FNJN SJ

__________________________________________________________________________________ FINJANS NOTICE OF MOTION AND MOTION Case No.: 13-CV-03999-BLF FOR SUMMARY JUDGMENT OF INFRINGEMENT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PAUL J. ANDRE (State Bar No. 196585) [email protected] LISA KOBIALKA (State Bar No. 191404) [email protected] JAMES HANNAH (State Bar No. 237978) [email protected] KRAMER LEVIN NAFTALIS & FRANKEL LLP 990 Marsh Road Menlo Park, CA 94025 Telephone: (650) 752-1700 Facsimile: (650) 752-1800 Attorneys for Plaintiff FINJAN, INC.

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION

FINJAN, INC., a Delaware Corporation, Plaintiff,

v. BLUE COAT SYSTEMS, INC., a Delaware Corporation, Defendant.

Case No.: 13-CV-03999-BLF PLAINTIFF FINJAN, INC.S NOTICE OF MOTION AND MOTION FOR SUMMARY JUDGMENT OF INFRINGEMENT OF U.S. PATENT NOS. 6,154,844; 7,058,822; 7,647,633; 7,418,731; 6,965,968; AND 6,804,780, OR, IN THE ALTERNATIVE, FOR PARTIAL SUMMARY JUDGMENT OF CERTAIN CLAIM ELEMENTS; MEMORANDUM OF POINTS AND AUTHORITIES Date: April 16, 2015 Time: 9:00 a.m. Place: Courtroom 3 5th Floor Before: Hon. Beth Labson Freeman

REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED

Case5:13-cv-03999-BLF Document179 Filed03/12/15 Page1 of 30

i __________________________________________________________________________________ FINJANS NOTICE OF MOTION AND MOTION Case No.: 13-CV-03999-BLF FOR SUMMARY JUDGMENT OF INFRINGEMENT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF CONTENTS

Page

NOTICE OF MOTION AND MOTION FOR PARTIAL SUMMARY JUDGMENT ........................... 1

MEMORANDUM OF POINTS AND AUTHORITIES .......................................................................... 1

I. INTRODUCTION ........................................................................................................................ 1

II. FACTUAL BACKGROUND ....................................................................................................... 2

A. History of Finjans Inventions and Blue Coats Infringement .......................................... 2

B. The Instant Lawsuit ........................................................................................................... 4

1. The Asserted Patents ............................................................................................. 4

2. The Accused Products ........................................................................................... 5

3. Fact and Expert Discovery .................................................................................... 8

III. SUMMARY OF ISSUES FOR SUMMARY JUDGMENT ........................................................ 9

IV. LEGAL STANDARD ................................................................................................................... 9

V. ARGUMENT .............................................................................................................................. 10

A. Partial Summary Judgment Should be Granted for Undisputed Elements ..................... 10

1. Undisputed Elements of the 844 Patent ............................................................. 10





B. Summary Judgment Should be Granted for Elements for which Blue Coats Defense is Unsupportable ............................................................................................... 18

1. Security Profile and Suspicious Code Elements ................................................. 18

2. Linking Element.................................................................................................. 19

3. Rule Set Element................................................................................................. 19

4. Mobile Protection Code Element ........................................................................ 20


ii __________________________________________________________________________________ FINJANS NOTICE OF MOTION AND MOTION Case No.: 13-CV-03999-BLF FOR SUMMARY JUDGMENT OF INFRINGEMENT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

5. Providing an Information Re-Communicator and a Mobile Code Executor Element ................................................................................................ 21

6. Receiving Downloadable Information Element .................................................. 21

7. Causing Mobile Protection Code to be Executed Element ................................. 22

8. Computer Gateway Element ............................................................................... 22

9. File Cache Element ............................................................................................. 23

10. Security Policy Cache Element ........................................................................... 23

11. Policy Index Element .......................................................................................... 24

12. Hashing Element ................................................................................................. 25

VI. CONCLUSION ........................................................................................................................... 25


iii __________________________________________________________________________________ FINJANS NOTICE OF MOTION AND MOTION Case No.: 13-CV-03999-BLF FOR SUMMARY JUDGMENT OF INFRINGEMENT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF AUTHORITIES

Page(s)

Cases

Anderson v. Liberty Lobby, Inc., 477 U.S. 242 (1986) ............................................................................................................................ 9

Celotex Corp. v. Catrett, 477 U.S. 317 (1986) ............................................................................................................................ 9

Kegel Co. v. AMF Bowling, Inc., 127 F.3d 1420 (Fed. Cir. 1997)........................................................................................................... 9

Markman v. Westview Instruments, Inc., 517 U.S. 370 (1996) ............................................................................................................................ 9

MShift, Inc. v. Digital Insight Corp., 747 F. Supp. 2d 1147 (N.D. Cal. 2010) ............................................................................................ 10

Norian Corp. v. Stryker Corp., 433 F. Supp. 2d 1051 (N.D. Cal. 2004) .............................................................................................. 9

Volterra Semiconductor Corp. v. Primarion, Inc., 799 F. Supp. 2d 1092 (N.D. Cal. 2011) ............................................................................................ 10

Other Authorities

Fed. R. Civ. P. 56(a) ................................................................................................................................. 9

Fed. R. Civ. P. 56(c) ................................................................................................................................. 9


1 FINJANS NOTICE OF MOTION AND MOTION Case No.: 13-CV-03999-BLF FOR SUMMARY JUDGMENT OF INFRINGEMENT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

NOTICE OF MOTION AND MOTION FOR SUMMARY JUDGMENT

TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD:

PLEASE TAKE NOTICE that on April 16, 2015 at 9:00 a.m., or as soon thereafter as the

matter may be heard by the Honorable Beth Labson Freeman in Courtroom 3, 5th Floor of the United

States District Court for the Northern District of California, 280 South 1st Street in San Jose, CA

95113, Plaintiff Finjan, Inc. (Finjan) shall, and hereby does, move the Court for an order granting

summary judgment of infringement in favor of Finjan that Blue Coat Systems, Inc. (Blue Coat)

infringes all of the elements of the following claims (collectively, the Asserted Claims):

U.S. Patent No. 6,154,844 (the 844 Patent), Claims 1, 7, 11, 15-16 and 41; U.S. Patent No. 7,058,822 (the 822 Patent), Claims 9 and 10; U.S. Patent No. 7,647,633 (the 633 Patent), Claims 8 and Claim 14; U.S. Patent No. 7,418,731 (the 731 Patent), Claim 1; U.S. Patent No. 6,965,968 (the 968 Patent), Claims 1, 9 and 33; U.S. Patent No. 6,804,780 (the 780 Patent), Claims 9, 13 and 18.

In the alternative, Finjan moves for partial summary judgment that Blue Coat infringes the following

elements of the following claims (collectively, the Undisputed Elements):

the 844 Patent, Claim 1, elements (a)-(b); Claim 7; Claim 15, element (a); and Claim 41, elements (a)-(b);

the 822 Patent, Claim 9, elements (a)-(c) and (e); and Claim 10; the 633 Patent, Claim 8, elements (a)-(c); and Claim 14, element (a); the 968 Patent, Claim 1, elements (a) and (c); Claim 9; and Claim 33,

elements (a)-(b); the 780 Patent, Claim 9, elements (a)-(b), Claim 13; and Claim 18, elements

(a)-(b).

This motion is based on: this Notice of Motion and supporting Memorandum of Points and

Authorities; the Declaration of James Hannah in Support of Plaintiff Finjan, Inc.s Motion for

Summary Judgment and exhibits attached thereto; the Moving Separate Statement submitted

concurrently herewith; and such other written or oral argument as may be presented at or before the

time this motion is deemed submitted by the Court.

MEMORANDUM OF POINTS AND AUTHORITIES

I. INTRODUCTION

Blue Coat infringes Finjans patents covering pioneering technology for protecting computers



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

and networks from viruses delivered over the Internet.

With this backdrop, it becomes apparent after

analyzing Blue Coats technical documents that this case is ripe for summary judgment.

Blue Coat cannot point to any evidence that creates a genuine issue of fact regarding its

infringement of various claim elements of Finjans patents. These elements fall into two categories.

First, for certain elements, Blue Coat altogether fails to dispute that its products meet the element.

These elements include descriptions of the accused products (e.g., an inspector system, a processor-

based system) and actions that they perform (e.g., receiving a Downloadable, storing a cache of

digital content). Second, for the other elements, Blue Coat provides defenses that are completely

unsupportable because they are directly contradicted by Blue Coats own documents and testimony.

Thus, because Blue Coat has failed to provide any supportable defense or any defense at all for

various claim elements, Finjan is entitled to summary judgment for all elements of the Asserted

Claims, or, in the alternative, partial summary judgment of the Undisputed Elements.

II. FACTUAL BACKGROUND

A. History of Finjans Inventions and Blue Coats Infringement

Finjan formed in 1995 to develop technology to proactively detect a new generation of

computer virus threats delivered over the Internet. Through over a decade of research, and after

spending over $65 million in research and development, Finjan developed an innovative suite of anti-

malware technologies. Finjans inventions included the identification of behavior of malicious code,

which allows previously unknown threats to be blocked proactively (in contrast to prior technology,

which relied on signatures of viruses already known in the security industry). Finjan has been

awarded various patents for these new techniques and sold products incorporating them, resulting in

millions of dollars of sales. Finjans patented technology has been long acknowledged by the industry

as a significant innovation and consistently praised for its pioneering nature. See, e.g., Ex. 11 at

1 All Ex. citations are to exhibits attached to the Declaration of James Hannah in Support of Finjans Motion for Summary Judgment filed herewith.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

FINJAN-BC 052429-30 (Finjan is the inventor of proactive content behavior inspection.); see also

Ex. 2 (2007 SC Magazine finalist for Best Security Company and Best Security Solution for

Government); Ex. 3 at FINJAN-BC 046307 (Finjan developed some of the basic building blocks of

the modern computer security industry, including the security sandbox.).

Finjan has had numerous partners in the computer and network security industry who have used

Finjans products within or along with their own products, including Blue Coat. Recognizing the

importance of Finjans proprietary technology in achieving online security, various leading technology

and network and computer security companies have also taken a license under Finjans patents,

amounting to over $150 million in fees to date. Finjan has also successfully enforced its patents in

court (including the 822 and 780 Patents asserted here against Blue Coat) in a decision upheld by the

Federal Circuit in 2010.

Blue Coat was founded in 1996 as a company focused on web optimization and acceleration.

In 2002, Blue Coat began partnering with other companies to add security features to its products,

including a partnership with Finjan.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

(

.

B. The Instant Lawsuit

1. The Asserted Patents

Finjan filed this action on August 28, 2013 for Blue Coats infringement of six of the Finjan

patents described above, specifically, the 844 Patent, 968 Patent, 731 Patent, 780 Patent, 822 Patent

and 633 Patent (the Asserted Patents). The Asserted Patents relate to a variety of technologies to

protect computers from viruses downloaded through the Internet, including technologies for

optimization of this protection.

The 844 Patent is the first line of defense and protects users against unknown downloadables

that are potentially malicious using behavior detection. Rather than relying on signatures, the system

of the 844 Patent tracks the operations that a downloadable is programmed to perform. Ex. 13 at 2:65.

In so doing, the system generates a profile that identifies suspicious code within the downloadable. Id.

at 2:5-3:5. This profile is linked to the downloadable before it is made available to the client who

requested the content so that appropriate actions can be taken. Id. at 5:59-6:24, Fig. 6. As a result, the

system can proactively protect users against malicious downloadables, even downloadables that have

never been seen before. Id. at 2:60-3:5.

If the downloadable is allowed to pass the inspection system described in the 844 Patent, the

system of the 822 Patent provides additional protection for users. The 822 Patents system inspects

downloadable information for executable code, such as downloadables, and injects mobile protection

code into the content in order to monitor or intercept any malicious activity made by executable code.

Ex. 17 at 2:40-3:20. The monitored downloadable content is then passed to the user. Id. at 7:5-15.

The 633 Patent is related to the 822 Patent and shares the same specification. The claims of

the 633 Patent, however, are different than the 822 Patent. While the claimed systems of the 822



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

and 633 Patents can monitor content through mobile protection code injection, the system claimed in

the 633 Patent can also run the downloadable in a protective virtual environment or sandbox. Ex.

18 at 3:15-20. This provides even further protection because the true actions of the code can be

determined without having to run the downloadable on the users computer. Id. at 4:10-25.

The remaining three patents provide a framework to optimize a security system. The system of

the 731 Patent utilizes multiple caches (temporary memory) to store various components of a typical

system that analyzes web traffic. Specifically, the 731 Patents system stores files (such as webpages)

in a file cache so that the system can quickly retrieve previously requested content. Ex. 15 at 1:64-

4:67. It stores the results of a security scan in a security profile cache so that it can avoid having to

rescan every file. Id. at 6:55-60. Finally, the system of the 731 stores security policies in a cache so

that decisions about which user can access which file or webpage is done an efficient manner. Id. at

7:55-59.

The 968 Patent describes a different cache-based system which provides for even further

efficiencies. After content is retrieved and scanned, security policies must be applied in order to

determine whether the content is allowable. The system of the 968 Patent stores these policy

decisions in a policy index (also known as a policy cache) for quick retrieval in analyzing requested

content. Ex. 14 at 1:63-2:10.

The 780 Patent protects users from downloadables by generating identifiers for incoming

downloadables at a network security system before they arrive at a users computer. Ex. 16 at 3:36-44

and Fig. 1. Hashing is used in this process, which is a mathematical function to determine whether

data was previously seen. Id. at 2:12-27. The generation of these identifiers allows the network

security system to avoid expensive analysis for previously seen Downloadables. Id.

2. The Accused Products

The Blue Coat technologies that infringe the Asserted Patents include WebPulse, ProxySG,

Content Analysis System (CAS), Malware Analysis Appliance (MAA) and ProxyAV. The following

chart summarizes which products infringe the Asserted Patents:



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Asserted Patents Infringing Products

844 Patent WebPulse2

822 Patent ProxySG3

633 Patent ProxySG;

MAA;

ProxySG with CAS and MAA

731 Patent ProxySG with WebPulse

968 Patent ProxySG with WebPulse

780 Patent ProxyAV4

ProxySG with ProxyAV

These technologies are the core of Blue Coats defense solution and often work in conjunction with

one another as part of a layered defense. Indeed, WebPulse, ProxySG, CAS and MAA are often

referred to as the secure web gateway. See Ex. 31 at BC0210379; see also Ex. 69 at BC0193196.

WebPulse is the front line of defense against unknown threats in the Blue Coat security system,

and is depicted below in relation to ProxySG and an origin content server, also known as a web server:

2 All references to WebPulse include all products that use WebPulse to analyze web traffic, including ThreatBLADES. 3 ProxySG includes a number of components, including Webfilter which interacts with WebPulse. Thus, all references to ProxySG includes all components within ProxySG, including Webfilter. 4 Notably, ProxyAV is the predecessor product to CAS.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

5 ProxyAV is the predecessor of CAS.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Ex. 71, Content Analysis System Guide Version 1.2 at 3.

.

3. Fact and Expert Discovery

Fact discovery took place from November 19, 2013 to December 12, 2014. Expert discovery

commenced on January 12, 2015. Below is a summary of the parties expert reports regarding

infringement and the Asserted Patents addressed by each report:

844 822 633

731 968 780

Dr. Coles 1/12/15 report for Finjan (Cole Report) X X X Dr. Mitzenmachers 1/12/15 report for Finjan (Mitzenmacher Report)

X X X

Dr. Bestavros 2/13/15 report for Blue Coat (Bestavros Report)

X X X X

Dr. Hicks 2/13/15 report for Blue Coat (Hicks Report)

X X

Each of these experts was deposed regarding his respective report in February 2015.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

III. SUMMARY OF ISSUES FOR SUMMARY JUDGMENT

Appendix A provides a chart that summarizes the claim elements at issue in the instant motion

and the Blue Coat products accused for each claim. For each element in the chart, Blue Coat has

either: (1) not disputed that the element is present in the accused products, indicated as Undisputed

and shaded in the chart and addressed in Section V(A) below, or (2) presented only factually

unsupported argument, indicated as Unsupported Defense in the chart and addressed in Section V(B)

below.

IV. LEGAL STANDARD

Summary judgment is proper when the pleadings, depositions, answers to interrogatories, and

admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any

material fact and that the moving party is entitled to a judgment as a matter of law. Anderson v.

Liberty Lobby, Inc., 477 U.S. 242, 248-49 (1986); Fed. R. Civ. P. 56(c). An issue is genuine only if

there is a sufficient evidentiary basis on which a reasonable fact finder could find for the non-moving

party. A dispute is material only if it could affect the outcome of the suit under governing law. See

Anderson, 477 U.S. at 248-49. Summary judgment is proper on each claim or defenseor the part of

each claim or defenseon which summary judgment is sought in order to isolate and dispose of

factually unsupported claims or defenses. Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S.

317, 323-24 (1986).

To determine patent infringement, first, the court must determine as a matter of law the

meaning of the particular patent claims at issue; second, it must consider whether the accused product

infringes a properly construed claim. Markman v. Westview Instruments, Inc., 517 U.S. 370 (1996).

The plaintiff bears the burden under a preponderance of the evidence standard. See Kegel Co. v.

AMF Bowling, Inc., 127 F.3d 1420, 1425 (Fed. Cir. 1997) (affirming summary judgment of

infringement). Comparison of a properly interpreted claim with an uncontested description of an

accused process would reflect such an absence of material fact as to warrant summary judgment.

Norian Corp. v. Stryker Corp., 433 F. Supp. 2d 1051, 1053 (N.D. Cal. 2004). Also, summary

judgment is appropriate when an expert opinion is not supported by sufficient facts to validate it in



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

eyes of law, or when indisputable record facts contradict or otherwise render opinion unreasonable.

Volterra Semiconductor Corp. v. Primarion, Inc., 799 F. Supp. 2d 1092, 1098-99 (N.D. Cal. 2011)

(quotations omitted); see also MShift, Inc. v. Digital Insight Corp., 747 F. Supp. 2d 1147, 1165-66

(N.D. Cal. 2010).

V. ARGUMENT

As explained below, Finjan has identified ample factual support (and supporting expert

opinions) to show that each element of claims of each Asserted Patent is present in the accused

products. Yet Blue Coat has either (1) completely failed to dispute the presence of the element

(Section A below) or (2) provided no supportable noninfringement defense for the element (Section B

below). As such, Finjan is entitled to summary judgment for all elements of the Asserted Claims, or,

in the alternative, partial summary judgment of the Undisputed Elements.

A. Partial Summary Judgment Should be Granted for Undisputed Elements

For various elements, Blue Coats own experts do not dispute that the elements are present in

the accused products. Moreover, the record in this matterincluding deposition testimony, source

code, expert testimony, expert reports, and documents producedclearly proves that Blue Coats

products infringe these elements. Blue Coat entirely fails to address this record. In the face of such

uncontroverted evidence, there is no genuine issue of material fact regarding infringement of these

elements. Thus, Finjan is entitled to at least partial summary judgment of infringement for each of

these elements.

1. Undisputed Elements of the 844 Patent

Blue Coat does not dispute that elements 1(a)-(b), 7, 15(a), and 41(a)-(b) of the 844 Patent are

present in WebPulse. Ex. 19, Bestavros Report, 180-244. As set forth below, Finjan has provided

ample evidence showing the presence of these elements, none of which Blue Coat has rebutted:

Element 1(a) - A method comprising: WebPulse is a hardware and software system that

performs methods to provide intelligence on unknown web threats. Ex. 20, 104-107. See Blue

Coats documents (id., 108-110), the deposition testimony of Messrs. Andersen, Harrison, and

Tomic (id., 111-112), and Dr. Coles testing (id., 113).



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Element 1(b) - receiving by an inspector a Downloadable: WebPulse intercepts requests

from a web client and inspects Downloadables from an origin content server before the server makes

the Downloadable available to the web client. Id., 114-119.

, testimony of Messrs. Andersen, Harrison, Larsen, Tomic (id., 130-132),

and Dr. Coles testing (id., 133).

Element 7 - wherein the Downloadable includes a JavaScript script: WebPulse receives

and processes Downloadables including JavaScript. Id., 189-192. See Blue Coats own documents

(id., 193-199), testimony of Messrs. Harrison, Whitchurch, Andersen, Larsen, and Tomic (id.,

200-204), and Dr. Coles testing (id., 205).

Element 15(a) - An inspector system comprising: WebPulse is an inspector system because it

requests, retrieves and inspects digital content from the Internet. Id., 229-235.

. Id. See Blue Coats own documents (id.,

236-244), testimony of Messrs. Andersen, Harrison, Larsen, and Tomic (id., 245-247), and Dr.

Coles testing (id., 248).

Element 41(a) A computer-readable storage medium storing program code for causing a

data processing system on an inspector to perform the steps of: WebPulse includes computer-

readable medium storage, such as storage for software, which causes the data processing system on an

inspector, such as DRTR, to perform a number of computer steps that provide intelligence on web

threats. Id., 349-355. See Blue Coats own documents (id., 356-364), testimony of Messrs.

Andersen, Harrison, Whitchurch, and Tomic (id., 365-367), and Dr. Coles testing (id., 368).

Element 41(b) receiving a Downloadable: WebPulse includes software such as DRTR, for

receiving a Downloadable from an origin content server. Id., 369-372. See Blue Coats own

documents (id., 373-381), testimony of Messrs. Andersen, Harrison, Larsen, and Tomic (id., 382-



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

384), and Dr. Coles testing (id., 385).


Blue Coat does not dispute that elements 9(a)-(c), 9(e) and 10 of the 822 Patent, are present in

ProxySG. Ex. 29, Hicks Report, 85-134. As set forth below, Finjan has provided ample evidence

showing the presence of these elements, none of which Blue Coat has rebutted:

Element 9(a) A processor-based system, comprising: ProxySG is a hardware and software

product running on computers that utilize processors. Ex. 20, 441-443. See Blue Coats own

documents (id., 444-449), testimony of Mr. Tomic (id., 450), and Dr. Coles testing (id., 451).

Element 9(b) an information monitor for receiving downloadable-information: ProxySG

includes components that monitor traffic to an intranet of clients, receiving both requests for content

and the actual requested content. Id., 453. See Blue Coats own documents (id., 456-463),

testimony of Mr. Tomic (id., 464), and Dr. Coles testing (id., 465).

Element 9(c) - a content inspection engine communicatively coupled to the information

monitor for determining whether the downloadable-information includes executable code:

Id., 468. See Blue Coats own documents

(id., 471-491), testimony of Mr. Tomic (id., 492), Blue Coats source code (id., 493-497) and Dr.

Coles testing (id., 498).

Element 9(e) wherein the content inspection engine comprises one or more downloadable-

information analyzers : ProxySG includes a content inspection engine communicatively coupled to

the information monitor, which determines whether the downloadable-information includes executable

code. Id., 538-542.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. Id. See Blue Coats own documents (id., 543-561), testimony

of Mr. Tomic (id., 562), Blue Coats source code (id., 563-566) and Dr. Coles testing (id., 567).

Element 10 wherein at least one of the detection-indicators indicates a level of

downloadable-information characteristic and executable code characteristic correspondence:

See Blue Coats own documents (id., 577-595), testimony of Mr. Tomic (id., 596), and Blue

Coats source code (id., 597-600).


Blue Coat does not dispute that elements 8(a)-(c) and 14(a) of the 633 Patent, are present in

ProxySG, CAS and MAA. Ex. 29, Hicks Report, 139-228, 238-263. Finjan has provided ample

evidence showing the presence of these elements, none of which Blue Coat has rebutted:

Element 8(a) A computer processor-based system for computer security, the system

comprising: ProxySG, CAS, and MAA are hardware and software products that run on computers

utilizing processors. Id., 608-610. ProxySG enforces security policies at the gateway and can use

the CAS and MAA to detect and block malicious content. Id. See Blue Coats own documents (id.,

611-635), testimony of Messrs. Runald, Whitchurch, Tomic, Harrison, and Ahlander (id., 636-

640), and Dr. Coles testing (id., 641).

Element 8(b) an information monitor for receiving downloadable-information by a

computer: ProxySG, CAS, and MAA receiving downloadable-information. Id., 642-648.

Specifically, ProxySG, CAS and MAA, working as a system, receive Downloadable-information such

as webpages that can be passed between them. Id.

(id., 649-678), testimony of Messrs.

Runald, Whitchurch, Ahlander, and Tomic (id., 679-682), and Dr. Coles testing (id., 683).

Element 8(c) a content inspection engine communicatively coupled to the information



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

monitor for determining, by the computer, whether the downloadable-information includes executable

code:

. Id. See Blue Coats own documents (id., 694-733), testimony of

Messrs. Runald, Whitchurch, Ahlander, Tomic, and Harrison (id., 734-738), and Dr. Coles testing

(id., 739).

Element 14(a) A computer program product, comprising a computer usable medium having

a computer readable program code therein, the computer readable program code adapted to be

executed for computer security, the method comprising: ProxySG, CAS, and MAA are hardware and

software products that run on computers utilizing processors. Id., 847-849.

. Id.

See Blue Coats own documents (id., 850-871), testimony of Messrs. Runald, Whitchurch, Tomic,

Harrison (id., 872-875), and Dr. Coles testing (id., 876).


Blue Coat does not dispute that elements 1(a) and 1(c), 9, and 33(a)-(b), are present in

ProxySG, WebFilter and WebPulse. Ex. 19, 301-350, 405-453. As set forth below, Finjan has

provided ample evidence showing the presence of these elements, none of which Blue Coat has

rebutted:

Element 1(a) A policy-based cache manager, comprising:



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. Id. See Blue Coats own documents (id., 300-

319), testimony of Messrs. Andersen, Harrison, Ahlander, Larsen, and Tomic (id., 320-323), and Dr.

Mitzenmachers testing (id., 324).

Element 1(c) - a content scanner, communicatively coupled with said memory, for scanning a

digital content received, to derive a corresponding content profile: ProxySG includes WebFilter

components that interact with WebPulse to analyze unknown web pages. Id., 374-383.

. Id. See Blue Coats own documents (id., 384-

398), testimony of Messrs. Andersen, Harrison, Larsen, and Tomic (id., 399-402), Blue Coats

source code (id., 403-404), and Dr. Mitzenmachers testing (id., 405).

Element 9 wherein the plurality of policies are used for URL filtering: ProxySG includes

WebFilter components that interact with WebPulse, and together act as a policy-based cache manager

and for URL filtering. Id., 445-448.

. Id. See Blue Coats own

documents (id., 449-458), testimony of Messrs. Harrison, Andersen, Tomic, and Ahlander (id.,

459-462), Blue Coats source code (id., 462), and Dr. Mitzenmachers testing. (id., 463).

Element 33(a) A policy-based cache manager, comprising: ProxySG includes software that

runs on hardware systems for managing a cache of digital content based on policy decisions. Id.,

657-660. ProxySG includes WebFilter components that interact with WebPulse, and together act as

a policy-based cache manager. Id. See Blue Coats own documents (id., 661-679), testimony of

Messrs. Andersen, Harrison, Ahlander, Larsen, and Tomic (id., 680-683), and Dr. Mitzenmachers

testing (id., 684).



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Element 33(b) a memory for storing a cache of digital content, and a plurality of policies:

.

See Blue Coats own documents (id., 692-706), testimony of Messrs. Andersen, Harrison, Larsen,

Ahlander, and Tomic (id., 707-710), Blue Coats source code (id., 711-713), and Dr.



Blue Coat does not dispute that elements 9(a)-(b), 13, and 18(a)-(b) of the 780 Patent are

present in ProxyAV and ProxySG. Ex. 19, 143-170. As set forth below, Finjan has provided ample

evidence showing the presence of these elements, none of which Blue Coat has rebutted:

Element 9(a) A system for generating a Downloadable ID to identify a Downloadable,

comprising:

. See Blue Coats own documents

(id., 81-95), testimony of Messrs. Ahlander, Whitchurch, and Tomic (id., 96-98), Blue Coats

source code (id., 99-100), and Dr. Mitzenmachers testing (id., 101).

Element 9(b) a communications engine for obtaining a Downloadable that includes one or

more references to software components required to be executed by the Downloadable:

See Blue Coats own documents (id., 110-127), testimony of Messrs. Ahlander, Whitchurch, and



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Tomic (id., 128-130), Blue Coats source code (id., 131-132), and Dr. Mitzenmachers testing (id.,

133).

Element 13 wherein the Downloadable includes HTML code: ProxySG includes

components for receiving digital content from the Internet requested by a client, such as HTML code

and content. Id., 172-174.

. Id. See Blue Coats own documents (id., 175-181),

testimony of Messrs. Ahlander and Tomic (id., 182-183), Blue Coats source code (id., 184-185),

and Dr. Mitzenmachers testing (id., 186).

Element 18(a) A computer-readable storage medium storing program code for causing a

computer to perform the steps of:

. Id.,

187-190. See Blue Coats own documents (id., 191-193), testimony of Messrs. Ahlander,

Whitchurch, and Tomic (id., 194-196), Blue Coats source code (id., 197-198), and Dr.


Element 18(b) obtaining a Downloadable that includes one or more references to software

components required to be executed by the Downloadable:

. Id. See Blue Coats own

documents (id., 208-226), deposition testimony of Messrs. Ahlander, Whitchurch, and Tomic (id.,

227-229), Blue Coats source code (id., 230-231), and Dr. Mitzenmachers testing (id., 232).

Thus, because the elements set forth above are undisputed, summary judgment of infringement

of these elements should be granted.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

B. Summary Judgment Should be Granted for Elements for which Blue Coats Defense is Unsupportable

For the other elements, Blue Coat has no support for its noninfringement defense. For these

elements, Blue Coats experts Dr. Bestavros and Dr. Hicks have provided opinions that are directly

contradicted by Blue Coats own documents, source code and testimony. Thus, Finjan is entitled to

summary judgment of infringement with respect to each of these elements because no reasonable jury

could find that the elements are not met.

1. Security Profile and Suspicious Code Elements

Claims 1(c), 15(c) and 41(c) of the 844 Patent contain the claim element: generating a first

Downloadable security profile that identifies suspicious code in the received Downloadable. Claim

11 includes the element wherein the first Downloadable security profile includes a list of operations

deemed suspicious by the inspector, and Claim 16 includes the element wherein the first rule set

includes a list of suspicious operations. Claim 1(b) of the 731 Patent includes a scanner for deriving

security profiles for incoming files from the Internet, wherein each of the security profiles comprises

a list of computer commands that a corresponding one of the incoming files is programmed to

perform. Claim 1(d) of the 731 Patent includes a security profile cache for storing the security

profiles derived by the scanner. These elements are referred to collectively herein as the Security

Profile and Suspicious Code Elements.

.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. As a result of this

unequivocal evidence, there is no genuine issue of fact that WebPulse generates a security profile

which identifies suspicious code, thus satisfying the Security Profile and Suspicious Code Elements.

2. Linking Element

Claims 1(d), 15(c) and 41(d) of the 844 Patent each contain the claim element requiring:

linking by the inspector the first Downloadable security profile to the Downloadable before a web

server makes the Downloadable available to web clients . . . . (the Linking Element).

In rebuttal, Dr. Bestavros simply disagrees with Finjans argumentsbut puts forth no

analysis and no evidence disputing Finjans arguments regarding the timing of the linking of the

security profile. Such unsupported conclusions cannot create a material issue of fact in light of the

concrete evidence. As such, Finjan is entitled to summary judgment with regard to the Linking

Element.

3. Rule Set Element

Claim 15(b) of the 844 Patent requires: memory storing a first rule set (the Rule Set

Element).

.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. Blue Coats Rule 30(b)(6) witness and documents demonstrate

that WebPulse uses rule sets. See, e.g., id., 250-252, 283-284.

.

4. Mobile Protection Code Element

Claims 9(d) of the 822 Patent and Claim 8 of the 633 Patent each contain the claim element

causing a mobile protection code to be communicated to the information destination (the Mobile

Protection Code Element).

. All of these scenarios are fully supported by

the testimony of Blue Coats 30(b)(6) witnesses, documents, and source code. See, e.g., Ex. 20, 499-



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

509, 525-531, 745-758, 798-805, 808-812. As such, Blue Coat and cannot raise any genuine factual

dispute that the Mobile Protection Code Element is met because any such assertions are contrary to the

factual evidence in this case.

5. Providing an Information Re-Communicator and a Mobile Code Executor Element

Claim 14(b) of the 633 Patent contains the claim element providing a system, wherein the

system comprises distinct software modules, and wherein the distinct software modules comprise an

information re-communicator and a mobile code executor. There can be no doubt that ProxySG, CAS

and MAA are computer software systems which contain distinct software modules. Ex. 25, Tomic Tr.

at 16:12-17:8, 18:18-19:13; Ex. 40, Runald Tr. at 10:17-12:5; Ex. 30, Ahlander Tr. at 96:21-97:5; Ex.

27 at BC0182646; Ex. 41 at BC0182658; Ex. 32 at BC0182641.

. See Blue Coats

own documents (Ex. 20, 884-907), testimony of Messrs. Runald, Whitchurch, Ahlander, Tomic,

Harrison (id., 908-912), and Dr. Coles testing (id., 913). As such, there is no genuine issue of

material fact that Blue Coat satisfies this element.

6. Receiving Downloadable Information Element

Claim 14(c) of the 633 Patent contains the claim element receiving, at the information re-

communicator, downloadable-information including executable code. ProxySG, CAS, and MAA

include components that receive downloadable-information with executable code. Id., 915-921.

.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

See Blue Coats own documents (id., 922-959), testimony of Messrs. Runald, Whitchurch, Ahlander,

Tomic, Harrison (id., 960-964), and Dr. Coles testing (id., 965). Thus, the facts are unequivocal

that this element is met.

7. Causing Mobile Protection Code to be Executed Element

Claim 14(d) of the 633 Patent contains the claim element causing mobile protection code to

be executed by the mobile code executor at a downloadable-information destination such that one or

more operations of the executable code at the destination, if attempted, will be processed by the mobile

protection code.

. See Blue Coats own documents (id., 974-1007), testimony of Messrs. Runald,

Whitchurch, Ahlander, Tomic, Harrison (id., 1008-1012), and Dr. Coles testing (id., 1013). Thus,

Blue Coat cannot raise a genuine issue of material fact for this element as any such position is directly

contrary to Blue Coats own documents and witnesses.

8. Computer Gateway Element

Element 1(a) of the 731 patent includes the preamble of [a] computer gateway for an intranet

of computers (the Computer Gateway Element).



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

. Because the evidence and testimony of Blue Coats expert confirms

that the Computer Gateway Element is met, Finjan should be granted summary judgment.

9. File Cache Element

Claim 1(c) of the 731 Patent requires a file cache for storing files that have been scanned by

the scanner for future access, wherein each of the stored files is indexed by a file identifier, and Claim

1(d) of the 731 Patent contains the claim element wherein each of the security profiles is indexed in

the security profile cache by a file identifier associated with a corresponding file stored in the file

cache (the File Cache Element). The specification of the 731 Patent states that in a preferred

embodiment, the web page and the web objects that the page references are stored in a web cache

160. Ex. 15, 731 Patent at 6:57-58.

. This is supported by the deposition of Blue Coats Rule 30(b)(6) witness

and documents. See e.g., id., 857-861, 878-879. There is no dispute that ProxySG caches webpages.

Ex. 25, Tomic Tr. at 159:6-9. Thus, Blue Coat does not, and cannot, raise any factual dispute that the

File Cache Element is met.

10. Security Policy Cache Element

Element 1(e) is of the 731 Patent is a security policy cache for storing security policies for

intranet computers within the intranet, the security policies each including a list of restrictions for files

that are transmitted to a corresponding subset of the intranet computers (Security Policy Cache

Element). This element is met because:



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Id., BC0160145. Blue Coat provides no analysis or

evidence to contradict this undisputable evidence and thus there is no genuine issue of fact.

11. Policy Index Element

Claims 1, 9 and 33 of the 968 patent each contain the claim element requiring a policy index

(the Policy Index Element), which was agreed to be a data structure indicating allowability of

cached content relative to a plurality of policies.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Ex. 25, Tomic Tr. at 106:4-15, 122:1-4, 128:22-129:8 (emphasis added). Blue Coat does not dispute

that Finjan accurately described the functionality of ProxySG, or the testimony of Blue Coats Rule

30(b)(6) witness, and thus, summary judgment should be granted.

12. Hashing Element

Claims 9(c) and 18(d) of the 780 Patent contain the claim element: performing a hashing

function on the Downloadable and the fetched software components to generate a Downloadable ID

which the parties agreed is construed as performing a hashing function on the Downloadable together

with its fetched software components. Dkt. 118. In addition, Claim 18(c) contains the element

fetching at least one software component identified by the one or more references. (The Hashing

Element.)

Because Blue Coat has not provided a supportable defense for the twelve elements above, there

is no genuine issue of material fact regarding the presence of these elements in the accused products.

Thus, summary judgment of infringement should be granted for all of the Asserted Claims.

VI. CONCLUSION

For the foregoing reasons, Finjan is entitled to summary judgment of the Asserted Claims, or,

in the alternative, partial summary judgment of the Undisputed Elements.



1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Dated: March 12, 2015

Respectfully submitted, By: /s/ James Hannah

Paul J. Andre (SBN 196585) Lisa Kobialka (SBN 191404) James Hannah (SBN 237978) KRAMER LEVIN NAFTALIS & FRANKEL LLP 990 Marsh Road Menlo Park, CA 94025 Telephone: (650) 752-1700 Facsimile: (650) 752-1800 [email protected] [email protected] [email protected] Attorneys for Plaintiff FINJAN, INC.


Documents

FNJN SJ