DCT

2:18-cv-00381

Packet Intelligence LLC v. Ericsson Inc

Log In

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 2:18-cv-00381, E.D. Tex., 06/14/2019
  • Venue Allegations: Plaintiff alleges venue is proper in the Eastern District of Texas because Defendant Ericsson Inc. maintains a regular and established place of business in Plano, Texas, where it develops and/or sells the accused products.
  • Core Dispute: Plaintiff alleges that Defendant’s network routers and related products that perform Deep Packet Inspection (DPI) infringe five patents related to monitoring, classifying, and processing network traffic.
  • Technical Context: The technology concerns methods for analyzing data packets in a computer network to identify and classify "conversational flows"—sequences of related data packets that may span multiple connections—an approach critical for modern network management, security, and policy enforcement.
  • Key Procedural History: The complaint states that the asserted patents have been litigated previously in the same district. It notes a jury verdict against NetScout Systems, Inc., which found infringement and upheld the validity of claims of the ’725, ’751, and ’789 patents. The complaint also mentions that the Patent Trial and Appeal Board (PTAB) denied institution of six inter partes review (IPR) petitions filed by defendants in prior litigations, finding no reasonable likelihood of success in invalidating the challenged claims.

Case Timeline

Date Event
1999-06-30 Earliest Priority Date for all Patents-in-Suit
2003-11-18 U.S. Patent No. 6,651,099 Issues
2003-12-16 U.S. Patent No. 6,665,725 Issues
2004-08-03 U.S. Patent No. 6,771,646 Issues
2005-01-04 U.S. Patent No. 6,839,751 Issues
2005-10-11 U.S. Patent No. 6,954,789 Issues
2014-01-01 Alleged earliest notice of infringement to Ericsson
2017-12-15 Plaintiff sends correspondence to Ericsson regarding patents
2018-02-22 Plaintiff sends follow-up correspondence to Ericsson
2019-06-14 Amended Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 6,651,099 - "Method and Apparatus for Monitoring Traffic in a Network"

The Invention Explained

  • Problem Addressed: The patent describes a problem with conventional network monitors that classify traffic into "connection flows," which only track packets on a single connection. This method is inadequate for applications that generate multiple connections for a single user activity (e.g., a Skype call), leading to a disjointed view of network traffic (’099 Patent, col. 2:35-48).
  • The Patented Solution: The invention proposes a method to monitor traffic by grouping packets into "conversational flows," which represent a sequence of packets exchanged as part of a single activity, regardless of the number of connections involved (’099 Patent, col. 2:38-42). This is achieved by parsing packets, creating a unique "flow key" or signature from selected portions, and using this key to look up and update a database of known flows, thereby "virtually concatenating" related exchanges (’099 Patent, col. 3:1-7; Abstract). The system maintains the state of each flow to analyze subsequent packets in context (’099 Patent, col. 5:25-34).
  • Technical Importance: This approach provided a more accurate and holistic method for understanding application-level network usage beyond simple packet-level or connection-level metrics, which was becoming increasingly important with the rise of complex internet applications (’099 Patent, col. 2:49-67).

Key Claims at a Glance

  • The complaint asserts at least independent claim 1 (Compl. ¶33).
  • Claim 1 of the ’099 Patent requires:
    • A packet monitor for examining packets passing through a connection point on a computer network.
    • A packet-buffer memory configured to accept a packet.
    • A parsing/extraction operations memory configured to store a database of operations.
    • A parser subsystem to examine the packet, extract selected portions, and form a function of the selected portions to identify the packet as part of a conversational flow-sequence.
    • A memory storing a flow-entry database for conversational flows.
    • A lookup engine to determine if there is an entry in the database for the packet's conversational flow.
    • A state patterns/operations memory.
    • A protocol/state identification mechanism to determine the protocol and state of the conversational flow.
    • A state processor to carry out state operations to further the process of identifying the application program associated with the conversational flow.
  • The complaint does not explicitly reserve the right to assert dependent claims for this patent.

U.S. Patent No. 6,665,725 - "Processing Protocol Specific Information in Packets Specified by a Protocol Description Language"

The Invention Explained

  • Problem Addressed: The patent addresses the difficulty for network monitors to adapt to new or modified network protocols. Hard-coded logic for parsing packets quickly becomes obsolete as network technologies evolve, making it difficult to perform protocol-specific analysis (’725 Patent, col. 3:45-51).
  • The Patented Solution: The invention provides a method where the rules for processing packets are specified in a high-level "protocol description language" (PDL). These specifications are compiled to generate data structures that direct the monitor's parsing, extraction, and state-processing operations (’725 Patent, col. 2:35-43). This allows the monitor's functionality to be updated for new protocols by compiling new PDL files rather than redesigning hardware or core software (’725 Patent, Abstract).
  • Technical Importance: This approach introduced a flexible and extensible architecture for network monitoring devices, allowing them to keep pace with rapid changes in network protocols and applications without requiring hardware replacement (’725 Patent, col. 4:45-50).

Key Claims at a Glance

  • The complaint asserts at least independent claim 17 (Compl. ¶38).
  • Claim 17 of the ’725 Patent requires:
    • A method of performing protocol specific operations on a packet.
    • Receiving the packet.
    • Receiving a set of protocol descriptions for a plurality of protocols that conform to a layered model.
    • Performing the protocol specific operations on the packet specified by the protocol descriptions based on the base protocol and children protocols used in the packet.
    • The packet belongs to a conversational flow of packets having a set of one or more states.
    • The protocol specific operations include one or more state processing operations that are a function of the state of the conversational flow of the packet.
  • The complaint does not explicitly reserve the right to assert dependent claims for this patent.

Multi-Patent Capsules

  • Patent Identification: U.S. Patent No. 6,771,646, "Associative Cache Structure for Lookups and Updates of Flow Records in a Network Monitor," issued August 3, 2004.

  • Technology Synopsis: This patent describes a specialized cache system for a network monitor to speed up the process of looking up flow records. It uses an associative cache with a true least-recently-used (LRU) replacement policy to handle the high rate of packet analysis required in modern networks (’646 Patent, col. 2:48-56).

  • Asserted Claims: At least independent claim 7 (Compl. ¶43).

  • Accused Features: The complaint alleges that the Accused Products, in implementing high-speed DPI, necessarily use high-performance memory and lookup structures that infringe the claimed cache technology (Compl. ¶¶30-31).

  • Patent Identification: U.S. Patent No. 6,839,751, "Re-Using Information from Data Transactions for Maintaining Statistics in Network Monitoring," issued January 4, 2005.

  • Technology Synopsis: This patent discloses methods for maintaining detailed statistics and metrics for network flows, including quality of service (QoS) metrics like jitter. The invention uses the stateful, conversational flow-based analysis to collect performance data that goes beyond simple packet counts (’751 Patent, col. 3:45-51).

  • Asserted Claims: At least independent claim 17 (Compl. ¶48).

  • Accused Features: The complaint alleges that Ericsson's products, which provide "Service awareness" and policy control, necessarily collect and maintain statistics on classified traffic flows to perform functions like bandwidth management and QoS enforcement (Compl. ¶¶13, 30-31).

  • Patent Identification: U.S. Patent No. 6,954,789, "Method and Apparatus for Monitoring Traffic in a Network," issued October 11, 2005.

  • Technology Synopsis: This patent is a continuation of the ’099 patent and further details the method for monitoring network traffic by identifying and analyzing "conversational flows." It elaborates on the use of a state processor and a database of state patterns to classify application traffic based on sequences of packets (’789 Patent, Abstract).

  • Asserted Claims: At least independent claim 19 (Compl. ¶53).

  • Accused Features: The infringement allegations for this patent mirror those for the ’099 Patent, focusing on the Accused Products' use of DPI to classify and control traffic based on application-level conversational flows (Compl. ¶¶23-31).

III. The Accused Instrumentality

Product Identification

  • The "Accused Products" are identified as Ericsson products that enable or implement Deep Packet Inspection (DPI) (Compl. ¶30). Specific examples include the SSR 8000 family of Smart Server Routers, the Ericsson Router 6000 family, and other products enabling Evolved Packet Gateway ("EPG"), Service Aware Support Node ("SASN"), or "Service Aware" DPI functionality (Compl. ¶30).

Functionality and Market Context

  • The complaint alleges the Accused Products perform multi-layered packet inspection to provide "Service awareness," allowing network operators to classify and control packet flows (Compl. ¶¶30-31). This functionality is allegedly used for policy and charging enforcement (Compl. ¶30). The complaint cites Ericsson documentation stating that this involves shallow packet inspection (IP 5-tuple), deep packet inspection (Layers 4, 7, and 7+), and heuristic analysis of packet flows (Compl. ¶31). A diagram from Ericsson's technical documentation illustrates this multi-layered approach to packet inspection (Compl. p. 12). Another diagram shows how this inspection is used in a "Service awareness" architecture to classify undifferentiated incoming packets into "service differentiated sessions" using an Analysis Engine and a Classification Engine (Compl. p. 13).

IV. Analysis of Infringement Allegations

6,651,099 Patent Infringement Allegations

Claim Element (from Independent Claim 1) Alleged Infringing Functionality Complaint Citation Patent Citation
a parser subsystem... configured to examine the packet... extract selected portions of the accepted packet, and form a function of the selected portions... The Accused Products perform shallow and deep packet inspection using an Analysis Engine with Protocol Analyzers to extract information from packet headers and payloads at Layers 3 through 7+ (Compl. p. 13). ¶31 col. 6:12-16
sufficient to identify that the accepted packet is part of a conversational flow-sequence; The Accused Products use the extracted information and heuristic patterns to classify traffic into "service differentiated sessions" or "conversation flow," which corresponds to the claimed "conversational flow" (Compl. p. 14). ¶26, p. 14 col. 2:38-42
a memory storing a flow-entry database including a plurality of flow-entries for conversational flows... The Accused Products' Classification Engine uses "Classification Rules," "Control Profiles and Policies," implying a database of known flow types and their associated handling rules (Compl. p. 13). p. 13 col. 6:23-27
a lookup engine... configured to determine using at least some of the selected portions of the accepted packet if there is an entry in the flow-entry database... The Classification Engine is alleged to compare extracted packet information against its stored rules and policies to identify whether an incoming packet belongs to a known, service-differentiated session (Compl. p. 13). p. 13 col. 6:28-33
a state processor... configured to carry out any state operations... furthering the process of identifying which application program is associated with the... flow... The system is alleged to analyze patterns in packet headers, payloads, IP flow metrics, and connectivity to determine the application involved in the conversational flow, implying stateful analysis over a sequence of packets (Compl. p. 14). p. 14 col. 6:49-56

6,665,725 Patent Infringement Allegations

Claim Element (from Independent Claim 17) Alleged Infringing Functionality Complaint Citation Patent Citation
A method of performing protocol specific operations on a packet... receiving a set of protocol descriptions for a plurality of protocols... The Accused Products' Analysis Engine uses "Protocol Analyzers" and "Classification Rules" that define how to inspect and classify different types of network traffic, which allegedly function as the claimed protocol descriptions (Compl. p. 13). p. 13 col. 2:35-39
performing the protocol specific operations on the packet specified by the set of protocol descriptions based on the base protocol of the packet and the children of the protocols... The system is alleged to perform multi-layered inspection, analyzing Layer 3, Layer 4, Layer 7, and Layer 7+ headers and payloads, consistent with a layered protocol model where analysis at one layer depends on the protocol identified at a lower layer (Compl. p. 12). ¶31, p. 12 col. 2:39-43
wherein the packet belongs to a conversational flow of packets having a set of one or more states, and wherein the protocol specific operations include one or more state processing operations that are a function of the state... The Accused Products' use of "Heuristic Analysis" on "IP flow metrics" and "connectivity patterns" allegedly involves analyzing a sequence of packets over time, which constitutes the claimed state processing on a conversational flow to determine the "most probable protocol" or application (Compl. p. 14). p. 14 col. 2:44-48
  • Identified Points of Contention:
    • Scope Questions: A central question may be whether the term "conversational flow," as defined in the patents, reads on the "service differentiated sessions" or "conversation flow" implemented by the Accused Products. The analysis may focus on whether Ericsson's classification links multiple, distinct network connections (as defined by source/destination IP/port pairs) into a single logical session, as the patents describe.
    • Technical Questions: What evidence does the complaint provide that the "Classification Rules" and "Protocol Analyzers" in the Accused Products function as the claimed "protocol description language" that directs parsing and state-processing operations? The dispute may concern whether Ericsson's rules are merely static pattern definitions or if they constitute a programmable language for defining protocol-specific operations as claimed in the ’725 Patent.

V. Key Claim Terms for Construction

  • The Term: "conversational flow" (’099 Patent, Claim 1)
  • Context and Importance: This term is the central point of novelty asserted in the ’099 patent family. The patent distinguishes it from a "connection flow." The infringement case depends on whether the accused Ericsson products, which classify traffic into "service differentiated sessions," are performing analysis on what the patent defines as a "conversational flow." Practitioners may focus on whether the patent's definition requires linking multiple, technically distinct connections.
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The specification states a conversational flow "is the sequence of packets that are exchanged in any direction as a result of an activity—for instance, the running of an application on a server as requested by a client" (’099 Patent, col. 2:38-42). This functional, activity-based definition could be argued to cover any method of grouping packets related to a single user application.
    • Evidence for a Narrower Interpretation: The background explicitly contrasts the invention with systems tracking single connections, noting "some conversational flows involve more than one connection" (’099 Patent, col. 2:42-43). This language, along with examples like SAP, suggests the term may be limited to scenarios where multiple, separate IP-level connections are linked.
  • The Term: "protocol description language" (’725 Patent, Claim 17)
  • Context and Importance: This term is key to the asserted claims of the ’725 Patent, which claims a flexible system where monitoring rules are not hard-coded. The dispute will likely center on whether the "Classification Rules" and "Protocol Analyzers" used by Ericsson's products (Compl. p. 13) meet the definition of a "language" that specifies "protocol specific operations."
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The abstract describes "providing the protocol descriptions in a high-level protocol description language, and compiling" them into a data structure. This could be argued to cover any system where rules are defined in a text-based format and then loaded into a system, which is common for signature-based DPI engines.
    • Evidence for a Narrower Interpretation: The patent describes the PDL as specifying not just patterns, but also "protocol specific operations to be performed on the packet," including "parsing and extraction operations" and "state processing operations" (’725 Patent, Abstract). This could support a narrower construction requiring a language that defines procedural steps and state transitions, not just declarative patterns.

VI. Other Allegations

  • Indirect Infringement: The complaint alleges active inducement under 35 U.S.C. § 271(b) for all asserted patents. The alleged acts of inducement include selling the Accused Products with infringing features, marketing their capabilities, and providing instructions and technical support that encourage customers to use the products in an infringing manner (Compl. ¶¶34, 39, 44, 49, 54).
  • Willful Infringement: The complaint alleges willful infringement for all asserted patents, claiming Ericsson had knowledge of the patents as early as 2014 from discussions to acquire a portfolio including them. It also alleges knowledge from correspondence sent in December 2017 and February 2018 (Compl. ¶¶22, 36, 41, 46, 51, 56). Continued infringement after these alleged notice dates is asserted as the basis for willfulness.

VII. Analyst’s Conclusion: Key Questions for the Case

  • A core issue will be one of definitional scope: does the term "conversational flow," which the patents frame as an improvement over tracking single "connection flows," read on the "service differentiated sessions" and "conversation flow" identified by Ericsson's DPI products? The outcome may depend on evidence showing whether Ericsson's technology groups packets across multiple, distinct network connections as part of a single logical activity.
  • A key evidentiary question will be one of technical implementation: do the "Classification Rules" and "Protocol Analyzers" cited in Ericsson’s documentation function as the claimed "protocol description language" that specifies not just patterns to be matched, but also the "protocol specific operations" and "state processing operations" required by the claims?
  • A third question will be the impact of prior litigation: how will the prior jury verdict against NetScout and the PTAB's denial of IPR institution, both cited heavily in the complaint, influence settlement leverage and potential court rulings on claim construction and validity in this case?