DCT

6:23-cv-00320

Proxense LLC v. Google LLC

Log In
Key Events
Amended Complaint

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 6:23-cv-00320, W.D. Tex., 11/25/2024
  • Venue Allegations: Plaintiff alleges venue is proper in the Western District of Texas because Google is registered to do business in Texas and maintains regular and established places of business in the district, including multiple large offices in Austin.
  • Core Dispute: Plaintiff alleges that Defendant’s universal password-less authentication architecture, including Google Identity, Android OS, and Google Pay, infringes five patents related to biometric authentication and the use of personal digital keys.
  • Technical Context: The technology concerns secure, password-free user authentication systems where a user’s identity is verified biometrically on a personal device, which then wirelessly communicates with a service to grant access.
  • Key Procedural History: The complaint is a Second Amended Complaint. Plaintiff alleges that Defendant was given actual notice of Plaintiff's technology and patent portfolio in 2008 and 2013, a fact pattern that may be central to allegations of willful infringement.

Case Timeline

Date Event
2001-12-31 Proxense founded (approximate date)
2004-12-20 Earliest Priority Date for ’730 and ’954 Patents
2007-12-06 Earliest Priority Date for ’042, ’289, and ’960 Patents
2008-12-31 Google allegedly given first notice of Proxense patents (approximate date)
2011-12-31 Google Wallet launched (approximate date)
2013-01-08 U.S. Patent No. 8,352,730 issues
2013-12-31 Google allegedly given second notice of Proxense patents (approximate date)
2014-02-04 U.S. Patent No. 8,646,042 issues
2014-11-11 U.S. Patent No. 8,886,954 issues
2017-06-13 U.S. Patent No. 9,679,289 issues
2018-08-06 Android OS enables password-less sign-in (approximate date)
2018-09-11 U.S. Patent No. 10,073,960 issues
2019-12-31 Google enables biometric authentication for Google Pay (approximate date)
2021-08-03 Google Identity Services APIs launched
2024-11-25 Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 8,352,730 - “Biometric Personal Data Key (PDK) Authentication”

Issued January 8, 2013

The Invention Explained

  • Problem Addressed: The patent addresses the shortcomings of conventional user authentication, which relies on either credentials that must be memorized (e.g., passwords) or access objects (e.g., keys) that do not verify the identity of the person using them (U.S. Patent 8352730, col. 1:26-53).
  • The Patented Solution: The invention proposes an integrated, portable device (a "biometric key") that securely stores a user's biometric data, such as a fingerprint, in a "tamper-resistant format." To authenticate, the user presents their biometric feature to the device itself. Upon successful on-device verification, the device wirelessly transmits a code, such as a unique device ID, to an external authentication module to grant access, thereby avoiding the transmission of the sensitive biometric data itself (’730 Patent, Abstract; col. 2:56-66).
  • Technical Importance: This technology provided a framework for secure and convenient password-less authentication by keeping sensitive biometric data localized on a user's personal device while enabling wireless access to external services (Compl. ¶¶23-24).

Key Claims at a Glance

The complaint asserts independent claims 1 (a method) and 15 (a system) (Compl. ¶111).

  • Independent Claim 1 (Method):
    • Persistently storing a user's biometric data and a plurality of codes (including a device ID and a secret decryption value) in a tamper-proof format on an integrated device.
    • Receiving scan data from a biometric scan in response to a verification request.
    • Comparing the scan data to the stored biometric data on the device.
    • If there is a match, wirelessly sending one or more of the codes for authentication by a "third-party trusted authority."
    • Receiving an access message from that authority, which allows the user to access an application.
  • Independent Claim 15 (System):
    • A "biometric key" that stores biometric data and codes in a tamper-proof format and wirelessly sends the codes upon successful user verification.
    • An "authentication unit" that receives the codes, sends them to a "third-party trusted authority" for authentication, and receives back an access message from that authority to allow access to an application.

The complaint reserves the right to assert dependent claims (Compl. ¶111).

U.S. Patent No. 8,886,954 - “Biometric Personal Data Key (PDK) Authentication”

Issued November 11, 2014

The Invention Explained

  • Problem Addressed: As a continuation of the application leading to the ’730 Patent, the ’954 Patent addresses the same fundamental problems in user authentication (U.S. Patent 8886954, col. 1:28-56).
  • The Patented Solution: The invention is substantively similar to that of the ’730 Patent, describing an integrated device that performs on-board biometric verification and then wirelessly transmits a code to an external system for authentication without exposing the underlying biometric data (’954 Patent, Abstract; col. 2:59-col. 3:3).
  • Technical Importance: This patent continues the development of a framework for secure, local biometric verification enabling password-less access to remote services (Compl. ¶¶23-24).

Key Claims at a Glance

The complaint asserts independent claims 1 (a method) and 22 (a system) (Compl. ¶124).

  • Independent Claim 1 (Method):
    • Persistently storing a user's biometric data and codes in a tamper-proof format on an integrated device.
    • Receiving scan data from a biometric scan.
    • Comparing the scan data to the stored biometric data.
    • If there is a match, wirelessly sending one or more codes to a "third party that operates a trusted authority."
    • Receiving an access message at an application from the trusted authority.
  • Independent Claim 22 (System):
    • An integrated hardware device that stores biometric data and wirelessly sends codes upon successful user verification.
    • An authentication circuit that receives the codes, sends them to a third-party trusted authority, and receives an access message from that authority to allow application access.

The complaint reserves the right to assert dependent claims (Compl. ¶124).

U.S. Patent No. 8,646,042 - “Hybrid Device Having a Personal Digital Key and Receiver-Decoder Circuit and Methods of Use”

Issued February 4, 2014

  • Technology Synopsis: The patent describes systems, devices, and methods that use personal digital keys (PDKs) in conjunction with receiver-decoder circuits (RDCs) for user verification to enable access to applications, functions, or services (Compl. ¶23; ’042 Patent, Abstract).
  • Asserted Claims: At least independent claim 1 is asserted (Compl. ¶151).
  • Accused Features: The complaint accuses Google's universal password-less architecture, including the integrated Android OS authenticator, Titan Security Key, and Google Identity, of infringement (Compl. ¶152).

U.S. Patent No. 9,679,289 - “Hybrid Device Having a Personal Digital Key and Receiver-Decoder Circuit and Methods of Use”

Issued June 13, 2017

  • Technology Synopsis: As part of the same family as the ’042 Patent, this patent continues to describe systems utilizing personal digital keys and receiver-decoder circuits for user verification and enabling access to services (Compl. ¶23; U.S. Patent 9679289, Abstract).
  • Asserted Claims: At least claims 14 and 16 are asserted (Compl. ¶164).
  • Accused Features: The complaint accuses Google's universal password-less architecture, including the integrated Android OS authenticator, Titan Security Key, and Google Identity, of infringement (Compl. ¶165).

U.S. Patent No. 10,073,960 - “Hybrid Device Having a Personal Digital Key and Receiver-Decoder Circuit and Methods of Use”

Issued September 11, 2018

  • Technology Synopsis: Continuing the same patent family, this patent further describes systems employing personal digital keys and receiver-decoder circuits for secure user verification (Compl. ¶23; U.S. Patent 10073960, Abstract).
  • Asserted Claims: At least claims 14 and 16 are asserted (Compl. ¶178).
  • Accused Features: The complaint accuses Google's universal platform password-less architecture, incorporating the integrated Android OS authenticator, Titan Security Key, and Google Identity, of infringement (Compl. ¶179).

III. The Accused Instrumentality

  • Product Identification: The accused instrumentality is Google's "universal platform password-less architecture" (Compl. ¶40). This architecture is alleged to comprise several integrated components, including Google Identity (an identity and access management service), authenticators such as the native authenticator in Android OS 9 and higher and the Titan Security Key, and services like Google Pay/Wallet that use this architecture (Compl. ¶¶41, 43, 47).
  • Functionality and Market Context: The architecture is alleged to operate using FIDO and OpenID Connect protocols to allow users to sign into applications and websites without a password (Compl. ¶51). The complaint describes a process where a user initiates a login on a first device (e.g., a computer), which triggers an authentication request from Google Identity to a separate, registered authenticator device (e.g., the user's Android phone) (Compl. ¶53). The complaint includes a diagram illustrating this cross-device authentication flow (Compl. ¶53, p. 18). After the user biometrically verifies themselves on the phone, the phone signs and returns a cryptographic challenge, and Google Identity issues an access message (an authorization code or token) back to the first device to grant access (Compl. ¶¶67, 72, 84-85). The complaint asserts this functionality is critical for Google to compete with Apple and Microsoft in mobile payments and cloud services (Compl. ¶¶30-31).

IV. Analysis of Infringement Allegations

’730 Patent Infringement Allegations

Claim Element (from Independent Claim 1) Alleged Infringing Functionality Complaint Citation Patent Citation
persistently storing biometric data of the user and a plurality of codes... comprising a device ID code uniquely identifying the integrated device and a secret decryption value in a tamper proof format written to a storage element on the integrated device... Android OS implementation guidelines allegedly require biometric data (e.g., fingerprint templates) and cryptographic keys to be stored within a hardware-backed Trusted Execution Environment (TEE), which is described as a tamper-proof and isolated environment (Compl. ¶¶68-69, 75). ¶68, ¶75 col. 4:26-40
responsive to receiving a request for a biometric verification of the user, receiving scan data from a biometric scan; When an authentication challenge is received, the Android OS authenticator prompts the user for biometric verification (e.g., a fingerprint scan) and receives the resulting scan data from the device’s sensor (Compl. ¶71). ¶71 col. 4:9-12
comparing the scan data to the biometric data to determine whether the scan data matches the biometric data; The process of comparing the new scan data with the stored biometric templates is alleged to occur securely inside the TEE, isolated from the rest of the operating system (Compl. ¶67-68). ¶67 col. 4:16-19
responsive to a determination that the scan data matches the biometric data, wirelessly sending one or more codes... for authentication by an agent that is a third-party trusted authority possessing a list of device ID codes uniquely identifying legitimate... devices After successful biometric verification, the Android authenticator signs a challenge using a stored private key (passkey) and sends the signed response back to the "Google Identity Servers," which the complaint identifies as the third-party trusted authority (Compl. ¶¶72, 78). ¶72, ¶78 col. 2:63-66
responsive to authentication of the one or more codes and the other data values by the agent, receiving an access message from the agent allowing the user access to an application... After Google Identity verifies the signed challenge, it returns an "access message in the form of an authorization code" to the user agent (e.g., browser), which can be exchanged for a token to log the user into the application (Compl. ¶¶84-85). A screenshot shows the "Sign in with Google" button that initiates this process (Compl. ¶57, p. 19). ¶84, ¶85 col. 3:5-13
  • Identified Points of Contention:
    • Scope Questions: A primary question may be whether Google Identity, a service operated by the Defendant, can meet the claim limitation of a "third-party trusted authority." The complaint alleges that because Google Identity is a distinct entity from the resource being accessed (e.g., a third-party website), it functions as such an authority (Compl. ¶41, 45). The interpretation of "third-party" in the context of the patent's disclosure will likely be a central point of dispute.
    • Technical Questions: The analysis may focus on whether the complex cryptographic process used in the accused FIDO-based system (generating and sending a signed challenge) corresponds to the claimed step of "wirelessly sending one or more codes." The patent describes sending codes like a "device ID code" and a "secret decryption value," which raises the question of whether a dynamic cryptographic signature is the technical equivalent of the codes described in the patent.

V. Key Claim Terms for Construction

  • The Term: "third-party trusted authority"

    • Context and Importance: The infringement theory for both the ’730 and ’954 patents depends on construing Google Identity as a "third-party trusted authority." Defendant will likely argue it is a first-party service provider, not a third-party authority as contemplated by the patent. Practitioners may focus on this term because its definition could be dispositive of infringement.
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: The claims require the authority to be an "agent" that authenticates the device's codes and provides an "access message" to an "application" (’730 Patent, cl. 1). This functional language may support an interpretation where any entity separate from the end-application being accessed qualifies as a "third-party." The complaint emphasizes that the "resource" being accessed is a "separate and distinct" system from Google Identity (Compl. ¶45).
      • Evidence for a Narrower Interpretation: The specification of a related patent discusses a "Central Registry" administered by a "trusted third-party organization," which suggests a more formally independent entity than a service provider authenticating access to its own ecosystem and partners (U.S. Patent 8646042, col. 5:51-61).

  • The Term: "tamper proof format"

    • Context and Importance: The security of the patented method hinges on the integrity of the stored biometric data. The dispute may turn on whether the accused Android Trusted Execution Environment (TEE) meets the patent's standard for being "tamper proof."
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: The claim requires a format on a storage element "that is unable to be subsequently altered" (’730 Patent, cl. 1). The complaint alleges that Android's TEE is a "secure trusted execution environment isolated from the rest of the system" where data "must never be accessible from outside," which could be argued to meet this functional requirement (Compl. ¶¶68, 93).
      • Evidence for a Narrower Interpretation: The patent's detailed description mentions that a "tamper-proof format" is one that "prevents any changes to the stored data," and gives examples like ROM or flash memory (’730 Patent, col. 4:35-40). A defendant could argue this points to a physical or hardware-level immutability that a software-partitioned TEE does not provide.

VI. Other Allegations

  • Indirect Infringement: The complaint alleges inducement by asserting that Google provides a "substantial knowledge base online, teaching how to use the features and how to integrate its universal platform password-less architecture into various applications, websites, and processes" (Compl. ¶103). For contributory infringement, it alleges that components like the native authenticator in Android OS are "especially made for such infringement" and have "no substantial non-infringing use" (Compl. ¶107).
  • Willful Infringement: Willfulness is alleged based on pre-suit knowledge. The complaint asserts that "Google was given actual notice of Proxense's technology and portfolio of patents in 2008 and 2013" (Compl. ¶102, 113). It is also alleged based on knowledge acquired no later than the filing of the complaint (Compl. ¶115).

VII. Analyst’s Conclusion: Key Questions for the Case

  • A core issue will be one of definitional scope: can the term "third-party trusted authority," described in the patent as a seemingly independent registry, be construed to cover Google Identity, an integrated service operated by the defendant that authenticates users for its own services as well as for external partners?
  • A key evidentiary question will be one of technical correspondence: does the accused system's modern, standards-based authentication flow (using FIDO/OpenID Connect protocols, passkeys, and cryptographic signatures) operate in a manner that meets the limitations of claims written before those standards were ubiquitous, or is there a fundamental mismatch in the technical operation of "sending a code" versus signing a cryptographic challenge?
  • A central factual question for willfulness will be the substance of pre-suit notice: what information was actually conveyed to Google in the alleged 2008 and 2013 notices, and did it provide knowledge of the specific patents-in-suit and the allegedly infringing technology sufficient to support a finding of willful infringement?