Blue Coat Systems Inc v. Finjan Inc

1. Case Identification

• Case #: IPR2016-01441
• Patent #: 8,225,408
• Filed: July 15, 2016
• Petitioner(s): Blue Coat Systems, Inc.
• Patent Owner(s): Finjan, Inc.
• Challenged Claims: 2, 8, 11, 24-28, and 30-34

2. Patent Overview

• Title: METHOD AND SYSTEM FOR ADAPTIVE RULE-BASED CONTENT SCANNERS
• Brief Description: The ’408 patent discloses a method for protecting computers from malicious code by scanning an incoming stream of computer code. The system creates tokens from the stream, generates a hierarchical "parse tree" data structure from patterns in the tokens, and identifies potential exploits by analyzing patterns within the parse tree using language-specific rules.

3. Grounds for Unpatentability

Ground 1: Obviousness over Chandnani, Kolawa, and Knuth - Claims 2, 11, 24-28, and 30-34 are obvious over Chandnani in view of Kolawa and Knuth.

• Prior Art Relied Upon: Chandnani (Application # 2002/0073330), Kolawa (Patent 5,860,011), and Knuth (Information and Control, 1965).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner argued that Chandnani teaches a multi-language virus scanner that converts a data stream into tokens and uses language-specific rules to detect malicious code. While Chandnani suggests parsing, Kolawa explicitly teaches using a "conventional" lexical analyzer/parser to group tokens into a parse tree for rule-based analysis of code. The challenged dependent claims require specific, conventional parsing techniques. Petitioner asserted that Knuth, a foundational paper on parsing, provides the explicit teachings for these techniques—such as the "shift-and-reduce algorithm" and the hierarchical structure of a parse tree—that a POSITA would use to implement the "conventional" parser described in Kolawa.
  • Motivation to Combine: A POSITA would combine Kolawa's parse tree with Chandnani's scanner because storing tokens in a hierarchical tree structure is a well-known technique that improves the ability to analyze complex code patterns compared to a simple text stream. A POSITA implementing Kolawa's "conventional" parser would naturally consult a foundational reference like Knuth for established, reliable implementation details like the shift-and-reduce algorithm.
  • Expectation of Success: Success would be expected because combining these known elements for their intended purposes was predictable. Using a parse tree (Kolawa) was a standard industry solution for analyzing tokens (Chandnani), and implementing it with a fundamental algorithm (Knuth) presented no technical hurdles.

Ground 2: Obviousness over Chandnani, Kolawa, and Huang - Claim 8 is obvious over Chandnani in view of Kolawa and Huang.

• Prior Art Relied Upon: Chandnani (Application # 2002/0073330), Kolawa (Patent 5,860,011), and Huang (Patent 6,968,539).
• Core Argument for this Ground:
  • Prior Art Mapping: This ground targets claim 8, which adds limitations for handling "embedded program code" written in a language different from the primary incoming stream (e.g., JavaScript within an HTML document). Petitioner argued the base scanner of Chandnani/Kolawa is rendered obvious for this purpose by Huang. Huang explicitly teaches a system for processing web pages that identifies and parses embedded code (like JavaScript) separately from the container document (like HTML), applying language-specific rules to each.
  • Motivation to Combine: A POSITA would combine Huang's teachings with the Chandnani/Kolawa scanner to address the common reality of web-based threats. Since Chandnani's system is designed to detect viruses from internet traffic, it would have been a logical and necessary step to enable it to scan the ubiquitous format of web pages with embedded scripts, as taught by Huang.
  • Expectation of Success: There was a high expectation of success, as Huang provides a direct solution for the specific problem of parsing embedded code, a necessary function for any effective, modern internet security scanner.

Ground 3: Obviousness over Combinations Including Walls - Claims including "dynamically building" and "dynamically detecting" are obvious with the addition of Walls.

• Prior Art Relied Upon: The combinations from Grounds 1 and 2, with the further addition of Walls (Patent 7,284,274).
• Core Argument for this Ground:
  • Prior Art Mapping: This argument asserted that the limitations requiring "dynamically building" a parse tree while receiving the data stream and "dynamically detecting" exploits while the tree is being built are taught by Walls. Walls discloses a "pipelined" approach to code analysis where distinct components operate in parallel. This allows one part of a code stream to be parsed and have a parse tree built while upstream portions of the stream are still being received, thereby satisfying the "dynamic" limitations.
  • Motivation to Combine: A POSITA would be motivated to incorporate Walls' pipelining technique into the primary scanner combinations to improve performance and throughput. Pipelining was a known method to make data processing more efficient by allowing analysis to begin before an entire data file is downloaded, a clear advantage for a real-time security scanner.
  • Expectation of Success: Pipelining is a generic and widely applicable computer science technique. A POSITA would have had a high expectation of success in applying this known performance-enhancing method to the otherwise-combined prior art scanner.

4. Key Claim Construction Positions

Petitioner argued for constructions consistent with those adopted by the Board in prior IPRs involving the ’408 patent.

• "parse tree": "a hierarchical structure of interconnected nodes built from scanned content."
• "dynamically building ... while said receiving receives the incoming stream": "a time period for dynamically building overlaps with a time period during which the incoming stream is being received."
• "dynamically detecting ... while said dynamically building builds the parse tree": "a time period for dynamically detection overlap with a time period during which the parse tree is built."
• "instantiating ... a scanner for the specific programming language": "substituting specific data, instructions, or both into a generic program unit to make it usable for scanning the specific programming language."

5. Arguments Regarding Discretionary Denial

• Petitioner argued that this petition is not redundant and should not be discretionarily denied under 35 U.S.C. § 325(d). It contended that prior IPR petitions and related joinder requests it filed against the ’408 patent were limited to a different set of claims (primarily independent claims). This petition specifically advances challenges to dependent claims not previously at issue, thus raising new questions of patentability that could not have been reasonably addressed in the earlier proceedings.

6. Relief Requested

• Petitioner requests institution of an inter partes review and cancellation of claims 2, 8, 11, 24-28, and 30-34 of the ’408 patent as unpatentable under 35 U.S.C. §103.