Wiz Inc v. Orca Security Ltd

1. Case Identification

• Case #: IPR2024-00220
• Patent #: 11,431,735
• Filed: January 8, 2024
• Petitioner(s): Wiz, Inc.
• Patent Owner(s): Orca Security Ltd.
• Challenged Claims: 1-7, 9-17, and 19

2. Patent Overview

• Title: Securing Virtual Cloud Assets Against Cyber Threats
• Brief Description: The ’735 patent discloses techniques for protecting virtual cloud assets, such as virtual machines, against cyber threats. The described system determines the location of a snapshot of a virtual disk, accesses and analyzes the snapshot to detect potential threats, and then issues prioritized security alerts to a user.

3. Grounds for Unpatentability

Ground 1: Claims 1-7, 9-17, and 19 are obvious over Veselov in view of Basavapatna.

• Prior Art Relied Upon: Veselov (Patent 11,216,563) and Basavapatna (Patent 8,595,845).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner argued that the combination of Veselov and Basavapatna renders all challenged claims obvious under 35 U.S.C. §103. Veselov was asserted to teach nearly every element of the independent claims (1, 10, and 11), including a method for securing virtual assets in a cloud environment by performing a security assessment on a "duplicate" or "snapshot" of a target resource like a virtual disk. This process includes determining the snapshot's location, accessing it (either in its original environment or a test environment), and analyzing it to identify threats and vulnerabilities. Petitioner contended that Veselov only fails to expressly disclose alerting a user "based on a determined priority." To supply this limitation, Petitioner relied on Basavapatna, which describes the commonplace technique of prioritizing security alerts using risk metrics calculated from factors like vulnerability severity and asset criticality. Petitioner argued that Basavapatna’s teachings on risk-based alert prioritization directly map onto the final limitation of the independent claims. Dependent claims were argued to be obvious as they recite additional conventional aspects of security analysis and cloud computing also taught or suggested by the combination.
  • Motivation to Combine: A POSITA would combine Veselov and Basavapatna because both references address analogous problems in the same field of computer security assessment. Petitioner argued that Veselov provides a system for detecting threats but only offers a high-level description of its alerting process. A POSITA would have been motivated to improve Veselov’s system by incorporating the more detailed, well-known alert prioritization techniques from Basavapatna. This combination would achieve the predictable and known benefit of allowing security personnel to more efficiently address the most critical threats first, a common goal in cybersecurity.
  • Expectation of Success: Petitioner asserted that a POSITA would have a reasonable expectation of success in combining the references. The snapshot-based security assessment methods described in Veselov were well-understood and routinely practiced in the art. Similarly, the concept of prioritizing security alerts based on risk, as taught by Basavapatna, was a common and straightforward practice. Combining these two known techniques would not have presented meaningful technical challenges or produced unexpected results, as it involved applying a standard optimization to a known security process.

4. Key Claim Construction Positions

• "location of a snapshot": Petitioner argued this term should be construed to encompass both virtual locations (e.g., a virtual address) and non-virtual, physical locations. This construction was asserted to be consistent with the specification and the common understanding that snapshots of virtual assets were routinely stored in and accessed via both types of locations.
• "analyzing the snapshot": Petitioner proposed this term encompasses two distinct approaches: (1) direct analysis of the snapshot data as a data file without instantiating a new virtual machine, and (2) analysis of a virtual machine that is instantiated from the snapshot. This interpretation was argued to be supported by the patent's specification and necessary to cover the different analysis methods known in the art and disclosed in the cited references.

5. Arguments Regarding Discretionary Denial

• Petitioner argued against discretionary denial under 35 U.S.C. §325(d), contending that the same or substantially the same prior art and arguments were not previously presented to the USPTO. The primary references, Veselov and Basavapatna, were not disclosed to or considered by the Examiner during the original prosecution. Petitioner asserted that these references are not cumulative to the art of record and, in combination, teach all limitations of the challenged claims, which would have precluded allowance had they been properly considered.

6. Relief Requested

• Petitioner requests institution of an inter partes review and cancellation of claims 1-7, 9-17, and 19 of the ’735 patent as unpatentable.