Formatted: Indent: Left: 1", First line: 0.5"
`
`U.S. Patent No. 7,784,058 (“’058 Patent”)
`Accused Instrumentalities: Google products and services using secure containerized applications, including without limitation Google
`Kubernetes Engine, Cloud Run, and Migrate to Containers, and all versions and variations thereof since the issuance of the asserted
`patent.
`Each Accused Instrumentality infringes the claims in substantially the same way, and the evidence shown in this chart is similarly
`applicable to each Accused Instrumentality. Each claim limitation is literally infringed by each Accused Instrumentality. However, to
`the extent any claim limitation is not met literally, it is nonetheless met under the doctrine of equivalents because the differences
`between the claim limitation and each Accused Instrumentality would be insubstantial, and each Accused Instrumentality performs
`substantially the same function, in substantially the same way, to achieve the same result as the claimed invention. Notably, Defendant
`has not yet articulated which, if any, particular claim limitations it believes are not met by the Accused Instrumentalities.
`
`Claim 1
`
`Claim 1
`[1pre] 1. A computing system
`for executing a plurality of
`software applications
`comprising:
`
`Accused Instrumentalities
`To the extent the preamble is limiting, each Accused Instrumentality comprises or constitutes a
`computing system for executing a plurality of software applications as claimed.
`See claim limitations below.
`See also, e.g.:
`
`https://cloud.google.com/migrate/containers/docs/getting-started
`
`https://cloud.google.com/migrate/containers/docs/getting-started.
`
`Page 1 of 63
`
`Google Exhibit 1020
`Google v. VirtaMove
`
`

`

`Claim 1
`
`Accused Instrumentalities
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 2 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`
`
`[1a] a) a processor;
`
`https://cloud.google.com/learn/what-are-containers
`Each Accused Instrumentality comprises a processor.
`For example, each node/host contains at least one CPU.
`See, e.g.:
`
`Page 3 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/learn/what-are-containers
`
`
`
`https://cloud.google.com/blog/products/containers-kubernetes/how-migrate-for-anthos-improves-
`vm-to-container-migration
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 4 of 63
`
`
`
`
`
`

`

`
`
`Claim 1
`[1b] b) an operating system
`having an operating system
`kernel having OS critical
`system elements (OSCSEs) for
`running in kernel mode using
`said processor; and,
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises an operating system having an operating system kernel
`having OS critical system elements (OSCSEs) for running in kernel mode using said processor.
`For example, the OSCSEs include kernel-mode functions similar to the functionalities provided by
`user-space libraries such as glibc. These are implemented in kernel-space to handle tasks such as
`(without limitation) memory management (kmalloc(), kfree(), etc,) at kernel level.
`See, e.g.:
`
`https://cloud.google.com/learn/what-are-containers
`
`https://www.techtarget.com/searchdatacenter/definition/kernel
`
`
`
`
`
`Page 5 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`https://cloud.google.com/blog/products/application-modernization/shift-your-apps-to-container-
`based-workloads-on-the-command-line
`
`Page 6 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/migrate/containers/docs/setting-up-overview
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`[1c] c) a shared library having
`shared library critical system
`elements (SLCSEs) stored
`therein for use by the plurality
`of software applications in
`user mode and
`
`https://en.wikipedia.org/wiki/Glibc
`Each Accused Instrumentality comprises a shared library having shared library critical system
`elements (SLCSEs) stored therein for use by the plurality of software applications in user mode.
`For example, the shared library with SLCSEs include the runtime environment, system tools, and
`dependencies, such as the glibc library and other libraries that replicate OSCSEs, included in the
`container image (including without limitation in a base image that is included within the container
`image).
`See, e.g.:
`
`Page 7 of 63
`
`
`
`
`
`
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`
`
`Page 8 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/software-supply-chain-security/docs/base-images
`
`https://cloud.google.com/workstations/docs/customize-container-images
`
`
`
`
`
`Page 9 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`
`
`Page 10 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`https://cloud.google.com/architecture/best-practices-for-operating-containers
`
`https://cloud.google.com/blog/products/containers-kubernetes/how-migrate-for-anthos-improves-
`vm-to-container-migration
`
`
`
`Page 11 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/learn/what-are-containers
`
`https://docs.docker.com/storage/storagedriver/
`
`Page 12 of 63
`
`
`
`
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 13 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 14 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/storage/volumes/
`
`
`
`
`https://kubernetes.io/docs/concepts/containers/container-environment/
`
`Page 15 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/containers/images/
`
`https://kubernetes.io/docs/concepts/storage/volumes/
`
`Page 16 of 63
`
`
`
`
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/spec.md
`
`
`
`Page 17 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/spec.md
`
`
`
`Page 18 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/config.md
`
`
`
`Page 19 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/config.md
`In each Accused Instrumentality, some of the SLCSEs stored in the shared library are functional
`replicas of OSCSEs and are accessible to some of the plurality of software applications and when
`
`
`
`[1d] i) wherein some of the
`SLCSEs stored in the shared
`library are functional replicas
`of OSCSEs and are accessible
`
`Page 20 of 63
`
`

`

`
`
`Claim 1
`to some of the plurality of
`software applications and
`when one of the SLCSEs is
`accessed by one or more of the
`plurality of software
`applications it forms a part of
`the one or more of the plurality
`of software applications,
`
`Accused Instrumentalities
`one of the SLCSEs is accessed by one or more of the plurality of software applications it forms a
`part of the one or more of the plurality of software applications.
`For example, a base image serves as a self-contained unit that encompasses all the necessary
`components for an application to run, including the application code, runtime environment, system
`tools, and dependencies (i.e., SLCSEs). The images are based on existing Linux distributions, such
`as Debian and Ubuntu, including essential system elements (i.e., functional replicas of OSCSEs).
`Each container image is based on a specific base image, which contains the application code, and
`dependencies, including system libraries or shared library critical system elements (SLCSEs). The
`base image forms a part of the container image according to the “layer” model described in the
`documentation below. When the container runs the image, it creates a runtime instance of that
`container image. In turn, when one or more applications executes within the container runtime
`environment, it dynamically links to the SLCSEs stored in the runtime environment, which thereby
`become a part of the application(s).
`See, e.g.:
`
`https://cloud.google.com/software-supply-chain-security/docs/base-images
`
`
`
`
`
`Page 21 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`
`
`Page 22 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`https://cloud.google.com/software-supply-chain-security/docs/base-images
`
`
`
`Page 23 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`Page 24 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`https://console.cloud.google.com/marketplace/browse?filter=solution-type:container
`
`Page 25 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 26 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 27 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 28 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/storage/volumes/
`
`
`
`
`https://kubernetes.io/docs/concepts/containers/container-environment/
`
`Page 29 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/containers/images/
`
`https://kubernetes.io/docs/concepts/storage/volumes/
`
`Page 30 of 63
`
`
`
`
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/spec.md
`
`
`
`Page 31 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/spec.md
`
`
`
`Page 32 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/config.md
`
`
`
`Page 33 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://github.com/opencontainers/image-
`spec/blob/a6af2b480dcfc001ba975f44de53001c873cb0ef/config.md
`
`
`
`Page 34 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`[1e] ii) wherein an instance of
`a SLCSE provided to at least a
`first of the plurality of
`software applications from the
`shared library is run in a
`context of said at least first of
`the plurality of software
`applications without being
`shared with other of the
`plurality of software
`applications and where at least
`a second of the plurality of
`software applications running
`under the operating system
`have use of a unique instance
`of a corresponding critical
`system element for performing
`same function, and
`
`
`
`https://man7.org/linux/man-pages/man8/ld.so.8.html
`In each Accused Instrumentality, an instance of a SLCSE provided to at least a first of the plurality
`of software applications from the shared library is run in a context of said at least first of the
`plurality of software applications without being shared with other of the plurality of software
`applications and where at least a second of the plurality of software applications running under the
`operating system have use of a unique instance of a corresponding critical system element for
`performing same function.
`When a Docker or Kubernetes image is used to create a container, it creates a separate and isolated
`instance of a runtime environment which is independent of other containers running on the same
`host. Each container has its own instance of base images and its own data. The containers run in
`isolation, ensuring that the SLCSEs stored in the shared library are accessible to the software
`applications running in their respective containers. The image includes essential system files,
`libraries, and dependencies required to run the software application within the container. The
`containers can share common dependencies and components using layered images. This means that
`multiple containers utilize the same base image to create an instance. When an instance of SLCSE
`is provided from the base image (i.e., from the shared library) to an individual container including
`application software, it operates in isolation and runs its own instance of the software application
`without sharing resources or critical system elements with other containers. This ensures that each
`container has its own isolated context. Docker or Kubernetes containers can share common
`dependencies and components using layered images. This means that multiple containers can
`utilize the same base image. Therefore, each container, containing the application software running
`under the operating system, utilizes a unique instance of the corresponding critical system element
`to execute the respective application software for performing a same or a different function.
`See, e.g.:
`
`Page 35 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`
`
`Page 36 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 37 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`
`https://cloud.google.com/architecture/best-practices-for-operating-containers
`
`Page 38 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/migrate/containers/docs/migrating-overview
`
`
`
`Page 39 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/architecture/best-practices-for-building-containers
`
`https://codelabs.developers.google.com/developing-containers-with-dockerfiles#2
`
`Page 40 of 63
`
`
`
`
`
`
`
`

`

`
`
`Claim 1
`[1f] iii) wherein a SLCSE
`related to a predetermined
`function is provided to the first
`of the plurality of software
`applications for running a first
`instance of the SLCSE, and
`wherein a SLCSE for
`performing a same function is
`provided to the second of the
`plurality of software
`applications for running a
`second instance of the SLCSE
`simultaneously.
`
`Accused Instrumentalities
`In each Accused Instrumentality, a SLCSE related to a predetermined function is provided to the
`first of the plurality of software applications for running a first instance of the SLCSE, and wherein
`a SLCSE for performing a same function is provided to the second of the plurality of software
`applications for running a second instance of the SLCSE simultaneously.
`For example, in Docker or Kubernetes containers, each container operates independently, and a
`base image includes essential system files, libraries, and dependencies (i.e., SLCSEs) required to
`run the software application within the container. Based on information and belief, each element,
`such as system files, libraries, and dependencies (i.e., SLCSE) is associated with an execution of a
`predetermined function related to the application. When an image is used to create a container in
`the Accused Instrumentality, an instance of the SLCSE is provided to a software application.
`Therefore, different instances of the SLCSE are provided to different applications for performing
`either a same or a different function, simultaneously.
`See, e.g.:
`
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 41 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/architecture/best-practices-for-building-containers
`
`
`
`Page 42 of 63
`
`

`

`
`
`Claim 1
`
`Accused Instrumentalities
`
`https://cloud.google.com/migrate/containers/docs/migrating-overview
`
`
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computing system as defined in claim 1,
`wherein in operation, multiple instances of an SLCSE stored in the shared library run
`simultaneously within the operating system.
`
`Claim 2
`
`Claim 2
`2. A computing system as
`defined in claim 1, wherein in
`operation, multiple instances
`of an SLCSE stored in the
`shared library run
`
`Page 43 of 63
`
`

`

`
`
`Claim 2
`simultaneously within the
`operating system.
`
`Accused Instrumentalities
`For example, an individual host/node runs multiple containers and/or pods simultaneously, each of
`which has an instance of an SLCSE. When the multiple containers and/or pods run simultaneously,
`the multiple instances of the SLCSE stored in the shared library run simultaneously.
`See, e.g.:
`
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 44 of 63
`
`

`

`
`
`Claim 2
`
`Accused Instrumentalities
`
`https://cloud.google.com/architecture/best-practices-for-building-containers
`
`
`
`Page 45 of 63
`
`

`

`
`
`Claim 2
`
`Accused Instrumentalities
`
`https://cloud.google.com/migrate/containers/docs/migrating-overview
`
`
`
`Page 46 of 63
`
`

`

`
`
`Claim 2
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/architecture/
`
`
`
`Page 47 of 63
`
`

`

`
`
`Claim 2
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/containers/
`
`
`
`Page 48 of 63
`
`

`

`
`
`Claim 2
`
`Accused Instrumentalities
`
`https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
`
`
`
`Page 49 of 63
`
`

`

`
`
`Claim 3
`
`Claim 2
`
`Accused Instrumentalities
`
`https://docs.docker.com/engine/reference/run/
`
`
`
`Claim 3
`3. A computing system
`according to claim 1 wherein
`OSCSEs corresponding to and
`capable of performing the
`same function as SLCSEs
`remain in the operating system
`kernel.
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computing system according to claim 1
`wherein OSCSEs corresponding to and capable of performing the same function as SLCSEs remain
`in the operating system kernel.
`For example, both Docker and Kubernetes systems preserve the host kernel substantially
`unchanged; therefore the OSCSEs corresponding to the SLCSEs remain in the operating system
`kernel.
`See, e.g.:
`
`
`https://cloud.google.com/software-supply-chain-security/docs/base-images
`
`Page 50 of 63
`
`

`

`
`
`Claim 3
`
`Accused Instrumentalities
`
`
`https://www.techtarget.com/searchitoperations/definition/container-containerization-or-container-
`based-virtualization
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 51 of 63
`
`

`

`
`
`Claim 4
`
`Claim 4
`4. A computing system
`according to claim 1 wherein
`the one or more SLCSEs
`provided to one of the plurality
`of software applications
`having exclusive use thereof,
`use system calls to access
`services in the operating
`system kernel.
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computing system according to claim 1
`wherein the one or more SLCSEs provided to one of the plurality of software applications having
`exclusive use thereof, use system calls to access services in the operating system kernel.
`For example, the SLCSEs in a container use system calls to access services in the operating system
`kernel. For example, the glibc library (or other similar library) in the container uses system calls to
`interface with the host Linux kernel. In general, system calls can be observed using a tool such as
`strace.
`See, e.g.:
`
`https://en.wikipedia.org/wiki/Glibc
`
`
`
`Page 52 of 63
`
`

`

`
`
`
`https://www.berops.com/blog/a-different-method-to-debug-kubernetes-pods
`
`Page 53 of 63
`
`

`

`
`
`Claim 5
`
`Claim 5
`5. A computing system
`according to claim 1 wherein
`the operating system kernel
`comprises a kernel module
`adapted to serve as an interface
`between an SLCSE in the
`context of an application
`program and a device driver.
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computing system according to claim 1
`wherein the operating system kernel comprises a kernel module adapted to serve as an interface
`between an SLCSE in the context of an application program and a device driver.
`For example, the server (node) includes an operating system having a kernel. The kernel comprises
`a kernel module which enables applications (including their libraries) to have access to system
`resources such as storage, i.e., acts as an interface between applications/libraries and OS libraries or
`drivers
`See, e.g.:
`
`https://kubernetes.io/docs/concepts/containers/
`
`
`
`
`ttps://www.techtarget.com/searchitoperations/definition/Docker-image
`
`
`
`
`Page 54 of 63
`
`

`

`
`
`Claim 5
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`
`
`Page 55 of 63
`
`

`

`
`
`Claim 5
`
`Accused Instrumentalities
`
`
`https://cloud.google.com/blog/products/application-modernization/shift-your-apps-to-container-
`based-workloads-on-the-command-line
`
`Page 56 of 63
`
`

`

`
`
`Claim 10
`
`Claim 10
`10. A computing system
`according to claim 2 wherein
`SLCSEs stored in the shared
`library are linked to particular
`software applications of the
`plurality of software
`applications as the particular
`software applications are
`loaded such that the particular
`software applications have a
`link that provides unique
`access to a unique instance of a
`CSE.
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computing system according to claim 2
`wherein SLCSEs stored in the shared library are linked to particular software applications of the
`plurality of software applications as the particular software applications are loaded such that the
`particular software applications have a link that provides unique access to a unique instance of a
`CSE.
`For example, the containers can share common dependencies and components using layered
`images, and multiple containers can use the same base image. Therefore, each container, containing
`the application software running under the operating system of the server hosting GKE, uses a
`unique instance of the corresponding critical system element to execute the respective application
`software and has a link to that unique instance. The software applications dynamically link to the
`SLCSEs using, e.g., ld.so.
`See, e.g.:
`
`https://kubernetes.io/docs/concepts/containers/
`
`
`
`
`ttps://www.techtarget.com/searchitoperations/definition/Docker-image
`
`
`
`Page 57 of 63
`
`

`

`
`
`Claim 10
`
`
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`
`
`Page 58 of 63
`
`

`

`
`
`Claim 10
`
`Accused Instrumentalities
`
`
`https://cloud.google.com/blog/products/application-modernization/shift-your-apps-to-container-
`based-workloads-on-the-command-line
`
`Page 59 of 63
`
`

`

`
`
`Claim 10
`
`Accused Instrumentalities
`
`
`
`
`https://services.google.com/fh/files/misc/why_container_security_matters.pdf
`
`Page 60 of 63
`
`

`

`
`
`Claim 10
`
`Accused Instrumentalities
`
`https://cloud.google.com/architecture/best-practices-for-building-containers
`
`https://man7.org/linux/man-pages/man8/ld.so.8.html
`
`Page 61 of 63
`
`
`
`
`
`

`

`
`
`Claim 18
`
`Claim 18
`18. A computer system as
`defined in claim 2 wherein
`SLCSEs are not copies of
`OSCSEs.
`
`Accused Instrumentalities
`Each Accused Instrumentality comprises or constitutes a computer system as defined in claim 2
`wherein SLCSEs are not copies of OSCSEs.
`For example, in a typical case the SLCSEs come from a Linux distribution independent of the host
`operating system, and thus are not identical to the OSCSEs. For another example, the SLCSEs are
`provided to the computer system through a separate process than the process by which the OSCSEs
`are provided to the computer system, and thus are not copied from the OSCSEs.
`See, e.g.:
`
`https://kubernetes.io/docs/concepts/containers/
`
`
`
`
`ttps://www.techtarget.com/searchitoperations/definition/Docker-image
`
`
`
`
`Page 62 of 63
`
`

`

`
`
`
`
`
`
`Claim 18
`
`Accused Instrumentalities
`
`https://docs.docker.com/storage/storagedriver/
`
`
`
`Page 63 of 63
`
`