throbber
Trials@uspto.gov
`571-272-7822
`
`
`
`
`
`
`
`Paper No.10
`Entered: November 9, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`ZSCALER, INC.,
`Petitioner,
`
`v.
`
`SYMANTEC CORPORATION,
`Patent Owner.
`____________
`
`Case IPR2017-01345
`Patent 7,392,543 B2
`____________
`
`
`
`Before RAMA G. ELLURU, DANIEL N. FISHMAN, and
`STACEY G. WHITE, Administrative Patent Judges.
`
`FISHMAN, Administrative Patent Judge.
`
`
`
`
`DECISION
`Denying Institution of Inter Partes Review
`37 C.F.R. § 42.108
`
`
`
`
`
`
`
`

`

`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`INTRODUCTION
`I.
`Zscaler, Inc. (“Petitioner”) filed a Petition (Paper 3, “Pet.”) requesting
`inter partes review of claims 1–31, all of the claims of the ’543
`patent,(hereinafter the “challenged claims”) of U.S. Patent No. 7,392,543 B2
`(Ex. 1001, “the ’543 patent”) pursuant to 35 U.S.C. §§ 311–319. Symantec
`Corporation (“Patent Owner”) filed a Patent Owner Preliminary Response
`(Paper 9, “Prelim. Resp.”). We have authority to determine whether to
`institute a trial under 35 U.S.C. § 314 and 37 C.F.R. § 42.4(a). An inter
`partes review may be instituted only if “the information presented in the
`petition . . . and any response . . . shows that there is a reasonable likelihood
`that the petitioner would prevail with respect to at least 1 of the claims
`challenged in the petition.” 35 U.S.C. § 314(a).
`Upon consideration of the Petition, the Preliminary Response, and the
`evidence of record, we conclude Petitioner has failed to establish a
`reasonable likelihood of prevailing in showing that any of the challenged
`claims are unpatentable. Accordingly, we deny institution of an inter partes
`review for all of the challenged claims of the ’543 patent.
`A.
`Real Parties-in-Interest and Related Matters
`Petitioner identifies Zscaler, Inc. as the sole real party-in-interest. Pet.
`56. Both Petitioner and Patent Owner identify a related litigation matter
`captioned Symantec Corp. v. Zscaler, Inc., Case No. 1:16-cv-01176-SLR-
`SLF, filed in the U.S. District Court for the District of Delaware. Pet. 56;
`Paper 5, 2.
`
`The ’543 Patent
`B.
`According to the ’543 patent, conventional computer immune systems
`that protect against malicious infection of computer systems utilize file-
`
`2
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`based scanning at client nodes and, when suspicious content is detected, a
`client node sends the suspicious content to a global analysis center for
`further processing. Ex. 1001, 1:11–15. The global analysis center generates
`a malicious code signature based on the received suspect content and returns
`the signature to the client nodes for use in subsequent detection. Id. at 1:16–
`20. Further, according to the ’543 patent, prior conventional immune
`systems detect only suspicious content stored in files and generally do not
`detect malicious content as it is transmitted over networks. Id. at 21–25.
`Some prior network-based intrusion detection systems employed protocol
`analyzers to monitor for malicious content embedded within portions of
`exchanges using known protocols. Id. at 1:26–48. Other network-based
`intrusion systems use a “network sniffer” to detect known signatures of
`malicious code content. Id.
`The ’543 patent suggests a problem with prior network-based systems
`because updating the system for signatures of newly detected malicious
`content is slow—taking hours or days to update, while malicious content
`may still be exchanged over the network. Id. at 49–56. The ’543 patent
`purports to address this problem by providing a host system with local
`capability to detect malicious code affecting the host system and to generate
`a malicious code packet for transmission to a local analysis center system.
`Id. at 1:60–2:8. If the local analysis center detects an attack in progress from
`the received packet, it sends the malicious code packet to a global analysis
`center for rapid dissemination to other host systems. Id.
`Figure 3, reproduced below, describes exemplary processing of
`malicious content in a host system in accordance with the ’543 patent.
`
`3
`
`

`

`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`
`
`Figure 3 above is a flow diagram of a host system for processing detected
`malicious content over a network in accordance with an embodiment of the
`’543 patent. Id. at 9:3–4. Step 204 awaits detection of an attempted attack
`on the host system by malicious code received over the network. Id. Step
`304 then extracts/generates a malicious code signature representing the
`detected malicious, attacking content. Id. at 9:25–10:4. Steps 212A and
`214A create a malicious code packet based on the signature and other
`parameters of the detected malicious code. Id. at 10:5–36. Steps 216A
`
`4
`
`

`

`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`through 222 then send the generated packet to an analysis system for further
`dissemination of a signature for detected malicious content. Id. at 10:37–
`12:20.
`
`
`
`Illustrative Claim
`C.
`Claims 1, 6, 20, and 29–31 are the independent claims of the ’543
`patent. Independent claim 1, reproduced below, is exemplary of the
`challenged claims:
`1. A method comprising:
`detecting an attack by malicious code on a first computer
`system;
`extracting a malicious code signature from said malicious
`code comprising:
`locating a caller's address of said malicious code in
`a memory of said first computer system; and
`extracting a specific number of bytes backwards
`from said caller's address;
`creating an extracted malicious code packet including
`said malicious code signature; and
`sending said extracted malicious code packet from said
`first computer system to a second computer system.
`Alleged Grounds of Unpatentability
`D.
`The Petition sets forth the following asserted grounds of
`unpatentability:
`Reference(s)
`Arnold1
`Arnold
`
`Challenged Claims
`Basis
`102(b) 1–3, 5–8, 20, 22, 26, and 29–31
`103(a) 4, 9–19, and 21
`
`
`1 U.S. Patent No. 5,440,723. Ex. 1008 (“Arnold”).
`
`5
`
`

`

`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`Challenged Claims
`Basis
`Reference(s)
`103(a) 20 and 29
`Arnold and Nachenberg2
`103(a) 23–25, 27, and 28
`Arnold and White3
`Petitioner relies on the Declaration of Dr. Erez Zadok (Ex. 1011) in
`support of its contentions. Patent Owner relies on the Declaration of Dr.
`Sandeep Chatterjee (Ex. 2001) in support of its contentions.
`
`II. ANALYSIS
`Claim Construction
`A.
`As a step in our analysis in regards to determining whether to institute
`a review, we determine the meaning of the claims for purposes of this
`Decision. In an inter partes review, a claim in an unexpired patent shall be
`given its broadest reasonable construction in light of the specification of the
`patent in which it appears. 37 C.F.R. § 42.100(b); see also Cuozzo Speed
`Techs., LLC v. Lee, 136 S. Ct. 2131, 2142–46 (2016) (upholding the use of
`the broadest reasonable interpretation standard). Under the broadest
`reasonable interpretation standard, claim terms generally are given their
`ordinary and customary meaning, as would be understood by one of ordinary
`skill in the art in the context of the entire disclosure. In re Translogic Tech.,
`Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). “[A] claim construction analysis
`must begin and remain centered on the claim language itself.” Innova/Pure
`Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1116 (Fed.
`Cir. 2004). “Though understanding the claim language may be aided by the
`explanations contained in the written description, it is important not to
`
`
`2 U.S. Patent No. 6,357,008 B1. Ex. 1009 (“Nachenberg”).
`3 Steve R. White et al.; ANATOMY OF A COMMERCIAL-GRADE IMMUNE
`SYSTEM. Ex. 1010 (“White”).
`
`6
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`import into a claim limitations that are not a part of the claim.” SuperGuide
`Corp. v. DirecTV Enters., Inc., 358 F.3d 870, 875 (Fed. Cir. 2004). Only
`terms that are in controversy need to be construed and only to the extent
`necessary to resolve the controversy. See Wellman, Inc. v. Eastman Chem.
`Co., 642 F.3d 1355, 1361 (Fed. Cir. 2011); Vivid Techs., Inc. v. Am. Sci.
`& Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999).
`1.
`“Packet”
`All claims recite the exchange of a “malicious code packet.”
`Independent claim 1, for example, recites “creating an extracted malicious
`code packet” and “sending said extracted malicious code packet from said
`first computer system to a second computer system.” Petitioner does not
`propose any particular construction of the term “packet.” Petitioner’s
`declarant refers to the Microsoft Computer Dictionary definition of “packet”
`as “[a] unit of information transmitted as a whole from one device to another
`on a network.” Ex. 1011 ¶ 144 (quoting Ex. 1028, 385). However, as noted
`by Patent Owner, the Petition does not propose adopting this definition or
`refer to this particular testimony of Dr. Zadok. Prelim. Resp. 19.
`Patent Owner argues the ordinarily skilled artisan would have
`understood “packet” to refer to information formatted (i.e., with appropriate
`headers, etc.) for use in a packet-switched network. Id. at 17 (citing Ex.
`2001 ¶ 46). Patent Owner asserts that headers in packets for packet-
`switched networks are required because the communication paths are shared
`among nodes of the network. Id. (citing Ex. 2001 ¶¶ 44–45). By contrast,
`earlier circuit-switched networks (earlier telephone and telegraph networks)
`established temporary, dedicated, communication paths between nodes of
`the network. Id. (citing Ex. 2001 ¶ 46). Patent Owner argues that the
`
`7
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`Specification of the ’543 patent discloses that the “packets” are transmitted
`over the Internet—an example of a packet-switched network. Id. at 18
`(citing Ex. 1001, 2:3–6, 3:24–25, Fig. 1; Ex. 2001 ¶ 47). Thus, Patent
`Owner contends the ordinarily skilled artisan would not have understood
`“packet” to be so broad as to be applicable in all types of networks (e.g.,
`circuit-switched as well as packet-switched) as suggested by Dr. Zadok’s
`reference to the Microsoft Computer Dictionary definition. Patent Owner
`proposes interpreting “packet” to mean “a unit of data formatted to include a
`header that contains the information necessary to route the unit of data
`through the network to its destination.” Id. at 16 (citing Ex. 2001 ¶¶ 42–53;
`Ex. 2003, 355).
`We agree with Patent Owner’s proposed interpretation of “packet”
`and adopt it as our own based on the disclosure of the ’543 patent. The
`broad definition cited by Dr. Zadok, Petitioner’s expert declarant, would
`consider any unit of data—even a single bit of information—exchanged over
`a communication medium to be a packet. Such a definition would be
`unreasonably broad in view of the Specification of the ’543 patent reference
`to transmission of packets over, for example, the Internet—a packet-
`switched network requiring header information to route packets to a desired
`destination. Ex. 1001, 3:24–25. We credit Dr. Chatterjee’s testimony in this
`regard. Ex. 2001 ¶¶ 42–53. For example, Dr. Chatterjee testifies,
`A person of ordinary skill in the art at the time of the invention
`of the ’543 Patent would also understand that “packets” are used
`in “packet-based networks,” i.e., a packet-switched network, and
`need to be “formatted” to include a “header” that “contains the
`information necessary to route the unit of data through the
`network to its destination.”
`
`8
`
`

`

`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`Ex. 2001 ¶ 43 (citing Ex. 2003, 235). Thus, on the record before us, we
`interpret “packet” to mean “a unit of data formatted to include a header that
`contains the information necessary to route the unit of data through the
`network to its destination.”
`
`
`
`Other Terms
`2.
`On this record, we determine that it is unnecessary to provide an
`explicit construction of any other claim terms.
`B.
`35 U.S.C. § 325(d) Discretion
`Section 325(d) of Title 35, U.S. Code, provides, in pertinent part:
`In determining whether to institute or order a proceeding under
`this chapter, chapter 30, or chapter 31, the Director may take into
`account whether, and reject the petition or request because, the
`same or substantially the same prior art or arguments previously
`were presented to the Office.
`Patent Owner argues that this Petition should be denied under
`§ 325(d) because the same or substantially the same art and arguments were
`presented, and overcome, during prosecution of the ’543 patent. Prelim.
`Resp. 27. Specifically, Patent Owner argues Arnold, Nachenberg, and
`White all were submitted during prosecution of the ’543 patent—listed on
`respective Information Disclosure Statements (IDS) and considered by the
`Examiner as evidenced by the Examiner’s initials on the respective IDS
`entries.
`We are not persuaded by Patent Owner’s argument. Other than being
`submitted in an IDS, we find no evidence in this record that the Examiner
`ever substantively considered Arnold, alone or in any combination, during
`prosecution of the ’543 patent. Accordingly, we are not persuaded that the
`same or substantially the same prior art or arguments previously were
`
`9
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`presented to the Office. We, therefore, decline to exercise our discretion
`under 35 U.S.C. § 325(d) to deny any of the asserted grounds.
`C.
`Anticipation by Arnold
`Petitioner asserts claims 1–3, 5–8, 20, 22, 26, and 29–31 are
`anticipated by Arnold. Pet. 14–42.
`1.
`Arnold (Ex. 1008)
`According to Arnold, known virus scanning techniques, while
`sufficient for detecting previously encountered viruses, are typically unable
`to detect viruses for which the scanner has not yet been programmed. Ex.
`1008, 1:45–2:1. Prior techniques, according to Arnold, relied on periodic
`distribution of new virus detection programs or parameters to update virus
`detection programs on each computer system. Id. at 2:1–5. Such update
`distribution techniques, however, are asserted to be unable to match the pace
`at which new viruses have been created. Id. at 2:5–25. Arnold purports to
`address this need by an improved technique that deploys decoy programs to
`capture samples of previously unknown viruses, identifying samples of
`suspected viruses, extracting a signature from such identified samples, and
`informing neighboring nodes in a network of the newly detected virus. Id. at
`2:58–67.
`
`Independent Claims 1, 6, 20, and 29–31
`2.
`Regarding independent claim 1, Petitioner identifies the limitation,
`“creating an extracted malicious code packet,” in Arnold’s disclosure of
`generating and transmitting a “distress signal,” a “kill signal,” or a “report.”
`Pet. 25–27. In particular, Petitioner argues creating a packet is disclosed by
`Arnold’s “distress signal” that includes pertinent details of the detected virus
`and a signature extracted from the detected virus. Id. at 25 (citing Ex. 1008,
`
`10
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`20:64–68). In the alternative, Petitioner asserts Arnold’s “kill signal”
`includes similar information regarding a virus and, thus, also discloses
`creating a packet. Id. at 25–26 (citing Ex. 1008, 24:36–42). Still further,
`Petitioner argues a report generated by Arnold that includes a code sample
`and an extracted signature for a detected virus discloses the claimed creation
`of a packet. Id. at 26 (citing Ex. 1008, 26:65–27:15). Petitioner contends
`this report “could be formatted and sent in the form of packet(s), for delivery
`to neighboring computers via packet-based networks, i.e., [(Local Area
`Networks)] LANs.” Id. (citing Ex. 1008, 22:24–26, 27:1–7; Ex. 1011
`¶¶ 140–145). Petitioner further contends “each of these signals or reports
`are necessarily packetized for transmission, e.g., on a LAN.” Id. at 28
`(citing Ex. 1011 ¶¶ 146–148).
`Patent Owner argues the Petition never identifies any disclosure in
`Arnold that the distress signal, the kill signal, or the generated report are
`formed as a “packet” and notes that the word “packet” never appears in
`Arnold. Prelim. Resp. 27. Patent Owner further argues that Petitioner’s
`argument that these signals or the report “could be” formatted as packets is a
`legally insufficient assertion for anticipation. Id. Patent Owner contends the
`Petition provides no basis for Petitioner’s assertion that “each of these
`signals or reports are necessarily packetized for transmission, e.g., on a
`LAN.” Id. at 28. Patent Owner also contends it is not inherent that
`information exchanged over a LAN is necessarily (inherently) packetized (in
`view of our interpretation of packet). Id. at 34–36 (citing Ex. 2001 ¶¶ 62–
`78, 42–53).
`We agree with Patent Owner. For anticipation of a claim, each
`element of the challenged claim must be found, either expressly or
`
`11
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`inherently, in the single prior art reference. Verdegaal Bros., Inc. v. Union
`Oil Co. of Cal., 814 F.2d 628, 631 (Fed. Cir. 1987). Petitioner fails to
`identify express teachings in Arnold of any transmission that is a packet in
`accord with our interpretation of the term. See Section II.A.3.a (“a unit of
`data formatted to include a header that contains the information necessary to
`route the unit of data through the network to its destination”). Specifically,
`the Petition fails to identify any express teaching that Arnold’s distress
`signal, kill signal, or generated report are formatted as a packet with header
`information needed to route the packet to a destination on the network.
`Petitioner asserts that formatting these signals or reports as packet(s)
`is inherent in Arnold’s reference to transmission over a LAN arguing, “each
`of these signals or reports are necessarily packetized for transmission, e.g.,
`on a LAN.” Pet. 28 (citing Ex. 1011 ¶¶ 146–148). Dr. Zadok’s testimony
`regarding this inherency simply repeats the argument in the Petition without
`providing any further basis or explanation for the opinion. Ex. 1011 ¶ 148
`(“each of these signals or reports are packetized for transmission”). We
`afford little weight to this opinion of Dr. Zadok because it is not supported
`by any facts articulated in the declaration or the Petition. 37 C.F.R.
`¶ 42.65(a) (“Expert testimony that does not disclose the underlying facts or
`data on which the opinion is based is entitled to little or no weight.”).
`By contrast, Dr. Chatterjee’s testimony, relied upon in Patent Owner’s
`arguments (see Prelim. Resp. 27–41), provides underlying facts in support of
`his opinion that it is not inherent that information is packetized over a LAN.
`See Ex. 2001 ¶¶ 67–72. Specifically, Dr. Chatterjee testifies that a LAN
`would have been understood by the ordinarily skilled artisan to be a short
`distance network that links together computers and peripheral devices within
`
`12
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`a building or campus. Id. ¶ 69 (citing Ex. 2007, 509). Thus, a LAN does
`not necessarily imply a packet-switched network. Dr. Chatterjee provides a
`simple example of an RS-232 “null modem” as within the ordinarily skilled
`artisan’s reasonable understanding of a LAN—i.e., a cable that connects two
`devices for exchange of information without requiring any header
`information to enable routing of the information. Ex. 2001 ¶¶ 70–72. We
`credit Dr. Chatterjee’s testimony in this regard. Thus, a LAN does not
`necessarily (inherently) require that information to be exchanged must be
`packetized.
`Having reviewed the parties’ arguments, supporting Declarations, and
`the record as a whole, we are not persuaded that Arnold discloses, expressly
`or inherently, the step of “creating an extracted malicious code packet
`including said malicious code signature” as recited in independent claim 1.
`Independent claims 6, 20, and 29–31 each include similar recitations
`regarding creating, sending, and/or receiving a malicious code packet. Thus,
`for the same reasons as claim 1, we are not persuaded Arnold discloses,
`expressly or inherently, these similar steps relating to malicious code
`packets.
`For the above reasons, we are not persuaded that there is a reasonable
`likelihood of Petitioner prevailing in showing any of independent claims 1,
`6, 20, and 29–31 are anticipated by Arnold.
`3.
`Dependent Claims 2, 3, 5, 7, 8, 22, or 26
`Dependent claims 2, 3, 5, 7, 8, 22, or 26 depend directly or indirectly,
`from one of independent claims 1, 6, or 20. For the same reasons as their
`respective base claims, we are not persuaded that there is a reasonable
`
`13
`
`

`

`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`likelihood of Petitioner prevailing in showing any of dependent claims 2, 3,
`5, 7, 8, 22, or 26 are anticipated by Arnold.
`D. Obviousness Grounds
`Petitioner proposes three additional grounds of unpatentability under
`35 U.S.C. § 103(a) asserting claims 4, 9–21, 23–25, and 27–29 are obvious
`over Arnold alone (combined with the knowledge of the ordinarily skilled
`artisan) or over Arnold in combination with either Nachenberg or White.
`Pet. 42–55. Petitioner does not rely on any of these other references, or rely
`on the knowledge of the ordinarily skilled artisan, to cure the above-
`identified deficiency in Arnold regarding creation of a packet as we interpret
`the term. Thus for the same reasons discussed supra regarding independent
`claims 1, 6, 20, and 29–31, we are not persuaded that there is a reasonable
`likelihood of Petitioner prevailing in showing any of claims 4, 9–21, 23–25,
`and 27–29 are obvious over Arnold with the knowledge of the ordinarily
`skilled artisan or over Arnold in various combinations with other references.
`
`
`III. CONCLUSION
`For the foregoing reasons, the information presented in the Petition
`and accompanying evidence does not establish a reasonable likelihood that
`Petitioner would prevail in showing the unpatentability of any challenged
`claim of the ’543 patent.
`
`
`IV. ORDER
`In consideration of the foregoing, it is hereby:
`ORDERED that the Petition is denied and no inter partes review is
`instituted.
`
`14
`
`

`

`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`
`
`PETITIONER:
`Leo L. Lam
`KEKER, VAN NEST & PETERS LLP
`llam@keker.com
`
`PATENT OWNER:
`Chad C. Walters
`Kurt M. Pankratz
`James Williams
`Harrison G. Rich
`BAKER BOTTS L.L.P.
`chad.walters@bakerbotts.com
`kurt.pankratz@bakerbotts.com
`james.williams@bakerbotts.com
`harrison.rich@bakerbotts.com
`
`
`15
`
`

This document is available on Docket Alarm but you must sign up to view it.


Or .

Accessing this document will incur an additional charge of $.

After purchase, you can access this document again without charge.

Accept $ Charge
throbber

Still Working On It

This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.

Give it another minute or two to complete, and then try the refresh button.

throbber

A few More Minutes ... Still Working

It can take up to 5 minutes for us to download a document if the court servers are running slowly.

Thank you for your continued patience.

This document could not be displayed.

We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.

Your account does not support viewing this document.

You need a Paid Account to view this document. Click here to change your account type.

Your account does not support viewing this document.

Set your membership status to view this document.

With a Docket Alarm membership, you'll get a whole lot more, including:

  • Up-to-date information for this case.
  • Email alerts whenever there is an update.
  • Full text search for other cases.
  • Get email alerts whenever a new case matches your search.

Become a Member

One Moment Please

The filing “” is large (MB) and is being downloaded.

Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.

Your document is on its way!

If you do not receive the document in five minutes, contact support at support@docketalarm.com.

Sealed Document

We are unable to display this document, it may be under a court ordered seal.

If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.


Access Government Site

We are redirecting you
to a mobile optimized page.





Document Unreadable or Corrupt

Refresh this Document
Go to the Docket

We are unable to display this document.

Refresh this Document
Go to the Docket