Splunk Inc v. PacSec3 LLC

1. Case Identification

• Case #: IPR2022-01230
• Patent #: 7,523,497
• Filed: June 30, 2022
• Petitioner(s): Splunk Inc.
• Patent Owner(s): PacSec3, LLC
• Challenged Claims: 7-12

2. Patent Overview

• Title: Packet Flooding Defense
• Brief Description: The ’497 patent is directed to methods for minimizing the effects of packet flooding attacks against computers or routers on a network. The methods involve identifying the path packets have taken, classifying them as wanted or unwanted based on their path, and allocating a processing or transmission rate to unwanted packets to limit their impact.

3. Grounds for Unpatentability

Ground 1: Obviousness over Wetherall and Doeppner - Claims 7-12 are obvious over Wetherall in view of Doeppner.

• Prior Art Relied Upon: Wetherall (Patent 6,801,503) and Doeppner (“Using Router Stamping to Identify the Source of IP Packets,” Nov. 1, 2000).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner argued Wetherall taught a system for defending against Denial-of-Service (DoS) attacks by regulating network traffic, including classifying packets into different types and rate-limiting them according to a "not-to-exceed" profile. However, Wetherall’s classification relied on packet header information (e.g., source address) that could be falsified ("spoofed") by an attacker. Doeppner addressed this known problem by disclosing a "router stamping" technique where each router marks a packet with information about the previous router, allowing a victim host to reliably reconstruct the packet's true path even with spoofed header data. The combination disclosed determining a packet's path via marks (Doeppner), classifying packets based on this path (Wetherall/Doeppner), associating a maximum processing rate with each class (Wetherall), and allocating a lower rate to unwanted packets (Wetherall/Doeppner).
  • Motivation to Combine: A person of ordinary skill in the art (POSITA) would combine Doeppner's reliable path-tracing solution with Wetherall's rate-limiting framework to solve the known problem of spoofed packet headers in DoS attacks. This would improve Wetherall's system by enabling more precise targeting of malicious traffic without inadvertently penalizing legitimate traffic, a clear technical advantage.
  • Expectation of Success: Both references are in the same field of network traffic management, address the same problem of DoS attacks, and were implemented on analogous network components. Doeppner's method was described as inexpensive and adaptable, leading to predictable results when combined with a system like Wetherall's.

Ground 2: Obviousness over Wetherall and Savage - Claims 7-12 are obvious over Wetherall in view of Savage.

• Prior Art Relied Upon: Wetherall (Patent 6,801,503) and Savage (“Practical Network Support for IP Traceback,” Sep. 1, 2000).

• Core Argument for this Ground:

  • Prior Art Mapping: This ground presented a similar argument to Ground 1, but substituted Savage for Doeppner as the source for reliable path tracing. Wetherall again provided the foundational system for rate-limiting network traffic based on classification. Savage, like Doeppner, taught a method for tracing anonymous packet flooding attacks by having routers probabilistically mark packets with IP address information. A victim host could then use these marked packets to reconstruct the attack path. The combination of Wetherall's rate-limiting and Savage's path reconstruction was argued to teach all limitations of the challenged claims.
  • Motivation to Combine: The motivation was identical to that in Ground 1: a POSITA would apply Savage's technique for identifying packet paths in the face of spoofed information to Wetherall's rate-limiting system. This would create a more effective DoS defense that could accurately distinguish and throttle malicious traffic. The fact that the references were authored around the same time by common authors suggested their teachings were compatible.
  • Expectation of Success: The combination was asserted to yield predictable results because both references addressed analogous problems in the same technical field, and Savage's teachings were designed for efficient implementation using conventional technology.

• Additional Grounds: Petitioner asserted additional obviousness challenges (Grounds 3 and 4) under 35 U.S.C. §103 based on Cheriton (Patent 7,120,931) in view of either Doeppner or Savage. Petitioner argued Cheriton provided an alternative base system for filtering network flows that would have been similarly improved by incorporating the reliable path-tracing techniques of Doeppner or Savage.

4. Arguments Regarding Discretionary Denial

• Petitioner argued that discretionary denial under Fintiv would be improper based on a parallel district court litigation. It contended that the petition presented compelling evidence of unpatentability and that Petitioner would stipulate not to pursue the same grounds in the parallel proceeding, consistent with then-current USPTO guidance.
• Petitioner also argued against denial under 35 U.S.C. §325(d) based on a pending ex parte reexamination. It asserted that the prior art references and arguments presented in the IPR petition (specifically the combinations including Wetherall, Doeppner, and Cheriton) were not the same as, or cumulative to, the art and arguments previously presented to the Office during original prosecution or in the pending reexamination.

5. Relief Requested

• Petitioner requests institution of an inter partes review (IPR) and cancellation of claims 7-12 of the ’497 patent as unpatentable.