DCT

6:12-cv-00855

VirnetX Inc v. Apple Inc

Log In
Key Events
Amended Complaint

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 6:12-cv-00855, E.D. Tex., 03/13/2015
  • Venue Allegations: Venue is alleged to be proper in the Eastern District of Texas because Apple conducts business, offers for sale, sells, and advertises its products and services within the district, placing its products into the stream of commerce with the expectation that they will be purchased and used by consumers there.
  • Core Dispute: Plaintiffs allege that certain functionalities within Apple's ecosystem—specifically VPN On Demand, FaceTime, and iMessage as implemented on iPhones, iPads, iPod Touches, and Mac computers—infringe six patents related to secure network communications and the automatic establishment of virtual private networks (VPNs).
  • Technical Context: The patents address foundational methods for establishing secure, anonymous, and reliable communication links over public networks like the Internet, a technology domain critical for both consumer privacy and enterprise data security.
  • Key Procedural History: This action is a consolidated and fourth amended complaint, combining two prior civil actions. The complaint alleges that Apple had pre-suit knowledge of the asserted patent portfolio due to previous litigation involving VirnetX, which may be relevant to the allegations of willful infringement.

Case Timeline

Date Event
1998-10-30 Earliest Priority Date for all Asserted Patents
2002-12-31 U.S. Patent 6,502,135 Issued
2008-08-26 U.S. Patent 7,418,504 Issued
2009-02-10 U.S. Patent 7,490,151 Issued
2009-09-09 iOS 3.1.x released, introducing accused VPN On Demand functionality
2011-04-05 U.S. Patent 7,921,211 Issued
2011-11-01 U.S. Patent 8,051,181 Issued
2013-08-06 U.S. Patent 8,504,697 Issued
2015-03-13 Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 6,502,135 - "Agile Network Protocol for Secure Communications with Assured System Availability," issued December 31, 2002

The Invention Explained

  • Problem Addressed: The patent's background describes the need for secure and anonymous communications over public networks like the Internet, noting that existing methods such as proxy servers and firewalls are vulnerable to traffic analysis and can create centralized points of failure ('135 Patent, col. 1:11–2:62).
  • The Patented Solution: The invention proposes a "Tunneled Agile Routing Protocol" (TARP) that uses a two-layer encryption system. An outer, unencrypted IP header directs a packet to the next router in a chain, while the packet's true final destination is concealed within an encrypted payload. This "agile routing" allows different packets from the same message to take different, unpredictable paths through a network of TARP routers, making it difficult for an eavesdropper to intercept and reconstruct the entire communication ('135 Patent, col. 3:1-46; Fig. 2).
  • Technical Importance: This method provided a decentralized approach to network security that aimed to be resilient against both eavesdropping and denial-of-service attacks by obscuring the ultimate endpoints of a communication session ('135 Patent, col. 2:63–3:2).

Key Claims at a Glance

  • The complaint asserts independent method claim 1 and independent system claim 10 (Compl. ¶¶15-16).
  • Independent Claim 1 (Method):
    • Generating a plurality of tunneled packets from a data stream.
    • Transmitting each of the tunneled packets to a router computer system.
    • Each tunneled packet has an outside IP header indicating the router's network address and an encrypted payload.
    • The encrypted payload contains an inside header indicating a destination computer system's network address.
  • Independent Claim 10 (System):
    • A first computer system for generating a plurality of tunneled packets from a data stream.
    • A router computer system for receiving the tunneled packets.
    • Each packet comprises an outside IP header with the router's address and an encrypted payload containing an inside header with the destination's address.
  • The complaint also asserts dependent claims 3, 7, 8, and 12 (Compl. ¶¶15-16).

U.S. Patent No. 7,490,151 - "Establishment of a Secure Communication Link Based on a Domain Name Service (DNS) Request," issued February 10, 2009

The Invention Explained

  • Problem Addressed: Conventional use of the Domain Name System (DNS) to resolve a website name into an IP address reveals the user's intended destination to network intermediaries, compromising anonymity. Furthermore, establishing a secure Virtual Private Network (VPN) typically required manual user configuration ('151 Patent, col. 37:44-50).
  • The Patented Solution: The invention describes a system including a DNS proxy server that intercepts a user's DNS request. If the request is for a designated secure resource, the proxy does not return the resource's true IP address. Instead, it automatically initiates the creation of a secure VPN to the target and returns information needed to connect via that secure link, making the process transparent to the user ('151 Patent, col. 38:1-9; Fig. 26).
  • Technical Importance: This technology sought to simplify the user experience for creating secure connections by automating VPN establishment based on a standard and near-universal user action: a domain name lookup ('151 Patent, col. 38:52-59).

Key Claims at a Glance

  • The complaint asserts independent apparatus claim 1 (Compl. ¶21).
  • Independent Claim 1 (Apparatus):
    • A data processing device comprising a domain name server (DNS) proxy module.
    • The module intercepts DNS requests from a client.
    • The module determines if the request corresponds to a secure server.
    • If not for a secure server, the module forwards the request to a standard DNS function.
    • If for a secure server, the module automatically initiates an encrypted channel between the client and the secure server.
  • The complaint also asserts dependent and computer-readable media claims 7 and 13 (Compl. ¶¶22-23).

U.S. Patent No. 7,418,504 - "Agile Network Protocol for Secure Communications Using Secure Domain Names"

  • Patent Identification: U.S. Patent No. 7418504, "Agile Network Protocol for Secure Communications Using Secure Domain Names," issued August 26, 2008 (Compl. ¶8).
  • Technology Synopsis: This patent relates to the '135 patent's agile routing protocol and extends it to systems that use secure domain names to initiate secure communications. The invention allows a domain name service to be used to establish a secure communication link, transparently to the user.
  • Asserted Claims: Independent system claims 1 and 36, and independent method claim 60, are among those asserted (Compl. ¶¶27-29).
  • Accused Features: The complaint alleges that Apple's FaceTime and iMessage functionalities, which establish secure communication links between users, infringe this patent (Compl. ¶¶27, 33).

U.S. Patent No. 7,921,211 - "Agile Network Protocol for Secure Communications Using Secure Domain Names"

  • Patent Identification: U.S. Patent No. 7921211, "Agile Network Protocol for Secure Communications Using Secure Domain Names," issued April 5, 2011 (Compl. ¶10).
  • Technology Synopsis: Continuing the technology family of the '135 and '504 patents, this patent further describes systems and methods for establishing secure communication links using secure domain names, including variations on the agile network protocol.
  • Asserted Claims: Independent system claims 1 and 36, and independent method claim 60, are among those asserted (Compl. ¶¶39-41).
  • Accused Features: The complaint alleges that Apple's FaceTime and iMessage functionalities infringe this patent (Compl. ¶¶39, 45).

U.S. Patent No. 8,051,181 - "Method for Establishing Secure Communication Link Between Computers of Virtual Private Network"

  • Patent Identification: U.S. Patent No. 8051181, "Method for Establishing Secure Communication Link Between Computers of Virtual Private Network," issued November 1, 2011 (Compl. ¶11).
  • Technology Synopsis: This patent focuses on methods for establishing a secure communication link, such as a VPN. It describes initiating a secure session via a "secure synchronization" request and using transmit/receive tables of hopped IP addresses to maintain secure communications.
  • Asserted Claims: Independent machine-readable medium claim 1 and independent method claim 2 are among those asserted (Compl. ¶¶51-52).
  • Accused Features: The complaint alleges that Apple's FaceTime and iMessage functionalities, which initiate and maintain secure sessions between devices, infringe this patent (Compl. ¶¶51, 56).

U.S. Patent No. 8,504,697 - "System and Method Employing an Agile Network Protocol for Secure Communications Using Secure Domain Names"

  • Patent Identification: U.S. Patent No. 8504697, "System and Method Employing an Agile Network Protocol for Secure Communications Using Secure Domain Names," issued August 6, 2013 (Compl. ¶12).
  • Technology Synopsis: This patent, also part of the same family, describes systems for creating secure communication links in response to DNS requests. It details how a DNS proxy can work with a gatekeeper to set up secure, hopped IP address connections transparently to the end user.
  • Asserted Claims: Independent method claims 1 and 16 are among those asserted (Compl. ¶¶62-63, 67-68).
  • Accused Features: The complaint alleges that Apple's FaceTime and iMessage functionalities infringe this patent (Compl. ¶¶62, 67).

III. The Accused Instrumentality

Product Identification

  • The accused instrumentalities are Apple's servers and a wide range of end-user devices, including the Apple iPhone (3G and later), iPod Touch (all generations), iPad (all generations), and Apple computers, when running specific software and services (Compl. ¶¶15, 27, 33).

Functionality and Market Context

  • The complaint targets three core functionalities that operate across these products:
    • VPN On Demand: A feature in Apple's iOS and OS X operating systems that automatically establishes a VPN connection when a user or application attempts to access predefined network resources, without requiring manual user intervention for each connection (Compl. ¶¶15-16).
    • FaceTime: Apple's proprietary video and audio calling service that establishes a secure, encrypted peer-to-peer or server-mediated communication channel between two or more Apple devices (Compl. ¶¶27, 39, 51, 62).
    • iMessage: Apple's proprietary messaging service that establishes a secure, encrypted communication channel for sending texts, photos, and other media between Apple devices (Compl. ¶¶33, 45, 56, 67).
  • The complaint's extensive list of accused products, spanning many generations of Apple's most commercially successful devices, suggests that the plaintiffs view the accused functionalities as integral and pervasive across Apple's ecosystem.

No probative visual evidence provided in complaint.

IV. Analysis of Infringement Allegations

The complaint does not provide claim charts. The following summarizes the infringement theories for the lead patents based on the narrative allegations.

’135 Patent Infringement Allegations

  • The complaint alleges that Apple's VPN On Demand system infringes claims of the ’135 Patent (Compl. ¶¶15-16). The core of the theory appears to be that an Apple device (the "first computer system") generates data packets that are sent to Apple's servers (the "router computer system") to establish a secure connection to a destination resource. The complaint alleges this system meets the "tunneled packet" limitations of the claims. However, the complaint does not provide specific details on the packet structure of the VPN On Demand feature to substantiate how it maps to the claimed two-layer encrypted packet with distinct outer (router) and inner (destination) headers.

’151 Patent Infringement Allegations

  • The infringement theory for the ’151 Patent focuses on the initiation of FaceTime and iMessage sessions (Compl. ¶¶21-22, 27, 33). The complaint alleges that when a user initiates a FaceTime call or sends an iMessage, the Apple device sends a request to Apple's servers to establish a connection. This process is alleged to function as a "DNS proxy module" that intercepts the request. Because FaceTime and iMessage require a secure link, the system allegedly determines that the request corresponds to a "secure server" and, in response, "automatically initiat[es] an encrypted channel" between the end-user devices, rather than simply returning a standard IP address.

Identified Points of Contention

  • Technical Questions: A primary factual question for the ’135 patent will be whether Apple’s VPN On Demand protocol actually creates and transmits "tunneled packets" as specifically defined by the patent. The complaint provides conclusory allegations but lacks technical evidence on the specific data structure of the packets used by Apple's service. For the ’151 patent, a key question will be the mechanism by which FaceTime and iMessage initiate connections. Is it a system that functionally intercepts a name-based request and establishes a secure channel, or does it operate in a technically distinct manner?
  • Scope Questions: The dispute over the ’151 patent may raise the question of whether the term "Domain Name Service (DNS) proxy module," can be construed to read on a proprietary directory and session initiation system like that used by Apple, or if its scope is limited to systems that formally interact with the public DNS infrastructure.

V. Key Claim Terms for Construction

Term: "tunneled packet" (from '135 Patent, e.g., claim 10)

  • Context and Importance: This term is central to the '135 patent infringement case. The patent's novelty is rooted in its specific "agile routing" method, which depends on this two-layer packet structure. Whether Apple's VPN On Demand packets meet this definition will be a dispositive issue.
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The specification describes the purpose as concealing the "true destination address" of a packet ('135 Patent, col. 3:7-9). A party might argue this supports a functional definition where any packet that obscures the final endpoint behind an intermediary address qualifies.
    • Evidence for a Narrower Interpretation: The specification provides a specific structure: an "outside IP header" containing the address of a "next hop router" and an "encrypted payload" that itself contains an "inside header" with the "network address of a destination computer system" ('135 Patent, col. 8:51-62). A party may argue the term is limited to this express embodiment.

Term: "domain name server (DNS) proxy module" (from '151 Patent, claim 1)

  • Context and Importance: Infringement by FaceTime and iMessage hinges on whether their session initiation services meet this definition. Practitioners may focus on this term because Apple's proprietary services may not interact with the public DNS in a conventional way.
  • Intrinsic Evidence for Interpretation:
    • Evidence for a Broader Interpretation: The specification describes the module's function as intercepting a lookup request and, for secure sites, transparently establishing a VPN instead of simply returning an IP address ('151 Patent, Fig. 26; col. 38:1-9). This may support a construction covering any system that functionally substitutes a secure channel for a standard name-to-address resolution.
    • Evidence for a Narrower Interpretation: The patent repeatedly and explicitly uses the term "DNS" in the claims, title, and specification. A party could argue that this limits the claim's scope to modules that are technically integrated with and act as proxies for the formal Domain Name System, as opposed to other types of proprietary directory services.

VI. Other Allegations

Indirect Infringement

  • The complaint alleges both induced and contributory infringement for all asserted patents. The factual basis alleged is that Apple provides its customers and resellers with devices and operating systems (iOS and OS X) containing the accused functionalities (VPN On Demand, FaceTime, iMessage) and instructs them on how to use these features, thereby causing and contributing to direct infringement by end-users (Compl. ¶¶19-20, 25-26, 31-32, 37-38, 43-44, 49-50, 54-55, 59-60, 65-66, 70-71).

Willful Infringement

  • The complaint alleges that Apple's infringement has been and continues to be willful (Compl. ¶74). The asserted basis for this claim includes alleged actual notice of the patent portfolio from prior litigation, constructive notice through VirnetX's product marking, and Apple's alleged knowledge of VirnetX's ongoing patent prosecution efforts that led to the issuance of the more recent patents-in-suit (Compl. ¶73).

VII. Analyst’s Conclusion: Key Questions for the Case

This case will likely revolve around the resolution of three central questions:

  1. A core issue will be one of definitional scope: can the term "domain name server (DNS) proxy module," which is rooted in the public internet's addressing system, be construed to cover the proprietary session initiation architecture used by Apple's closed-ecosystem services like FaceTime and iMessage?
  2. A key evidentiary question will be one of technical implementation: what evidence will show that Apple's VPN On Demand functionality employs the specific two-layer "tunneled packet" structure—with its distinct outer next-hop and inner final-destination headers—as required by the '135 patent claims, versus a standard, non-infringing VPN protocol?
  3. Given the extensive litigation history cited in the complaint, a pivotal question for damages will be scienter: did Apple's alleged knowledge from prior lawsuits create an obligation to avoid infringement, and does its continued use of the accused features rise to the level of willful conduct that would justify enhanced damages?