Grounds 1-4 under 37 C.F.R. § 325(d),
`
`because the Petition relies solely on references that the Patent Office previously
`
`considered and over which determined the claims were patentable. The Board
`
`should use its discretion and deny institution to prevent the unwarranted burden
`
`and expense to the Patent Owner of defending the validity of the ’543 Patent
`
`against references already considered by the Patent Office, and to prevent the
`
`Board from having to waste its limited resources adjudicating an issue that was
`
`already decided by the Patent Office.
`
`Ground 1 – “malicious code packet”
`
`The Board should deny institution of Ground 1, because the Petitioner has
`
`not met its burden of establishing that Arnold anticipates the challenged claims.
`
`
`
`1
`
`

`

`
`
`Petitioner does not identify any disclosure in Arnold of the claim element
`
`“malicious code packet,” required by all claims of the ’543 Patent, and instead
`
`appears to rely on unsupported inherency.
`
`Petitioner first asserts that “[a] person of ordinary skill in the art would
`
`understand from Arnold’s teachings that the disclosed reports could be formatted
`
`and sent in the form of packet(s)[.]” Pet. at 26 (emphasis added). However,
`
`merely asserting that “the disclosed reports could be formatted and sent in the form
`
`of packet(s)” is insufficient as a matter of law to establish anticipation through
`
`inherency. Id. (emphasis added); see infra at § VII(A)(1)(a)-(b). Petitioner then
`
`refers back to this legally deficient inherency assertion, stating “[a]s discussed
`
`above . . . , each of these signals or reports are necessarily packetized for
`
`transmission, e.g., on a LAN[.]” Pet. at 28 (emphasis added). Petitioner’s
`
`conclusory statement that the “signals or reports are necessarily packetized for
`
`transmission” is entirely unsupported in the Petition and is in fact contradicted by
`
`the very portion of the Petition it cites to for support. Specifically, Petitioner’s
`
`statement that “[a] person of ordinary skill in the art would understand from
`
`Arnold’s teachings that the disclosed reports” merely “could be formatted and sent
`
`in the form of packet(s)” contradicts Petitioners subsequent statement that “[a]s
`
`discussed above. . . , each of these signals or reports are necessarily packetized for
`
`transmission, e.g., on a LAN[.]” Pet. at 26 and 28 (emphasis added).
`
`
`
`2
`
`

`

`
`
`The Board should reject Petitioner’s legally insufficient and conclusory
`
`arguments that Arnold inherently discloses the claim element “malicious code
`
`packet.” Because all claims in Ground 1 require a “malicious code packet” and
`
`because the Petitioner refers back to the flawed analysis discussed above for all
`
`claims in Ground 1, the Board should deny institution for all claims of Ground 1.
`
`Grounds 2-4 – “malicious code packet”
`
`The Board should further deny institution of Grounds 2-4 because all claims
`
`in Grounds 2-4 also require the claim element “malicious code packet,” and
`
`Grounds 2-4 also refer back to the flawed argument discussed above with respect
`
`to “malicious code packet.” Although Grounds 2-4 rely on obviousness instead of
`
`anticipation, Grounds 2-4 do not present any independent obviousness argument
`
`for “malicious code packet” and merely refer to the legally insufficient inherency
`
`analysis in Ground 1. As such, Petitioner has not presented an assertion that
`
`“malicious code packet” is “obvious” in view of Arnold, and the Board should
`
`deny institution for all claims of Grounds 2-4.
`
`Ground 1 – “extracting a specific number of bytes backwards”
`
`The Board should also deny institution of Claims 1-3, 5, and 30 in Ground 1
`
`because the Petitioner has not met its burden of establishing that Arnold anticipates
`
`the claim element “extracting a specific number of bytes backwards from said
`
`caller’s address.”
`
`
`
`3
`
`

`

`
`
`The Petition argues that Arnold “specifically disclosed that the candidate
`
`signatures extracted near (and back from) the caller’s address — that is, near the
`
`beginning or ‘head’ of the virus code — are particularly useful as extracted
`
`malicious code signatures.” Pet. at 22. The actual disclosure from Arnold states:
`
`“Self-garblers typically consist of a short decrypting ‘head’ portion followed by
`
`code which is transformed in an easily-invertible manner . . . when the virus is
`
`replicated.” Ex. 1008 at 8:46-51 (emphasis added). Notably, Arnold does not ever
`
`state that the “head” is “near the beginning . . . of the virus code,” as alleged in the
`
`Petition. See Pet. at 22. Instead, Arnold discloses that the “head” is in front of
`
`“code which is transformed in an easily invertible manner . . . when the virus is
`
`replicated.” Ex. 1008 at 8:46-51 (distinguishing “code which is transformed in an
`
`easily invertible manner” and “the virus” by using different terminology to refer to
`
`each) (emphasis added). As such, the Petition conflates the disclosure in Arnold
`
`that the “head” is in front of “code which is transformed in an easily invertible
`
`manner” and Petitioner’s unsupported assertion that the “head” is “near the
`
`beginning, or ‘head’ of the virus code.” Ex. 1008 at 8:46-56; Pet. at 22. This
`
`distinction is critical, because it is possible for the “head” to be located far from the
`
`“beginning . . . of the virus code” and still be in front of “code which is
`
`“transformed in an easily-invertible manner . . . when the virus is replicated,” as
`
`disclosed in Arnold.
`
`
`
`4
`
`

`

`
`
`Arnold further discloses that “the only portion of the code which remains
`
`invariant, from one instance of the virus to another, is the head.” Ex. 1008 at
`
`8:51-56 (emphasis added). Fig. 6A of Arnold “illustrates exemplary portions of
`
`three instances of a computer virus, the three portions each including an invariant
`
`portion and variant portions,” and clearly depicts the “invariant” portion of the
`
`code in the middle of the virus, as opposed to being necessarily “near the
`
`beginning . . . of the virus code” as alleged by the Petition. Id. at 3:36-39 and Fig.
`
`6A; Pet. at 22.
`
`
`
`Because the Petition relies on the unsupported proposition that the “head” of
`
`“code which is transformed in an easily invertible manner . . . when the virus is
`
`replicated” is necessarily “near the beginning . . . of the virus code” which
`
`Petitioner equates to the “caller’s address,” the Board should reject Petitioner’s
`
`legally insufficient and conclusory argument that Arnold inherently discloses the
`5
`
`
`
`

`

`
`
`claim element “extracting a specific number of bytes backwards from said caller’s
`
`address,” and deny institution of Claims 1-3, 5, and 30 of Ground 1.
`
`Ground 2 – “extracting a specific number of bytes backwards”
`
`The Board should further deny institution of Claim 4 in Ground 2 because
`
`Claim 4 requires the claim element “extracting a specific number of bytes
`
`backwards from said caller’s address,” and Petitioner merely cites back to the
`
`flawed inherency argument from Ground 1. Although Ground 2 relies on
`
`obviousness instead of anticipation, the Petition does not present any obviousness
`
`argument for “extracting a specific number of bytes backwards from said caller’s
`
`address.” As such, Petitioner has not presented any assertion that the claim
`
`element “extracting a specific number of bytes backwards from said caller’s
`
`address” is obvious in view of Arnold and “one of ordinary skill in the art,” and the
`
`Board should deny institution Claim 4 of Ground 2.
`
`II. OVERVIEW OF THE ’543 PATENT
`The ’543 Patent describes a “[b]ehavior blocking application” that “detects
`
`attacks by malicious code” in a computer system. See, e.g., Ex. 1001 at 3:38-40.
`
`A “malicious code packet” is generated that can include a “malicious code
`
`signature” or “parameters” associated with the malicious code. Id. at 6:9-15; 9:25-
`
`38. The “malicious code packet” is sent to another computer system so that “the
`
`further spread of the malicious code on [the] client network,” for example, by “an
`
`
`
`6
`
`

`

`
`
`intrusion detection system.” Id. at 2:53-56. The ’543 Patent also describes
`
`receiving a “malicious code packet” and “determining whether an attack threshold
`
`has been exceeded” and “delivering a signature update” that includes a “malicious
`
`code signature” to “an intrusion detection system.” Id. at 13:34-47; 19:24-36.
`
`III. PERSON OF ORDINARY SKILL IN THE ART
`A person of ordinary skill in the art at the time of the invention of the ’543
`
`Patent would have a Bachelor’s degree in computer science, electrical engineering,
`
`or related scientific field, and at least two to four years of experience related to
`
`network security, distributed computer systems, or a related technology field. Ex.
`
`2001 at ¶ 36. Alternatively, a person of ordinary skill in the art at the time of the
`
`invention of the ’543 Patent would have been someone with an advanced degree,
`
`such as a Master’s Degree, in computer science, electrical engineering, or a related
`
`scientific field, focusing on network security, distributed computer systems, or a
`
`related technology field. Id. Alternatively, a person of ordinary skill in the
`
`relevant timeframe would have been someone having practical experience with
`
`network security, distributed computer systems, or a related technology field that
`
`would have been equivalent to such education. Id.
`
`
`
`7
`
`

`

`
`
`IV. THE BOARD SHOULD DENY INSTITUTION UNDER § 325(d)
`BECAUSE THE PATENT OFFICE PREVIOUSLY CONSIDERED ALL OF
`THE RELIED-UPON REFERENCES.
`
`Petitioner relies on three references for the four asserted grounds: U.S.
`
`Patent No. 5,440,723 (“Arnold”), U.S. Patent No. 6,357,008 (“Nachenberg”), and
`
`“Anatomy of a Commercial-Grade Immune System” by Steven R. White et al.
`
`(“White”). The Patent Office considered all three of these references during
`
`examination and allowed the claims over those references.
`
`Arnold (U.S. Patent No. 5,440,723) was disclosed in the “European Search
`
`Report” dated Jul. 31, 2002 published with the European patent application EP 1
`
`315 066 A11 cited by Applicant in an Information Disclosure Statement (“IDS”)
`
`dated Aug. 16, 2007, which was considered by the Examiner.
`
`
`1 The “A1” suffix to “EP 1 315 066” signifies that it is the “European patent
`
`application published with European search report” as a single “document.” See
`
`Ex. 2008.
`
`
`
`8
`
`

`

`
`
`Ex. 1007 at 8.
`
`
`
`
`
`Ex. 2002 at 51. Notably, Arnold was the first of only four references identified as
`
`“DOCUMENTS CONSIDERED TO BE RELEVANT” in the Jul. 31, 2002
`
`“European Search Report” published with European patent application EP 1 315
`
`066 A1 Ex. 2002 at 51.
`
`Nachenberg was cited by Applicant in an IDS dated Dec. 5, 2003 and was
`
`considered by the Examiner.
`
`
`
`9
`
`

`

`
`
`Ex. 2002 at 5; 13. Nachenberg also appears on the face of the ’543 Patent under
`
`“References Cited.”
`
`
`
`Ex. 1001 at Cover.
`
`White was cited by Applicant in an IDS dated Feb. 20, 2007 and was
`
`considered by the Examiner.
`
`
`
`
`
`10
`
`
`
`

`

`
`
`Ex. 1002 at 3; Ex. 2002 at 21. White also appears in the “References Cited”
`
`portion of the ’543 Patent under “Other Publications”:
`
`
`
`Ex. 1001 at p. 2.
`
`
`
`The Examiner’s initials on the IDSs disclosing Arnold, Nachenberg, and
`
`White demonstrate that the Examiner considered these references. See Benitec
`
`Biopharma Ltd. v. Cold Spring Harbor Lab., IPR2016-00014, Paper 7 at 10
`
`(P.T.A.B. Mar. 23, 2016) (“An Examiner’s initials on an IDS form ‘provides . . . a
`
`clear record in the application to indicate which documents have been considered
`
`by the examiner in the application.’”).
`
`The Examiner issued an Office Action rejecting the claims eight days after
`
`considering Nachenberg and White without using either of those references in the
`
`rejection. Ex. 1003. Accordingly, the Examiner made an affirmative decision not
`
`to include Nachenberg or White in the rejection despite considering both of the
`
`references at the same time of examination. Similarly, the Examiner issued a
`
`Notice of Allowance 12 days after considering the “European Search Report”
`
`disclosing Arnold, demonstrating that the Examiner concluded, without need for an
`
`Office Action, that Arnold did not disclose or render obvious the claims of the ’543
`
`Patent. Ex. 1007.
`
`
`
`11
`
`

`

`
`
`Petitioner asserts that “Arnold is not disclosed or mentioned in the file
`
`history of the ’543 patent.” As demonstrated above, however, this statement is
`
`incorrect because Arnold (U.S. Patent No. 5,440,723) was identified in the
`
`“European Search Report” that published with European patent application EP 1
`
`315 066 A1 that was cited in Applicant’s Aug. 16, 2007 IDS and considered by the
`
`Examiner.
`
` Ex. 2002 at 51.
`
`
`
`12
`
`
`
`
`
`

`

`
`
`Ex. 1007 at 8. The Petition now seeks a second bite at the apple by relying on the
`
`exact same references that the Patent Office previously considered and over which
`
`allowed the claims. The Petition therefore “raises the same . . . prior art . . .
`
`previously [] presented to the Patent Office.” 37 C.F.R. § 325(d). 2
`
`The Board should exercise its discretion to deny institution under § 325(d).
`
`Nu-Mark, IPR2016-01309, Paper 11 at 8-11 (exercising discretion to deny petition
`
`under § 325(d) where Petition relied in part on art that an examiner considered in
`
`an IDS). Petitioner relies on identical references previously presented to and
`
`considered by the Patent Office during examination. Petitioner is asking the Board
`
`to second-guess the Patent Office’s previous decision to allow the claims over the
`
`Arnold, Nachenberg, and White references. Patent Owner already faced that issue
`
`
`2 Petitioner asserts that “[a]lthough Symantec listed Nachenberg and White in an
`
`Information Disclosure Statement during prosecution,
`
`the Office did not
`
`substantively consider them.” Pet. at 55. Petitioner’s assertion that the “Office did
`
`not substantively consider” Nachenberg and White is speculative and undermined
`
`by the Examiner’s initialed statements that he considered the references. Id.;
`
`Skechers USA, Inc. v. Adidas AG, IPR2017-00322, Paper 9 at 7 (P.T.A.B. May 30,
`
`2017) (rejecting argument that the examiner did not “substantively” consider a
`
`reference where reference was only cited on the face of the patent).
`
`
`
`13
`
`

`

`
`
`during examination. Forcing the Patent Owner to defend the validity of the ’543
`
`Patent based on the same references that the Office already considered would
`
`cause Patent Owner unwarranted burden and expense. Moreover, adjudicating an
`
`already-decided issue is not an efficient use of the Board’s resources.
`
`V. OVERVIEW OF ALLEGED PRIOR ART
`U.S. Patent No. 5,440,723 (“Arnold”)
`
`Arnold is generally directed towards identifying “invariant” portions of
`
`viruses and using these “invariant” portions to create signatures for the viruses.
`
`See, e.g., Ex. 1008 at 7:09-10:9. Unlike the ’543 Patent, however, these signatures
`
`are not communicated by “malicious code packet[s]” but are
`
`instead
`
`communicated by various “signals” over dedicated communication paths between
`
`network elements. See, e.g., Id. at Fig. 1C and 19:46-20:21.
`
`
`
`14
`
`
`
`

`

`
`
`Further, unlike the ’543 Patent, Arnold does not generate signatures by
`
`“extracting a specific number of bytes backwards from [a] caller’s address,” e.g., a
`
`“memory location of the malicious code.” Ex. 1001 at 9:25-37. Instead, Arnold
`
`discloses creating signatures from the “invariant” portions of the virus, and does
`
`not disclose that these “invariant” portions are at the “memory location of the
`
`malicious code,” e.g., the virus. See, e.g., Ex. 1008 at 7:09-10:9.
`
`VI. CLAIM CONSTRUCTION
`The Board construes claims of an unexpired patent using the “broadest
`
`reasonable construction in light of the specification of the patent.” 37 C.F.R. §
`
`42.100(b); Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2144-46 (2016).
`
`“Under that standard, claim terms are given their ordinary and customary meaning
`
`in view of the specification, as would be understood by one of ordinary skill in the
`
`art at the time of the invention.” Baker Hughes Inc. v. LiquidPower Specialty
`
`Prods. Inc., IPR2016-01905, Paper 10 at 7 (P.T.A.B. Apr. 10, 2017) (citing In re
`
`Translogic Tech., Inc., 504 F.3d 1250, 1257 (Fed. Cir. 2007)).
`
`“It is important not to import into a claim limitations that are not a part of
`
`the claim.” Ford Motor Co. v. Paice LLC, IPR2015-00800, Paper 32 at 11
`
`(P.T.A.B. Sept. 26, 2016) (citing SuperGuide Corp. v. DirectTV Enters., Inc., 358
`
`F.3d 870, 875 (Fed. Cir. 2004)). However, “[e]ven under the broadest reasonable
`
`interpretation, the Board’s construction . . . ‘must be consistent with the one that
`
`
`
`15
`
`

`

`
`
`those skilled in the art would reach’” and “[a] construction that is ‘unreasonably
`
`broad’ and which does not ‘reasonably reflect the plain language of the disclosure’
`
`will not pass muster.” Microsoft Corp. v. Proxyconn, Inc., 789 F.3d 1292, 1298
`
`(Fed. Cir. 2015) (citing In re NTP, Inc., 654 F.3d 1279, 1288 (Fed. Cir. 2011) and
`
`In re Suitco Surface, Inc., 603 F.3d 1255, 1260 (Fed. Cir. 2010)).
`
`A. “packet”
`All claims of the ’543 Patent require the claim element “malicious code
`
`packet.” See Ex. 1001 at 18:8-20:56. The broadest reasonable interpretation of the
`
`term “packet” is “a unit of data formatted to include a header that contains the
`
`information necessary to route the unit of data through the network to its
`
`destination.” See Ex. 2001 at ¶¶ 42-53; Ex. 2003 at 355 (“The packet header
`
`contains the information necessary to route the packet through the network[.]”).
`
`
`
`The specification states that “[p]rotocols and formats for network packets
`
`are well known to those of skill in the art and depend, for example, on the
`
`particular type of network 106, and so create extracted malicious code packet
`
`operation 214 is not discussed further to avoid detracting from the principals of the
`
`invention.” Ex. 1001 at 6:30-35. The specification of the ’543 Patent makes clear
`
`to a person of skill in the art that the “network packets” have a particular “format,”
`
`and a person of skill in the art would understand from the specification of the ’543
`
`
`
`16
`
`

`

`
`
`Patent that the “malicious code packet” is “formatted” for a “packet” network (i.e.,
`
`a packet-switched network). Ex. 2001 at ¶¶ 42-49.
`
`A person of ordinary skill in the art would also understand that “packets” are
`
`only useful in packet-switched networks. Id. at ¶ 46. Packet-switched networks
`
`rely on shared communication paths between points in the network. Id. at ¶¶ 44-
`
`45. Because communication paths in packet-switched networks are shared
`
`between points of
`
`the networks, data communicated over
`
`the shared
`
`communication paths must contain additional information, known as a “header,”
`
`that identifies the network destination of the data. Id. Specialized network
`
`components such as routers, or packet-switches, read the “headers” of data on the
`
`shared communication path and to identify the destination (e.g., a destination
`
`address) and “route” the data over the shared communication paths to the
`
`destination. Id.
`
`The shared communications paths of packet-switched networks differ from
`
`earlier networks that relied on dedicated communication paths between endpoints
`
`on the network, for example, circuit-switched telephone and telegraph networks.
`
`Id. at ¶ 46. These dedicated communication paths provided a dedicated link
`
`between the communicating endpoints so that data transmitted from one endpoint
`
`would be received at the other endpoint. Id. at ¶¶ 44-45; see Ex. 2004 at 100
`
`(defining “circuit switching” as “a method of opening communications lines, as
`
`
`
`17
`
`

`

`
`
`through the telephone system, by creating a physical link between the initiating and
`
`receiving parties” and that “[u]nlike other methods of transmission, such as packet
`
`switching, . . . requires the link to be established before any communication can
`
`take place.”) Networks with dedicated communication paths, like circuit-switched
`
`networks, did not need or use “headers.” Ex. 2001 at ¶ 46. This “header”
`
`information would be an unnecessary waste of bandwidth in a network where
`
`endpoints were connected on a dedicated communication path. Id.
`
`The ’543 Patent specification further discloses that the “malicious code
`
`packet” is sent over the internet, which is an example of a packet-switched
`
`network. Id. at ¶ 47; see Ex. 2004 at 386 (stating that “[t]he internet is an example
`
`of a packet-switching network”). Specifically, the specification discloses that “the
`
`local analysis center computer [LAC] system also automatically sends an extracted
`
`malicious code packet . . . to a global analysis center” so that “the spread of the
`
`malicious code is rapidly detected and prevented,” and that the “LAC computer
`
`system 112 is also coupled to a global analysis center 116, e.g., over internet 118.”
`
`Ex. 1001 at 2:3-6 and 3:24-25 (emphasis added). Fig. 1 illustrates that the
`
`connection between the “Global Analysis Center 116” and the rest of the system is
`
`through connection 118, which is specifically described as the “internet.” Id. at
`
`Fig. 1; 3:24-25.
`
`
`
`18
`
`

`

`
`
`
`
`The Petition does not propose a construction for the term “packet.”
`
`Although the declaration of Dr. Zadok states that “Microsoft’s Computer
`
`Dictionary, 5th edition (2002), defines a ‘packet’ as ‘a unit of information
`
`transmitted as a whole from one device to another on a network,’” the Petition does
`
`not ever adopt this construction. Ex. 1011 at ¶ 144. Similarly, Dr. Zadok does not
`
`ever actually state that it is his opinion that “packet” should be construed as “a unit
`
`of information transmitted as a whole from one device to another on a network” or
`
`that it is his opinion that a person of skill in the art would understand that a
`
`
`
`19
`
`

`

`
`
`“packet” is “a unit of information transmitted as a whole from one device to
`
`another on a network.” See Ex. 1011 at ¶ 144; infra at § VII(A)(1)(d)-(f)
`
`(discussing the inadequacies of Dr. Zadok’s declaration with respect to “packet.”)
`
`A person of ordinary skill in the art at the time of the ‘543 Patent would not
`
`understand “packet” to be merely “a unit of information transmitted as a whole
`
`from one device to another on a network.” Id. at ¶¶ 50-53. This construction of
`
`“packet” would be so broad that it could transform nearly every conceivable
`
`network into a “packet” network. Ex. 2001 at ¶¶ 50-53. All networks transmit
`
`“unit[s] of information . . . from one device to another on a network.” Id. at ¶ 51.
`
`It is not clear how “transmitted as a whole” would meaningfully modify or limit
`
`“unit[s] of information” or why “transmit[ting] as a whole” is a defining
`
`characteristic of “packet” networks. Id. For example, a bit of information (e.g., a
`
`0 or a 1) is necessarily transmitted “as a whole” because a bit is the smallest unit of
`
`data that can be communica