Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-cand-5_15-cv-03295/USCOURTS-cand-5_15-cv-03295-12/pdf.json

Nature of Suit Code: 830
Nature of Suit: Patent
Cause of Action: 15:1126 Patent Infringement

---

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION

FINJAN, INC.,

Plaintiff,

v.

BLUE COAT SYSTEMS, LLC,

Defendant.

Case No. 15-cv-03295-BLF 

ORDER DENYING BLUE COAT’S 

MOTION FOR JUDGMENT ON THE 

PLEADINGS

Defendant Blue Coat Systems, LLC (“Blue Coat”) brings this motion for judgment on the 

pleadings that U.S. Patent No. 8,677,494 (the “’494 patent”) is invalid for failure to claim patenteligible subject matter under 35 U.S.C. § 101. ECF 104. For the reasons discussed below, the 

Court DENIES Blue Coat’s motion.

I. BACKGROUND

A. The ’494 Patent

Finjan owns the ’494 patent, which is entitled “Malicious Mobile Code Runtime 

Monitoring System and Methods.” The ’494 patent was filed on November 7, 2011 and issued on 

March 18, 2014, but belongs to a long line of continuation and continuation-in-part applications

which originated from patent applications filed in 1996. One of these parent applications resulted 

in U.S. Patent No. 6,092,194 (the “’194 patent”), which the ’494 patent identifies in its 

specification and states is “incorporated by reference.” ’494 patent, col. 1 ll. 33-38.

The ’494 patent generally relates to systems and methods for protecting devices on an 

internal network from code, applications, and/or information downloaded from the Internet that 

perform malicious operations. Id., Abstract. According to the ’494 patent, at the time of 

invention, virus protection strategies for networked computers “met with limited success at best” 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 1 of 21
2

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

because virus scanning was localized and reactive: virus protection programs were installed on 

individual computers and only protected against known viruses. Id., col. 2 ll. 11-21. Because of 

this, these “program[s] [would] inevitably [be] surmounted by some new virus,” at which point 

they would need to be updated or replaced and the cycle would begin again. Id. In addition, 

certain types of viruses were “not well recognized or understood, let alone protected against.” Id., 

col. 2 ll. 22-24. This included viruses that were hidden in executable programs such as

“Downloadables.”

1

Id., col. 2 ll. 23-30. “Accordingly, there remains a need for efficient, accurate, 

and flexible protection of computers and other network connectable devices from malicious 

Downloadables.” Id., col. 2 ll. 45-48.

The ’494 patent purports to address this problem by detecting whether downloadable 

content contains potentially malicious code before it is allowed to be run on the destination 

computer. See id., col. 5 l. 60-col. 6 l. 6. At a high level, the disclosed embodiments describe a 

protection engine that generally resides on a network server and inspects incoming downloads for 

executable code. See id., col. 2 l. 20-col. 3 l. 4; ’194 patent, col. 3 ll. 10-21. The claims are 

directed to a narrow aspect of this, which involve a solution consisting of three basic steps that 

appear to be most closely detailed in the ’194 patent:

First, an incoming Downloadable is intercepted. ’494 patent, col. 21 l. 20, col. 22 l. 8. The 

’194 specification describes an “Internal Network Security System” which sits in between an 

external computer network and the internal computer network and “examines Downloadables 

received from external computer network 105, and prevents Downloadables deemed suspicious 

from reaching the internal computer network 115.” ’194 patent, col. 3 ll. 10-13.

Second, the Downloadable is scanned and “security profile data,” which includes “a list of 

suspicious computer operations that may be attempted by the Downloadable,” is derived. ’494 

patent, col. 21 ll. 21-23, col. 22 ll. 10-13. The ’194 specification discloses a “code scanner” 

component that scans through a Downloadable and generates the “security profile data” (also 

 

1

The parties agree in their Patent Local Rule 4-3 Joint Claim Construction Statement that a 

“Downloadable” is “an executable application program, which is downloaded from a source 

computer and run on the destination computer.” ECF 79 at 1.

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 2 of 21
3

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

referred to as “Downloadable Security Profile (DSP) data,” ’194 patent, col. 4 ll. 17-18). ’194 

patent, col. 5 ll. 41-42. Figure 7 of the ’194 specification illustrates this process:

Id., Fig. 7. At the beginning of the process, the code scanner “disassemble[s] the machine code of 

the Downloadable.” Id., col. 9 ll. 23-24. Next, the code scanner iterates through the machine 

code, (1) resolving the next command in the machine code, (2) “determin[ing] whether the 

resolved command is suspicious,” and, if so, (3) “decod[ing] and register[ing] the suspicious 

command and its command parameters as DSP data.” Id., col. 9 ll. 20-42. The format of the DSP 

data is “based on command class (e.g., file operations, network operations, registry operations, 

operating system operations, resource usage thresholds).” Id., col. 9 ll. 38-42. Examples of 

operations deemed potentially hostile include:

File operations: READ a file, WRITE a file;

Network operations: LISTEN on a socket, CONNECT to a socket, 

SEND data, RECEIVE data, VIEW INTRANET;

Registry operations: READ a registry item, WRITE a registry item;

Operating system operations: EXIT WINDOWS, EXIT BROWSER, 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 3 of 21
4

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

START PROCESS/THREAD, KILL PROCESS/THREAD, 

CHANGE PROCESS/THREAD PRIORITY, DYNAMICALLY 

LOAD A CLASS/LIBRARY, etc.; and

Resource usage thresholds: memory, CPU, graphics, etc.

Id., col. 5 l. 59-col. 6 l. 4.

Third, the “security profile data” is stored in a database. ’494 patent, col. 21 ll. 24-25, col. 

22 ll. 14-16. The’194 specification discloses that, after DSP data is generated, it is stored in a 

“DSP data” data object according to the Downloadable’s ID. ’194 patent, col. 6 ll. 9-10 (“[t]he 

code scanner 325 then stores the DSP data into DSP data 310 (corresponding to its Downloadable 

ID)”). The DSP data is then stored in “security database 240,” along with other data such as 

security policies, a list of known Downloadables, and a list of known Certificates. See id., col. 3 

ll. 47-50, col. 4 ll. 15-18.

The ’194 specification discloses that DSP data stored in the database can be compared, 

along with other information, against a security policy to determine whether the Downloadable 

should be permitted to be run on the destination computer. See id., col. 6 ll. 13-20. However, the 

claims themselves do not recite this, nor any subsequent use of the security profile data, after it 

gets stored in the database. ’494 patent, col. 21 ll. 22-23, col. 22 ll. 8-17. 

Finjan currently asserts claims 1, 10, 14, 15, and 18. Mot. 2, ECF 104. Independent 

claims 1 and 10 recite:

1. A computer-based method, comprising the steps of: 

receiving an incoming Downloadable;

deriving security profile data for the Downloadable, including a list 

of suspicious computer operations that may be attempted by the 

Downloadable; and

storing the Downloadable security profile data in a database.

10. A system for managing Downloadables, comprising: 

a receiver for receiving an incoming Downloadable;

a Downloadable scanner coupled with said receiver, for deriving 

security profile data for the Downloadable, including a list of 

suspicious computer operations that may be attempted by the 

Downloadable; and

a database manager coupled with said Downloadable scanner, for 

storing the Downloadable security profile data in a database.

Id., col. 21 ll. 22-23, col. 22 ll. 8-17. Claim 14 additionally requires that the Downloadable 

include a program script. Id., col. 22 ll. 26-27. Claim 15 specifically names suspicious computer 

operations. Id., col. 22 ll. 28-30. Claim 18 requires that the Downloadable scanner comprise a 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 4 of 21
5

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

disassembler. Id., col. 22 ll. 37-39.

B. Procedural History

The parties’ dispute predates the instant case. On August 28, 2013, Finjan initiated a first 

patent infringement action, Case No. 5:13-CV-03999-BLF (“Finjan I”), against Blue Coat, 

alleging that Blue Coat infringed U.S. Patent Nos. 6,154,844 (the “’844 patent”), 6,965,968 (the 

“’968 patent”), 7,418,731 (the “’731 patent”), 6,804,780 (the “’780 patent”), 7,058,822 (the “’822 

patent”), and 7,647,633 (the “’663 patent”). The parties tried all six patents before a jury who, on 

August 4, 2015, found that Blue Coat infringed the ’844, ’968,’731,’780, and ’633 patents. Finjan 

I, ECF 438 at 2-3. The Court upheld these findings in its post-trial rulings. Finjan I, ECF 543. In 

addition, the Court held a bench trial where it decided, among other things, that the ’844 patent 

was not patent-ineligible under 35 U.S.C. § 101. Finjan I, ECF 486 at 13-18. The Court entered 

final judgment on July 18, 2016. Finjan I, ECF 556.

On July 7, 2015, five days before the beginning of trial in Finjan I, Finjan initiated the 

instant suit. ECF 1. Here it asserts three patents from Finjan I (the ’844 patent, the ’968 patent, 

and the ’731 patent), the ’494 patent, and six others (U.S. Patent Nos. 8,566,580 (the “’580 

patent”); 8,079,086 (the “’086 patent”); 8,225,408 (the “’408 patent”); 9,141,786 (the “’786 

patent”); 9,189,621 (the “’621 patent”); and 9,219,755 (the “’755 patent”)). On September 16, 

2016, Blue Coat filed a motion for judgment on the pleadings that the asserted claims of the ’494 

patent are invalid for failure to claim patent-eligible subject matter under 35 U.S.C. § 101. ECF 

104. 

II. LEGAL STANDARD

A. Motion for Judgment on the Pleadings Under Fed. R. Civ. P. 12(c)

Rule 12(c) provides that “[a]fter the pleadings are closed—but early enough not to delay 

trial—a party may move for judgment on the pleadings.” Fed. R. Civ. P. 12(c). “A judgment on 

the pleadings is properly granted when, taking all allegations in the pleadings as true, the moving 

party is entitled to judgment as a matter of law.” Enron Oil Trading & Transp. Co. v. Walbrook 

Ins. Co., 132 F.3d 526, 528 (9th Cir. 1997) (citing McGann v. Ernst & Young, 102 F.3d 390, 392 

(9th Cir. 1996)). When ruling on a Rule 12(c) motion, the Court must “accept factual allegations 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 5 of 21
6

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

in the complaint as true and construe the pleadings in the light most favorable to the nonmoving 

party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Any 

existing ambiguities must be resolved in favor of the pleading. Walling v. Beverly Enters., 476 

F.2d 393, 396 (9th Cir. 1973).

“If, on a motion under Rule 12(b)(6) or 12(c), matters outside the pleadings are presented 

to and not excluded by the court, the motion must be treated as one for summary judgment under 

Rule 56.” Fed. R. Civ. P. 12(d). A court, however, may “consider certain materials—documents 

attached to the complaint, documents incorporated by reference in the complaint, or matters of 

judicial notice—without converting the motion to dismiss into a motion for summary judgment.” 

United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003).

B. Patent Validity Challenges Under 35 U.S.C. § 101

35 U.S.C. § 101 provides that “[w]hoever invents or discovers any new and useful process, 

machine, or composition of matter, or any new and useful improvement thereof, may obtain a 

patent therefor, subject to the conditions and requirements of this title.” However, the Supreme 

Court has recognized that these broad categories contain an implicit exception: “[l]aws of nature, 

natural phenomena, and abstract ideas are not patentable.” Ass’n for Molecular Pathology v. 

Myriad Genetics, Inc., 133 S. Ct. 2107, 2116, 186 L. Ed. 2d 124 (2013) (internal quotation marks 

and citation omitted). 

To determine whether a claim falls outside this exception, the Supreme Court has 

established a two-step framework: First, the court must “determine whether the claims at issue are 

directed to a patent-ineligible concept.” Alice Corp. Pty. Ltd. v. CLS Bank Int’l, ––– U.S. ––––, 

134 S.Ct. 2347, 189 L.Ed.2d 296 (2014). Second, if the claims are directed to patent-ineligible 

subject matter, the Court must “consider the elements of each claim both individually and ‘as an 

ordered combination’ to determine whether the additional elements ‘transform the nature of the 

claim’ into a patent-eligible application.” Id. (quoting Mayo Collaborative Servs. v. Prometheus 

Laboratories, Inc., 132 S.Ct. 1289, 1298, 1297, 182 L. Ed. 2d 321 (2012)). The Supreme Court 

has described this as a “search for an ‘inventive concept’—i.e., an element or combination of 

elements that is ‘sufficient to ensure that the patent in practice amounts to significantly more than 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 6 of 21
7

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

a patent upon the [ineligible concept] itself.’” Id. 

In evaluating step one, “the ‘directed to’ inquiry applies a stage-one filter to claims, 

considered in light of the specification, based on whether ‘their character as a whole is directed to 

excluded subject matter.’” Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1335 (Fed. Cir. 2016) 

(quoting Internet Patents Corp. v. Active Network, Inc., 790 F.3d 1343, 1346 (Fed. Cir. 2015)). In 

the software context, claims may fail step one because they are directed to an abstract idea. The 

Federal Circuit has found this to be true in a number of cases, and some commonalities have 

emerged. For example, fundamental economic activities and business practices, even if performed 

on a computer, are often abstract. OIP Techs., Inc. v. Amazon.com, Inc., 788 F.3d 1359, 1362 

(Fed. Cir. 2015), cert. denied, 136 S. Ct. 701, 193 L. Ed. 2d 522 (2015) (collecting cases). In 

addition, “we have treated collecting information, including when limited to particular content 

(which does not change its character as information), as within the realm of abstract ideas.” Elec. 

Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1353 (Fed. Cir. 2016) (collecting cases); see also, 

e.g., In re TLI Commc’ns LLC Patent Litig., 823 F.3d 607, 611 (Fed. Cir. 2016); FairWarning IP, 

LLC v. Iatric Sys., Inc., 839 F.3d 1089, 1095 (Fed. Cir. 2016). Mental steps, including 

mathematical algorithms, are also generally considered abstract ideas. Elec. Power Grp., 830 F.3d 

at 1353 (collecting cases); see, e.g., Parker v. Flook, 437 U.S. 584, 589-90, 98 S.Ct. 2522, 57 

L.Ed.2d 451 (1978); Gottschalk v. Benson, 409 U.S. 63, 67, 93 S.Ct. 253, 34 L.Ed.2d 273 (1972). 

However, the Federal Circuit has recognized that “precision has been elusive in defining an allpurpose boundary between the abstract and the concrete.” Internet Patents, 790 F.3d at 1345. 

Courts must tow the fine line between assessing a claim’s “character as a whole” and “describing 

the claims at such a high level of abstraction and untethered from the language of the claims [such 

that it] all but ensures that the exceptions to § 101 swallow the rule.” Enfish, 822 F.3d at 1335, 

1337.

To date, the Federal Circuit has provided two examples of software claims that are not 

directed to an abstract idea. First, in Enfish, the Federal Circuit determined that claims directed to 

a specific type of self-referential table constituted a specific “solution to a problem in the software 

arts” such that they were “non-abstract improvements to computer technology.” 822 F.3d at 1339. 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 7 of 21
8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

The court noted that “[t]he Supreme Court has suggested that claims ‘purport[ing] to improve the 

functioning of the computer itself,’ or ‘improv[ing] an existing technological process’ might not 

succumb to the abstract idea exception.” Id. at 1335. The court found that because the claims 

focused “on the specific asserted improvement in computer capabilities (i.e., the self-referential 

table for a computer database)” instead of “a process that qualifies as an ‘abstract idea’ for which 

computers are invoked merely as a tool,” they were not directed to an abstract idea. Id. at 1335-

36, 1339.

Second, in McRO, Inc. v. Bandai Namco Games Am. Inc., the Federal Circuit found that 

patents that automated part of a preexisting method for 3-D facial expression animation were not 

abstract because they “focused on a specific asserted improvement in computer animation, i.e., the 

automatic use of rules of a particular type.” 837 F.3d 1299, 1314 (Fed. Cir. 2016). Here too the 

court found that this was not the case of using a computer as a tool to implement an abstract idea; 

instead, the claims set forth a process of following a distinct set of rules, which was different from 

the process used by human animators, to improve animation technology. Id. at 1314 (“It is the 

incorporation of the claimed rules, not the use of the computer, that ‘improved [the] existing 

technological process’ by allowing the automation of further tasks.”). This moved the clams 

beyond the realm of the abstract. Id.

However, not all claims relating to computer technologies are not abstract. Where the 

focus of the claims is on “certain independently abstract ideas that use computers as tools” instead 

of “an improvement in computers as tools,” claims may fail step one. See, e.g., Elec. Power Grp., 

830 F.3d at 1354; see, e.g., Affinity Labs of Texas, LLC v. DIRECTV, LLC, 838 F.3d 1253, 1262 

(Fed. Cir. 2016) (claims relating to “deliver[ing] content to a handheld wireless electronic device” 

were directed to an abstract idea because they claimed “the general concept of out-of-region 

delivery of broadcast content through the use of conventional devices, without offering any 

technological means of effecting that concept”); Synopsys, Inc. v. Mentor Graphics Corp., 839 

F.3d 1138, 1140 (Fed. Cir. 2016) (claims related to logic circuit design in computer hardware were 

“drawn to the abstract idea of: translating a functional description of a logic circuit into a hardware 

component description of the logic circuit”); Tranxition, Inc. v. Lenovo (United States) Inc., No. 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 8 of 21
9

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

2015-1907, 2016 WL 6775967, at *3 (Fed. Cir. Nov. 16, 2016) (claims relating to migration of 

computer settings were directed to an abstract idea because “manual migration is an abstract idea” 

and the claims merely “automate[d] the migration of data between two computers”). This has 

proven true for patents in the computer security space. For example, in BASCOM Glob. Internet 

Servs., Inc. v. AT&T Mobility LLC, the Federal Circuit found that claims2reciting an Internet

content filtering system were directed to an abstract idea because “filtering content . . . is a 

longstanding, well-known method of organizing human behavior, similar to concepts previously 

found to be abstract.” 827 F.3d 1341, 1348 (Fed. Cir. 2016). In Intellectual Ventures I LLC v. 

Symantec Corp., the Federal Circuit found claims3related to filtering unwanted content from 

email were directed to an abstract idea because “it was long-prevalent practice for people 

receiving paper mail to look at an envelope and discard certain letters, without opening them, from 

sources from which they did not wish to receive mail based on characteristics of the mail” and 

 

2 One of the asserted claims, claim 1 of U.S. Patent No. 5,987,606 , recited:

1. A content filtering system for filtering content retrieved from an 

Internet computer network by individual controlled access 

network accounts, said filtering system comprising:

a local client computer generating network access requests for said 

individual controlled access network accounts;

at least one filtering scheme;

a plurality of sets of logical filtering elements; and

a remote ISP server coupled to said client computer and said Internet 

computer network, said ISP server associating each said network 

account to at least one filtering scheme and at least one set of 

filtering elements, said ISP server further receiving said network 

access requests from said client computer and executing said 

associated filtering scheme utilizing said associated set of logical 

filtering elements.

827 F.3d at 1345 (quoting U.S. Patent No. 5,987,606 at col. 6 l. 62-col. 7 l. 10).

3 One of the asserted claims, claim 9 of U.S. Patent No. 6,460,050, recited:

9. A method for identifying characteristics of data files, comprising:

receiving, on a processing system, file content identifiers for data 

files from a plurality of file content identifier generator agents, 

each agent provided on a source system and creating file content 

IDs using a mathematical algorithm, via a network;

determining, on the processing system, whether each received 

content identifier matches a characteristic of other identifiers; 

and

outputting, to at least one of the source systems responsive to a 

request from said source system, an indication of the 

characteristic of the data file based on said step of determining.

838 F.3d at 1313 (quoting U.S. Patent No. 6,460,050 at col. 8, ll. 13-26).

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 9 of 21
10

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

“[c]haracterizing e-mail based on a known list of identifiers is no less abstract.” 838 F.3d 1307, 

1314 (Fed. Cir. 2016). The court found these claims distinguishable from those in Enfish and 

McRO because there was no “specific or limiting recitation of . . . improved computer 

technology;” instead, they merely “use[d] generic computers to perform generic computer 

functions.” Id. at 1315, 1316. Thus, non-abstract claims that “improve the functioning of the 

computer itself,” Alice, 134 S.Ct. at 2359, such as those in Enfish and McRO, remain a narrow 

class.

In assessing step two, courts must “consider the elements of each claim both individually

and ‘as an ordered combination’” and assess whether there are any “additional features” in the 

claims that constitute an “inventive concept.” Alice, 134 S.Ct. at 2357. This inventive concept 

“must be significantly more than the abstract idea itself,” BASCOM, 827 F.3d at 1349, “must be 

more than well-understood, routine, conventional activity,” Affinity, 838 F.3d at 1262, “and cannot 

simply be an instruction to implement or apply the abstract idea on a computer.” BASCOM, 827 

F.3d at 1349. For example, it may be found in an “inventive set of components or methods,” 

“inventive programming,” or an inventive approach in “how the desired result is achieved.” Elec. 

Power Grp., 830 F.3d at 1355.

To date, the Federal Circuit has found an inventive concept in three cases. First, in DDR 

Holdings, LLC v. Hotels.com, L.P., the Federal Circuit found that claims that addressed the 

“Internet-centric problem” of third-party merchant advertisements that would “lure . . . visitor 

traffic away” from a host website (because clicking on the advertisement would redirect the visitor 

to the merchant’s website) amounted to an inventive concept. 773 F.3d 1245, 1248, 1259 (Fed. 

Cir. 2014). The claims solved this problem by generating composite websites that combined the 

visual elements of the host’s webpage with the content of the third-party merchant. Id. at 1248. 

The Federal Circuit reasoned that the claims “specify how interactions with the Internet are 

manipulated to yield a desired result” such that the interactions are “not merely the routine or 

conventional use of the Internet.” Id. at 1259. Accordingly, there was sufficient transformation 

for the claims to not be patent-ineligible. Id.

Second, in BASCOM, the Federal Circuit found that the claims directed to Internet content 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 10 of 21
11

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

filtering recited the inventive concept of “install[ing] a filtering tool at a specific location, remote 

from the end-users, with customizable filtering features specific to each end user.” 827 F.3d at 

1350. The court reasoned that “an inventive concept can be found in the non-conventional and 

non-generic arrangement of known, conventional pieces.” Id. The court found this to be the case 

there because the patents claimed a specific type of content filtering that took advantage of an ISP 

server’s ability to associate internet requests with user accounts. Id. Thus, they “harnesse[d] [a] 

technical feature of the network” to claim a “specific method of filtering Internet content cannot 

be said, as a matter of law, to have been conventional or generic.” Id.

Third, in Amdocs (Israel) Ltd. v. Openet Telecom, Inc., the Federal Circuit found that 

claims relating to solutions for managing accounting and billing data over large, disparate 

networks recited an inventive concept because they contained “specific enhancing limitation[s]

that necessarily incorporates the invention’s distributed architecture—an architecture providing a 

technological solution to a technological problem.” No. 2015-1180, 2016 WL 6440387, at *11 

(Fed. Cir. Nov. 1, 2016). Use of this “distributed architecture” transformed the claims into 

patentable subject matter. Id.

Nevertheless, not all technological aspects of how a patented invention is implemented 

supply a basis for finding an “inventive concept.” A claim that simply takes an abstract idea and 

adds “the requirement to perform it on the Internet, or to perform it on a set of generic computer 

components . . . would not contain an inventive concept.” BASCOM, 827 F.3d at 1350. For 

example, in Content Extraction & Transmission LLC v. Wells Fargo Bank, Nat. Ass’n, the Federal 

Circuit found that claims directed to the abstract ideas of extracting data and recognizing patterns 

did not recite an inventive concept because they simply recited “generic scanner and computer to 

perform well-understood, routine, and conventional activities commonly used in industry.” 776 

F.3d 1343, 1348 (Fed. Cir. 2014), cert. denied, 136 S. Ct. 119, 193 L. Ed. 2d 208 (2015). In 

Affinity Labs, the court found there was no inventive concept because “[t]he claim simply recites 

the use of generic features of cellular telephones, such as a storage medium and a graphical user 

interface, as well as routine functions, such as transmitting and receiving signals, to implement the 

underlying idea.” 838 F.3d at 1262. In Intellectual Ventures I, the court found that the claimed 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 11 of 21
12

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

email filtering methods and systems did not recite an inventive concept because “the asserted 

claims describe only generic computer elements” or “generic computers that use generic virus 

screening technology.” 838 F.3d at 1316, 1320. Accordingly, the search for an inventive

concept remains one that court must approach cautiously, “scrutiniz[ing] the claim elements more 

microscopically” than in step one. Elec. Power Grp., 830 F.3d at 1354.

In addition to these principles, several other considerations may be helpful in conducting a 

§ 101 analysis: First, the Supreme Court has recognized that the “concern that undergirds [the]

§ 101 jurisprudence” is preemption. Alice, 134 S. Ct. at 2358. If a claim is so abstract so as to 

“pre-empt use of [the claimed] approach in all fields, and would effectively grant a monopoly over 

an abstract idea” is not patent-eligible. Bilski v. Kappos, 561 U.S. 593, 612, 130 S. Ct. 3218, 

3231, 177 L. Ed. 2d 792 (2010). However, the inverse is not true: “[w]hile preemption may signal 

patent ineligible subject matter, the absence of complete preemption does not demonstrate patent 

eligibility.” FairWarning, 839 F.3d at 1098 (internal quotation marks and citation omitted).

Second (and relatedly), “claims that are ‘so result-focused, so functional, as to effectively 

cover any solution to an identified problem’ are frequently held ineligible under section 101.” 

Affinity Labs, 838 F.3d at 1265. For example, in Elec. Power Grp., the Federal Circuit found that 

claims directed to “any way of effectively monitoring multiple sources on a power grid” instead of 

“some specific way of enabling a computer to monitor data from multiple sources across an 

electric power grid” did not contain an inventive concept. 830 F.3d at 1356. The Federal Circuit 

has noted that this framework “is one helpful way of double-checking the application of the 

Supreme Court's framework to particular claims—specifically, when determining whether the 

claims meet the requirement of an inventive concept in application.” Id.

III. DISCUSSION

With these principles in mind, the Court turns to the claims at issue. As set forth below, 

the Court finds that the asserted claims of the ’494 patent are not patent-ineligible because, 

although they are directed to an abstract idea, they recite an inventive concept. 134 S. Ct. at 2355.

A. Relevance of ’194 Patent

Before turning to the merits, this case requires the Court to clarify the scope of materials 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 12 of 21
13

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

relevant to its analysis. This case presents an interesting scenario where the claims themselves are 

basic and broad, but significant clarifying detail is provided in a specification that belongs not to 

the ’494 patent itself, but to a parent patent (the ’194 patent), which the ’494 patent identifies and 

declares to be “hereby incorporated by reference.” ’494 patent, col. 1 ll. 37-38. Finjan, 

unsurprisingly, urges the Court to pay particular attention to these details and argues that the ’494 

patent successfully incorporates them by reference. Hrg. Tr. at 24:2-25:18, 50:6-53:4. Blue Coat 

responds that the focus must remain on the claims themselves and that, in any event, the ’494 

patent does not identify the ’194 disclosure with sufficient particularity to incorporate it by 

reference. ECF 144 at 1-3. The Court addresses these issues in turn.

As with any matter involving the scope of the patent grant, “[t]he § 101 inquiry must focus 

on the language of the Asserted Claims themselves.” Synopsys, 839 F.3d at 1142. Accordingly, 

“the complexity of the implementing software or the level of detail in the specification does not 

transform a claim reciting only an abstract concept into a patent-eligible system or method.” 

Accenture Glob. Servs., GmbH v. Guidewire Software, Inc., 728 F.3d 1336, 1345 (Fed. Cir. 2013). 

Nevertheless, the specification, as a helpful tool in understanding claim scope, is not to be ignored 

entirely. See Enfish, 822 F.3d at 1335 (“The ‘directed to’ inquiry applies a stage-one filter to 

claims, considered in light of the specification, based on whether their character as a whole is 

directed to excluded subject matter.”) (internal quotation marks and citation omitted). The Court 

is not required to undertake a full claim construction process in order to do this. Content 

Extraction, 776 F.3d at 1349 (“Although the determination of patent eligibility requires a full 

understanding of the basic character of the claimed subject matter, claim construction is not an 

inviolable prerequisite to a validity determination under § 101.”). Rather, the Court may interpret 

the claims in the light most favorable to the non-moving party, Finjan, bounded by what Federal 

Circuit law on claim construction allows. See Manzarek, 519 F.3d at 1031 (in ruling on a Rule 

12(c) motion, a court must “construe the pleadings in the light most favorable to the nonmoving 

party”); cf. Ultramercial, Inc. v. Hulu, LLC, 722 F.3d 1335, 1339-40 (Fed. Cir. 2013), cert. 

granted, judgment vacated sub nom. WildTangent, Inc. v. Ultramercial, LLC, 134 S. Ct. 2870, 189 

L. Ed. 2d 828 (2014) (“At summary judgment, the district court may choose to construe the claims 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 13 of 21
14

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

in accordance with this court’s precedent, or if not it may choose to give a construction most 

favorable to the patentee, and to apply the usual rules pertaining to summary judgment from there, 

and still require clear and convincing evidence of ineligible subject matter.”).4

Accordingly, in assessing patent eligibility here, the Court must restrict itself to the 

language of the asserted claims of the ’494 patent, which recite, in relatively broad terms, only 

three basic functions: receiving, deriving, and storing. Nevertheless, each of these functions 

should be read in light of the specification, including its detailed descriptions of how a 

“Downloadable” is “receiv[ed]” or how “security profile data” is “deriv[ed].” Because the Court

must construe the pleadings in favor of Finjan, Manzarek, 519 F.3d at 1031, the Court must err on 

the side of incorporating more—not less—particularities from the specification into its 

understanding of the claims, while still refraining from importing limitations from the 

specification into the claim, Phillips v. AWH Corp., 415 F.3d 1303, 1323 (Fed. Cir. 2005). In 

addition, the Court will rely on the parties’ agreed-upon construction of “Downloadable” as “an 

executable application program, which is downloaded from a source computer and run on the 

destination computer.” ECF 79 at 1.

This leads to the question of what constitutes the specification in this case. The ’494

patent identifies itself as an eventual “continuation of assignee’s US. patent application Ser. No. 

08/964,388, filed on Nov. 6, 1997 by inventor Shlomo Touboul, now US. Pat. No. 6,092,194, also 

entitled ‘System and Method for Protecting a Computer and a Network from Hostile 

Downloadables’ and hereby incorporated by reference.” ’494 patent, col. 1 ll. 33-38. The Court 

finds that this language is sufficient to incorporate the entire ’194 patent by reference. According 

to the Federal Circuit, “[t]o incorporate material by reference, the host document must identify 

with detailed particularity what specific material it incorporates and clearly indicate where that 

 

4 Although Ultramercial has been vacated by the Supreme Court, the Federal Circuit has 

continued to cite to this portion of the opinion approvingly. See Bancorp Servs., L.L.C. v. Sun Life 

Assur. Co. of Canada (U.S.), 687 F.3d 1266, 1273-74 (Fed. Cir. 2012) (“Although Ultramercial

has since been vacated by the Supreme Court, we perceive no flaw in the notion that claim 

construction is not an inviolable prerequisite to a validity determination under § 101. We note, 

however, that it will ordinarily be desirable—and often necessary—to resolve claim construction 

disputes prior to a § 101 analysis, for the determination of patent eligibility requires a full 

understanding of the basic character of the claimed subject matter.”).

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 14 of 21
15

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

material is found in the various documents.” Zenon Envtl., Inc. v. U.S. Filter Corp., 506 F.3d 

1370, 1378 (Fed. Cir. 2007). Here, the ’494 patent identifies the material it is incorporating with 

sufficient particularly: it indicates that it is incorporating the entire ’194 patent, and provides 

enough information for the reader to locate this information. More detail, such as identification of 

specific subject matter, is not necessary, as holding otherwise would render any incorporation of a 

document in full a practical impossibility. 

Blue Coat nevertheless contends that Federal Circuit precedent directs otherwise, citing 

two decisions which declined to incorporate the entirety of another patent’s disclosure. However, 

these cases are inapposite, as they relate to instances where only discussion of a particular topic 

from another specification was being incorporated. See Zenon Envtl., Inc., 506 F.3d at 1379 

(incorporating language stated that “[f]urther details relating to the construction and deployment of 

a most preferred skein are found in the parent U.S. Pat. No. 5,639,373, and in Ser. No. 08/690,045, 

the relevant disclosures of each of which are included by reference thereto as if fully set forth 

herein”); Cook Biotech Inc. v. Acell, Inc., 460 F.3d 1365, 1375 (Fed. Cir. 2006) (incorporating 

language stated that “[t]he preparation of UBS from a segment of urinary bladder is similar to the 

procedure for preparing intestinal submucosa detailed in U.S. Patent No. 4,902,508, the disclosure 

of which is expressly incorporated herein by reference”). In those cases, it would make sense that 

incorporation language would require more particularity. Here, it does not. Accordingly, the 

Court is persuaded that the ’494 patent successfully incorporates the entirety of the ’194 patent’s 

disclosure by reference.

B. Patent Eligibility Under 35 U.S.C. § 101

i. Alice Step One: Whether the Claims are Directed to an Abstract Idea

Having clarified that the ’194 patent is part of the ’494 specification and that its disclosures 

are relevant to the Court’s understanding of the claimed functions, the Court proceeds to assess 

whether the asserted claims are patent-eligible under § 101. In step one of the Alice framework, 

the Court must determine whether the “claims, considered in light of the specification, based on 

whether their character as a whole is directed to excluded subject matter.” Enfish, 822 F.3d at 

1335; Alice, 134 S. Ct. at 2355.

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 15 of 21
16

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

Blue Coat contends that the asserted claims pass step one because they are directed to the 

abstract idea of data gathering—i.e., “receiving information, identifying certain characteristics of 

that information, and storing those characteristics.” Mot. 6, ECF 104. Blue Coat analogizes the 

claim elements to steps that could be performed by a mailroom clerk: the clerk receives a package 

in a mailroom, makes a list on a notepad of potentially hazardous materials in the package, and 

stores the notepad in a cabinet. Id. According to Blue Coat, this is the same type of data gathering 

that the Federal Circuit has found abstract in other cases, including Elec. Power Grp., 830 F.3d at 

1354; OIP Techs., 788 F.3d at 1361; and Mayo, 132 S. Ct. at 1297-98. Mot. 7-8, ECF 104. Blue 

Coat also argues that this case is distinguishable from Enfish and McRO because the claims are 

broader and more abstract than those that were at issue in those cases: instead of reciting a specific 

type of security profiling technology, they claim the general concept of security profiling. Reply 

2-3, ECF 115. According to Blue Coat, this is not enough for the claims at issue to be considered 

non-abstract improvements to computer technology. Id.

Finjan responds that the claims are not abstract because they are directed to a computerspecific solution to a computer-specific problem: malware on a computer network. Opp. 4-5, ECF 

109. Finjan argues that Blue Coat’s position relies on an overgeneralization: the claimed solution 

relies on a specific type of data security profile which must include a list of computer operations; 

to that, Finjan, argues, there is no non-computer equivalent. Opp. 5-6, 9-10, ECF 109. For this 

reason, Finjan presses, the asserted claims fall squarely within the Federal Circuit’s ruling in 

Enfish because, by providing a better way to detect malware, they are “directed to a specific 

improvement to the way computers operate.” Opp. 6-7, ECF 109.

The Court agrees with Blue Coat that the asserted claims are directed to an abstract idea. 

Although they are deployed in the context of malware detection, the asserted claims merely recite 

the familiar concepts of gathering data, analyzing that data for certain characteristics, and storing 

the results of that analysis. These are fundamental concepts germane to any type of content 

analysis. See Intellectual Ventures I, 838 F.3d at 1314 (quoting Alice, 134 S.Ct. at 2356) (“The 

Supreme Court has held that ‘fundamental . . . practice[s] long prevalent’ are abstract ideas.”). 

This is true even when the asserted claims are given the full benefit of the technical details 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 16 of 21
17

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

disclosed in the ’194 patent. At their heart, they claim nothing more than a solution that scans 

through data (e.g., the disassembled code from the code scanner, ’194 patent, col. 5 ll. 41-45, col. 

9 ll. 20-42), identifies certain characteristics (e.g., the operations that match its pre-existing list of 

operations, ’194 patent, col. 5 l. 45-col. 6 l. 4), and stores the results of the analysis (e.g., the list of 

suspicious operations encountered, stored as formatted DSP data, ’194 patent, col. 6 ll. 9-10). 

This is not inherently different from how a human would perform a classification process with 

pencil and paper. This observation is true of both independent claims (claims 1 and 10) and 

dependent claims (claims 14, 15, and 18), as the additional limitations in the dependent claims 

simply restrict the context in which this process is performed. The focus, however, remains the 

same. Accordingly, the “character as a whole” of the claims is directed to data collection and 

analysis, an abstract idea.

This finding is consistent with conclusions that the Federal Circuit has reached in similar 

cases. In a number of cases, the court has found that claims directed to data collection and 

analysis recited an abstract idea. See Elec. Power Grp., 830 F.3d at 1353 (collecting cases); see 

also, e.g., In re TLI Commc’ns LLC Patent Litig., 823 F.3d at 611; FairWarning, 839 F.3d at 

1098. This has held true even where the data collection and analysis was used to solve computerrelated problems, such as malware. See, e.g., BASCOM, 827 F.3d at 1348 (claims directed to 

content filtering on the Internet recited an abstract idea); Intellectual Ventures I, 838 F.3d at 1314 

(claims directed to filtering email for spam and viruses recited an abstract idea). The claims at 

issue here are no less abstract than those at issue in BASCOM and Intellectual Ventures I. If 

anything, they are more so, as they recite fewer steps and less technical detail. Compare U.S. 

Patent No. 5,987,606 at col. 6 l. 62-col. 7 l. 10 and U.S. Patent No. 6,460,050 at col. 8, ll. 13-26, 

with ’494 patent at col. 21 ll. 18-25, col. 22 ll. 7-17, 26-30, 37-39.

Finjan nevertheless contends that the claims are not abstract because they provide a better 

way to solve the computer-specific problem of malware on a computer network, and are thus, as in 

Enfish, “directed to a specific improvement to the way computers operate.” Op. 4-7. The Court 

disagrees. Simply because claims recite a computer technology does not mean that they are not

directed to an abstract idea. See, e.g., Affinity Labs, 838 F.3d at 1262; Synopsys, 839 F.3d at 1140; 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 17 of 21
18

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

Tranxition, No. 2015-1907, 2016 WL 6775967, at *3. Instead, in order to be non-abstract under 

Enfish/McRO, claims must focus on an “improvement in computers as tools” rather than “uses of 

existing computers as tools in aid of processes focused on ‘abstract ideas.’” Elec. Power Grp., 

830 F.3d at 1354. The asserted claims here focus on the latter. They recite use of generic 

computer components to perform data collection and analysis generally. They do not recite an 

improvement to a particular computer technology used in malware detection —they do not, for 

example, claim an improvement to a specific, preexisting malware detection algorithm or recite 

special data structures that fundamentally improve the process of detecting malware. Although the 

Court appreciates that “deriving security profile data” may, if construed narrowly, involve a 

certain process of extracting code and identifying certain suspicious operations, the “character as a 

whole” of this process remains focused on the abstract idea of data collection and analysis, not on 

a fundamental improvement to computer operation. Enfish, 822 F.3d at 1335. Accordingly, for 

these reasons, the claims are directed to an abstract idea under step one of Alice, 134 S. Ct. at 

2355.

The Court notes that this conclusion differs from the result it reached Finjan I, where it 

determined that the asserted claims (claims 1, 7, 11, 15, and 41) of the ’844 patent were not 

directed to an abstract idea. Finjan I, ECF 486 at 13-18. This determination predated many of the 

Federal Circuit decisions that now guide the Court’s step one analysis, including Enfish, 822 F.3d 

at 1339, McRO, 837 F.3d at 1314, Elec. Power Grp., 830 F.3d at 1353, BASCOM, 827 F.3d at 

1348, and Intellectual Ventures I, 838 F.3d at 1314. If, to any extent, the Court’s reasoning in 

Finjan I conflicts with Federal Circuit precedent, Federal Circuit precedent controls. Further, in 

Finjan I, the Court found the Patent Office’s guidance persuasive. See “2014 Interim Guidance on 

Patent Subject Matter Eligibility (Interim Eligibility Guidance) for USPTO personnel to use when 

determining subject matter eligibility under 35 U.S.C. § 101 in view of recent decisions by the 

U.S. Supreme Court, including Alice Corp., Myriad, and Mayo,” available at

www.uspto.gov/patent/laws-and-regulations/examination-policy (last visited November 9, 2015) 

(hereinafter “Patent Office’s Guidance”). The example claim given in the Patent Office’s 

Guidance is distinguishable from the asserted claims of the ’494 patent because the example claim 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 18 of 21
19

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

is directed to creating a sanitized version of a suspicious file, not merely collecting and analyzing 

information from that file. The asserted claims of the ’494 patent are also more different from the 

example claim than the asserted claims of the ’844 patent because the ’844 claims recite taking a 

protective step (specifically, “linking by the inspector the first Downloadable security profile to 

the Downloadable before a web server makes the Downloadable available to web clients”), 

whereas the ’494 claims stop at collecting and storing data.

ii. Alice Step Two: Whether the Asserted Claims Contain an “Inventive 

Concept” Sufficient to Confer Patent Eligibility

Because the claims are directed to an abstract idea, the Court turns to step two, which 

requires that it “consider the elements of each claim both individually and ‘as an ordered 

combination’” to identify whether they recite an “inventive concept” which “‘transform[s] the 

nature of the claim’ into a patent-eligible application.” Alice, 134 S.Ct. at 2355. (quoting Mayo, 

132 S.Ct. at 1298, 1297). 

Blue Coat argues that the claims do not contain an “inventive concept” because they recite 

only routine, well-understood features (e.g., computer, database, scanner, manager) and activities 

(e.g., receiving, deriving, storing), none of which is inventive or transformative. Mot. 8-12, ECF 

104. Finjan responds that the claims do contain an “inventive concept” because they recite a novel 

approach to malware detection that is based on deriving a profile of actual, suspicious operations 

that may be attempted by a file, which is a non-conventional and non-generic arrangement of 

computer elements. Opp. 13, ECF 109.

The Court agrees with Finjan that the claims, taken as an ordered combination, recite an 

inventive concept sufficient to render them patent-eligible. As the ’494 patent explains, at the 

time of invention, virus protection was localized and reactive: virus protection programs were 

installed on individual, end-user computers and only checked to see if incoming files were known 

viruses. ’494 patent, col. 2 ll. 11-21. The ’494 patent claims both spatial and temporal alterations 

to this paradigm, the combination of which results in “non-conventional and non-generic 

arrangement of known, conventional pieces” that are sufficiently transformative to constitute an 

“inventive concept.” BASCOM, 827 F.3d at 1350.

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 19 of 21
20

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

First, spatially, the ’494 claims move malware profiling from its traditional location on 

end-user computers to an intermediate location on the network. Although not explicit in the 

claims, the specification makes clear that all of the asserted claims recite operations that are 

performed on a network server, not an end-user’s computer. All embodiments of the protection 

engines disclosed in the ’494 and ’194 specifications reside on a network server. See ’494 patent, 

col. 2 l. 20-col. 3 l. 4; ’194 patent, col. 3 ll. 10-21. In addition, the ’194 specification discloses 

that the code scanner, the particular component that performs the analysis to derive the data 

security profile, resides in the Internal Network Security System, which sits in between the 

external computer network and end-user computers. ’194 patent, Fig. 1; col. 3 ll. 10-13. 

Accordingly, the claimed “receiving,” viewed in a light most favorable to Finjan, refers to an 

operation that happens at an intermediate network location, not on an end-user computer. (And by 

extension, the “receiver” in claim 10 refers to a component at this network location.) As such, the 

’494 claims harness specific network architecture and use it in a “non-conventional and nongeneric arrangement” to offer improved malware protection for an internal computer network as a 

whole. BASCOM, 827 F.3d at 1350. Accordingly, this is a “specific technical solution beyond 

simply using generic computer concepts in a conventional way” which helps transform the claims 

into patentable subject matter. Id. at 1352.

Second, temporally, the ’494 claims shift malware profiling logic from something that 

must be applied to a single, complete file to something that must be applied to extracted aspects or 

components of a file (namely, operations) after it has been decomposed. Although this process is 

not laid out in the claims themselves, the Court finds that “deriving security profile data,” if 

construed in a light most favorable to Finjan, at least requires a process of parsing through a 

Downloadable and creating a list of all potentially suspicious computer operations. The claims 

themselves recite that “security profile data” must include “a list of suspicious computer 

operations that may be attempted by the Downloadable.” ’494 patent, col. 21 ll. 22-23, col. 22 ll. 

11-12. By necessity, then, “deriving” must include some means of extracting and identifying 

these operations. Only the ’194 specification uses the phrase “downloadable security profile 

data,” and the only embodiment of deriving security profile data that it discloses involves a precise 

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 20 of 21
21

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

process of decomposing code and extracting operations. ’194 patent, col. 9 ll. 20-42, Fig. 7. 

Thus, a person of ordinary skill in the art would understand “deriving security profile data” to 

refer to this type of process. At the time, this move from profiling at the file level to profiling at 

the operation level was non-conventional rearrangement of the malware profiling process. See 

’494 patent, col. 2 ll. 11-21. This provided for better, more effective malware detection because 

even if a new virus was launched into the network, it could still be detected because it performed 

certain suspicious operations. See ’494 patent, col. 2 ll. 56-64. This too constituted a “specific 

technical solution beyond simply using generic computer concepts in a conventional way,” which 

helps transform the claims into patentable subject matter. BASCOM, 827 F.3d at 1352.

Taking these spatial and temporal shifts together, viewed in the light most favorable to 

Finjan, the Court concludes that the claims recite an inventive concept, rendering them not patentineligible even though they are directed to an abstract idea.

IV. CONCLUSION

For the foregoing reasons, the Court concludes that the asserted claims of the ’494 patent 

are not patent-ineligible under 35 U.S.C. § 101 because, although they are directed to an abstract 

idea, they contain an inventive concept sufficient to transform these claims into patentable subject 

matter. Accordingly, the Court DENIES Blue Coat’s motion for judgment on the pleadings.

IT IS SO ORDERED.

Dated: December 13, 2016

 ______________________________________

BETH LABSON FREEMAN

United States District Judge

Case 5:15-cv-03295-BLF Document 156 Filed 12/13/16 Page 21 of 21