Finjan, Inc. v. Cisco Sys., 2019-2074

FINJAN, INC., Appellant v. CISCO SYSTEMS, INC., Cross-Appellant

2019-2074

2019-2146

United States Court of Appeals for the Federal Circuit

December 30, 2020

NOTE: This disposition is nonprecedential.

Appeals from the United States Patent and Trademark Office, Patent Trial and Appeal Board in No. IPR2018-00391.

JAMES R. HANNAH, Kramer Levin Naftalis & Frankel LLP, Menlo Park, CA, for appellant. Also represented by PAUL J. ANDRE; JEFFREY PRICE, New York, NY.

PATRICK D. MCPHERSON, Duane Morris LLP, Washington, DC, for cross-appellant. Also represented by PATRICK C. MULDOON; MATTHEW CHRISTOPHER GAUDET, Atlanta, GA; JOSEPH POWERS, Philadelphia, PA.

Before LOURIE, REYNA, and WALLACH, Circuit Judges.

WALLACH, Circuit Judge.

Cisco Systems, Inc. ("Cisco") sought inter partes review ("IPR") of claims 1-4, 8, and 11-14 ("the Challenged Claims") of Finjan, Inc.'s ("Finjan") U.S. Patent No. 7,647,633 ("the '633 patent"). The U.S. Patent and Trademark Office's Patent Trial and Appeal Board ("PTAB") issued a final written decision concluding that Cisco "ha[d] shown by a preponderance of the evidence that claims 1-4, 8, and 11-13 of the '633 patent are unpatentable" as obvious, but "ha[d] not shown by a preponderance of the evidence that [independent] claim 14 of the '633 patent is unpatentable" as obvious. Cisco Sys., Inc. v. Finjan, Inc., No. IPR2018-00391, 2019 WL 2237141, at *1 (P.T.A.B. May 23, 2019).

Finjan appeals and Cisco cross-appeals. We have jurisdiction pursuant to 28 U.S.C. § 1295(a)(4)(A). We affirm.

BACKGROUND

I. The '633 Patent

Entitled "Malicious Mobile Code Runtime Monitoring System and Methods," the '633 patent "relates generally to computer networks, and more particularly" to "a system and methods for protecting network-connectable devices from undesirable downloadable operation." '633 patent col. 1 ll. 30-33. The '633 patent "provides protection systems and methods capable of protecting . . . network accessible devices or processes," such as personal computers, "from harmful, undesirable, suspicious or other 'malicious' operations that might otherwise be effectuated by remotely operable code," such as computer viruses. Id. col. 2 ll. 20-25; see id. col. 1 ll. 40-44 (noting that "the Internet and other public networks have . . . become a major source of potentially system-fatal or otherwise damaging computer code commonly referred to as 'viruses'"). The '633 patent discloses "embodiments" that first "determin[e], within one or more network 'servers' . . . whether received information includes executable code"—referred to as a "Downloadable"—then, based on that determination, "deliver[] static, configurable, and/or extensible remotely operable protection [code or] policies" to the location of the Downloadable, and "caus[e] the mobile protection code to be executed within a Downloadable-destination in a manner that enables various Downloadable operations to be detected, intercepted or further responded to via protection operations." Id. col. 2 ll. 39-55; see id. col. 1 ll. 60-66 (providing that "[d]ownloadable information" may include "distributable components (e.g.[,] Java™ applets and JavaScript scripts, ActiveX™ controls, Visual Basic, add-ins and/or others)" and "application programs, Trojan horses, multiple compressed programs such as zip or meta files, among others"), col. 2 ll. 28-33 (similar).

Independent claims 1 and 14, and claims 2 and 3 of the '633 patent, are illustrative. Independent claim 1 recites:

A computer processor-based method, comprising:

receiving, by a computer, downloadable-information;

determining, by the computer, whether the downloadable-information includes executable code; and

based upon the determination, transmitting from the computer mobile protection code to at least one information-destination of the downloadable-information, if the downloadable-information is determined to include executable code.

Id. col. 20 ll. 54-62. Claim 2 depends from independent claim 1, and provides that "receiving includes monitoring received information of an information re-communicator." Id. col. 20 ll. 63-65. Claim 3, which depends from claim 2, provides that claim 2's "information re-communicator is a network server." Id. col. 20 ll. 66-67.

Independent claim 14 recites:

A computer program product, comprising a computer usable medium having a computer readable program code therein, the computer readable program code adapted to be executed for computer security, the method comprising:

providing a system, wherein the system comprises distinct software modules, and wherein the distinct software modules comprise an information re-communicator and a mobile code executor;

receiving, at the information re-communicator, downloadable-information including executable code; and

causing mobile protection code to be executed by the mobile code executor at a downloadable-information destination such that one or more operations of the executable code at the destination, if attempted, will be processed by the mobile protection code.

Id. col. 21 l. 58-col. 22 l. 5.

II. The Prior Art

A. Hanson

Entitled "Reverse Proxy Server," WIPO Pub. No. WO 98/31124 ("Hanson") is an international application published under the Patent Cooperation Treaty, and "relates to client/server computer communications over an internetwork system and, more particularly, to improved access of firewall protected servers." J.A. 833; see J.A. 831- 52 (Hanson).¹ Hanson discloses "a method and system for securely accessing servers" over a network by providing "secure bi-directional data packet communication between" an external "client . . . and [internal] servers," with the servers "protected by a firewall . . . and bastion server." J.A. 835-36. The bastion server "includes a processor and memory like typical servers, but also includes an internal [IP] address file . . . and a rules file . . . stored in memory." J.A. 836.²

Hanson teaches that its bastion server uses its address and rule files to limit "external access to [the internal servers] through the firewall," J.A. 837, specifically, by checking both outgoing and incoming "data packet[s]" against its internal address file and rules file, J.A. 838. Data packets are routed through the bastion server. J.A. 838. Incoming data packets are addressed to an internal server name. J.A. 838. The bastion server receives the data packet and, first, "determines whether a match exists between the server name and an internal address located in the internal address file." J.A. 838. "If no match is found, the bastion" server notifies the client that the "packet cannot be delivered." J.A. 838. If the address is found, the bastion server then "check[s]" "the received packet . . . against [the] rules contained within the rules file." J.A. 838. If the data packet "fails to pass" any of the rules, the bastion server notifies the client and does not deliver the packet. J.A. 838. "[I]f the received packet passes all the rules contained within the rules file, a connection is made between the client and the [addressed internal] server" and the packet is delivered. J.A. 838. "The rule checks include certainsecurity [check] programs that operate upon received data packets and, particularly, data packets that are or include programs." J.A. 838; see J.A. 842-43 (providing that these programs may be "J[ava™] applets" or "ActiveX[™] programs which are intended to be run on the destination client or server"). Hanson explains that the "security check program" does this by "tagging" or "attaching itself to the [executable code] being sent in the data packet," such that, when the executable code is "run at the destination client or server," the security check program "runs simultaneously" and "performs [the necessary] security operations." J.A. 842, 845. Outgoing packets undergo a similar check through the bastion server. J.A. 840.

B. Hyppönen

Entitled "Computer Virus Screening," U.S. Patent No. 6,577,920 ("Hyppönen") "relates to the screening of computer data for viruses and more particularly to the screening of computer data for macro viruses." J.A. 857; see J.A. 854-61 (Hyppönen). Hyppönen defines "macros" as "small executable programs written in a simple high level language" that provide, for example, "customized menu bars" or "document templates" in word processing programs. J.A. 857.

Hyppönen discloses a "method of screening a software file for viral infection" using three databases—one "of known macro virus signatures, a second . . . of known and certified commercial macro signatures, and a third . . . of known and certified local macro signatures." J.A. 854. Hyppönen teaches that a software file may be "scanned to determine whether or not [it] contains a macro." J.A. 854. "If [it does] contain[] a macro," then the method determines "a signature for the macro" such that it may be "screened against the signatures contained in [the three] databases" of known signatures. J.A. 854. If the macro is a known virus, the file system event is suspended and the user alerted. J.A. 859. If the macro is a known legitimate program, it is allowed to proceed. J.A. 859. If the macro is unknown and unverifiable, the file system event is suspended and "a report is sent to the network manager" with "a copy of the [unknown] macro." J.A. 859. The databases may be updated as more macros are encountered or become available. J.A. 857. Hyppönen suggests that its system may be modified "to screen files for viruses other than macro viruses." J.A. 859.

DISCUSSION

Finjan argues that the PTAB made a series of claim construction errors, and that, under the proper construction, claims 1-4, 8, and 11-13 of the '633 patent are not obvious over Hanson and Hyppönen. Appellant's Br. 20-36. On cross-appeal, Cisco argues that the PTAB's conclusion that independent claim 14 of the '633 patent is not obvious over Hanson and Hyppönen is unsupported by substantial evidence. Cross-appellant's Br. 40. We address each argument in turn.

I. Standard of Review

"We review the PTAB's...