Unified Patents, LLC v. Longhorn HD LLC, IPR2020-00879

• Decision Date: 09 November 2021
• Docket Number: Patent 7,846 B2,260,IPR2020-00879
• Parties: UNIFIED PATENTS, LLC, Petitioner, v. LONGHORN HD LLC, Patent Owner.
• Court: Patent Trial and Appeal Board

UNIFIED PATENTS, LLC, Petitioner, v. LONGHORN HD LLC, Patent Owner.

No. IPR2020-00879

Patent 7, 260, 846 B2

United States Patent and Trademark Office, Patent Trial and Appeal Board

November 9, 2021

For PETITIONER:

David Tennant

ALLEN & OVERY LLP

David Markoff

WHITE & CASE LLP

Roshan Mansinghani

Jung Hahm

UNIFIED PATENTS, LLC

For PATENT OWNER:

Vincent Rubino

FABRICANT LLP

John Rubino

RUBINO LAW LLC

Before KARL D. EASTHOM, GARTH D. BAER, and MATTHEW S. MEYERS Administrative Patent Judges.

JUDGMENT

MEYERS, ADMINISTRATIVE PATENT JUDGE

Final Written Decision Determining All Challenged Claims Unpatentable

35 U.S.C. § 318(a)

Dismissing Petitioner's Motion to Exclude

37 C.F.R. § 42.64

I. INTRODUCTION

A. Background and Summary

Unified Patents, LLC, ("Petitioner") filed a Petition (Paper 1, "Petition" or "Pet.") requesting inter partes review of claims 7, 8, 10, and 11 of U.S. Patent No. 7, 260, 846 B2 (Ex. 1001, "the '846 patent"). Longhorn HD LLC, ("Patent Owner") filed a Preliminary Response. Paper 8. We instituted an inter partes review on claims 7, 8, 10, and 11 on all grounds asserted in the Petition. See Paper 10 ("Decision on Institution" or "Dec. on Inst."). After institution of trial, Patent Owner filed a Patent Owner Response (Paper 15, "PO Resp."), Petitioner filed a Reply (Paper 18, "Pet. Reply"), and Patent Owner filed a Sur-Reply (Paper 20, "Sur-Reply").

After filing an objection to Patent Owner's evidence (Paper 16), Petitioner filed a motion to exclude certain testimony from the declaration of Mr. Jawadi. Paper 24 ("Mot."). Patent Owner filed an opposition (Paper 25, "Opp."), and Petitioner filed a reply (Paper 26, "Reply"). We held a hearing on August 25, 2021, a transcript of which is included in the record. See Paper 33 ("Tr ").

We have authority under 35 U.S.C. § 6. Petitioner bears the burden of proving unpatentability of the challenged claims, and the burden of persuasion never shifts to Patent Owner. Dynamic Drinkware, LLC v. Nat'l Graphics, Inc., 800 F.3d 1375, 1378 (Fed. Cir. 2015). To prevail, Petitioner must prove unpatentability by a preponderance of the evidence. See 35 U.S.C. § 316(e) (2018); 37 C.F.R. § 42.1(d) (2019). This Final Written Decision is issued pursuant to 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73. For the reasons discussed below, we determine that Petitioner has shown by a preponderance of the evidence that claims 7, 8, 10, and 11 of the '846 patent are unpatentable.

B. Real Parties in Interest

Unified Patents indicates that it alone is the real party-in-interest, and that "no other party exercised control or could have exercised control over Unified's participation in this proceeding, the filing of this petition, or the conduct of any ensuing trial." Pet. 1. Patent Owner indicates that it alone is the real party-in-interest. Paper 4, 2.

C Related Matters

Petitioner identifies the following district court proceedings as related to the '846 patent: Longhorn HD LLC. v. Fortinet Inc, 2:19-cv-00124 (E.D. Tex. April 16, 2019); Longhorn HD LLC. v. Juniper Networks, Inc., 2:19-cv-00385 (E.D. Tex. Nov. 20, 2019); and Longhorn HD LLC. v. Checkpoint Software Technologies Ltd., No. 2:19-cv-00384 (E.D. Tex. Nov. 11, 2019). Pet. 2.

II. BACKGROUND

A. The '846 Patent

The '846 patent is titled "INTRUSION DETECTION SYSTEM." Ex. 1001, code (54). According to the '846 patent, "[t]o fill the security gap left open by firewall usage, information technologists incorporate intrusion detection system (IDS) technology within the enterprise." Id. at 1:44-46. The '846 patent is directed to an IDS that "can monitor [any] packets passing across a coupled communications path" and "identify protocol boundaries separating the various fields of each passing network packet and can store data for selected ones or all of the fields in a database, such as a relational database." Id. at 4:25-31. "In particular, data for each field can be stored in a separate record to facilitate the robust analysis of the stored data at a substantially granular level." Id. at 4:31-33.

The '846 patent explains that "[o]nce sufficient data has be[en] stored in the database, multidimensional vectors can be constructed and reduced from the stored data" and "[t]he reduced multi-dimensional vectors can be processed using one or more conventional multi-variate analysis methods and the output sets produced by the multi-variate analysis methods can be correlated against one another according to one or more selected metrics." Ex. 1001, 4:34-40. Then, "[b]ased upon these correlations, both normal and anomalous events can be identified." Id. at 4:40-42.

Figure 2 of the '846 patent, reproduced below, is a flow chart illustrating a process for performing intrusion detection. Ex. 1001, 8:6-7.

(Image Omitted)

As shown in Figure 2 (above), packet sniffer 220 can extract network traffic 210 flowing across a communications path coupled to IDS 200. Id. at 8:7-10. Parser 230 can de-construct the network packets along known protocol field boundaries, such as destination and source IP address, time-to-live, payload size, packet type, type of service, etc. Id. at 8:28-31. Subsequently, selected ones of the de-constructed fields can be stored in separate records in database 240 and can be associated with the particular socket to which the packet belongs. Id at 8:32-35.

In block 250, a vector builder in a feature extraction process can select individual ones of the network packet fields to be included in the construction of a multi-dimensional vector. Ex. 1001, 8:39-42. Multidimensional vectors can be constructed using the chosen features produced in block 250. Id. at 8:51-53. Specifically, the vector builder can process the records in the database 240 to identify pertinent fields associated with a particular "conversation" or socket. Id. at 8:53-55. In block 260, a vector separation system can reduce the dimensionality of the multi-dimensional vectors in order to simplify a subsequent multi-variate analysis. Id. at 8:64-66. Components of the multi-dimensional vectors that appear to be redundant, irrelevant, or otherwise insignificant relative to other interested components can be eliminated across all or a selection of the multidimensional vectors to produce a set of reduced vectors. Id. at 8:66-9:7.

In block 270, one or more self-organizing clustering methodologies can be applied concurrently or sequentially to the set of reduced vectors. Ex. 1001, 9:8-10. After the reduced vectors have been processed by the multiple clustering methodologies in block 270, one or more metrics can be selected in block 280 for purposes of establishing a correlation between the output sets of the processed reduced multi-dimensional vectors. Id. at 9:15-19. In block 290 a classifier can identify from any established correlations whether an anomaly has been detected. Id. at 9:21-23. The classification process of block 290 can identify either normal traffic or an attack. Id. at 9:25-26.

B. Illustrative Claims

The '846 patent includes twelve claims, and Petitioner challenges claims 7, 8, 10, and 11. Claim 7, the sole challenged independent claim, is illustrative and reads as follows:

1. An intrusion detection method comprising the steps of:

monitoring network traffic passing across a network communications path:

extracting network packets from said passing traffic;

storing individual components of said network packets in a database;

constructing multi-dimensional vectors from at least two of said stored individual components and applying at least one multi-variate analysis to said constructed multi-dimensional vectors, said at least one multi-variate analysis producing a corresponding output set;

establishing a correlation between individual output sets based upon a selected metric to identify anomalous behavior; and

classifying said anomalous behavior as an event selected from the group consisting of a network fault, a change in network performance and a network attack.

Ex. 1001, 11:29-45.

C. Asserted Grounds of Unpatentability

Pursuant to 35 U.S.C. § 314(a), on November 11, 2020, we instituted inter partes review on all grounds asserted in the Petition, namely:

Claims Challenged

35 U.S.C. §

Reference(s)/Basis

7, 8

103(a) ^[1]

Portnoy, ^[2] Cannady, ^[3] Barbara^[4]

10, 11

103(a)

Portnoy, Cannady, Barbara, AAPA

See Pet. 4, 5, 29-70. Petitioner also relies on the declaration of Jaideep Srivastava, Ph.D. Ex. 1002 (“Srivastava Decl.”). Patent Owner relies on testimony from Zaydoon Jawadi. Ex. 2001 (“Jawadi Decl.”). ^[5] Patent Owner cross-examined Dr. Srivastava. See Ex. 2003 (deposition transcript of Dr. Jaideep Srivastava, “Srivastava Dep.”).

III. ANALYSIS

A. Principles of Law

To prevail in its challenges to Patent Owner's claims, Petitioner must demonstrate by a preponderance of the evidence that the challenged claims are unpatentable. 35 U.S.C. § 316(e); 37 C.F.R. § 42.1(d) (2019). A patent claim is unpatentable under 35 U.S.C. § 103(a) if the differences between the claimed subject matter and the prior art are such that the subject matter, as a whole, would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. KSR Int'l Co. v. Teleflex Inc, 550 U.S. 398, 406 (2007). The question of obviousness is resolved on the basis of underlying factual determinations including (1) the scope and content of the prior art; (2) any differences between the claimed subject matter and the prior art; (3) the level of ordinary skill in the art; and (4) when in evidence, objective evidence of non-obviousness. ^[6] Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966).

B. Level of Ordinary Skill in the Art

We review the grounds of...