Ex. E ‐ Claim Chart

U.S. Patent No. 9,600,661

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 1 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[pre] In a computer

comprising a mass datastorage device and an

application running on

said computer inconjunction with an

operating system that

manages access to saiddata storage device, a

method of controllingwrite access to said datastorage device by saidapplication comprising:

CLAIM 16 SOPHOS PRODUCTS

Sophos offers various software that performs the method of claim 16. Specifically

many applications to protect against electronic threats such as viruses, ransomwa

the like. That software includes features such as Sophos Anti‐Virus, Sophos Behav

and/or Sophos Live Protection. For example, the infringing products that incorpor

include Endpoint Security and Control, Central Endpoint Protection, Intercept X, In

Advanced, Intercept X Advanced with EDR, Home, and Home Premium.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PD

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 2 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[pre] In a computer

comprising a mass datastorage device and an

application running on

said computer inconjunction with an

operating system that

manages access to saiddata storage device, a

method of controllingwrite access to said datastorage device by saidapplication comprising:

Relevant features discussed in this chart span the software of Endpoint Security aIntercept X, Intercept X Advanced, Intercept X Advanced with EDR, Central Endpo

Home Premium as shown in this charts. Upon information and belief, Endpoint Sean earlier iteration of the Intercept X & Central Endpoint Suite.

https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-endpoint-license-gui

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 3 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[pre] In a computer

comprising a mass datastorage device and an

application running on

said computer inconjunction with an

operating system that

manages access to saiddata storage device, a

method of controllingwrite access to said datastorage device by saidapplication comprising:

This chart shows an overview of the Sophos Home versus Premium editions.

https://home.sophos.com/en-us/free-anti-virus-windows.aspx

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 4 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[pre] In a computer

comprising a mass datastorage device and an

application running on

said computer inconjunction with an

operating system that

manages access to saiddata storage device, a

method of controllingwrite access to said datastorage device by saidapplication comprising:

Sophos’s software operates and runs on a computer such as a PC, Mac, or Server device such as a hard disk or memory. The software controls write access to the c

device to prevent malicious files from being written to the device, which is a cent

software sold by Sophos. As shown below, Sophos’s software analyzes application

computer and blocks activity of the applications that appear to be malicious, inclu

access to the storage device.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 25-2

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 5 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[a] detecting using aprocess operating inkernel mode monitoringfile system access anattempt by theapplication to write dataof a designated file typeto said data storagedevice;

Sophos’s software performs the step of detecting using a process operating in ker

monitoring file system access an attempt by the application to write data of a des

said data storage device.For example, Sophos’s “malicious behavior detection” analyses programs running 

detect and block known malicious activity, including attempts to write data to the 

shown below, using Sophos’s Behavior Monitoring, Sophos’s “suspicious behavior 

the behavior of program and watches for signs of malware, such as suspicious wr

or file copy actions.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 25-2

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 6 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[a] detecting using aprocess operating inkernel mode monitoringfile system access anattempt by theapplication to write dataof a designated file typeto said data storagedevice;

As another example, Sophos’s “on‐access scanning,” detects attempts by applicat

said storage devices. For example, on‐access scanning detects attempts to open, 

rename a file, which necessarily includes an attempt by the application to write dmedium. Further, “on‐access scanning” may be set to “check files on write.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 7

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 7 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[a] detecting using aprocess operating inkernel mode monitoringfile system access anattempt by theapplication to write dataof a designated file typeto said data storagedevice;

As noted in the previous slides for limitation 16[a], Sophos’s software detects atteapplications to write data of a designated file type to said storage device.

Further, that detection can occur using a process operating in kernel mode, as sho

Intercept X Solution Brief (https://www.avanet.com/assets/pdf/sophos‐intercept‐x‐solution‐briehttps://www.avanet.com/assets/pdf/sophos‐intercept‐x‐esg‐lab‐validation‐jan‐2018‐en.pdf at 8

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 8 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[a] detecting using aprocess operating inkernel mode monitoringfile system access anattempt by theapplication to write dataof a designated file typeto said data storagedevice;

https://community.sophos.com/kb/en‐us/13503

Below is another example of the detection occurring using a process operating in 

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 9 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

In response to the write attempts discussed for limitation 16[pre] and [a], the Sophos sof

permission value from a database comprised of data elements encoding at least one per

associated with the application. For example, the Sophos software utilizes rules, policies, 

lists, exceptions, allowed lists, and/or IDE file lists that are stored in a database. For exam

“Authorized list” includes at lease one permission value (e.g., an authorization) associate

the list, and each item is associated with an application. The programs on the exception l

database that include data elements encoding permission values, e.g., approved or block

associated with the applications on the list.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 6

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 10 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

As another example, the Sophos software also includes whitelists. The programs on that 

database that include data elements encoding permission values, e.g., trusted or not, tha

the applications on the list.

https://community.sophos.com/kb/en-us/111334

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 11 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

As another example, the Sophos software also includes an allow list. The programs on thdatabase that include data elements encoding permission values, e.g., allowed or not, th

the applications on the list. While an allow list is maintained by SophosLabs, the list is pro

in the computer to “improve performance.”

https://community.sophos.com/kb/en‐us/110921

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 12 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

As another example, the Sophos software also includes an excluded list. The programs on 

on a database that include data elements encoding permission values, e.g., excluded or n

associated with the applications on the list.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 21

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 13 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

Below is yet another example of a Sophos list that allows a user to specify which file exte

during on‐access scanning.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 15

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 14 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[b] in response to said

attempt, retrieving apermission value from a

database comprised of

data elements encodingat least one permissionvalue associated withthe application; and

As another example, the Sophos software also includes “threat identify (IDE) files.” The p

are stored on a database that include data elements encoding permission values, e.g., tru

associated with the applications on the list.

https://community.sophos.com/kb/en‐us/110921

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 15 of 16
Ex. E – Claim Chart

U.S. Patent No. 9,600,661

16[c] controlling write

access to the datastorage device by theapplication independence on said

permission value.

As shown in the slides for limitation 16[b], Sophos’s Software controls write acces

storage device by the application in dependence on said permission value. For exaapplication in on an authorized list, white list, or allowed list, or excluded list then 

allowed write access. Further, if the application is on an IDE file list, the permissio

discussed for limitation 16[b]) based on the list will indicate whether to allow or d

CLAIM 16 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-6 Filed 05/14/20 Page 16 of 16