DigitalDoors Inc v. Flushing Bank

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: DigitalDoors, Inc. (Florida)
  • Defendant: Flushing Bank (New York)
  • Plaintiff’s Counsel: Lucosky Brookman, LLP; Hoffberg & Associates
• Case Identification: 2:25-cv-01895, E.D.N.Y., 06/27/2025
• Venue Allegations: Plaintiff alleges venue is proper because Defendant maintains a regular and established business presence in the Eastern District of New York, including physical branch locations and employees, and specifically targets customers within the district.
• Core Dispute: Plaintiff alleges that Defendant’s data security and disaster recovery systems, which are alleged to be compliant with the financial industry’s “Sheltered Harbor” standard, infringe four patents related to methods for securely organizing, filtering, and processing data in a distributed system.
• Technical Context: The technology concerns secure data management, specifically methods for isolating and protecting critical data to ensure survivability and recovery from catastrophic events like a cyberattack, a domain of significant importance for the financial services industry.
• Key Procedural History: The complaint does not mention prior litigation or administrative proceedings involving the patents-in-suit. It extensively details the post-invention development of the "Sheltered Harbor" industry standard, beginning in 2015, as evidence of the patents' non-obviousness and the technical merits of the claimed inventions.

Case Timeline

Date	Event
2007-01-05	Priority Date for all Patents-in-Suit
2015-01-01	"Sheltered Harbor" initiative launched
2015-04-21	U.S. Patent No. 9,015,301 Issued
2017-08-15	U.S. Patent No. 9,734,169 Issued
2019-01-15	U.S. Patent No. 10,182,073 Issued
2019-04-02	U.S. Patent No. 10,250,639 Issued
2025-06-27	Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 9,015,301 - *Information Infrastructure Management Tools with Extractor, Secure Storage, Content Analysis and Classification and Method Therefor*

The Invention Explained

• Problem Addressed: As of the invention date, enterprises struggled to manage and secure information, particularly sensitive data within unstructured files. Conventional methods focused on securing entire files rather than the specific content within them, lacked robust rights management for "open ecosystems," and could not effectively address the changing sensitivity of data over its lifecycle (Compl. ¶35; ’301 Patent, col. 1:31-2:61).
• The Patented Solution: The invention provides a method for organizing and processing data by shifting focus from the file to the content itself. It uses a system of "categorical filters" to identify and obtain "select content" (e.g., sensitive data) from a larger data input. This select content is then stored in corresponding secure data stores, and specific data processes (like copy, archive, or destruction) are associated with the filtered content, allowing for granular control over sensitive information in a distributed computing environment (’301 Patent, Abstract; col. 3:26-4:24).
• Technical Importance: This content-centric approach provided an unconventional method for data management that offered enhanced security and flexibility compared to traditional file-level security protocols (Compl. ¶34).

Key Claims at a Glance

• The complaint asserts independent claim 25 (Compl. ¶106).
• The essential elements of Claim 25 include:
  • A method of organizing and processing data in a distributed computing system.
  • Providing a plurality of "select content data stores" operative with a plurality of "designated categorical filters."
  • Activating at least one categorical filter and processing a data input through it to obtain "select content" that is contextually or taxonomically associated.
  • Storing the aggregated select content in the corresponding data store.
  • Associating at least one data process (from a group including copy, extract, archive, distribution, and destruction) with the activated filter.
  • Applying the associated data process to further data inputs processed by that filter.
  • The activation can be automatic (time-based, condition-based, or event-based) or manual.
• The complaint’s use of "at least Claim 25" suggests it reserves the right to assert other claims, including dependent claims (Compl. ¶106).

U.S. Patent No. 9,734,169 - *Digital Information Infrastructure and Method for Security Designated Data and with Granular Data Stores*

The Invention Explained

• Problem Addressed: The patent addresses the need for secure data storage and controlled access in a distributed, potentially cloud-based, environment. The background identifies risks associated with "open ecosystems" where many parties can access information, necessitating robust management of data access and modification rights (’169 Patent, col. 1:59-2:27).
• The Patented Solution: The invention describes a method for processing data in a distributed cloud-based system. The system provides separate data stores for "security designated data" (sensitive content) and "granular data" (other data). It extracts the sensitive data, stores it in its designated secure store, and then parses the "remainder data" and stores it in separate granular stores. Access to the sensitive data is controlled, and data can only be withdrawn when proper access controls are applied (’169 Patent, Abstract; col. 3:26-4:18).
• Technical Importance: This architecture provides enhanced security by separating sensitive data from non-sensitive data at a granular level and storing them in different, access-controlled locations within a distributed system, thereby reducing the risk of a comprehensive breach (Compl. ¶60).

Key Claims at a Glance

• The complaint asserts independent claim 1 (Compl. ¶137).
• The essential elements of Claim 1 include:
  • A method of organizing and processing data in a distributed cloud-based computing system.
  • Providing select content data stores, granular data stores, and a cloud-based server coupled by a communications network.
  • Extracting and storing "security designated data" in the select content data stores.
  • Activating a data store to permit access based on applying access controls.
  • Parsing "remainder data" not extracted and storing it in granular data stores.
  • Parsing and storing the remainder data can be done randomly or according to a predetermined algorithm.
  • Withdrawing the security designated data and parsed data only in the presence of the respective access controls.
• The complaint’s use of "at least Claim 1" suggests it reserves the right to assert other claims (Compl. ¶137).

U.S. Patent No. 10,182,073 - *Information Infrastructure Management Tools with Variable and Configurable Filters and Segmental Data Stores*

• Technology Synopsis: This patent addresses the need for flexible and dynamic data filtering in distributed systems. It discloses a method of creating an information infrastructure where data is processed through initially configured filters, which can then be dynamically altered (expanded, contracted, or reclassified) to create modified filters for organizing subsequent data throughput (’073 Patent, Abstract).
• Asserted Claims: Independent claim 1 is asserted (Compl. ¶173).
• Accused Features: The complaint alleges that the Accused Instrumentalities, specifically through features that allow for the creation and modification of "protection policies," infringe the ’073 Patent. The ability to define, run, monitor, and modify policies and their outcomes is identified as the infringing functionality (Compl. ¶¶190, 192-193).

U.S. Patent No. 10,250,639 - *Information Infrastructure Management Data Processing Tools for Data Flow with Distribution Controls*

• Technology Synopsis: This patent describes a method for "sanitizing" data by processing it through a system with multiple filters (content, contextual, taxonomic). The system extracts sensitive content based on sensitivity levels, stores it in secure extract stores, and stores the remaining data separately, thereby creating a "sanitized" version of the data for use while the sensitive components remain protected (’639 Patent, Abstract).
• Asserted Claims: Independent claim 16 is asserted (Compl. ¶200).
• Accused Features: The complaint alleges that the Accused Instrumentalities' process of extracting critical financial data based on predefined policies, converting it to a standard format, and storing it in a secure data vault constitutes the claimed method of sanitizing data (Compl. ¶¶211, 224).

III. The Accused Instrumentality

Product Identification

The "Accused Instrumentalities" are identified as the data processing and security systems used by *DigitalDoors Inc v. Flushing Bank* that are compliant with the "Sheltered Harbor" specification or are functionally equivalent (Compl. ¶103). The complaint cites Dell PowerProtect Cyber Recovery as an exemplary system that satisfies the Sheltered Harbor standard (Compl. ¶79).

Functionality and Market Context

The complaint alleges that, to comply with federal and state regulations, Flushing Bank utilizes systems that perform robust data backup and disaster recovery (Compl. ¶¶5-11). The core accused functionality is a system that extracts critical customer account data, converts it into a standardized format, and stores it in a secure, isolated, immutable, and air-gapped "data vault" for recovery after a catastrophic event (Compl. ¶¶77, 83-84). This process is allegedly performed nightly (Compl. ¶83). A diagram in the complaint illustrates this architecture, showing a "Production Environment" where data is extracted and a separate, air-gapped "Data Vault Environment" where replicated data undergoes processing and is locked (Compl. ¶80, p. 38). The Sheltered Harbor standard is described as an industry-wide initiative to ensure the stability of the U.S. financial system, underscoring its market importance (Compl. ¶70).

IV. Analysis of Infringement Allegations

U.S. Patent No. 9,015,301 Infringement Allegations

Claim Element (from Independent Claim 25)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
activating at least one of said designated categorical filters and processing a data input therethrough to obtain said select content and associated select content...	Defendant's system uses "protection policies" (filters) to identify and extract "critical financial account information" (select content) from its production data (data input).	¶117	col. 14:15-23
which associated select content is at least one of contextually associated select content and taxonomically associated select content, as aggregated select content.	The extracted financial account information is contextually or taxonomically associated, for example, by using aggregated tags or metadata to group assets belonging to a finance department.	¶118	col. 14:24-27
storing said aggregated select content for said at least one categorical filter in said corresponding select content data store;	The extracted critical account data is stored in a secure, corresponding "data vault" or "storage unit." A diagram illustrates the "Sheltered Harbor Vault (Locked)" as a distinct storage location.	¶121; ¶89, p. 89	col. 14:28-31
and for the activated categorical filter, associating at least one data process from the group of data processes including a copy process...	The system associates data processes like copying, archiving, and backup with the selected data to move it to the secure data vault for protection and potential restoration.	¶123-124	col. 14:32-38
applying the associated data process to a further data input based upon a result of said further data being processed by said activated categorical filter...	Once a protection policy is established, all subsequent data inputs that match the filter (e.g., nightly account data) are processed in the same way, with the associated data process (e.g., copy to vault) being applied automatically.	¶127	col. 14:39-44
wherein activating said designated categorical filter encompasses an automatic activation or a manual activation and said automatic activation is time-based, distributed computer system condition-based, or event-based.	The system's processing is alleged to occur automatically at designated time intervals (e.g., nightly), upon a designated condition (e.g., detection of new data), or manually on demand.	¶129, ¶131	col. 15:1-6

• Identified Points of Contention:
  • Scope Questions: The case may raise questions about whether a standard industry backup protocol, like Sheltered Harbor, performs the specific, multi-step method claimed in the patent. For example, does the accused system "associate" a data process with a filter as a distinct step, or does it simply execute a pre-configured backup job that inherently includes selection and copying?
  • Technical Questions: A factual dispute may arise over whether the "protection policies" alleged to be used by Flushing Bank function as the "categorical filters" described in the patent, which include specific types like "content-based," "contextual," and "taxonomic" filters. Evidence will be needed to show that the accused filtering goes beyond simple file-type or location-based rules and performs the kind of contextual or taxonomic analysis contemplated by the patent.

U.S. Patent No. 9,734,169 Infringement Allegations

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
providing in said distributed cloud-based computing system: (i) a plurality of select content data stores... (ii) a plurality of granular data stores; and (iii) a cloud-based server...	The accused system is alleged to be cloud-based or hybrid-cloud and provides a secure "data vault" (select content stores) as well as production and backup systems (granular data stores). A diagram shows a "Data Vault Environment" separate from the "Production Environment."	¶140, ¶144-145; ¶89, p. 89	col. 132:15-24
with respect to data processed by said cloud-based system, extracting and storing said security designated data in respective select content data stores;	The system extracts critical customer account data ("security designated data") and stores it in the secure, isolated data vault. A diagram shows "Data Extraction" from the production environment feeding into a process that creates "Replicated Data" in the vault.	¶151-152; ¶89, p. 89	col. 132:28-31
parsing remainder data not extracted from data processed by said cloud-based system and storing the parsed data in respective granular data stores;	Remainder data (non-critical data) is stored in production and backup systems, which constitute separate "granular data stores." A diagram shows "Backup Workloads" and "Production Workloads" as distinct from the cyber recovery vault.	¶159-161; ¶144, p. 74	col. 132:38-41
withdrawing some or all of said security designated data and said parsed data from said respective data stores only in the presence of said respective access controls applied thereto.	The data vault is protected by strict access controls, including multi-factor authentication, and data can only be withdrawn for restoration upon satisfaction of these security measures.	¶165-166	col. 132:46-50

• Identified Points of Contention:
  • Scope Questions: A central question may be what constitutes "parsing remainder data." Defendant may argue its system performs a full backup and then extracts a copy of critical data for vaulting, rather than performing an extraction first and then separately "parsing" and storing the remainder as required by the claim's plain language.
  • Technical Questions: The complaint alleges the accused systems are "cloud-based." The actual architecture of Flushing Bank's system (on-premises, third-party cloud, or hybrid) will be a key factual issue. The definition of "cloud-based" as used in the patent, which dates to a 2007 priority, will be critical to this analysis.

V. Key Claim Terms for Construction

U.S. Patent No. 9,015,301

• The Term: "categorical filters"
• Context and Importance: This term is the central mechanism for identifying the "select content" to be protected. The breadth of its definition will determine whether standard backup policies and rules fall within the claim scope. Practitioners may focus on this term because the infringement theory depends on equating modern "protection policies" with the patent's specific filter terminology.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The specification states that designated filters screen data for an enterprise based on policies such as "level of service policy, customer privacy policy," and others, suggesting any policy-based screening could be a categorical filter (’301 Patent, col. 4:18-24).
  • Evidence for a Narrower Interpretation: The specification repeatedly describes the filters as including "content-based filters, contextual filters and taxonomic classification filters" (’301 Patent, col. 3:39-42). This may support an argument that the term should be limited to these specific, more advanced types of filters rather than any generic data selection rule.

U.S. Patent No. 9,734,169

• The Term: "parsing remainder data not extracted"
• Context and Importance: This step defines what happens to the data left behind after sensitive content is removed. The infringement allegation hinges on whether the accused system performs this specific sequence of (1) extracting, then (2) parsing and storing the remainder. A mismatch in this operational sequence could be a basis for a non-infringement defense.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The patent describes "remainder data" simply as what is left after "select content" is separated, and "storage" can occur in various ways, including on the original PC or network (’169 Patent, col. 47:4-16). This could support a view that simply leaving the original data in place on the production server after copying a portion to a vault constitutes "storing" the "remainder data."
  • Evidence for a Narrower Interpretation: The claim language recites "parsing... and storing" as an active step performed on the remainder data. This suggests more than just leaving the original file untouched. The specification also discusses creating a "remainder document" with placeholders, which is a more active process than simply making a copy of select data (’169 Patent, col. 38:8-12).

VI. Other Allegations

• Indirect Infringement: The complaint focuses on direct infringement by Flushing Bank's use of the Accused Instrumentalities (Compl. ¶¶106, 137). It alleges the systems are "specially configured by Defendant to directly perform... all infringing steps," which contains language often used to support inducement, but no separate count for indirect infringement is included.
• Willful Infringement: Count V of the complaint alleges willful infringement (Compl. ¶¶234-236). The basis is two-fold: (1) post-suit knowledge based on Defendant having received service of the complaint, making any continued infringement willful and deliberate; and (2) pre-suit willful blindness based on an alleged "policy or practice of not reviewing the patents of others" and instructing employees not to do so (Compl. ¶¶133, 235-236).

VII. Analyst’s Conclusion: Key Questions for the Case

• Definitional Scope: A core issue will be whether the terminology used in these 2007-priority patents, developed in a different technological context, can be construed to cover the architecture and processes of modern, industry-standard financial data vaulting systems. The case may turn on whether terms like "categorical filter" and "parsing remainder data" are interpreted broadly to read on features like "protection policies" and standard backup operations, or are limited to the specific embodiments described in the patents.
• Operational Sequence and Equivalence: A central evidentiary question will be one of operational equivalence. The complaint maps the functionalities of the Sheltered Harbor standard to the patent claims. The key test will be whether Flushing Bank's actual system performs the specific, ordered steps of the asserted claims (e.g., extract first, then parse and store remainder) or if it achieves a similar result (a secure, vaulted backup) through a technically distinct process that falls outside the claim language.
• Pleading Sufficiency: The complaint relies heavily on "information and belief" and the public-facing descriptions of the Sheltered Harbor standard and exemplary vendor products (like Dell's) to allege infringement. An initial question for the court may be whether these allegations, which lack specific details about Flushing Bank's proprietary systems, are sufficient to state a plausible claim for relief, or if they are based on impermissible speculation about how the accused systems actually operate.