PTAB

IPR2017-01755

Cisco Systems Inc v. Vir2us Inc

Log In
Key Events
Petition
petition

1. Case Identification

2. Patent Overview

  • Title: COMPUTER SYSTEM ARCHITECTURE AND METHOD PROVIDING OPERATING-SYSTEM INDEPENDENT VIRUS-, HACKER-, AND CYBER-TERROR-IMMUNE PROCESSING ENVIRONMENTS SYSTEM
  • Brief Description: The ’541 patent describes a computer system architecture that uses a switching system to selectively and independently couple a processing device to different data storage areas. This mechanism is intended to create secure, isolated processing environments by separating the execution of trusted programs and data from untrusted ones, thereby providing immunity from viruses, hacking, and other security threats.

3. Grounds for Unpatentability

Ground 1: Obviousness over Reshef - Claims 1, 3, 6-8, 11-13, and 15-16 are obvious over Reshef.

  • Prior Art Relied Upon: Reshef (International Publication No. WO 00/16200).
  • Core Argument for this Ground:
    • Prior Art Mapping: Petitioner argued that Reshef teaches a method for protecting computer systems by creating multiple, isolated operating environments using processor hardware mechanisms and unshared resources. Specifically, Petitioner focused on Reshef’s second embodiment, which discloses a “monitor program” running in a privileged, isolated memory space that establishes and manages one or more operating systems (OSs) in separate, unprivileged virtual environments. Petitioner contended this architecture directly maps to the claims: the monitor's isolated memory space is the claimed “first storage” for trusted code (the monitor itself), and each virtual environment is a “second storage” for untrusted code (the guest OS and its applications).
    • The claimed “switching system” was mapped to Reshef’s use of standard processor-level context switching, controlled by the monitor program. This system leverages CPU memory management hardware (e.g., paging units, privilege levels) to automatically and independently couple or decouple the processor between the monitor's trusted environment and the less-trusted virtual OS environments. For example, when the processor executes the monitor program, it is coupled to the first storage; when it executes a guest OS, it is decoupled from the first storage and coupled only to the second storage. This automated switching in response to events like clock interrupts or system calls was argued to meet the limitations for the claimed switching system.
    • Motivation to Combine: The primary motivation cited was found within Reshef itself. Petitioner argued a person of ordinary skill in the art (POSITA) would be motivated to combine teachings from Reshef’s two disclosed embodiments (one for isolating programs within an OS, the other for isolating entire OSs) because Reshef explicitly states they are “interchangeable” and can both be used to implement its described “security gateway.” The goal of protecting a system from untrusted programs (a key feature of Reshef’s first embodiment) while using the robust hardware-based isolation of the second embodiment provided a clear and compelling reason to combine their teachings to arrive at the claimed invention.
    • Expectation of Success: Petitioner asserted a POSITA would have a high expectation of success in implementing Reshef’s teachings. The methods described—hardware-based virtualization, memory protection via paging, and CPU privilege levels—were well-understood, mature, and predictable technologies common in processors of the era (e.g., Intel Pentium), ensuring that combining the disclosed elements would function as expected.

4. Key Claim Construction Positions

  • “[first]/[second] data storage”: Petitioner argued this term is not limited to physically distinct hardware but encompasses logically separate memory areas, such as memory address spaces or disk partitions protected by hardware. This construction was central to mapping the claims onto Reshef, whose isolation mechanism relies on creating logically separate memory spaces for its monitor program and virtual environments on the same physical hardware.
  • “couple”/“decoupling”: Petitioner proposed these terms be construed broadly to mean allowing or disallowing the communication of information, independent of a persistent physical connection. This interpretation supports mapping the claim terms to Reshef's software-driven context switching, where the processor’s ability to access different memory regions is logically enabled or disabled by the monitor program via memory management hardware.
  • “a switching system ... under automated control”: Petitioner contended this limitation in claim 1 should be treated as a means-plus-function term under 35 U.S.C. §112(f). The recited function was defined as "selectively and independently allowing or disallowing a processing logic device to communicate information with a first storage and/or a second storage under automated control." Petitioner argued that the corresponding structure in Reshef is its monitor program operating in conjunction with the CPU's memory management hardware to perform context switching. This combination was asserted to be a known structural equivalent to the hardware switches disclosed in the ’541 patent.

5. Relief Requested

  • Petitioner requests the institution of an inter partes review and the cancellation of claims 1, 3, 6-8, 11-13, and 15-16 of Patent 7,392,541 as unpatentable under 35 U.S.C. §103.