`571-272-7822
`
`
`
`
`
`
`
`Paper No.10
`Entered: November 9, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`ZSCALER, INC.,
`Petitioner,
`
`v.
`
`SYMANTEC CORPORATION,
`Patent Owner.
`____________
`
`Case IPR2017-01345
`Patent 7,392,543 B2
`____________
`
`
`
`Before RAMA G. ELLURU, DANIEL N. FISHMAN, and
`STACEY G. WHITE, Administrative Patent Judges.
`
`FISHMAN, Administrative Patent Judge.
`
`
`
`
`DECISION
`Denying Institution of Inter Partes Review
`37 C.F.R. § 42.108
`
`
`
`
`
`
`
`
`
`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`INTRODUCTION
`I.
`Zscaler, Inc. (“Petitioner”) filed a Petition (Paper 3, “Pet.”) requesting
`inter partes review of claims 1–31, all of the claims of the ’543
`patent,(hereinafter the “challenged claims”) of U.S. Patent No. 7,392,543 B2
`(Ex. 1001, “the ’543 patent”) pursuant to 35 U.S.C. §§ 311–319. Symantec
`Corporation (“Patent Owner”) filed a Patent Owner Preliminary Response
`(Paper 9, “Prelim. Resp.”). We have authority to determine whether to
`institute a trial under 35 U.S.C. § 314 and 37 C.F.R. § 42.4(a). An inter
`partes review may be instituted only if “the information presented in the
`petition . . . and any response . . . shows that there is a reasonable likelihood
`that the petitioner would prevail with respect to at least 1 of the claims
`challenged in the petition.” 35 U.S.C. § 314(a).
`Upon consideration of the Petition, the Preliminary Response, and the
`evidence of record, we conclude Petitioner has failed to establish a
`reasonable likelihood of prevailing in showing that any of the challenged
`claims are unpatentable. Accordingly, we deny institution of an inter partes
`review for all of the challenged claims of the ’543 patent.
`A.
`Real Parties-in-Interest and Related Matters
`Petitioner identifies Zscaler, Inc. as the sole real party-in-interest. Pet.
`56. Both Petitioner and Patent Owner identify a related litigation matter
`captioned Symantec Corp. v. Zscaler, Inc., Case No. 1:16-cv-01176-SLR-
`SLF, filed in the U.S. District Court for the District of Delaware. Pet. 56;
`Paper 5, 2.
`
`The ’543 Patent
`B.
`According to the ’543 patent, conventional computer immune systems
`that protect against malicious infection of computer systems utilize file-
`
`2
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`based scanning at client nodes and, when suspicious content is detected, a
`client node sends the suspicious content to a global analysis center for
`further processing. Ex. 1001, 1:11–15. The global analysis center generates
`a malicious code signature based on the received suspect content and returns
`the signature to the client nodes for use in subsequent detection. Id. at 1:16–
`20. Further, according to the ’543 patent, prior conventional immune
`systems detect only suspicious content stored in files and generally do not
`detect malicious content as it is transmitted over networks. Id. at 21–25.
`Some prior network-based intrusion detection systems employed protocol
`analyzers to monitor for malicious content embedded within portions of
`exchanges using known protocols. Id. at 1:26–48. Other network-based
`intrusion systems use a “network sniffer” to detect known signatures of
`malicious code content. Id.
`The ’543 patent suggests a problem with prior network-based systems
`because updating the system for signatures of newly detected malicious
`content is slow—taking hours or days to update, while malicious content
`may still be exchanged over the network. Id. at 49–56. The ’543 patent
`purports to address this problem by providing a host system with local
`capability to detect malicious code affecting the host system and to generate
`a malicious code packet for transmission to a local analysis center system.
`Id. at 1:60–2:8. If the local analysis center detects an attack in progress from
`the received packet, it sends the malicious code packet to a global analysis
`center for rapid dissemination to other host systems. Id.
`Figure 3, reproduced below, describes exemplary processing of
`malicious content in a host system in accordance with the ’543 patent.
`
`3
`
`
`
`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`
`
`Figure 3 above is a flow diagram of a host system for processing detected
`malicious content over a network in accordance with an embodiment of the
`’543 patent. Id. at 9:3–4. Step 204 awaits detection of an attempted attack
`on the host system by malicious code received over the network. Id. Step
`304 then extracts/generates a malicious code signature representing the
`detected malicious, attacking content. Id. at 9:25–10:4. Steps 212A and
`214A create a malicious code packet based on the signature and other
`parameters of the detected malicious code. Id. at 10:5–36. Steps 216A
`
`4
`
`
`
`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`through 222 then send the generated packet to an analysis system for further
`dissemination of a signature for detected malicious content. Id. at 10:37–
`12:20.
`
`
`
`Illustrative Claim
`C.
`Claims 1, 6, 20, and 29–31 are the independent claims of the ’543
`patent. Independent claim 1, reproduced below, is exemplary of the
`challenged claims:
`1. A method comprising:
`detecting an attack by malicious code on a first computer
`system;
`extracting a malicious code signature from said malicious
`code comprising:
`locating a caller's address of said malicious code in
`a memory of said first computer system; and
`extracting a specific number of bytes backwards
`from said caller's address;
`creating an extracted malicious code packet including
`said malicious code signature; and
`sending said extracted malicious code packet from said
`first computer system to a second computer system.
`Alleged Grounds of Unpatentability
`D.
`The Petition sets forth the following asserted grounds of
`unpatentability:
`Reference(s)
`Arnold1
`Arnold
`
`Challenged Claims
`Basis
`102(b) 1–3, 5–8, 20, 22, 26, and 29–31
`103(a) 4, 9–19, and 21
`
`
`1 U.S. Patent No. 5,440,723. Ex. 1008 (“Arnold”).
`
`5
`
`
`
`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`
`
`
`Challenged Claims
`Basis
`Reference(s)
`103(a) 20 and 29
`Arnold and Nachenberg2
`103(a) 23–25, 27, and 28
`Arnold and White3
`Petitioner relies on the Declaration of Dr. Erez Zadok (Ex. 1011) in
`support of its contentions. Patent Owner relies on the Declaration of Dr.
`Sandeep Chatterjee (Ex. 2001) in support of its contentions.
`
`II. ANALYSIS
`Claim Construction
`A.
`As a step in our analysis in regards to determining whether to institute
`a review, we determine the meaning of the claims for purposes of this
`Decision. In an inter partes review, a claim in an unexpired patent shall be
`given its broadest reasonable construction in light of the specification of the
`patent in which it appears. 37 C.F.R. § 42.100(b); see also Cuozzo Speed
`Techs., LLC v. Lee, 136 S. Ct. 2131, 2142–46 (2016) (upholding the use of
`the broadest reasonable interpretation standard). Under the broadest
`reasonable interpretation standard, claim terms generally are given their
`ordinary and customary meaning, as would be understood by one of ordinary
`skill in the art in the context of the entire disclosure. In re Translogic Tech.,
`Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). “[A] claim construction analysis
`must begin and remain centered on the claim language itself.” Innova/Pure
`Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1116 (Fed.
`Cir. 2004). “Though understanding the claim language may be aided by the
`explanations contained in the written description, it is important not to
`
`
`2 U.S. Patent No. 6,357,008 B1. Ex. 1009 (“Nachenberg”).
`3 Steve R. White et al.; ANATOMY OF A COMMERCIAL-GRADE IMMUNE
`SYSTEM. Ex. 1010 (“White”).
`
`6
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`import into a claim limitations that are not a part of the claim.” SuperGuide
`Corp. v. DirecTV Enters., Inc., 358 F.3d 870, 875 (Fed. Cir. 2004). Only
`terms that are in controversy need to be construed and only to the extent
`necessary to resolve the controversy. See Wellman, Inc. v. Eastman Chem.
`Co., 642 F.3d 1355, 1361 (Fed. Cir. 2011); Vivid Techs., Inc. v. Am. Sci.
`& Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999).
`1.
`“Packet”
`All claims recite the exchange of a “malicious code packet.”
`Independent claim 1, for example, recites “creating an extracted malicious
`code packet” and “sending said extracted malicious code packet from said
`first computer system to a second computer system.” Petitioner does not
`propose any particular construction of the term “packet.” Petitioner’s
`declarant refers to the Microsoft Computer Dictionary definition of “packet”
`as “[a] unit of information transmitted as a whole from one device to another
`on a network.” Ex. 1011 ¶ 144 (quoting Ex. 1028, 385). However, as noted
`by Patent Owner, the Petition does not propose adopting this definition or
`refer to this particular testimony of Dr. Zadok. Prelim. Resp. 19.
`Patent Owner argues the ordinarily skilled artisan would have
`understood “packet” to refer to information formatted (i.e., with appropriate
`headers, etc.) for use in a packet-switched network. Id. at 17 (citing Ex.
`2001 ¶ 46). Patent Owner asserts that headers in packets for packet-
`switched networks are required because the communication paths are shared
`among nodes of the network. Id. (citing Ex. 2001 ¶¶ 44–45). By contrast,
`earlier circuit-switched networks (earlier telephone and telegraph networks)
`established temporary, dedicated, communication paths between nodes of
`the network. Id. (citing Ex. 2001 ¶ 46). Patent Owner argues that the
`
`7
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`Specification of the ’543 patent discloses that the “packets” are transmitted
`over the Internet—an example of a packet-switched network. Id. at 18
`(citing Ex. 1001, 2:3–6, 3:24–25, Fig. 1; Ex. 2001 ¶ 47). Thus, Patent
`Owner contends the ordinarily skilled artisan would not have understood
`“packet” to be so broad as to be applicable in all types of networks (e.g.,
`circuit-switched as well as packet-switched) as suggested by Dr. Zadok’s
`reference to the Microsoft Computer Dictionary definition. Patent Owner
`proposes interpreting “packet” to mean “a unit of data formatted to include a
`header that contains the information necessary to route the unit of data
`through the network to its destination.” Id. at 16 (citing Ex. 2001 ¶¶ 42–53;
`Ex. 2003, 355).
`We agree with Patent Owner’s proposed interpretation of “packet”
`and adopt it as our own based on the disclosure of the ’543 patent. The
`broad definition cited by Dr. Zadok, Petitioner’s expert declarant, would
`consider any unit of data—even a single bit of information—exchanged over
`a communication medium to be a packet. Such a definition would be
`unreasonably broad in view of the Specification of the ’543 patent reference
`to transmission of packets over, for example, the Internet—a packet-
`switched network requiring header information to route packets to a desired
`destination. Ex. 1001, 3:24–25. We credit Dr. Chatterjee’s testimony in this
`regard. Ex. 2001 ¶¶ 42–53. For example, Dr. Chatterjee testifies,
`A person of ordinary skill in the art at the time of the invention
`of the ’543 Patent would also understand that “packets” are used
`in “packet-based networks,” i.e., a packet-switched network, and
`need to be “formatted” to include a “header” that “contains the
`information necessary to route the unit of data through the
`network to its destination.”
`
`8
`
`
`
`IPR2017‐01345
`
`Patent 7,392,543 B2
`
`
`Ex. 2001 ¶ 43 (citing Ex. 2003, 235). Thus, on the record before us, we
`interpret “packet” to mean “a unit of data formatted to include a header that
`contains the information necessary to route the unit of data through the
`network to its destination.”
`
`
`
`Other Terms
`2.
`On this record, we determine that it is unnecessary to provide an
`explicit construction of any other claim terms.
`B.
`35 U.S.C. § 325(d) Discretion
`Section 325(d) of Title 35, U.S. Code, provides, in pertinent part:
`In determining whether to institute or order a proceeding under
`this chapter, chapter 30, or chapter 31, the Director may take into
`account whether, and reject the petition or request because, the
`same or substantially the same prior art or arguments previously
`were presented to the Office.
`Patent Owner argues that this Petition should be denied under
`§ 325(d) because the same or substantially the same art and arguments were
`presented, and overcome, during prosecution of the ’543 patent. Prelim.
`Resp. 27. Specifically, Patent Owner argues Arnold, Nachenberg, and
`White all were submitted during prosecution of the ’543 patent—listed on
`respective Information Disclosure Statements (IDS) and considered by the
`Examiner as evidenced by the Examiner’s initials on the respective IDS
`entries.
`We are not persuaded by Patent Owner’s argument. Other than being
`submitted in an IDS, we find no evidence in this record that the Examiner
`ever substantively considered Arnold, alone or in any combination, during
`prosecution of the ’543 patent. Accordingly, we are not persuaded that the
`same or substantially the same prior art or arguments previously were
`
`9
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`presented to the Office. We, therefore, decline to exercise our discretion
`under 35 U.S.C. § 325(d) to deny any of the asserted grounds.
`C.
`Anticipation by Arnold
`Petitioner asserts claims 1–3, 5–8, 20, 22, 26, and 29–31 are
`anticipated by Arnold. Pet. 14–42.
`1.
`Arnold (Ex. 1008)
`According to Arnold, known virus scanning techniques, while
`sufficient for detecting previously encountered viruses, are typically unable
`to detect viruses for which the scanner has not yet been programmed. Ex.
`1008, 1:45–2:1. Prior techniques, according to Arnold, relied on periodic
`distribution of new virus detection programs or parameters to update virus
`detection programs on each computer system. Id. at 2:1–5. Such update
`distribution techniques, however, are asserted to be unable to match the pace
`at which new viruses have been created. Id. at 2:5–25. Arnold purports to
`address this need by an improved technique that deploys decoy programs to
`capture samples of previously unknown viruses, identifying samples of
`suspected viruses, extracting a signature from such identified samples, and
`informing neighboring nodes in a network of the newly detected virus. Id. at
`2:58–67.
`
`Independent Claims 1, 6, 20, and 29–31
`2.
`Regarding independent claim 1, Petitioner identifies the limitation,
`“creating an extracted malicious code packet,” in Arnold’s disclosure of
`generating and transmitting a “distress signal,” a “kill signal,” or a “report.”
`Pet. 25–27. In particular, Petitioner argues creating a packet is disclosed by
`Arnold’s “distress signal” that includes pertinent details of the detected virus
`and a signature extracted from the detected virus. Id. at 25 (citing Ex. 1008,
`
`10
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`20:64–68). In the alternative, Petitioner asserts Arnold’s “kill signal”
`includes similar information regarding a virus and, thus, also discloses
`creating a packet. Id. at 25–26 (citing Ex. 1008, 24:36–42). Still further,
`Petitioner argues a report generated by Arnold that includes a code sample
`and an extracted signature for a detected virus discloses the claimed creation
`of a packet. Id. at 26 (citing Ex. 1008, 26:65–27:15). Petitioner contends
`this report “could be formatted and sent in the form of packet(s), for delivery
`to neighboring computers via packet-based networks, i.e., [(Local Area
`Networks)] LANs.” Id. (citing Ex. 1008, 22:24–26, 27:1–7; Ex. 1011
`¶¶ 140–145). Petitioner further contends “each of these signals or reports
`are necessarily packetized for transmission, e.g., on a LAN.” Id. at 28
`(citing Ex. 1011 ¶¶ 146–148).
`Patent Owner argues the Petition never identifies any disclosure in
`Arnold that the distress signal, the kill signal, or the generated report are
`formed as a “packet” and notes that the word “packet” never appears in
`Arnold. Prelim. Resp. 27. Patent Owner further argues that Petitioner’s
`argument that these signals or the report “could be” formatted as packets is a
`legally insufficient assertion for anticipation. Id. Patent Owner contends the
`Petition provides no basis for Petitioner’s assertion that “each of these
`signals or reports are necessarily packetized for transmission, e.g., on a
`LAN.” Id. at 28. Patent Owner also contends it is not inherent that
`information exchanged over a LAN is necessarily (inherently) packetized (in
`view of our interpretation of packet). Id. at 34–36 (citing Ex. 2001 ¶¶ 62–
`78, 42–53).
`We agree with Patent Owner. For anticipation of a claim, each
`element of the challenged claim must be found, either expressly or
`
`11
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`inherently, in the single prior art reference. Verdegaal Bros., Inc. v. Union
`Oil Co. of Cal., 814 F.2d 628, 631 (Fed. Cir. 1987). Petitioner fails to
`identify express teachings in Arnold of any transmission that is a packet in
`accord with our interpretation of the term. See Section II.A.3.a (“a unit of
`data formatted to include a header that contains the information necessary to
`route the unit of data through the network to its destination”). Specifically,
`the Petition fails to identify any express teaching that Arnold’s distress
`signal, kill signal, or generated report are formatted as a packet with header
`information needed to route the packet to a destination on the network.
`Petitioner asserts that formatting these signals or reports as packet(s)
`is inherent in Arnold’s reference to transmission over a LAN arguing, “each
`of these signals or reports are necessarily packetized for transmission, e.g.,
`on a LAN.” Pet. 28 (citing Ex. 1011 ¶¶ 146–148). Dr. Zadok’s testimony
`regarding this inherency simply repeats the argument in the Petition without
`providing any further basis or explanation for the opinion. Ex. 1011 ¶ 148
`(“each of these signals or reports are packetized for transmission”). We
`afford little weight to this opinion of Dr. Zadok because it is not supported
`by any facts articulated in the declaration or the Petition. 37 C.F.R.
`¶ 42.65(a) (“Expert testimony that does not disclose the underlying facts or
`data on which the opinion is based is entitled to little or no weight.”).
`By contrast, Dr. Chatterjee’s testimony, relied upon in Patent Owner’s
`arguments (see Prelim. Resp. 27–41), provides underlying facts in support of
`his opinion that it is not inherent that information is packetized over a LAN.
`See Ex. 2001 ¶¶ 67–72. Specifically, Dr. Chatterjee testifies that a LAN
`would have been understood by the ordinarily skilled artisan to be a short
`distance network that links together computers and peripheral devices within
`
`12
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`a building or campus. Id. ¶ 69 (citing Ex. 2007, 509). Thus, a LAN does
`not necessarily imply a packet-switched network. Dr. Chatterjee provides a
`simple example of an RS-232 “null modem” as within the ordinarily skilled
`artisan’s reasonable understanding of a LAN—i.e., a cable that connects two
`devices for exchange of information without requiring any header
`information to enable routing of the information. Ex. 2001 ¶¶ 70–72. We
`credit Dr. Chatterjee’s testimony in this regard. Thus, a LAN does not
`necessarily (inherently) require that information to be exchanged must be
`packetized.
`Having reviewed the parties’ arguments, supporting Declarations, and
`the record as a whole, we are not persuaded that Arnold discloses, expressly
`or inherently, the step of “creating an extracted malicious code packet
`including said malicious code signature” as recited in independent claim 1.
`Independent claims 6, 20, and 29–31 each include similar recitations
`regarding creating, sending, and/or receiving a malicious code packet. Thus,
`for the same reasons as claim 1, we are not persuaded Arnold discloses,
`expressly or inherently, these similar steps relating to malicious code
`packets.
`For the above reasons, we are not persuaded that there is a reasonable
`likelihood of Petitioner prevailing in showing any of independent claims 1,
`6, 20, and 29–31 are anticipated by Arnold.
`3.
`Dependent Claims 2, 3, 5, 7, 8, 22, or 26
`Dependent claims 2, 3, 5, 7, 8, 22, or 26 depend directly or indirectly,
`from one of independent claims 1, 6, or 20. For the same reasons as their
`respective base claims, we are not persuaded that there is a reasonable
`
`13
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`likelihood of Petitioner prevailing in showing any of dependent claims 2, 3,
`5, 7, 8, 22, or 26 are anticipated by Arnold.
`D. Obviousness Grounds
`Petitioner proposes three additional grounds of unpatentability under
`35 U.S.C. § 103(a) asserting claims 4, 9–21, 23–25, and 27–29 are obvious
`over Arnold alone (combined with the knowledge of the ordinarily skilled
`artisan) or over Arnold in combination with either Nachenberg or White.
`Pet. 42–55. Petitioner does not rely on any of these other references, or rely
`on the knowledge of the ordinarily skilled artisan, to cure the above-
`identified deficiency in Arnold regarding creation of a packet as we interpret
`the term. Thus for the same reasons discussed supra regarding independent
`claims 1, 6, 20, and 29–31, we are not persuaded that there is a reasonable
`likelihood of Petitioner prevailing in showing any of claims 4, 9–21, 23–25,
`and 27–29 are obvious over Arnold with the knowledge of the ordinarily
`skilled artisan or over Arnold in various combinations with other references.
`
`
`III. CONCLUSION
`For the foregoing reasons, the information presented in the Petition
`and accompanying evidence does not establish a reasonable likelihood that
`Petitioner would prevail in showing the unpatentability of any challenged
`claim of the ’543 patent.
`
`
`IV. ORDER
`In consideration of the foregoing, it is hereby:
`ORDERED that the Petition is denied and no inter partes review is
`instituted.
`
`14
`
`
`
`
`
`IPR2017‐01345
`
`
`
`Patent 7,392,543 B2
`
`
`
`
`PETITIONER:
`Leo L. Lam
`KEKER, VAN NEST & PETERS LLP
`llam@keker.com
`
`PATENT OWNER:
`Chad C. Walters
`Kurt M. Pankratz
`James Williams
`Harrison G. Rich
`BAKER BOTTS L.L.P.
`chad.walters@bakerbotts.com
`kurt.pankratz@bakerbotts.com
`james.williams@bakerbotts.com
`harrison.rich@bakerbotts.com
`
`
`15
`
`