Threatstop Inc v. Infoblox Inc

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: Threatstop, Inc. (Delaware)
  • Defendant: Infoblox, Inc. (Delaware)
  • Plaintiff’s Counsel: Lewis Brisbois Bisgaard & Smith LLP
• Case Identification: 5:23-cv-01172, N.D. Cal., 03/15/2023
• Venue Allegations: Venue is alleged to be proper in the Northern District of California because the Defendant resides in the district.
• Core Dispute: Plaintiff alleges that Defendant misappropriated its confidential technology to file U.S. Patent No. 9,736,185, and seeks a court order to correct the patent's inventorship and ownership from Defendant's employees to its own.
• Technical Context: The technology relates to automating network security policy enforcement by using a central server to propagate policy-relevant updates to network controllers that manage devices like firewalls and routers.
• Key Procedural History: The complaint alleges the parties had a business relationship from 2012 to 2016 governed by a Service and Software License Agreement (SSLA). A dispute over royalties led to an arbitration initiated in 2020. Plaintiff states it attempted to add the inventorship claim to the arbitration, but Defendant opposed, arguing the matter was within the exclusive jurisdiction of federal courts, leading Plaintiff to file this lawsuit.

Case Timeline

Date	Event
Early 2012	Parties' business relationship and SSLA initiated
2015-04-21	’185 Patent Priority Date (Provisional Application No. 62/150,792 filed)
2015-07-22	Patent Application leading to '185 patent filed
2016	Parties' SSLA terminated
2017-08-15	U.S. Patent No. 9,736,185 issued
2020-09-30	Plaintiff served Demand for Arbitration on Defendant
2023-03-15	Complaint for Correction of Inventorship filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 9,736,185 - DNS OR NETWORK METADATA POLICY FOR NETWORK CONTROL

The Invention Explained

• Problem Addressed: The patent's background section describes that managing network security policies, such as firewall rules and Access Control Lists (ACLs), is highly complex and sensitive. These rule lists can be thousands of entries long, and mistakes in configuration can create significant performance and security vulnerabilities ('185 Patent, col. 2:36-54).
• The Patented Solution: The invention proposes a system to automate this process. A central Domain Name System (DNS) or IP Address Management (IPAM) server receives network updates (e.g., a new IP address for a domain name) and checks them against a defined policy. If an update is relevant, it is automatically sent to a network controller, which in turn reconfigures network devices (like routers or firewalls) to enforce the policy. This decouples the high-level policy from the low-level, device-specific implementation ('185 Patent, Abstract; Fig. 1).
• Technical Importance: This automated approach is intended to reduce the complexity and potential for human error inherent in manually managing configurations for large enterprise networks, thereby improving security responsiveness ('185 Patent, col. 2:47-54).

Key Claims at a Glance

• The complaint alleges derivation of the "essential elements of each of the issued claims" (Compl. ¶37). The primary independent claims are 1 (system), 12 (method), and 16 (computer program product).
• Independent Claim 1 of the '185 Patent recites the following essential elements:
  • A processor of a DNS or IP Address Management (IPAM) server configured to:
  • receive a DNS or network metadata update that is determined to be relevant to a network policy;
  • wherein the policy is based on DNS zones, subzones, DNS wildcards, or metadata associated with network configuration data;
  • send the DNS or network metadata update to a network controller for a network;
  • wherein the network controller configures a plurality of network devices on the network based on the policy; and
  • wherein sending the update to the network controller effectuates actions such as adding or removing an IP address from a set of addresses relevant to the policy.

III. The Contested Instrumentality

Product Identification

The subject of the dispute is the intellectual property embodied in U.S. Patent Application No. 14/806,476 and the resulting U.S. Patent No. 9,736,185 ('185 Patent) (Compl. ¶34).

Functionality and Market Context

The complaint alleges that in early 2012, Defendant Infoblox, needing a threat-intelligence system for its customers, approached Plaintiff ThreatSTOP to license its technology (Compl. ¶12). During confidential technical discussions about integrating the two companies' systems, ThreatSTOP allegedly disclosed proprietary information and enhancements (Compl. ¶¶14-15). The complaint claims that Infoblox, unbeknownst to ThreatSTOP, filed the patent application in July 2015, incorporating "confidential and proprietary information developed by ThreatSTOP" (Compl. ¶¶23, 35). Plaintiff alleges this was done to improperly obtain the economic and non-economic benefits of an invention created and owned by ThreatSTOP (Compl. ¶42).

IV. Analysis of Derivation Allegations

The complaint does not contain a claim chart, as the central claim is one of derivation and incorrect inventorship, not infringement. The core theory is presented narratively.

The complaint alleges that the true inventors of the '185 Patent are ThreatSTOP employees Tomás Byrnes and Francis Turner (Compl. ¶38). It is alleged that these individuals conceived of the invention and that its "essential elements" were disclosed to Infoblox during confidential technical discussions held under non-disclosure agreements and an SSLA (Compl. ¶¶15-16, 37). The complaint asserts that "substantially all of the concepts, information and inventive disclosures in the specification and claims" of the patent application were "derived directly or indirectly" from the proprietary information provided by ThreatSTOP (Compl. ¶36). It further alleges that the named inventors listed on the patent—John Dominic Belamaric, Soheil Eizadi, and John Charles Voss—did not contribute to the conception of any essential elements and are not proper inventors (Compl. ¶39).

No probative visual evidence provided in complaint.

• Identified Points of Contention:
  • Evidentiary Question: A central issue will be what specific, corroborating evidence (e.g., dated documents, emails, lab notebooks, source code) ThreatSTOP can produce to demonstrate that its employees had conceived of the complete and operative invention, as defined by the patent's claims, prior to or contemporaneously with the disclosures to Infoblox.
  • Contribution Question: The case will likely require a detailed factual inquiry into the respective contributions of both the alleged true inventors (Byrnes and Turner) and the named inventors (Belamaric, Eizadi, and Voss). The court will need to determine who contributed to the "conception"—the formation in the mind of the inventor of a definite and permanent idea of the complete and operative invention—of the subject matter of the claims.
  • Contractual Question: The terms of the SSLA and any separate non-disclosure agreements may be scrutinized to determine the scope of confidentiality obligations and what rights, if any, were conferred regarding intellectual property developed during the collaboration (Compl. ¶¶16-18).

V. Key Claim Terms for Construction

The complaint does not raise issues of claim construction. The dispute centers on inventorship and derivation, making this section not applicable.

VI. Other Allegations and Remedies Sought

• Correction of Inventorship and Ownership: The primary relief sought is a court order under 35 U.S.C. § 256 correcting the '185 Patent to remove the named Infoblox employees and identify Tomás Byrnes and Francis Turner as the sole joint inventors (Compl., Prayer for Relief ¶1). As a consequence, ThreatSTOP also seeks to be identified as the sole owner and assignee of the patent (Compl., Prayer for Relief ¶2).
• Exceptional Case Allegations: ThreatSTOP seeks a finding that the case is "exceptional" under 35 U.S.C. § 285, which would permit an award of attorney fees (Compl., Prayer for Relief ¶3). This request is based on allegations that Infoblox's failure to name the correct inventors was "intentional, undertaken in bad faith," and that it "intentionally concealed" the patent application in violation of its confidentiality obligations (Compl. ¶¶45-46, 48).

VII. Analyst’s Conclusion: Key Questions for the Case

• A central issue will be one of conception and derivation: Can ThreatSTOP present sufficient corroborating evidence to prove that its employees conceived of the complete invention as claimed in the '185 Patent, and that the named inventors at Infoblox derived that invention from ThreatSTOP's confidential disclosures?
• A critical factual question will be one of inventive contribution: What, if any, contribution to the conception of the claimed subject matter was made by the named Infoblox inventors? The court’s determination of the correct "inventive entity" will dictate whether inventors are added, removed, or substituted.
• The request for exceptional case status will turn on the question of intent: Does the evidence demonstrate that Infoblox's actions constituted an intentional, bad-faith misappropriation of intellectual property, or was the incorrect listing of inventors a result of a good-faith mistake regarding inventorship law?