N OTE : This disposition is nonprecede n tial. 

# United States **Court of A**  **p peals**  **for the Federal Circuit**

______________________
TRUSTED KNIGHT CORPO RATION, Plaintiff

- Appellant

v.

INTERNATIONAL BUSINE SS MACHINES CORPORATION, TRUSTEE R INC., Defendants

- Appellees

______________________

2016

- 1510

______________________ Appeal from the United States District Court for the District of Delaware in No. 1:14

- cv

- 01063

- LPS, Chief Judge Leona rd P. Stark.

______________________

Decided: March 7, 2017

______________________

P AUL R. G UPTA , Reed Smith LLP, San Francisco, CA, argued for plaintiff

- appellant. Also represented by G ERARD M. D ONOVAN , Washington, DC; R. E RIC H UTZ , R UDOLF E DWARD H UTZ , Wilmin g ton, DE; J AMES C HRISTOPHER M ARTIN , Pittsburgh, PA.

D AVID A. N ELSON , Quinn Emanuel Urquhart & Sull ivan, LLP, Chicago, IL, argued for defendants -appellees.TRUSTED KNIGHT CORPO RATION v. IBM 2

Also represented by J OHN T HOMAS M C K EE , A LEXANDER R UDIS , New York, NY.

______________________
Before D YK , R EYNA , and S TOLL , Circuit Judges.

S TOLL , Circuit Judge

. Trusted Knight Corporation appeals from a stip u lated judgment of invalidity from the United States District Court for the District of Delaware following adverse in definiteness rulings against its asserted patent, U.S. Patent No. 8,316,445. W e affirm.

B ACKGROUND

I.
Trusted Knight owns the ’445 patent, which gene r ally discloses “systems and methods for protection against the operation of malware commonly used in ide ntity

- theft and cyber

- fraud.” ’445 patent col. 1 ll. 24

– 26. More specifica lly, the ’445 patent purports to protect against a type of malware known as key lo g ging. According to the ’445 patent, key logging “is a method of capturing keyboard input to a computer or computing device” and “is a common technique for obtaining pas swords and sensitive information using unauthorized software.” Id. at col. 1 ll. 57

– 60. There are many key

- logging techniques

, “including hooking various ope rating system Application Programming Interfaces (APIs) and system drivers, screen capture, and form grabbing and hook based keystroke logging.” Id. at col. 2 ll. 1

– 4. The ’445 patent describes in detail two types of key lo gging —hook- based key logging and form

- grabbing key loggi ng.
T he ’445 patent describes h ook- based key logging as the insertion of a system API hook into an API stack, which allows the key logger to record all ke y stroke dataTRUSTED KNIGHT CORPO RATION v. IBM 3

passing through an operating system driver. T he logger
saves t his data to a text file, which can subsequently be sent to malefactors at a remote location. Because this method of key logging indi s criminately records all of the keystroke data , it often results in a large volume of data that is burdensome to store. Additionally, th is volum inous data can be “di f ficult to search for the purpose of extracting the very small percentage of data that repr esents credential and password information.” Id. at col. 2 ll. 24

– 26. “As a result, malefactors have fine

- tuned their malware to me et these challenges and better reduce the large take of useless data stolen by their malware.” Id. at col. 2 ll. 26

– 28.

One such fine

- tuned version of key logging is f orm

grabbing key logging , which the ’445 patent describes as the insertion of a hook th at captures form data solely from form data inputs. “ The form information being stolen is, essentially, those forms used for online banking and other online commerce that require users to enter personal information, card data, passwords, reminder question s, and mother ’ s maiden names. ” Id. at col. 2 ll. 31

– 35. For example, “when a user submits data to a legitimate banking website using web forms, a form

- grabbing key logger that is monitoring the web browser can grab the submitted data by injecting a hook and hooking API functions within the browser.” Id. at col. 2 ll. 60

– 64. The patent further explains that sophisticated cyber criminals have come to prefer form

- grabbing key loggers because : (1) they are r e sistant to detection and lack effective
counterme as ures ; (2) they substantially reduce the vo lume of captured data ; and (3) they capture the vast majority of credentials criminals want, since almost all crede n tials used for online transactions are inputted into a web form.
The ’445 patent describes various prior art methods used to counteract key logging malware. Many of these methods “are available to detect and/or disable hook

-TRUSTED KNIGHT CORPO RATION v. IBM 4

based key loggers.” Id. at col. 3 ll. 15

– 16. For example, “[o] ne method used is the unhooking of API’s that insert themselves into the API stack.” Id. at col. 3 ll. 17

– 19. T he ’445 patent warns , however, that this method does
not protect the user when the malware inserts a hook at the first instance in the API stack and it is also in effective against form

- grabbing key loggers.

Another method works by launching a new process when it detect s a hook

- based key logger

, whereby the keystroke data is passed through the new process and bypasses the keystroke

- logger hook. T he ’445 patent

warns , however, that this method can cause system instability and can be counteracted by key loggers.

The invention

, as described in the ’445 patent spe c ification

, allegedly improves upon the prior art by preven ting the actions of form

- gra bbing and hook

- based key loggers in a way that “does not depend on the detection of malware at all.” Id. at col. 3 ll. 60

– 61. One embodiment of the invention prevents form

- grabbing key logging. Specifically, the software : (1) identifies forms on a calle d web page ; (2) connects to each form submis sion event; (3) clears all form inputs marked with INPUT or PASSWORD; (4) provides the user

- inputted data to the designated receiving party, such as a bank; and (5) e nsures that all password form fields are cleared from the API chain.
Another embodiment of the invention prevents the a ctions of both hook- based and form

- grabbing key loggers. The software hooks the kernel keyboard driver where it intercepts and encrypts the keystroke data received from th e keyboard. This encrypted data is then sent to the intended application, such as a web browser, where the keystrokes are decrypted and presented to the web form for submission to the de s ignated receiving entity.
The ’445 patent has three independen t claims : claims 1, 22, and 23. Claim 1 of the ’445 patent r e cites:TRUSTED KNIGHT CORPO RATION v. IBM 5

1. A software program embedded in a non

transitory microprocessor

- readable storage med ium and executable by a microprocessor to prevent software key logging comprising:

a software module that inserts and ex ecutes predetermined software processes at

a zero

- ring level in an application pr ogramming interface (“API”) stack of a browser, said software pr o cesses inclu ding: a process of detecting a browser form su b mission initiation call
event at the zero

- ring level, wher ein the form submission initiation call event takes a form of an on Submit call or a BeforeNavigate call; a process of intercepting data i nputs keyed in by a user at the z ero

- ring level; and a process of (1) submitting the keyed-i n data to a designated ent ity through the API stack while (2) clearing confidential data from i ntercepted data at the zero

- ring level prior to a subsequent tran smission, which does not contain said confidential data, in response to the software key logging through the API stack to an internet co mmunication port

. Id. at col. 11 ll. 33

– 53 (disputed claim term italicized). Claim 22 recites:

22. A software program embedded in a non

transitory microprocessor

- readable storage med i-TRUSTED KNIGHT CORPO RATION v. IBM 6

um and executable by a microproc essor to prevent software key logging comprising:

a software module that inserts and ex ecutes predetermined software processes at

a zero

- ring level in an application pr ogramming interface (“API”) stack of a browser, said software pr o cesses inclu ding:

a pro cess of inserting an initial hook which works within the 0

- Ring level and prevents any other hooks from inserting at the 0

- Ring level; a process of detecting a browser form su b mission initiation call event at the zero

- ring level, wher ein the form submissio n initiation call event takes a form of an o nSubmit call or a BeforeNavigate call; a process of intercepting and encrypting data inputs keyed in by a user at the zero

ring level; a process of passing the encrypted data to a 3

- ring level where a hook insert ed by a hook

- based key lo gger; a process of decrypting data which passed via the 3

- ring level; and a process of submitting the d ecrypted data to a designated entity through the API stack to an inte rnet communication port.TRUSTED KNIGHT CORPO RATION v. IBM 7

Id. at col. 12 l. 57 – col. 13 l. 13 (disputed claim term italicized). 1

II.
Trusted Knight sued International Business M achines Corporation and Trusteer, Inc. for infring e ment of the ’445 patent. The district court conducted a Markman hearing and issued a claim construction order constru ing four disputed claim terms. Trusted Knight Corp. v. Int’l Bus. Machs. Corp. , No. 14

- 1063

- LPS

- CJB, 2015 WL 7307134 (D. Del. Nov. 19, 2015). Relevant here, the district found the following dispu t ed claim terms indefinite: (1) “in response to the sof t war e key logging through the API stack to an internet communication port

, ” recited in independent claims 1 and 23; and (2) “a process of passing the encrypted data to a 3

- ring level where a hook inserted by a hook

- based key logger

, ” recited in indepen dent cla im 22. Id. at * 4– 7. Following the district court’s claim construction order, the parties filed a stipulated final judgment of invalidity. Trusted Knight appeals the district co urt’s indefiniteness rulings, and w e have jurisdiction under 28 U.S.C. § 12 95(a)(1).

D ISCUSSION On appeal, Trusted Knight argues that the district
court erred in ruling that the claim limitation , “in r esponse to the software key logging through the API stack to an internet communication port,” recited in claims 1 and 23, is indefinite

. Trusted Knight also argues that the district court erred in ruling that the claim limitation

, “a process of passing the encrypted data to a 3

- ring level

1 We do not reproduce claim 23 because the pa r ties agree that it “recites a method counterpart to claim 1.” Appellant Br. 16; Appellee Br. 6.TRUSTED KNIGHT CORPO RATION v. IBM 8

where a hook inserted by a hook

- based key logger,” reci ted in claim 22, is indefinite . We address these argument s in turn.

I. Pursuant to 35 U.S.C. § 112, ¶ 2, a patent specific ation must “ conclude with one or more claims partic u larly pointing out and distinctly claiming the subject matter which the applicant regards as his invention. ” 2 The S upreme Court has held this definiteness prov i sion “to require that a patent ’ s claims, viewed in light of the specification and prosecution history, inform those skilled in the art about the scope of the inve n tion with reason able certainty. ” Nautilus, Inc. v. B i osig Instruments, Inc.

, 134 S. Ct. 2120, 2129 (2014).

As t he Supreme Court explained

, the definiteness requirement “entails a ‘delicate balance.’” Id. at 2128 (quoting Festo Corp. v. Shoketsu Kinzoku Kogyo K a bush iki Co.

, 535 U.S. 722, 731 (2002) ). On one hand, “the inherent limitations of language ,” id. (citing Fe s to , 535 U.S. at 731), must be taken into account, re c ognizing that “[s]ome modicum of uncertainty

. . . is the ‘price of ensuring the appropriate incentives for innovation

, ’” i d. ( quoting Festo , 535 U.S. at 732). On the other hand , “ a patent must be precise enough to afford clear notice of what is claimed , thereby ‘a p pris[ing] the public of what is still open to them.’” Id. at 2129 (alteration in original) (quoting Markman v. Westview Instruments, Inc.

, 517 U.S. 370 , 373 (1996)). “Otherwise there would be ‘[a] zone of

2 Because the ’ 445 patent w as filed before the ado ption of the Leahy

– Smith America Invents Act, Pub. L. No. 112

– 29, § 4(e), 125 Stat. 284, 296

- 97 (2011), the previous version of § 112 governs. See AbbVie Deutschland GmbH & Co. KG v. Janssen Biotech, Inc. , 759 F.3d 1285, 1290 n.3 (Fed. Cir. 2014).TRUSTED KNIGHT CORPO RATION v. IBM 9

uncertainty which enterprise and experimentation may enter only at the risk of infringement claims.’” Id. (alter ation in original) (quoting United Carbon C o. v. Bin ney & Smith Co. , 317 U.S. 228, 236 (1942)).
Here, the district court held that the claim term “in response to the software key logging through the API stack to an internet communication port ” is indefinite because it is unclear what “in response to the so ftware key logging” requires. We agree.
Trusted Knight argues that the claim limitation does
not require respond ing to or detect ing actual instances of malware on a user’s computer

. This a r gument finds support in the specification, which em phasizes that “[t]he solution of the present invention does not depend on detection of malware at all.” ’445 patent at col. 3 ll. 59

– 61. As t he district court asked , however, “if the invention is not responding to ma l ware, then what is happening

‘ [

i]n response to the software key logging? ’” Trusted Knight , 2015 WL 7307134

, at *5. Trusted Knight answers that the claimed invention responds to the threat of malware: “ The specification clarifies that the ‘ in response
to ’ term should be read as being in response to the threat of key logging malware, whether detected or not, and whether present or not.” Appellant Br. 32. This pos i tion, however, is undermined by the claim language itself

, which as the district court noted, “suggests an event (‘response’) triggered by ano ther event (‘lo g ging’).” Trus ted Knight , 2015 WL 7307134

, at *5. The claim limitation does not even refer to the “ threat ” or “potential presence” of key logging; rather it refers to key logging

. After review of the relevant intrinsic evidence an d the parties’ positions , we agree with the district court that the meaning of this claim limitation is not re a sonably certain. T he “in response to” claim term does not “appris [e] the publi c of what is still open to them,” Nautilus

, 134 S. Ct. at 2129 (quotin g Mar k man , 517 U.S. at 373 ), and createsTRUSTED KNIGHT CORPO RATION v. IBM 10

“[a] zone of unce r tainty which enterprise and experime ntation may enter only at the risk of infringement claims ,” id. (quoting United Carbon , 317 U.S. at 236 ). Accordin gly, we hold that claims 21 and 23 of the ’445 patent are invalid for indefiniteness because , when read in light of the specification, Trusted Knight has failed to i n form with reasonable certainty those skilled in the art about the scope of its invention

. II.
Trusted Knight also argues that the disputed claim term, “a process of passing the encrypted data to a 3

- ring level where a hook inserted by a hook

- based key logger,” recited in claim 22, is not indefinite. Both parties concede that this claim term conta ins a typ o graphical error. See Appellant Br. 6; Appellee Br. 2. Specifically, the claim term is missing a verb between “hook ” and “ inserted.”

“ It is well

- settled law that, in a patent infring e ment suit, a district court may correct an obvious error in a patent claim. ” CBT Flint Partners, LLC v. Return Path, Inc. , 654 F.3d 1353, 1358 (Fed. Cir. 2011) (citing I.T.S. Rubber Co. v. Essex Rubber Co. , 272 U.S. 429, 442 (1926)). A district court can only correct a patent, however, if : “(1) the correction is not subject to reasonable debate based on consideration of the claim language and the specification and (2) the prosecution history does not suggest a diffe rent interpretation of the claims. ” Novo Indus. v. Micro Molds Corp. , 350 F.3d 1348, 1357 (Fed. Cir. 2003).

The district court held that this claim limitation was not amenable to correction because the correction was subject to reasonable debate based on consider a tion of the claim language and the specification. We agree.
Trusted Knight argues that the claim limitation can be corrected by inserting “is” in between “hook ” and

“ inserted,” s o the claim limitation would read “a process of passing the encrypted data to a 3

- ring level where a hookTRUSTED KNIGHT CORPO RATION v. IBM 11

[is] inserted by a hook

- based key logger .” Such a corre ction, however, would sugges t that the “process of passing the encrypted data to a 3

- ring level” occurs only when a hook is actually inserted

. But a s noted above in the discussion of the “in r e sponse to” limitation , the specific ation emphasizes that the invention operates regardless of the presence or detection of malware. This ambiguity, noted by the district court, demonstrates that Trusted Knight’s correction to the claim language is subject to

reasona ble debate.

Indeed , other possible corrections appear to be fe as ible. The district court , for example, explained that it could correct the claim limitation by placing “could be” between “hook inserted,” such that the claim limit a tion would read “a process of passing the encrypted data to a 3- ring level where a hook [could be] in serted by a hook

based key logger .” W hile this correction would seem to be consistent with the specification and Trusted Knight’s position that the claimed invention operates even in the absence of malware, it would create a different claim scope than Trusted Knight’s proposed correction of adding “is.” Thus, because the proposed construction is subject to reasonable debate, the disputed claim limitation is not amenable to co r rection. Additionally, as the claim limitation stands unco rrected , it does not i nform those skilled in the art about the scope of the invention with reasonable certainty

. W e accordingly hold that claim 22 of the ’445 patent is invalid for indefiniteness because , when read in light of the specification, Trusted Knight has failed to i n form with reasonable certainty those skilled in the art about the scope of its invention

. C ONCLUSION
We have considered Trusted Knight ’s remaining arguments and determined that they lack merit. Be cause claims 1, 22, and 23 do not reasonably inform thoseTRUSTED KNIGHT CORPO RATION v. IBM 12

skilled in the art about the scope of the inve n tion with reasonable certainty, they are indefinite, and we affirm the district court ’s judgment of indef i niteness

. AFFIRMED

C OSTS Costs to Appellees.