DCT
1:17-cv-01470
Selective Signals LLC v. Palo Alto Networks Inc
I. Executive Summary and Procedural Information
- Parties & Counsel:
- Plaintiff: Selective Signals, LLC (Texas)
- Defendant: Palo Alto Networks, Inc. (California)
- Plaintiff’s Counsel: Brandt Law Firm
- Case Identification: 1:17-cv-01470, E.D. Tex., 01/31/2017
- Venue Allegations: Plaintiff alleges venue is proper in the Eastern District of Texas because Defendant transacts business in the district and has committed acts of patent infringement there.
- Core Dispute: Plaintiff alleges that Defendant’s Next Generation Firewall products infringe a patent related to identifying the type of a network media session by analyzing packet traffic characteristics.
- Technical Context: The technology concerns methods for identifying and managing specific types of internet traffic, such as voice or video streams, without relying on computationally expensive deep packet inspection.
- Key Procedural History: Post-filing, the asserted patent was the subject of an Inter Partes Review (IPR) proceeding, IPR2018-00594, initiated by a petition filed on February 7, 2018. The IPR resulted in a final written decision cancelling claims 15 and 17-22 of the patent, including the sole independent claim asserted in this complaint. This subsequent invalidation of the asserted claims raises a fundamental question about the continued viability of the lawsuit as pleaded.
Case Timeline
| Date | Event |
|---|---|
| 2006-11-06 | ’629 Patent Priority Date |
| 2012-02-07 | ’629 Patent Issue Date |
| 2017-01-31 | Complaint Filing Date |
| 2018-02-07 | IPR Petition Filed for ’629 Patent |
| 2020-07-15 | IPR Certificate Issued, Cancelling Asserted Claims |
II. Technology and Patent(s)-in-Suit Analysis
U.S. Patent No. 8,111,629 - "Media Session Identification Method for IP Networks"
- Issued: February 7, 2012
The Invention Explained
- Problem Addressed: The patent describes the challenge of identifying specific types of media sessions (e.g., voice, video) within a high volume of network traffic. Traditional methods like Deep Packet Inspection (DPI), which analyze the content (payload) of data packets, are described as resource-intensive, slow, and potentially ineffective against encrypted traffic or when applications change their data format (’629 Patent, col. 2:3-36).
- The Patented Solution: The invention proposes a method to identify media sessions by analyzing external "traffic characteristics" of packets rather than their internal payload. The system observes parameters such as packet length and the time interval between packets ("inter-arrival period") to probabilistically group packets into a "presumed session" and then identify the session's type (e.g., voice, video) based on patterns in these characteristics (’629 Patent, Abstract; col. 3:22-42). This approach is intended to be faster and more resilient to encryption than content-based inspection (’629 Patent, col.8:47-56).
- Technical Importance: By avoiding payload analysis, the described method aimed to provide a less computationally demanding way to manage network traffic for quality of service, security, and billing purposes, particularly in high-speed network backbones where DPI could be a bottleneck (’629 Patent, col. 1:25-34; col. 2:50-59).
Key Claims at a Glance
- The complaint asserts infringement of at least independent claim 15 (’629 Patent, ¶8).
- The essential elements of independent claim 15 are:
- obtaining passing packets of respectively unknown sessions and unknown session types;
- obtaining traffic packet characteristics of said passing packets of respectively unknown session types;
- comparing said obtained packets with each other using respectively obtained traffic packet characteristics;
- grouping together those packets having similar values of said traffic packet characteristics into a presumed session;
- analyzing said grouped packets of said presumed session for session characteristic;
- using said session characteristics to identify a session type of said presumed session.
- The complaint does not explicitly reserve the right to assert dependent claims, though the post-filing IPR proceeding cancelled claims 17-22.
III. The Accused Instrumentality
Product Identification
- The accused products are Defendant’s "Next Generation Firewalls," including the PA-7000, PA-5000, PA-3000, PA-500, and PA-200 Series (Compl. ¶9).
Functionality and Market Context
- The complaint alleges these devices are network security appliances that perform "a full stack, single pass inspection of all traffic across all ports" (Compl. ¶10). The core accused technology is "App-ID," which identifies applications by analyzing packets using "Application Signatures," "TLS/SSL and SSH Decryption," "Application and Protocol Decoding," and "Heuristics" (Compl. ¶11). This process is alleged to involve grouping packets with similar characteristics (e.g., same application, protocol, user) into a session, analyzing the session, and using the resulting characteristics to identify the session type, thereby enabling security policies (Compl. ¶13-15).
IV. Analysis of Infringement Allegations
No probative visual evidence provided in complaint.
’629 Patent Infringement Allegations
| Claim Element (from Independent Claim 15) | Alleged Infringing Functionality | Complaint Citation | Patent Citation |
|---|---|---|---|
| obtaining passing packets of respectively unknown sessions and unknown session types | Defendant's devices obtain passing packets to perform "a full stack, single pass inspection of all traffic across all ports" to provide context on application and content. | ¶10 | col. 13:26-29 |
| obtaining traffic packet characteristics of said passing packets of respectively unknown session types | Defendant's devices determine packet characteristics by analyzing "Application Signatures," performing "TLS/SSL and SSH Decryption," "Application and Protocol Decoding," and/or using "Heuristics." | ¶11 | col. 13:30-32 |
| comparing said obtained packets with each other using respectively obtained traffic packet characteristics | Defendant's devices compare packets using characteristics such as "session rate" to perform "additional heuristic, or behavior analysis to identify certain applications." | ¶12 | col. 13:33-35 |
| grouping together those packets having similar values of said traffic packet characteristics into a presumed session | Defendant's devices "automatically group together packets that have similar values of traffic packet characteristics (i.e., same application, same protocol and same user) to a session." | ¶13 | col. 13:36-39 |
| analyzing said grouped packets of said presumed session for session characteristic | Defendant's devices analyze grouped packets by, for example, decrypting a TLS/SSL connection to see the underlying HTTP traffic and applying "contextual signatures" to detect the application in use (e.g., WebEx). | ¶14 | col. 13:40-42 |
| using said session characteristics to identify a session type of said presumed session | Defendant's devices use the determined session characteristics to identify a session type, such as detecting a "mode-shift" within a WebEx session from conferencing to remote access. | ¶15 | col. 13:43-45 |
Identified Points of Contention
- Scope Questions: The patent specification distinguishes the invention from "deep packet inspection" by focusing on external characteristics like packet length and timing, explicitly noting its method "excludes packet payload content whose inspection is common in deep packet inspection" (’629 Patent, col. 6:16-19). The complaint, however, alleges that the accused "App-ID" functionality involves "TLS/SSL and SSH Decryption" and analysis of "Application Signatures" (Compl. ¶11, ¶14). This raises the question of whether an accused method that relies on decrypting and inspecting packet content can infringe a claim from a patent that teaches avoiding content inspection.
- Technical Questions: Claim 15 requires grouping packets based on "similar values of said traffic packet characteristics." The patent specification provides examples of these characteristics such as "packet length or inter-arrival period" (’629 Patent, col. 6:46-47). The complaint alleges the accused devices group packets based on "same application, same protocol and same user" (Compl. ¶13). It is an open question whether the basis for grouping alleged in the complaint is equivalent to the "traffic packet characteristics" described and claimed in the patent.
V. Key Claim Terms for Construction
The Term: "traffic packet characteristics"
Context and Importance: This term is central to the invention's claimed departure from prior art deep packet inspection. The outcome of the infringement analysis may depend on whether the analysis performed by the accused products (e.g., decryption, signature matching) falls within the definition of analyzing "traffic packet characteristics."
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The term is not explicitly defined or limited within claim 15 itself, which may support an argument that it can encompass any characteristic derivable from a packet.
- Evidence for a Narrower Interpretation: The specification repeatedly provides specific examples, stating that "traffic characteristics comprise at least one member of the group consisting of packet length, inter-arrival period, and average bandwidth" (’629 Patent, col. 4:6-8). Further, the description of the invention emphasizes that these are "characteristics that do not require deep analysis of the packet content" (’629 Patent, col. 6:50-52), suggesting the term should be construed to exclude information derived from the packet's payload.
The Term: "analyzing said grouped packets"
Context and Importance: The nature of the "analysis" is critical. Practitioners may focus on this term because the patent appears to teach a statistical or behavioral analysis based on external metrics, while the complaint alleges the accused products perform a content-based analysis after decryption.
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The claim language itself does not restrict the type of analysis performed on the grouped packets.
- Evidence for a Narrower Interpretation: The specification describes the analysis in terms of creating histograms of packet lengths and inter-arrival times, calculating statistical derivatives, and using these to identify session types (’629 Patent, col. 8:21-65). This may support a narrower construction limited to statistical analysis of traffic patterns, as opposed to the deterministic signature matching and protocol decoding alleged to be performed by the accused products (Compl. ¶11, ¶14).
VI. Other Allegations
Indirect Infringement
- The complaint does not plead specific facts to support claims of induced or contributory infringement, such as allegations of specific intent or knowledge.
Willful Infringement
- The complaint does not contain an allegation of willful infringement or facts to support a finding of willfulness, such as pre-suit knowledge of the patent.
VII. Analyst’s Conclusion: Key Questions for the Case
- A core issue will be one of definitional scope: can the claimed method, which the patent specification positions as an alternative to content-based deep packet inspection, be construed to cover the accused "App-ID" system, which allegedly relies on payload decryption and application signature analysis? This dispute centers on the proper construction of "traffic packet characteristics."
- A key evidentiary question will be one of functional operation: does the accused system's method of grouping packets based on "application, protocol and user" meet the claim limitation of grouping based on "similar values of said traffic packet characteristics" as that term is understood in light of the patent's disclosure?
- A dispositive procedural question overlays the entire case: given the subsequent cancellation of all asserted claims in IPR proceedings that concluded after the complaint was filed, the primary question is whether the plaintiff's action has any remaining legal basis to proceed.