Citations
- 283 F. Supp. 3d 839
Full opinion text
BETH LABSON FREEMAN, United States District Judge
Before the Court are the parties' respective motions for summary judgment. Plaintiff Finjan, Inc. ("Finjan") seeks summary judgment that Defendant Blue Coat Systems, Inc.'s ("Blue Coat") Internet security software products infringe one of its patents and that several of its patents are not invalid. Blue Coat seeks summary judgment that certain of its products do not infringe several of Finjan's patents. After careful consideration, Finjan's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART and Blue Coat's Motion for Summary Judgment is GRANTED IN PART and DENIED IN PART.
I. BACKGROUND
A. The Technology and the Asserted Patents
Finjan asserts ten patents against Blue Coat: U.S. Patent No. 8,677,494 ("the '494 patent") ; U.S. Patent No. 8,566,580 ("the '580 patent") ; U.S. Patent No. 8,079,086 ("the '086 patent") ; U.S. Patent No. 8,225,408 ("the '408 patent") ; U.S. Patent No. 6,154,844 ("the '844 patent") ; U.S. Patent No. 6,965,968 ("the '968 patent") ; U.S. Patent No. 7,418,731 ("the '731 patent") ; U.S. Patent No. 9,141,786 ("the '786 patent") ; U.S. Patent No. 9,189,621 ("the '621 patent") ; and U.S. Patent No. 9,219,755 ("the '755 patent") (collectively, "the Asserted Patents"). Broadly speaking, the patents relate to two technology areas: (1) content-based security, and (2) secure sockets layer ("SSL") communication.
i. Content-Based Security
At a high level, content-based security identifies, isolates, and neutralizes actually or potentially malicious code in files downloaded from the Internet based on the detected behavior and characteristics of the code in those files, rather than scanning and maintaining a list of known viruses and actual malicious code signatures.
The '844 patent claims a system and methods of network protection where an inspector reviews a "Downloadable" for suspicious code or behavior according to a set of rules. '844 patent, col. 2 ll. 3-19. A "Downloadable" is "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 180 at 1. The inspector generates a profile characterizing the areas of suspicion and then attaches that profile to the Downloadable. Id. By providing verifiable profiles, the object of the invention is to provide flexible, efficient protection against known and unknown hostile Downloadables without having to re-inspect the same Downloadable each time. Id. , col. 2 l. 61-col. 3 l. 7.
The '494 patent also relates to inspecting a "Downloadable" for suspicious behavior. '494 patent, Abstract. Its claims, however, are directed to a narrower aspect of this, which involve the solution of: (1) intercepting an incoming Downloadable; (2) scanning the Downloadable and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable;" and (3) storing the "security profile data" in a "database." Id. , col. 21 l. 20, col. 22 l. 8.
The '086 patent also concerns a discrete aspect of inspecting a "Downloadable" for suspicious behavior. '086 patent, Abstract. Similar to the '494 patent, its claims recite (1) receiving an incoming Downloadable and (2) scanning it and deriving "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable." Id. , col. 22 ll. 9-15. However, instead of storing the "security profile data" in a database, the '086 patent claims "transmitting the Downloadable and a representation of the Downloadable security profile data to a destination computer." Id. , col. 22 ll. 16-20.
The '731 patent describes systems and methods of operating computer and network gateways that protect an intranet of computers. '731 patent, Abstract. The claimed inventions provide for caching of security information and policies at the gateway. Id. This caching of specific types of security profiles and security policies mitigates network latency-delay in the transmission of data-caused when the gateway processes downloadable information to protect intranet devices. Id. , col. 1 ll. 55-67.
The '968 patent is directed to policy-based caching, and more specifically to the management of multiple caches. '968 patent, Abstract. Content from the Internet can be cached so that the same web page does not have to be retrieved each time a user on the network requests the page. See id. , col. 3 ll. 34-40. However, users on the same network can also have different security policies-sets of rules that govern whether a file is allowed through the security filter. Id. , col. 4 ll. 14-19. The '968 patent provides a system and method of managing cached content in relation to multiple security policies by, inter alia, providing a "policy-based index ... indicating allowability of cached content relative to a plurality of policies" that can be easily utilized by a cache manager to determine whether cached content is allowable for different requesting users. Id. , col. 1 l. 63-col. 2 l. 11.
The '786 patent provides systems and methods for protecting devices on an internal network from code, applications, and/or information downloaded from the Internet that performs malicious operations. '786 patent, Abstract. At a high level, the disclosed embodiments describe a protection engine that generally resides on a network server and inspects incoming downloads for executable code. Id. , col. 2 l. 20-col. 3 l. 4. Upon detection of executable code, the protection engine deploys "mobile protection code" ("MPC") and protection policies to the download destination. Id. , col. 3 ll. 5-21. MPC is "code that, at runtime, monitors or intercepts actually or potentially malicious code operations." ECF 180 at 1;
see also Blue Coat I , ECF 118 at 5. At the destination, the downloadable-information is executed, typically within a sandboxed environment, and malicious or potentially malicious operations that run or attempt to run are intercepted and neutralized by the MPC according to set protection policies. Id. , col. 3 ll. 22-40.
The '621 and '755 patents relate to the use of operating system probes to monitor the behavior of a system during runtime. '621 patent, col. 21 ll. 33-53; '755 patent, col. 22 ll. 30-63. Certain detected information or operations can be compared against a security policy and, as appropriate, trigger responsive action. Id.
The '408 patent is directed towards using a "parse tree" to scan content to detect malicious code, known as exploits. '408 patent, Abstract. A "parse tree" is "a hierarchical structure of interconnected nodes built from scanned content." ECF 180 at 2. When the system of the '408 patent receives an incoming stream of content to be scanned, it sequentially reads in tokens from the stream, organizes the tokens into a parse tree, and analyzes the tree to determine if it contains any patterns/structures that indicate the existence of an exploit. See generally '408 patent, col. 6 l. 14-col. 9 l. 58. To do this, it uses tokenizer, parser, and analyzer components which are specific to a particular "programming language" or "content language." Id. , col. 2 ll. 8-13, col. 6 ll. 17-26. This allows the '408 patent to provide "a multitude of content scanners within a unified framework." Id. , col. 15 ll. 41-43.
ii. Secure Sockets Layer ("SSL") Communication
SSL is a protocol that is used to send encrypted, secure communications between a client and a server. Id ., col. 1 ll. 10-12. In order to set up a secure SSL connection, the client and the server must first perform a series of initial exchanges, commonly referred to as the "SSL handshake." Ex. 5 to Blue Coat Mot. at BC2-0024371, ECF 225-5; Ex. 21 to Blue Coat Mot. at 16:11-19:15, ECF 226-24; Ex. 17 to Finjan Opp. at BC2-0778678, ECF 240-26. The handshake begins when the client sends a request to initiate an SSL connection, or a "client hello." Id. The server then sends the client a certificate verifying its identity and the server's public key, which the client can use to encrypt the information it sends to the server. Id. The encrypted information can be decrypted by a private key, which only the server knows. Id. After this exchange of information, the client and server share an SSL connection because the client can send encrypted information (using the server's public key) which only the server knows how to de-crypt. See id.
The '580 patent relates to methods and systems for efficiently providing an SSL connection between a client and server where one or several intermediate gateway computers lie in the transmission path. '580 patent, Abstract. Prior art solutions enabled SSL communication between a client and a server in these networks by maintaining an SSL connection at every step in the transmission chain:
Id. , Fig. 1(c), col. 1 ll. 21-37. Unfortunately, the additional SSL connections meant "additionally degrade[d] performance and cause[d] additional latency."Id. , col. 1 ll. 35-37.
The '580 patent purports to solve this problem by "splitting" the SSL connection between the client and the server, so that the client and the server can communicate using SSL without requiring an SSL connection throughout: Id. , Fig. 2., col. 3 l. 62-col. 4 l. 5.
Setting up this split SSL connection works as follows: a client sends a request to initiate an SSL connection (i.e., a "client hello"), which gets received by the next computer in the chain, the first security computer. Id. , col. 4 ll. 36-38, col. 5 ll. 28-30. The first security computer passes this request to the intermediate third party gateway computer, which passes it to the second security computer, which passes it to the server. Id. , col. 4 ll. 37-57, col. 5 ll. 30-64. Once the server receives the request, it responds with its certificate (which includes its public key). Id. , col. 4 ll. 57-60, col. 5 ll. 64-67. This response is received by the second security computer, which passes it to the third party gateway computer, which passes it to the first security computer. Id. , col. 4 l. 65-col. 5 l. 2; col. 6 ll. 24-27. (Specifically, the second security computer does this by appending the server certificate attributes to a header in a CONNECT reply message, which it sends to the third party gateway computer, which the sends it to the first security computer. Id. , col. 4 l. 60-col. 5 l. 1, col. 6 ll. 12-14.) The first security computer then creates its own "proxy signed certificate" "using the attributes of the server certificate" with its own public key, and then passes it off to the client. Id. , col. 5 ll. 3-10, col. 6 ll. 36-40.
The end result is a system that, in operation, works as follows: the client will encrypt information using the first security computer's public key (received from the "proxy signed certificate"). See id. The first security computer will then decrypt that information and re-encrypt it with the server's public key. See id. , col. 4 l. 65-col. 5 l. 2; col. 6 ll. 24-27. This encrypted information will then be passed to the third party gateway computer, which passes it to the second security computer, which passes it to the server. See id. , col. 4 ll. 57-60, col. 5 ll. 64-67. The server will then decrypt it using its private key. See id. Thus, even though there is an intermediate third party gateway computer, information is only encrypted with a recipient's public key twice-hence, only two SSL connections. See id. , col. 1. l. 65-col. 2 l.4.
A final aspect of this system is that the first security computer maintains a cache of the server certificates it receives, so that the second security computer does not always have to send server certificates to the first security computer. Id. , col. 5 ll. 14-16. During the SSL handshake, when the client sends a request to initiate an SSL connection with a specific server and that request is first received by the first security computer, the first security computer will check its certificate cache to see if it already has a certificate for that server. Id. , col. 5 ll. 30-33. If it does, it will append a "fingerprint or hash of the certificate server" to the SSL connection request that it sends (directly or indirectly through third party gateway computer(s)) to the second security computer. Id. , col. 5 ll. 33-39. The second security computer will then also generate a "fingerprint or hash" of the server it receives from the certificate and check to see if it matches what it received from the first security computer. Id. , col. 6 ll. 3-8. If it does, the second security computer will skip the step of appending the server's certificate to its reply message. Id. , col. 6 ll. 17-19. If it does not, the second security computer will send the server's certificate to the first security computer, as described above. Id. , col. 6 ll. 8-14. The first security computer will then use this information to update its certificate cache, as necessary. Id. , col. 6 ll. 28-35.
B. Accused Products
Finjan accuses Blue Coat's ProxySG, Content Analysis System ("CAS"), Advanced Secure Gateway ("ASG"), Web Security Service ("WSS"), SSL Visibility Appliance ("SSLV"), Malware Analysis Appliance ("MAA"), and WebPulse service of infringing various claims of the asserted patents. ProxySG is a proxy server that provides, among other things, web security through policy control. CAS is a content inspection appliance that ProxySG can use for additional analysis of files. ASG is a single appliance that combines the functionality of ProxySG and CAS. WSS is a product that combines the functionality of ProxySG and CAS as a web-hosted service.
SSLV is a stand-alone appliance that performs SSL inspection, decryption, and management. It can be deployed by itself in a network or in-line with other appliances, such as a ProxySG. Finjan accuses a configuration where SSLV is deployed in-line with ProxySG of infringing the '580 patent.
MAA is an appliance that provides a customizable sandboxing environment. It can integrate with CAS (which, in turn, can integrate with ProxySG) or ASG. Finjan accuses a combination of ProxySG, CAS, and MAA, as well as a combination of ASG and MAA, of infringing the '844, '731, '968, '494, '621, '755, and '786 patents. Blue Coat also offers MAA functionality as a cloud-based service, referred to as MAS, which can be used in conjunction with WSS. Finjan accuses a combination of WSS and MAS of infringing the '844, '731, '968, '086, '494, '621, and '755 patents.
WebPulse is a cloud-based infrastructure that categorizes web pages and runs background processes, some of which look for evidence of malware activity. It is provided as part of Blue Coat's Global Intelligence Network ("GIN"), which is an umbrella name for Blue Coat's suite of intelligence services. WebPulse contains a real-time content analyzer component called the Dynamic Real-Time Rating ("DRTR") service. WebPulse or "WebPulse/GIN," either alone or in combination with WSS, is accused of infringing all of the Asserted Patents except for the '580 patent.
As helpfully provided by the parties, the following chart illustrates the patents, asserted claims, and accused products and product combinations at issue:
Patent Asserted Claims Accused Products '844 1, 7.15 WebPulse/GIN, WSS with WebPulse/GIN, WSS with ALAS: ASG with MAA. SA with MAA '731 1, 2 ASG with MAN, WSS with WebPulse/GIN, WSS with MAS '968 1 ASG with MAA, WSS with WebPulse/GIN, WSS with MAS '986 24 WebPulse/GIN, WSS with WebPulse/GIN, WSS with MAS, SA with MAA '494 10, 14, 16 WebPulse/GIN, WSS with WebPulse/GIN, WSS with MAS: ASG with MAA, ProxySG and CAS with MAA; SA with MAA '621 1, 10 WebPulse/GIN, WSS with MAS; ProxySG and CAS with MAA, ASG with MAA '755 3 ProxySG and CAS with MAA, ASG with MAA '786 1 WebPulse/GIN, WSS with MAS, ProxySG and CAS with MAA, ASG with MAA '580 1 SSLVA with ProxySG '408 22 WebPulse, WSS with WebPulse
C. Procedural History
The parties in this dispute are neither unfamiliar with each other nor this Court. On August 28, 2013, Finjan initiated a first patent infringement action, Case No. 5:13-CV-03999-BLF ("Blue Coat I "), against Blue Coat, alleging that Blue Coat infringed the '844, '968, and '731 patents, as well as U.S. Patent Nos. 6,804,780 ("the '780 patent"), 7,058,822 ("the '822 patent"), and 7,647,633 ("the '633 patent"). The parties tried all six patents before a jury who, on August 4, 2015, found that Blue Coat infringed the '844, '968, '731, '633, and '780 patents and awarded Finjan a total of $39,528,487 in lump-sum damages. Blue Coat I , ECF 438 at 2-3, 6-7. The Court entered final judgment on July 18, 2016. Blue Coat I , ECF 556.
On July 7, 2015, five days before the beginning of trial in Blue Coat I , Finjan initiated the instant suit. ECF 1. The parties have amended their pleadings several times. ECF 39, 46, 47, 62, 63, 65, 155, 161, 171.
On July 28, 2016, ten days after the Court entered final judgment in Blue Coat I , Finjan moved for a preliminary injunction, seeking to enjoin Blue Coat's alleged infringement of the '494 patent through the DRTR component. ECF 71. The Court denied Finjan's motion. ECF 149. On September 16, 2016, Blue Coat moved for judgment on the pleadings that the '494 patent was invalid for failure to claim patent-eligible subject matter under 35 U.S.C. § 101. ECF 104. The Court also denied that motion. ECF 156.
On January 31, 2017, the parties filed a joint stipulation notifying the Court that they had resolved all pending claim construction disputes and stipulating to certain agreed-upon constructions for six terms. ECF 175. The Court granted the parties' stipulation. ECF 178. The parties have since filed a further stipulation stating that they agree that certain additional terms should be given their plain and ordinary meaning. ECF 270.
The parties filed the instant motions for summary judgment on May 17, 2017. ECF 224, 228. The Court heard argument on June 22, 2017. ECF 273.
II. LEGAL STANDARDS
Federal Rule of Civil Procedure 56 governs motions for summary judgment. Summary judgment is appropriate if the evidence and all reasonable inferences in the light most favorable to the nonmoving party "show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Celotex Corp. v. Catrett , 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). The current version of Rule 56 authorizes a court to grant "partial summary judgment" to dispose of less than the entire case and even just portions of a claim or defense. See Fed. R. Civ. P. advisory committee's note, 2010 amendments; Ochoa v. McDonald's Corp. , 133 F.Supp.3d 1228, 1232 (N.D. Cal. 2015). As such, a court can, "when warranted, selectively fillet a claim or defense without dismissing it entirely." Id.
The moving party "bears the burden of showing there is no material factual dispute," Hill v. R+L Carriers, Inc. , 690 F.Supp.2d 1001, 1004 (N.D. Cal. 2010), by "identifying for the court the portions of the materials on file that it believes demonstrate the absence of any genuine issue of material fact." T.W. Elec. Serv. Inc. v. Pac. Elec. Contractors Ass'n , 809 F.2d 626, 630 (9th Cir. 1987). In judging evidence at the summary judgment stage, the Court "does not assess credibility or weigh the evidence, but simply determines whether there is a genuine factual issue for trial." House v. Bell, 547 U.S. 518, 559-60, 126 S.Ct. 2064, 165 L.Ed.2d 1 (2006). A fact is "material" if it "might affect the outcome of the suit under the governing law," and a dispute as to a material fact is "genuine" if there is sufficient evidence for a reasonable trier of fact to decide in favor of the nonmoving party. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986).
Where the moving party will have the burden of proof on an issue at trial, it must affirmatively demonstrate that no reasonable trier of fact could find other than for the moving party. Celotex , 477 U.S. at 325, 106 S.Ct. 2548 ; Soremekun v. Thrifty Payless, Inc., 509 F.3d 978, 984 (9th Cir. 2007). Once the moving party meets its initial burden, the nonmoving party must set forth, by affidavit or as otherwise provided in Rule 56, "specific facts showing that there is a genuine issue for trial." Liberty Lobby, 477 U.S. at 250, 106 S.Ct. 2505 (internal quotation marks omitted). If the nonmoving party's "evidence is merely colorable, or is not significantly probative, summary judgment may be granted." Id. at 249-50, 106 S.Ct. 2505 (internal citations omitted). Mere conclusory, speculative testimony in affidavits and moving papers is also insufficient to raise genuine issues of fact and defeat summary judgment. See Thornhill Publ'g Co. v. GTE Corp., 594 F.2d 730, 738 (9th Cir.1979). For a court to find that a genuine dispute of material fact exists, "there must be enough doubt for a reasonable trier of fact to find for the [non-moving party]." Corales v. Bennett , 567 F.3d 554, 562 (9th Cir. 2009).
III. FINJAN'S MOTION
Finjan seeks summary judgment that WebPulse/GIN and certain combinations of gateway products-(1) ProxySG and CAS with MAA and (2) ASG with MAA-infringe claim 10 of the '494 patent. Finjan also seeks summary judgment that its patents are not invalid because:
(1) Blue Coat did not challenge the validity of the '731 and '580 patents in its expert reports; (2) Blue Coat is estopped under 35 U.S.C. § 315(e)(2) from challenging the validity of the '494 and '408 patents ; (3) Blue Coat is estopped from challenging the validity of the '844, '968, and '731 patents because of Blue Coat I ; (4) the Patent Trial and Appeals Board ("PTAB") declined to institute IPR for the '844, '968, '731, and '086 patents under a lower evidentiary standard; and (5) Blue Coat cannot establish that several pieces of the alleged prior art were publicly available in the United States before the priority date of the asserted patents. The Court addresses each issue in turn.
A. The '494 Patent
Finjan accuses WebPulse/GIN, ProxySG and CAS with MAA, and ASG with MAA of infringing claim 10 of the '494 patent. Claim 10 recites:
10. A system for managing Downloadables, comprising:
a receiver for receiving an incoming Downloadable;
a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable; and
a database manager coupled with said Downloadable scanner, for storing the Downloadable security profile data in a database.
'494 patent, col. 22 ll. 7-17. A "Downloadable" is "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 180 at 1. A "database" is "a collection of interrelated data organized according to a database schema to serve one or more applications." Id.
i. WebPulse/GIN
Finjan seeks summary judgment that "WebPulse/GIN" infringes claim 10. The parties only substantially dispute whether WebPulse/GIN satisfies the final two limitations of claim 10. According to Finjan, WebPulse/GIN has "a Downloadable scanner ... for deriving security profile data ..." because DRTR scans and profiles content, [Redacted] Finjan Mot. 7-8. Finjan argues the "database manager ... for storing the Downloadable security profile data in a database" limitation is satisfied by either of two components: [Redacted] Finjan Mot. 8-9; see also Ex. 26 to Finjan Mot. (Cole Rpt.) ¶¶ 1464-70, ECF 227-6. Under Finjan's infringement theory, [Redacted ] Id. ; Ex. 30 to Finjan Mot., ECF 227-14.
Blue Coat, on the other hand, disagrees that some of the alleged "security profile data," [Redacted] "includ[es] a list of suspicious computer operations." Blue Coat Opp. 3-5. Blue Coat also argues there are at least disputed issues of fact as to whether the alleged [Redacted] are "databases." Id. at 5-7. With respect to the [Redacted] Blue Coat argues that it does not store a "list of suspicious operations" [Redacted] Id. at 5-7. [Redacted] Blue Coat argues that it does not store a "list of suspicious computer operations" [Redacted] does not "includ[e] a list of suspicious computer operations." Id. at 7. As support for these arguments, Blue Coat cites almost exclusively to the report and testimony of its expert, Dr. Nielson. Id. at 3-7.
The Court agrees that summary judgment is inappropriate, at least for the reason that disputed questions of fact remain as to whether the "database manager ..." limitation is satisfied by either [Redacted] the Court notes, as an initial matter, that the parties appear to disagree as to the scope of "database:" Finjan argues that "database" encompasses key-value pairings [Redacted] whereas Blue Coat argues it does not. Compare Finjan Mot. 8-9, Finjan Reply 4-5, with Blue Coat Opp. 6-7. On this point, the Court agrees with Finjan that key-value pairing can be a "database" within the context of the '494 patent. The parties stipulated that "database" should be construed as "a collection of interrelated data organized according to a database schema." ECF 180 at 1. Key-value pairings are a way of organizing interrelated data-keys to their related values. To the extent that "schema" implies a greater level of organization and/or relation between data than this, the Court finds it inappropriate to restrict the scope of "database" in this way. The plain language of claim 10 simply recites "database," and nothing in the specification suggests that "database" should be restricted to any certain degree of data organization. See Phillips v. AWH Corp. , 415 F.3d 1303, 1312 (Fed. Cir. 2005) ("[T]he words of a claim are generally given their ordinary and customary meaning.") (internal citation and quotation marks omitted). Indeed, the specification contrasts "database" with single-dimensional data structures (i.e., that have no interrelation) such as "list" or "array," but it provides no further clarification. '494 patent, col. 10 l. 11 ("list, array, database, etc."); id. , col. 17 l. 11 ("list, database or other storage structure(s) or storage structure configuration(s)"). Blue Coat cannot artificially restrict "database" through a one-sided interpretation of the parties' stipulation.
Nevertheless, [Redacted] disputed questions of fact remain as to whether it satisfies the remainder of the limitation. Claim 10 requires that the "database" store "security profile data," which must include a "list of suspicious computer operations." The parties disagree as to whether [Redacted] See Ex. 30 to Finjan Mot. at BC2-1884319, ECF 227-14. On one hand, Blue Coat's engineer testified that [Redacted]
[Redacted]
Ex. 3 to Finjan Reply at 66:8-22, ECF 249-10. However, construing this evidence in the light most favorable to Blue Coat, this excerpt only suggests that [Redacted] Further, the parties' experts appear to disagree as to whether the source code confirms that [Redacted] Compare Ex. 26 to Finjan Mot. (Cole Rpt.) ¶¶ 1276, 1465-66, ECF 227-6 [Redacted] with Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 318, ECF 227-8 [Redacted] Thus, based on the evidence before it, the Court cannot rule out that there are no material factual disputes as to whether [Redacted] is an infringing "database." As such, summary judgment of infringement is inappropriate.
[Redacted] the parties do not dispute that this constitutes a "database." Compare Finjan Mot. 9, Finan Reply 4, with Blue Coat Opp. 7. The parties also do not substantially disagree as to what [Redacted] Compare Finjan Mot. 9-10, with Blue Coat Opp. 7-8; see also Ex. 26 to Finjan Mot. (Cole Rpt.) ¶ 1469, ECF 227-6; Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 319, ECF 227-8. Instead, the parties dispute whether PDF Labels and YARA rule hits constitute "security profile data ... including a list of suspicious operations." Both of these issues are factual questions for the jury. For example, with respect to PDF Labels, Blue Coat's own expert acknowledges that at least some of the labels that can be assigned to PDFs indicate the existence of certain operations within the PDF. See, e.g Ex. 27 to Finjan Mot. (Nielson Rpt.) ¶ 141, ECF 227-8 [Redacted] However, whether these are suspicious operations, whether PDF Labels are sufficiently comprehensive to amount to a "security profile data ... including a list of suspicious operations," and other open factual questions remain. Similarly, with respect to YARA rule hits, [Redacted] See, e.g. , Ex. 31 to Finjan Mot. at BC2-1884474, ECF 227-16. However, whether these are suspicious operations, whether YARA rules are sufficiently comprehensive to amount to a "security profile data ... including a list of suspicious operations," and/or [Redacted] amounts to a "security profile data ... including a list of suspicious operations," and other open factual questions remain. Accordingly, material disputes as to whether [Redacted] is an infringing "database." As such, summary judgment of infringement is inappropriate.
In sum, material questions of fact remain at least as to whether the WebPulse/GIN infringes the "database manager ..." limitation of claim 10. Finjan's motion for summary judgment is DENIED.
ii. Gateway Products
Finjan also seeks summary judgment that "the accused combinations of gateway products-(1) ProxySG and CAS with MAA and (2) ASG with MAA-infringe claim 10. The parties only substantially dispute whether the accused combinations satisfy the final limitation of claim 10. Finjan argues that this limitation is satisfied by any one of three components: [Redacted] Finjan Mot. 11-14.
Blue Coat responds that there is at least a material factual dispute as to whether any of these components are infringing "databases." Specifically, [Redacted] Blue Coat argues that it does not "stor[e] ... security profile data" which "includ[es] a list of suspicious operations" [Redacted] Blue Coat Opp. 8-10. With respect to the [Redacted] Blue Coat argues that it also does not "stor[e] ... security profile data" [Redacted] Id. at 10-11. With respect to [Redacted] Blue Coat argues that this cannot be a "database" that is part of a "system for managing Downloadables" because it is instead only used [Redacted] Id. at 11-13. Blue Coat points out that this is underscored by the fact that [Redacted] which is an unacceptable substitute for the required "security profile data." Id. at 12.
The Court addresses each of Blue Coat's challenges in turn. Turning to [Redacted] the Court agrees with Blue Coat that there are at least disputed questions of material fact as to whether this comprises a "database" that "stor[es] ... security profile data." By the plain language of claim 10, "security profile data" must "includ[e] a list of suspicious operations." Reading this limitation in light of the specification makes it clear that the "security profile data" must include (in addition to, for example, other types of metadata) a selective list of suspicious operations, not an indiscriminate list of all operations. See, e.g. , '194 patent at col. 9 ll. 34-37 (describing how "if the code scanner ... determines that the resolved command is suspect, then the code scanner ... decodes and registers the suspicious command and its command parameters as DSP data"). Indeed, Finjan has itself taken a similar position before the PTAB. See Ex. 4 to Blue Coat Opp. at 16, ECF 237-4 ("Simply listing every operation, regardless of whether it is suspicious, does not create a list of suspicious computer operations without the additional step of deeming certain operations as suspicious."). Whether [Redacted] meets this bar is at least a disputed question of fact. On one hand, Mr. Runald, a Blue Coat employee, [Redacted] Ex. 4 to Finjan Reply at 201:19-202:9, ECF 249-12. On the other hand [Redacted] are not themselves "suspicious operations." For example, [Redacted] See Ex. 8 to Blue Coat Opp. at 56:1-5, 197:1-4, ECF 238-11; Ex. 6 to Blue Coat Opp. at BC2-0070332, ECF 237-6; Ex. 7 to Blue Coat Opp. at BC2-0426163, ECF 238-10. Thus, the Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
Turning to [Redacted] the Court also finds that there are material questions of fact as to whether this is a "database" which "stor[es] ... security profile data" within the meaning of claim 10. For example, [Redacted] Ex. 45 to Finjan Mot. at BC2-1895322, ECF 227-34. However, pattern data used for matching is not the same as matches of suspicious operations that have been located for a particular file. Further, [Redacted] See, e.g. , Ex. 8 to Blue Coat Opp. at 210:16-22, ECF 238-11 [Redacted] Ex. 9 to Blue Coat Opp. at 29:3-11, ECF 238-12 [Redacted] Thus, there are at least disputed questions of fact as to whether [Redacted] "stor[es] ... security profile data" which includes a "list of suspicious operations," not all operations. Accordingly, the Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
Turning to the [Redacted] the Court also finds that there are material questions of fact as to whether this comprises a "database" that "stor[es] ... security profile data." For example, [Redacted] Ex. 48 to Finjan Mot. at 90:8-18, ECF 227-36; see also Ex. 6 to Finjan Reply at 253:15-17. However, there is conflicting evidence as to whether these patterns amount to a "list of suspicious operations." See, e.g. , Ex. 5 to Finjan Reply at 48:20-25, ECF 249-16 [Redacted] Accordingly, this is a factual dispute that must be left for the jury. The Court cannot grant summary judgment on the basis that [Redacted] is the infringing "database."
In sum, material questions of fact remain at least as to whether the accused combinations of gateway products infringe the "database manager ..." limitation of claim 10. Finjan's motion for summary judgment is DENIED.
B. Validity
i. '731 and '580 Patents : Lack of Expert Opinion
Finjan moves for summary judgment that the '731 and '580 patents are not invalid because Blue Coat has not disclosed any expert opinion on their validity. Finjan Mot. 16-17. Blue Coat responds that a finding of invalidity need not be supported by expert testimony, and points out that it has at least provided invalidity contentions and prior art reference elections for these patents. Blue Coat Opp. 21-22.
Blue Coat's arguments are unconvincing. This is not a case where the "references and [Blue Coat's] invention[s] are easily understandable without the need for expert explanatory testimony." Union Carbide Corp. v. Am. Can Co. , 724 F.2d 1567, 1573 (Fed. Cir. 1984). Accordingly, in order to bear its burden of proving invalidity by clear and convincing evidence at trial, Blue Coat will need to present "testimony from one skilled in the art [which] identif[ies] each claim element, state[s] the witnesses' interpretation of the claim element, and explain[s] in detail how each claim element is disclosed in the prior art reference." Schumer v. Lab. Computer Sys., Inc. , 308 F.3d 1304, 1315 (Fed. Cir. 2002). Because it disclosed no expert opinion on the '731 and '580 patents, Blue Coat will be unable to do this. Accordingly, Finjan's motion for summary judgment that the '731 and '580 patents are not invalid is GRANTED.
ii. '494 and '408 Patents : IPR Estoppel
Finjan seeks summary judgment that the '494 and '408 patents are not invalid on the basis that Blue Coat is estopped from asserting invalidity under 35 U.S.C. § 315(e)(2). The parties do not dispute the underlying facts: In 2016, Blue Coat joined several third-party IPRs which were filed against the '494 and '408 patents. Exs. 56-59 to Mot., ECF 230-20 through 230-23. For each, the PTAB has issued final written decisions. Exs. 11, 15, 19 to Mot., ECF 229-11, 229-15, 229-18 The chart below summarizes the grounds raised and outcomes of each:
Patent Grounds in Petition Instituted Final Written Decision (IPR) Grounds '494 patent Swimmer (§§ 102, § 103) Swimmer Swimmer (§ 103): some (IPR2015-1892) Cline in view of Ji '600 (§ 103) (§ 103) claims unpatentable, Forrest in view of Ji '600 (§ 103) other claims not unpatentable '494 patent Touboul (§§ 102. § 103) Swimmer Swimmer (§ 103): some (IPR2016-00159) Touboul in view of Swimmer (§ 103) (§ 103) claims unpatentable; Touboul in view of Ji '600 (§ 103) Swimmer other claims not Swimmer (§ 103) and unpatentable Swimmer in view of Martin (§ 103) Martin Swimmer and Martin (§ (§ 103) 103): no claims unpatentable '408 patent Chandnani and Kolawa (§ 103) All All grounds: no claims (IPR2015-2001) Chandnani, Kolawa, and Walls (§ 103) grounds unpatentable Chandnani, Kolawa, and Huang (§ 103) (IPR2016-00157) Chandnani, Kolawa, Walls, and Huang (§ 103)
Here, Blue Coat challenges claims 10, 14, and 16 of the '494 patent as obvious over Griffin, Ji '348, and Nachenberg. Ex. 12 to Blue Coat Opp. at 126, ECF 237-12. Blue Coat challenges claim 22 of the '408 patent as obvious over (1) Kolawa and Necula '774 and (2 Kolawa, Li, and Chandnani. Id.
Finjan argues that, because Blue Coat was a party (through joinder) to the above-listed IPRs, § 315(e)(2) precludes it from asserting prior art that it raised or reasonably could have raised during these proceedings. Finjan argues that all of the references currently asserted by Blue Coat fall within this because they are "patents or printed publications"-types of prior art which can be raised in IPR petitions. Finjan Mot. 19. In addition, Finjan argues that Blue Coat could have reasonably known about and raised the Griffin, Ji '348, and Nachenberg references for the '494 patent because they are listed on the face of the '494 patent. Id. at 20. Finjan also argues that the same is true of the '408 references because Blue Coat disclosed Necula '774 in its invalidity contentions in Blue Coat I , Li was previously disclosed as a prior art reference in another case involving the '408 patent, and Blue Coat identified both Li and Griffin in its June 2016 invalidity contentions in this case. Id. at 20-21.
Blue Coat does not dispute that it was a party to the above-listed IPRs, but nevertheless argues that it is not bound by § 315(e)(2) estoppel because, under the Federal Circuit's decision in Shaw Indus. Grp., Inc. v. Automated Creel Sys., Inc. , 817 F.3d 1293, 1300 (Fed. Cir. 2016), cert. denied , --- U.S. ----, 137 S.Ct. 374, 196 L. Ed. 2d 292 (2016), estoppel only applies to arguments that reasonably could have been raised after institution, not grounds that were not instituted or never raised in the petition. Blue Coat Opp. 14-16. Because none of the IPRs instituted on the prior art combinations that Blue Coat asserts in this case, Blue Coat argues, § 315(e)(2) estoppel does not apply. Id. In reply, Finjan argues that Shaw is inapposite, because it applies only to estoppel when invalidity grounds were raised in the petition but denied institution. Finjan Reply 10-11.
Under § 315(e)(2), "[t]he petitioner in an [IPR] ... that results in a final written decision ... or the real party in interest or privy of the petitioner, may not assert ... in a civil action ... that [a] claim is invalid on any ground that the petitioner raised or reasonably could have raised during" IPR. 35 U.S.C. § 315(e)(2). In Shaw Indus. Grp. , 817 F.3d at 1300, the Federal Circuit addressed the application of this language in a case where the PTAB had instituted IPR on some grounds but not others, and found that § 315(e)(2) did not create estoppel for the non-instituted grounds. The court reasoned this was the case because "[b]oth parts of § 315(e) create estoppel for arguments 'on any ground that the petitioner raised or reasonably could have raised during that inter partes review' " and "IPR does not begin until it is instituted." Id. (emphasis in original). Thus, the court reasoned, it was impossible for the petitioner to have "raised or reasonably could have raised" the non-instituted grounds during IPR. Id.
Since Shaw , a number of district courts-including at least one in this District-have interpreted § 315(e)(2) estoppel as applying only to grounds that were both raised in the IPR petition and instituted in the IPR proceeding. See, e.g. , Verinata Health, Inc. v. Ariosa Diagnostics, Inc , No. 12-CV-05501-SI, 2017 WL 235048, at *3 (N.D. Cal. Jan. 19, 2017). However, other district courts have disagreed that Shaw applies so broadly, finding that, in the case of grounds that were never raised in the IPR petition, Shaw is mere dicta and § 315(e)(2) estoppel can still apply. See, e.g. , Cobalt Boats, LLC, v. Sea Ray Boats, Inc. , No. 2:15-CV-00021-HCM-LRL, Dkt. No. 285, slip op. at 5-6, 2017 WL 2605977 (E.D. Va. June 5, 2017).
The Court adopts the approach of its sister court in this District and follows the broader interpretation of Shaw : § 315(e)(2) estoppel applies only to grounds that were both raised in the IPR petition and instituted in the IPR proceeding. Applied to the facts here, Blue Coat is not estopped under § 315(e)(2) from pursuing any of the invalidity combinations that it currently asserts against the '494 and '408 patents. None of the IPRs were instituted on these precise combinations. Accordingly, Finjan's motion is DENIED.
iii. '844, '968, and '731 Patents : Collateral Estoppel
Finjan argues that collateral estoppel bars Blue Coat from challenging the validity of the '844, '968, and '731 patents because it challenged the validity of these patents in Blue Coat I and lost. Finjan Mot. 21-22. Finjan argues that all of the elements of collateral estoppel are met here: the issue-validity-is identical, Blue Coat I ended in a final judgment on the merits, and Blue Coat was a party in the first proceeding. Id.
Blue Coat responds that, under the Federal Circuit's decision in Nasalok Coating Corp. v. Nylok Corp. , 522 F.3d 1320, 1326 (Fed. Cir. 2008), whether Blue Coat is precluded from arguing invalidity with respect to the patents asserted in Blue Coat I should be governed by questions of res judicata, not collateral estoppel. Blue Coat Opp. 19-20. Blue Coat then argues that res judicata does not apply here because the accused products for the '844, '968, and '731 patents are different from Blue Coat I . Id.
Blue Coat's rebuttal is unconvincing. Collateral estoppel and res judicata are separate concepts. See Roche Palo Alto LLC v. Apotex, Inc. , 531 F.3d 1372, 1381 n.2 (Fed. Cir. 2008). Finjan moves only on the basis of collateral estoppel, so the Court will only conduct a collateral estoppel analysis. Nasalok does not compel a contrary approach, as it was only a res judicata case. See Nasalok Coating Corp. , 522 F.3d at 1326 ("[o]nly the doctrine of claim preclusion is relevant in this case"). Blue Coat's position is also belied by recent district court cases which have decided the question of whether collateral estoppel bars invalidity claims in later suits. See, e.g. , Rudolph Technologies, Inc. v. Camtek Ltd. , 2016 WL 8668504, *4-*6 (D. Minn. Aug. 8, 2016) ; Fairchild Semiconductor Corporation v. Power Integrations, Inc. , 2015 WL 1905871, *2 (D. Del. Apr. 23, 2015).
Collateral estoppel bars re-litigation of issues adjudicated in an earlier proceeding if: (1) the issue necessarily decided at the previous proceeding is identical to the one which is sought to be re-litigated; (2) the first proceeding ended with a final judgment on the merits; and (3) the party against whom collateral estoppel is asserted was a party or in privity with a party at the first proceeding. See Reyn's Pasta Bella, LLC v. Visa USA, Inc. , 442 F.3d 741, 746 (9th Cir. 2006). There is no dispute that Blue Coat I ended in a final judgment on the merits and that the parties are the same. Thus, the only question is whether the issues are "identical." On that point, the ultimate question of patent validity is the same, but the grounds of challenge are different: In Blue Coat I , Blue Coat challenged the '844 patent as anticipated by U.S. Patent No 6,253,370 ("Abadi"), the '968 patent as anticipated by U.S. Patent No. 6,772,214 ("McClain"), and the '731 patent as anticipated by a publication entitled "IBM Websphere Edge Server: New Features and Functions in Version 2" dated April 2002 ("Braswell"). Blue Coat I , ECF 543 at 18. Here, Blue Coat challenges the '844 patent as obvious over Ji '348, Necula, and Abadi and the '968 patent as obvious over Graham, O'Toole, and Coss. Ex. 12 to Blue Coat Opp. ¶ 274, ECF 237-12.
In the context of patent validity, the Federal Circuit has not definitively addressed what constitutes an "issue" for the purposes of collateral estoppel. Rudolph Techs., Inc. , No. 15-CV-1246, 2016 WL 8668504, at *3 ("the Court is unaware of[ ] any precedent in ... the Federal Circuit directly addressing [this issue]"). Some district courts and commentators have suggested that different grounds of invalidity, such as different sections of the Patent Act or different combinations of prior art references, constitute different "issues." See, e.g. , TASER Int'l, Inc. v. Karbon Arms, LLC , 6 F.Supp.3d 510, 519 (D. Del. 2013) ("[I]f the invalidity theories are based on different claim constructions or different prior art, the requirement of identicality is not satisfied."). The vast majority of district courts, however, have interpreted "issue" to mean the ultimate question of patent validity, regardless of its grounds. See, e.g. , Fairchild Semiconductor Corp. , C.A. No. 12-540, 2015 WL 1905871, at *2 ; Evonik Degussa GmbH v. Materia Inc. , 53 F.Supp.3d 778, 792-94 (D.Del. 2014) ; Astrazeneca UK Ltd. v. Watson Labs., Inc. , 905 F.Supp.2d 596, 602-03 (D. Del. 2012) ; Roche Palo Alto LLC v. Apotex, Inc. , 526 F.Supp.2d 985, 994-95 (N.D. Cal. 2007) ; Meritor Transmission Corp. v. Eaton Corp. , Civil No. 1:04CV178, 2006 WL 3951711, at *4-7 (W.D.N.C. Sept. 26, 2006) ; Applied Medical Resources Corp. v. U.S. Surgical Corp. , 352 F.Supp.2d 1119, 1124-26 (C.D. Cal. 2005).
The Court is persuaded by the reasoning of the latter cases and adopts this majority view. Accordingly, because the ultimate issue of the validity of the '844, '968, and '731 patents was litigated in Blue Coat I , Blue Coat is estopped from re-litigating it here. Finjan's motion for summary judgment that the '844, '968, and '731 patents are not invalid is GRANTED.
iv. '844, '968, '731, and '086 Patents : Estoppel Due to Denied IPR Petitions
Finjan argues that Blue Coat should be estopped from challenging the validity of the '844, '968, '731, and '086 patents because it filed IPR petitions for these patents and the PTAB denied institution under a lower evidentiary standard. Finjan Mot. 22. Blue Coat responds that Finjan is wrong as a matter of law, and that none of the institution decisions even have persuasive effect because the prior art combinations asserted here are different. Blue Coat Opp. 17-18.
The Court agrees with Blue Coat. Finjan cites no authority for the proposition that denying institution creates estoppel, and the Court is aware of none. Further, because the asserted combinations differ, the PTAB's decisions have little relevance to the validity issues before the Court. Accordingly, Finjan's motion is DENIED.
v. '494 Patent : Invalidity Theories Relying on Nachenberg Reference
Finjan seeks summary judgment that the '494 patent is not invalid over any theory relying on the Nachenberg reference because Blue Coat cannot prove that it is a printed publication that was publicly available before the priority date of the '494 patent. Finjan Mot. 21-22. Blue Coat does not substantively rebut Finjan's arguments, but instead offers to drop the Nachenberg reference from the combination of Griffin, Ji '348, and Nachenberg that it has asserted against the '494 patent. Blue Coat Opp. 20-21. In reply, Finjan objects that Blue Coat's proposal is in direct contravention of the Court's scheduling order, which states that "references for a single obviousness theory shall not be changed or revised for subsequent election of asserted prior art" and that "obviousness combination A, B, C, and D" "may not be changed or revised to the combination A, B, and C." ECF 41 n.3.
The Court agrees with Finjan that, pursuant to its scheduling order, Blue Coat cannot now revise its invalidity theory of obviousness over Griffin, Ji '348, and Nachenberg to obviousness over Griffin and Ji '348. Further, because Blue Coat provides no rebuttal for Finjan's arguments that Nachenberg is not a printed publication, the Court adopts Finjan's view. As such, any obviousness combination that includes the Nachenberg reference-including Blue Coat's proposed combination of Griffin and Ji '348-is not a valid obviousness combination and Blue Coat may not seek to invalidate the '494 patent on those grounds. Finjan's motion for summary judgment that the '494 patent is not invalid over any theory relying on the Nachenberg reference is GRANTED.
vi. '086 Patent : Priority Date
Finjan argues that summary judgment that the '086 is not invalid should be granted for any theory relying on Ji '348 because Ji '348 is not prior art to the '086 patent. Finjan Mot. 24-25. On November 28, 2016, the PTO issued a reexamination certificate for the '086 patent, which newly reflected that the '086 patent could claim the benefit of a priority date to U.S. Provisional Application No. 60/030,639 ("the '639 provisional application"), filed on November 8, 1996. Finjan argues that, in light of the reexamination certificate, Ji '348 is not prior art to the '086 patent, as Ji '348 claims a priority date of September 10, 1997. Finjan also points out that the PTAB found the reexamination certificate persuasive in IPR2016-01444, as it determined that, in light of this reexamination certificate, Blue Coat had not shown a reasonable likelihood of prevailing in establishing that the priority date of the '086 patent was no earlier than November 6, 1997. Id .; Ex. 25 to Finjan Mot. at 3, 6-9, ECF 229-25.
Blue Coat responds that summary judgment is inappropriate, as there are disputed questions of fact as to whether the '639 provisional application discloses claim 24's "transmitter" element. Blue Coat Opp. 18. In reply, Finjan argues that this is unpersuasive, as the PTAB found that there was support for the elements of claim 24 in its decision. Finjan Reply 14.
Both parties' arguments on this issue are unconvincing: Finjan effectively argues that the Court should award an earlier priority date to the '086 patent because the PTAB did so, while Blue Coat baldly asserts lack of written description support without offering any supporting argument or evidence. However, because Finjan, as the moving party, bears the initial burden, its shortcomings govern. Finjan has not met its burden of showing that it is entitled to summary judgment that the '086 is not invalid under invalidity theories relying on Ji '348. Accordingly, Finjan's motion is DENIED.
vii. Summary
In summary, for one or several reasons discussed above, Finjan's motion for summary judgment of no invalidity is GRANTED with respect to the '731, '580, '844, '968, and '494 (for theories relying on Nachenberg) patents. Finjan's motion for summary judgment of no invalidity is DENIED with respect to the '408, '086, and '494 (for all other theories) patents.
IV. BLUE COAT'S MOTION
Blue Coat seeks summary judgment that: (1) SSLV with ProxySG does not infringe claim 1 of the '580 patent ; (2) WebPulse, alone or in combination with WSS, does not infringe claim 22 of the '408 patent ; (3) WebPulse/GIN, WSS with MAS, ProxySG and CAS with MAA, and ASG with MAA do not infringe claim 1 of the '786 patent ; and (4) "WebPulse/GIN sandboxing" does not infringe any of the Asserted Patents. Finjan opposes summary judgment on all of these grounds. The Court addresses each issue in turn.
A. The '580 Patent
Finjan accuses SSLV, in conjunction with ProxySG, of infringing claim 1 of the '580 patent. Claim 1 recites:
1. A system for secure communication, comprising:
a first security computer comprising:
a certificate creator, (i) for receiving attributes of a server computer's signed certificate within a reply message generated by a second security computer and communicated to the first security computer, the signed certificate being used to authenticate the server computer, and (ii) for creating a proxy signed certificate from the received attributes;
a certificate cache for storing and retrieving the attributes of the server computer's signed certificate; and
a first SSL connector, for connecting to a client computer and for performing a first SSL handshake with the client computer using the proxy signed certificate created by said certificate creator; and
a second security computer communicatively coupled with said first security computer via a non-SSL connection for receiving a connection request message therefrom, the connection request message including cached attributes of the signed certificate, comprising:
a second SSL connector, for connecting to the server computer, for receiving current attributes of the signed certificate from the server computer, for performing a second SSL handshake with the server computer using the signed certificate, and for generating the reply message communicated to said first security computer in response to the connection request message;
a certificate comparator for comparing the cached attributes of the signed certificate with the current attributes of the signed certificate; and
a protocol appender, for appending the current attributes of the signed certificate within the reply message communicated to said first security computer, when said certificate comparator determines that the cached attributes of the signed certificate do not match the current attributes of the signed certificate.
'580 patent, col. 7 l. 46-col. 8 l. 20 (emphasis added). According to Finjan, SSLV is the "first security computer" and ProxySG is the "second security computer." Finjan Opp. 6.
Blue Coat argues that the combination of SSLV and ProxySG does not infringe claim 1 for several reasons: (1) SSLV and ProxySG do not "communicate" to each other; (2) SSLV and ProxySG do not communicate a "reply message" or a "connection request message including cached attributes of the signed server certificate" to each other and do not have a "certificate comparator;" (3) SSLV and ProxySG do not share a "non-SSL connection;" and (4) SSLV does not perform an "SSL handshake with the client computer." Blue Coat Mot. at 5-14. The Court finds that summary judgment is appropriate for at least two of these reasons, which it discusses in detail below.
i. SSLV and ProxySG do not share the claimed "non-SSL connection"
One critical aspect of the system recited in claim 1 is that the "first security computer" and "second security computer" share a "non-SSL connection." This distinguishes the invention of claim 1 from prior art systems, which required an SSL connection throughout. See '580 patent at col. 1 ll. 35-37, 49-53.
Blue Coat argues that the accused combination of SSLV and ProxySG does not meet this limitation because, instead, SSLV and ProxySG-the accused "first security computer" and "second security computer," respectively-communicate using an SSL connection. Blue Coat Mot. 11-13. Blue Coat argues this is the case because SSLV and ProxySG must each independently decrypt and re-encrypt the SSL traffic that pass through them. Id. As support, Blue Coat points to its documentation on "Us[ing] the SSL Visibility Appliance with a ProxySG" states that "[i]n this architecture SSL traffic is decrypted twice: once on the ProxySG, and then again on the SSL Visibility Appliance." Ex. 7 to Blue Coat Mot. at BC2-0024427, ECF 225-7. It also cites its employee David Wells, who testified to the same. Ex. 24 to Blue Coat Mot. at 90:12-22, ECF 225-26.
Finjan responds that SSLV and ProxySG do share a non-SSL connection because, in its view, "the SSLV sends intercepted plaintext (i.e., unencrypted) to the ProxySG, resulting in a non-SSL connection." Finjan Opp. 11. As support, Finjan cites to its expert Dr. Cole's report and deposition testimony, where he opines that a non-SSL connection exists between SSLV and ProxySG because SSLV sends an unencrypted connection request message to the ProxySG. Ex. 3 to Finjan Opp. (Cole Rpt.) ¶ 1796, ECF 240-6 ("the SSLV create a non-SSL connection between them to transfer information including a connection request message using the ProxySG as the second security computer"); Ex. 10 to Finjan Opp. at 240:12-241:7, ECF 240-16. Finjan also cites to several excerpts from Blue Coat's documentation which describe how, after SSLV has decrypted intercepted traffic, it can pass that decrypted intercepted traffic to other attached security appliances. Ex. 15 to Finjan Opp. at BC-0024354, ECF 241-16 ("sending non-SSL flows to the attached security appliances"); Ex. 9 to Finjan Opp. at BC2-0025898, ECF 241-10 ("Intercepted plaintext is delivered to attached devices as a valid regenerated TCP stream via the SSL Visibility's network ports.").
There is no genuine dispute that SSLV and ProxySG do not share a "non-SSL connection." Instead, all of the evidence cited by the parties agrees that, when SSLV and ProxySG are deployed in combination, they share an SSL connection. The "Blue Coat Systems V2800 and SV3800 Administration and Deployment Guide" relied on by Finjan explains how, when SSLV is deployed in a cooperative configuration with a "proxy device" (such as a ProxySG) to inspect outgoing traffic, each use certificate re-sign to gain access to the encrypted traffic. Ex. 9 to Finjan Opp. at BC2-0025920, ECF 241-10 ("The existing proxy re-signs the original server certificate and then the SSL Visibility re-signs the modified server certificate it receives."); see also Ex. 1 to Finjan Opp. at BC2-0024727, ECF 241-2 ("The existing proxy re-signs the original server certificate and then the SSL Visibility re-signs the modified server certificate it receives."). This means that SSLV and the proxy device perform an SSL handshake: as part of the certificate resigning technique, the proxy, after it receives a certificate from the server, will re-sign the server's certificate and replace the server's public key with its own public key and send that to the SSLV. See id. at BC2-0025918-19. This makes it such that, when SSLV transmits outgoing traffic to the proxy, it will encrypt the traffic with the proxy's public key. See id. This is an SSL connection. In addition, Blue Coat's "Use the SSL Visibility Appliance with a ProxySG" document explains how, when SSLV is deployed in combination with a ProxySG to inspect incoming traffic, it is given the ProxySG's private key so that it can decrypt incoming traffic. Ex. 7 to Blue Coat Mot. at BC2-0024427, ECF 225-7. SSLV receives this traffic from the ProxySG (which received it from the internet), which decrypts it, inspects it, and re-encrypts it with its public key before passing it off to SSLV. Id. This too is an SSL
connection. The testimony of Blue Coat's employee David Wells also confirms that, when SSLV and ProxySG are deployed in combination, traffic is decrypted and re-encrypted at every step. Ex. 24 to Blue Coat Mot. at 90:12-22, ECF 226-26. This also suggests that SSLV and ProxySG share an SSL connection.
None of the evidence cited by Finjan contradicts this. First, the only evidence of a "non-SSL connection" that Dr. Cole cites is the "connection request message" that SSLV sends to ProxySG. Ex. 3 to Finjan Opp. at ¶ 1796, ECF 240-6; Ex. 10 to Finjan Opp. at 240:12-241:7, ECF 240-16. However, as Dr. Cole admitted, this is simply an initial message that is sent "before the session between the client and the server." Ex. 21 to Blue Coat Mot. at 75:3-9, ECF 226-24. All SSL connections begin with an unencrypted initial message (e.g., the "client hello" in the SSL handshake, see Ex. 21 to Blue Coat Mot. at 16:11-19:15, ECF 226-24), so this initial "connection request message" gives no indication that SSLV and ProxySG do not share an SSL connection. Second, the excerpts that Finjan cites