CrowdStrike Inc v. Taasera Licensing LLC

1. Case Identification

• Case #: IPR2023-01467
• Patent #: 8,990,948
• Filed: October 20, 2023
• Petitioner(s): CrowdStrike, Inc.
• Patent Owner(s): Taasera Licensing LLC
• Challenged Claims: 1-5

2. Patent Overview

• Title: System and Method for Runtime Application and Computing Environment Integrity Verification
• Brief Description: The ’948 patent discloses systems and methods for determining the operational integrity of applications running on a computing device. The technology addresses security risks arising from the proliferation of applications and unmanaged devices in enterprise networks by monitoring various events and activities to generate real-time integrity status indications.

3. Grounds for Unpatentability

Ground 1: Claims 1-5 are obvious over Mukherjee in view of Cooper.

• Prior Art Relied Upon: Mukherjee ("Network Intrusion Detection," a 1994 research paper) and Cooper (Patent 7,451,488).

• Core Argument for this Ground:

  • Prior Art Mapping: Petitioner argued that the combination of Mukherjee and Cooper taught every limitation of the challenged claims. Mukherjee’s Distributed Intrusion Detection System (DIDS) was asserted to provide the core architecture for a real-time operational integrity system. Petitioner mapped components of DIDS to the claimed elements: Mukherjee’s LAN monitor was alleged to be a "network analyzer," its host event generator an "integrity processor," and its rule-based expert system director a "trust supervisor" that performs the functions of an "event correlation matrix" and a "risk correlation matrix." Mukherjee’s system monitors host and network events, which Petitioner contended are "behavior-based events."

  Petitioner argued that Cooper, which discloses "scanning for vulnerabilities on a continuous basis," supplemented Mukherjee’s older system. Cooper was asserted to teach continuous monitoring of applications (as required by claim 2), performing scans on a schedule (claim 4), and scoring the severity of threats based on vulnerability data (claim 4). Furthermore, Petitioner contended that the web-based graphical user interfaces (GUIs) disclosed in Cooper provided concrete examples of the "plurality of runtime dashboards" (claim 1) and specific dashboard types like a "global view dashboard" (claim 5) that a person of ordinary skill in the art (POSITA) would use to implement the user interface described more generally in Mukherjee.

  • Motivation to Combine: Petitioner asserted a POSITA would combine Mukherjee and Cooper because both references address detecting and resolving vulnerabilities in network systems. Mukherjee explicitly stated that its DIDS architecture could be enhanced by using it in conjunction with other tools, such as network-management tools that perform network mapping. Petitioner argued Cooper’s vulnerability scanner is precisely such a tool. A POSITA would have been motivated to integrate Cooper’s vulnerability assessment data into Mukherjee’s system to provide better context for events being analyzed by Mukherjee’s expert system, thereby improving the accuracy of threat identification.

  • Expectation of Success: Petitioner contended that a POSITA would have had a high expectation of success in combining the references. The motivation was strong, and Cooper’s vulnerability scanner was designed to work with the type of network monitoring system disclosed in Mukherjee. Integrating Cooper’s vulnerability events and dashboard displays into Mukherjee’s framework would have been a straightforward implementation for a POSITA.

4. Key Claim Construction Positions

• Petitioner proposed that for the purposes of the inter partes review (IPR), all claim terms should be given their plain and ordinary meaning. No specific claim constructions were deemed necessary to apply the asserted prior art to the challenged claims.

5. Arguments Regarding Discretionary Denial

• Petitioner argued against discretionary denial under 35 U.S.C. §314(a), asserting that the Fintiv factors weighed against denial. The parallel district court litigation is part of a Multi-District Litigation (MDL), and no operative trial date has been set in the originating court, making a trial date highly uncertain. Further, Petitioner stipulated that, if the IPR is instituted, it would not pursue in the district court any invalidity ground that utilizes Mukherjee and Cooper.
• Petitioner also argued against denial under 35 U.S.C. §325(d), stating that neither Mukherjee nor Cooper was cited or considered during the original prosecution of the ’948 patent. These references were argued to be materially different from the art previously considered by the examiner because they allegedly disclose the complete combination of claim limitations that formed the basis for allowance.

6. Relief Requested

• Petitioner requests institution of an IPR and cancellation of claims 1-5 of the ’948 patent as unpatentable.