DigitalDoors Inc v. Colony Bank

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: DigitalDoors, Inc. (Florida)
  • Defendant: Colony Bank (Georgia)
  • Plaintiff’s Counsel: Garteiser Honea, PLLC
• Case Identification: 1:24-cv-05578, N.D. Ga., 12/05/2024
• Venue Allegations: Plaintiff alleges venue is proper in the Northern District of Georgia because Defendant maintains physical branch locations, employs individuals, and generates substantial revenue within the district, in addition to targeting its services to residents of the district.
• Core Dispute: Plaintiff alleges that Defendant’s data backup and disaster recovery systems, which are asserted to be compliant with the financial industry’s "Sheltered Harbor" standard, infringe four patents related to methods for securely filtering, extracting, and storing sensitive data in distributed computing systems.
• Technical Context: The technology at issue addresses secure data management, specifically for isolating and protecting critical data to ensure operational continuity after a catastrophic event, a service of high significance in the financial sector.
• Key Procedural History: The complaint does not mention prior litigation or post-grant proceedings involving the asserted patents. It does, however, extensively argue that the inventions were novel and non-obvious by pointing to the financial services industry's collective, multi-year effort beginning in 2015 to develop the "Sheltered Harbor" standard, which allegedly incorporates the patented technologies invented years earlier.

Case Timeline

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 9,015,301 - "Information infrastructure management tools with extractor, secure storage, analysis and classification and method therefor"

• Patent Identification: U.S. Patent No. 9,015,301, "Information infrastructure management tools with extractor, secure storage, analysis and classification and method therefor," issued April 21, 2015.

The Invention Explained

• Problem Addressed: The patent describes challenges in managing information in enterprise systems, including the difficulty of handling unstructured data, the vulnerability of open ecosystems with numerous access points, and the inability of conventional systems to effectively manage the changing sensitivity of data over its lifecycle (Compl. ¶27; ’301 Patent, col. 1:31–2:61).
• The Patented Solution: The invention proposes a method for organizing and processing data by applying a plurality of filters (e.g., categorical, contextual, taxonomic) to a data input. These filters extract "select content" (important or sensitive data), which is then stored in corresponding secure data stores. This method associates specific data processes—such as copying, archiving, or destruction—with the filtered content, allowing for granular and automated management based on the data's substance rather than just its file container (’301 Patent, Abstract; col. 3:17–4:15).
• Technical Importance: This approach allegedly represented an unconventional shift in data management from a file-based to a content-based paradigm, enabling more robust and flexible security protocols (Compl. ¶¶12, 29).

Key Claims at a Glance

• The complaint asserts independent method Claim 25 (Compl. ¶98).
• Essential elements of Claim 25 include:
  • Providing a plurality of select content data stores operative with a plurality of designated categorical filters.
  • Activating at least one filter and processing a data input to obtain select content.
  • Storing the obtained select content in a corresponding data store.
  • Associating a data process (e.g., copy, extract, archive, distribution, destruction) with the activated filter.
  • Applying the associated data process to a further data input based on the filter's processing.
  • The filter activation can be automatic (time-based, condition-based, or event-based) or manual.

U.S. Patent No. 9,734,169 - "Digital information infrastructure and method for security designated data and with granular data stores"

• Patent Identification: U.S. Patent No. 9,734,169, "Digital information infrastructure and method for security designated data and with granular data stores," issued August 15, 2017.

The Invention Explained

• Problem Addressed: The patent addresses the need to secure sensitive data within a distributed or cloud-based system without requiring full-document encryption, which can be inefficient. The core problem is how to separate and distinctly manage sensitive versus non-sensitive data derived from the same source (’169 Patent, Abstract).
• The Patented Solution: The invention claims a method in a distributed cloud-based system where "security designated data" is extracted from a data source and stored in secure "select content data stores" governed by strict access controls. The "remainder data" (the non-extracted portion) is parsed and stored separately in "granular data stores." This architecture allows for the secure, isolated management and withdrawal of sensitive information while leaving the less sensitive remainder data in a different location (’169 Patent, Abstract).
• Technical Importance: By separating data based on content sensitivity into different storage locations with different access rules, the system provides a granular security architecture that protects critical information while maintaining the accessibility of non-critical data (Compl. ¶¶35, 36).

Key Claims at a Glance

• The complaint asserts independent method Claim 1 (Compl. ¶129).
• Essential elements of Claim 1 include:
  • Providing, in a distributed cloud-based system, a plurality of "select content data stores" (for sensitive data), "granular data stores" (for other data), and a cloud-based server.
  • Extracting and storing security-designated data in the select content data stores.
  • Activating a select content data store to permit access based on applied access controls.
  • Parsing "remainder data" not extracted from the processed data.
  • Storing the parsed remainder data in the granular data stores.
  • Withdrawing data from any of the stores only in the presence of the respective access controls.

Multi-Patent Capsule: U.S. Patent No. 10,182,073 - "Information infrastructure management tools with variable and configurable filters and segmental data stores"

• Patent Identification: U.S. Patent No. 10,182,073, "Information infrastructure management tools with variable and configurable filters and segmental data stores," issued January 15, 2019.
• Technology Synopsis: The ’073 Patent describes a method for creating a dynamic information infrastructure where initially configured data filters can be altered. The system can expand or contract the scope of what is considered sensitive or select content within a filter, generate new modified filters based on these alterations, and then organize subsequent data throughput using these new rules (’073 Patent, Abstract, Claim 1).
• Asserted Claims: Claim 1 (Compl. ¶165).
• Accused Features: The accused systems allegedly provide a user interface to define, run, and modify "policies" for data backup and replication. The complaint contends that this functionality of creating and modifying policies constitutes the claimed "altering" of filters and "generating modified configured filters" to manage data processing (Compl. ¶¶182, 184).

Multi-Patent Capsule: U.S. Patent No. 10,250,639 - "Information infrastructure management data processing tools for processing data flow with distribution controls"

• Patent Identification: U.S. Patent No. 10,250,639, "Information infrastructure management data processing tools for processing data flow with distribution controls," issued April 2, 2019.
• Technology Synopsis: The ’639 Patent claims a method for "sanitizing" data by extracting sensitive content based on sensitivity levels into secure stores, thereby creating "sanitized" versions from the remaining data. A key step involves "inferencing" this sanitized data using a combination of content, contextual, and taxonomic filters to analyze it and obtain new insights or classifications (’639 Patent, Abstract, Claim 16).
• Asserted Claims: Claim 16 (Compl. ¶192).
• Accused Features: The complaint alleges that the accused systems extract sensitive account data into a secure data vault, creating a sanitized version of the data. It further alleges that the systems perform data analytics and content scans within the vault, which is asserted to be the claimed "inferencing" of the sanitized data using various filters (Compl. ¶¶217, 220).

III. The Accused Instrumentality

Product Identification

The "Accused Instrumentalities" are identified as the data backup and disaster recovery systems and methods that Defendant Colony Bank makes, owns, operates, or controls (Compl. ¶95).

Functionality and Market Context

The complaint alleges these systems are compliant with the "Sheltered Harbor" specification, an industry standard for the financial services sector designed to protect critical customer account data (Compl. ¶¶62, 95). Their core function is to create secure, immutable, and isolated backups of financial data in a "data vault." This allows the financial institution to recover critical operations and restore customer access to funds following a catastrophic event, such as a major cyberattack (Compl. ¶¶65, 69). An exemplary system that meets the Sheltered Harbor standard, the Dell PowerProtect Cyber Recovery solution, is described as isolating data in a protected vault via an "automated operational air gap" to shield it from the production network (Compl. ¶¶71, 79). A diagram in the complaint illustrates this architecture, showing a "Production Environment" where data is extracted and a separate "Data Vault Environment" where data is replicated and secured (Compl. ¶72).

IV. Analysis of Infringement Allegations

U.S. Patent No. 9,015,301 Infringement Allegations

• Identified Points of Contention:
  • Scope Questions: A central question may be whether the term "categorical filter," as used in the patent, can be construed to read on the "protection policies" of a modern data backup system like Dell PowerProtect. The defense may argue that these policies are conventional backup rules, not the specific types of filters disclosed in the patent.
  • Technical Questions: The claim requires "applying the associated data process to a further data input." It may be disputed whether a system that repeatedly backs up an entire dataset and applies the same policy each time meets this limitation, or if the claim requires a more dynamic application of processes to new, distinct data inputs.

U.S. Patent No. 9,734,169 Infringement Allegations

• Identified Points of Contention:
  • Scope Questions: A primary issue may be the interpretation of "parsing remainder data...and storing the parsed data." The defense could argue this requires splitting an original data stream into two parts, whereas the accused systems appear to perform a full backup and then copy critical data from that backup to a separate vault, which may be a technically distinct process.
  • Technical Questions: Does the accused system's "production backup system" function as the claimed "granular data stores" for "remainder data"? The court will have to determine if this mapping is technically sound or if the patent contemplates a different architectural relationship between the data stores.

V. Key Claim Terms for Construction

For the ’301 Patent:

• The Term: "categorical filters"
• Context and Importance: This term is foundational to the infringement theory for the '301 patent. Its definition will determine whether the "protection policies" of the accused data backup systems fall within the claim's scope. Practitioners may focus on this term because the complaint broadly equates it with modern backup rules, while the patent specification describes more specific types, such as content-based, contextual, and taxonomic filters (Compl. ¶87; ’301 Patent, col. 9:48-50).
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The summary of the invention describes "enterprise designated categorical filters which include content-based filters, contextual filters and taxonomic classification filters" (’301 Patent, col. 3:34-37). The use of "include" suggests these are examples, not an exhaustive list.
  • Evidence for a Narrower Interpretation: The detailed description repeatedly references the specific combination of "content-based filters, contextual filters, and taxonomic filters" as the mechanism for overcoming the prior art's deficiencies (e.g., ’301 Patent, col. 9:48-50). An opponent might argue these specific types are essential features of the invention.

For the ’169 Patent:

• The Term: "parsing remainder data not extracted... and storing the parsed data"
• Context and Importance: The infringement analysis for the '169 patent hinges on whether the accused process meets this limitation. The complaint alleges that storing non-extracted data in production/backup systems satisfies this step (Compl. ¶151). This will likely be a key point of dispute, as the claim language suggests an action performed on the "remainder," not simply leaving the original source file in place after a copy/extract operation.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The abstract states the system extracts data and stores the remainder in granular data stores, without specifying that the original must be altered or deleted. One could argue that creating a full backup and then copying sensitive data out leaves the backup as the "remainder data," which is then "stored."
  • Evidence for a Narrower Interpretation: The term "parsing" implies an active process of analyzing and processing the remainder data, not just leaving it untouched. Furthermore, the specification's focus on splitting data streams to enhance security (e.g., '169 Patent, col. 17:58-63) suggests an intent to separate the original data into distinct components, not merely to copy a portion of it. The complaint's visual evidence showing data flow from "Backup Workloads" to a vault may suggest a copy-based architecture rather than a parsing-and-storing one (Compl. ¶70).

VI. Other Allegations

• Indirect Infringement: The complaint focuses on allegations of direct infringement, asserting that Defendant Colony Bank "makes, owns, operates, uses, or otherwise exercises control over" the accused systems and that the systems are configured to "directly perform... all infringing steps" (Compl. ¶¶95, 98, 129).
• Willful Infringement: Plaintiff includes a specific count for knowledge and willfulness (Compl. ¶¶225-227). The allegations are based on Defendant's alleged actual notice of the patents upon service of the complaint, or alternatively, constructive notice based on awareness of prior lawsuits filed against competitor financial institutions. The complaint further alleges that Defendant maintains a policy or practice of not reviewing the patents of others, constituting willful blindness (Compl. ¶227).

VII. Analyst’s Conclusion: Key Questions for the Case

• A core issue will be one of temporal and technological scope: can patent claims with a 2007 priority date, directed at allegedly "unconventional" methods of granular data filtering and separation, be construed to cover the "Sheltered Harbor" industry standard for disaster recovery, which was developed nearly a decade later? The case may depend on whether the court views the accused systems as practicing the patented inventions or as a parallel technological evolution based on conventional backup principles.
• A second key question will be one of operational equivalence: does the accused functionality of creating full backups and then copying critical data to a secure vault align with claim language requiring the "extraction" of sensitive data and the separate "parsing and storing of remainder data"? The resolution of this question may turn on whether the accused copy-and-isolate architecture is functionally equivalent to the patents' claimed split-and-store architecture.
• Finally, the case presents a question of claim construction and definition: how will terms like "categorical filter" ('301 Patent) and "parsing remainder data" ('169 Patent) be defined? The outcome will likely be determined by whether these terms are interpreted broadly to encompass modern data protection policies and backup routines, or narrowly to require the specific implementations and data-flow models described in the patent specifications.