Ex. F ‐ Claim Chart

U.S. Patent No. 10,503,418

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 1 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[pre] A method ofcontrolling write accessto a data storage device

by an applicationrunning in applicationspace on a first computer

comprising:

Trend Micro performs the method of claim 29 via its Smart Protection Network. S

Micro offers many applications that can run on end‐user devices (i.e., on a first co

those devices from electronic threats such as viruses, ransomware, malware, and “hostile applications”). That software includes but is not limited to, OfficeScan, En

Control, Apex One, Antivirus+ Security, Internet Security, and Maximum Security. 

software use the Smart Protection Network, which practices a method of control

data storage device by an application running in application space on a first compshown in this chart.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 2 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[a] receiving at aserver computer from aplurality secondcomputers operativelyconnected to the serverby means of a data

network, acorresponding plurality

of permission valuesassociated with theapplication operating on

the first computer;

Trend Micro’s Smart Protection Network receives at a server computer from a plucomputers operatively connected to the server by means of a data network, a cor

of permission values associated with the application operating on the first compuSmart Protection Network includes servers that collect data via a data network fro

that comprise a plurality of second computers, including from honeypots, webcra

initiative, customers and partners, and threat researchers.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 3 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[a] receiving at aserver computer from aplurality secondcomputers operativelyconnected to the serverby means of a data

network, acorresponding plurality

of permission valuesassociated with theapplication operating on

the first computer;

Trend Micro’s Smart Protection Network servers also collect data from a plurality computers, including from its sandbox. Those servers receive a corresponding plu

values associated with the application running on the first computer from the com

honeypots, webcrawlers, zero day initiative, customers and partners, threat reseasandbox. Those permission values can be, for example, allowing the application aapplication access, a trusted program value, a whitelist value, a blacklist value, a b

value, or an allowed program value.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 4 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[b] storing said

permission values;

Trend Micro’s Smart Protection Network stores the permission values so that it ca

its overall threat database using all its available resources.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 5 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[c] generating anoutput permission valuefor the application independence on the

stored permissionvalues;

Trend Micro’s Smart Protection Network generates an output permission value fo

dependence on the stored permission values. For example, if the stored permissiothat a hostile application was allowed access to a computer, resulting in a threat d

permission value to reject access for that application will be generated and updatcustomers using the Smart Protection Network.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 6 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[c] generating anoutput permission valuefor the application independence on the

stored permissionvalues;

As another example, if the stored permission values indicate that a benign applica

access to a computer without harm, an output permission value to allow access twill be generated and updated to Trend Micro’s customers using the Smart Protec

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 7 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s Smart Protection Network servers receive said server computer fro

computer operatively connected to the server by means of a data network, a requ

permission value associated with the application running on the first computer as process monitoring write access requests by the application on the first compute

attempt by the application to write data to the data storage device, interrogating 

permission values and failing to locate a permission value associated with the app

database.The computer using Trend Micro’s software is operatively connected to Trend Mic

Protection Network servers by means of a data network as shown below.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 8 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The computer using Trend Micro’s software sends a threat query that is received 

Micro’s Smart Protection Network as a request for a permission value associated running on the first computer.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 9 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The computer using Trend Micro’s software sends a threat query in response to th

monitoring write access requests attempts by the application and detecting an at

application to write data to a storage device (e.g., hard drive or memory) on the cattempt to write data can occur during every stage of the hostile application’s pre

point; (2) pre‐execution; (3) runtime; and (4) exit point. The graphic below showin

Micro’s software defends endpoints (e.g., the claimed “computer”) is illustrative. application arrives on an endpoint via for example a network, email, or USB, the s

attempts to write. Second, while a hostile application is being written to the stora

before execution, the software detects the attempts to write. Third, while a hosti

running it can make attempts to write data, which the software will detect. Fourt

application exits it can make attempts to write data, which the software will also 

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 10 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s software detects attempts by hostile applications to write data to a 

in any of the four stages outlined above. The example on this slide shows Trend MSecurity detecting an attempt to write by an email attachment. In the image beloto and or downloads a zip file from an email attachment, which would cause data 

storage device. In the image on the next slide, Trend Micro’s software detects tha

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 11 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The image below shows that Trend Micro’s software detects that attempt to write 

has clicked to save the file.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 12 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The image below shows another example of Trend Micro’s Security software’s abi

attempts by hostile applications to write data to a data storage device. As the ima

software scans for threats when saving or downloading files or when programs tr

unauthorized changes to system settings.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 13 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The image below shows another example of Trend Micro’s Security software’s abi

attempts by hostile applications to write data to a data storage device. As the imaare caught as they try to enter memory or touch the hard drive.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 14 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s Office Scan and Apex One software also include real‐time scans, wh

by hostile applications to write data to the computer’s data storage device.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 15 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s software also includes Behavior Monitoring that detects attempts b

applications to write data to a data storage device. As explained in the excerpt be

Monitoring constantly monitors endpoints, e.g., the claimed computers, for unus

the operating system or on installed software, e.g., attempts to write data to a da

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 16 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The Behavior Monitoring service includes ransomware protection that detects att

applications to write data to a storage device of a computer. Those attempts to w

example, in the attempts modify, delete, or rename files or in the modification of 

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 17 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The following excerpt shows that Trend Micro’s Security software (Antivirus+ Secu

Security, and Maximum Security) also include Behavior Monitoring functionality.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 18 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The following excerpt shows that Apex One also includes Behavior Monitoring fun

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 19 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s Endpoint Application Control software also detects attempts by hos

write data to a computer’s data storage device. Endpoint Application Control dete

to prevent them from occurring. For example it detects write attempts by executa

Windows App store apps, device drivers, controls panels, and other portable exec

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 20 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s software interrogates a local database of permission values to locat

value associated with the application in the local database. This includes interroga

populated by Trend Micro’s permission values or by permission values set by the 

smart scan feature first interrogate a local database of permission values (“perfor

local endpoint”). If it fails to locate a permission value associated with the applica

database, it sends a scan query to the Smart Protection Network, and then cachescan query.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 21 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Apex One includes the same functionality as Office Scan’s fu

discussed on the previous slide.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 22 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s Security software also uses a local database of permission values in 

the online database of the Smart Protection Network. The signature database is m

on Trend Micro Servers in the cloud,” which means that at least some of the data

locally.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 23 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Office Scan also interrogates a local database of permission values from an exception list 

programs and blocked programs. If a program is on the exception list as an approved pro

does not monitor that program. If a program is on the exception list as a blocked program

that program. Upon information and belief, the programs on the exception list are stored 

include data elements encoding permission values, e.g., approved or blocked, that are as

applications on the list.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 24 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The Office Scan software also interrogates a local database of permission values from a T

Upon information and belief, the programs on that list are stored on a database that incl

encoding permission values, e.g., trusted or not, that are associated with the applications 

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 25 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Office Scan interrogates a local database of permission values from a whitelist, such as th

trusted programs lists at each layer or stage.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 26 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Trend Micro’s other software packages also include exception lists and trusted programs 

excerpt shows that Antivirus+ Security, Internet Security, and Maximum Security also inc

trusted program lists.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 27 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The following excerpts also show that Apex One includes exception lists and trusted prog

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 28 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The following excerpts also show that, during for example real‐time scans that run in res

requests as discussed above, Office Scan and Apex One interrogating a local database of Those permission values are stored on a database containing the Smart Scan Agent Patte

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 29 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The following excerpts shows the same Smart Scan Agent Pattern for the Apex One.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 30 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As shown in the previous slides, the interrogation of the local database results in 

permission value, the Smart Protection Network receives a request for the permis

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 31 of 32
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[e] selecting the

stored permission value

in response to receivingthe request; and29[f] transmitting to saidfirst computer theoutput permission valuederived from theplurality of receivedpermission values to thefirst computer over thedata network in order to

cause the monitoringprocess operating on the

first computer to permit

or deny write access by

the application to the

data storage device independence on the

transmitted output

permission value.

For the Smart Protection Network to respond to a query or update a local signatuselect the stored permission value in response to receiving the request and transm

computer. The output permission value is derived from the plurality of received pdiscussed for limitation 29[c]. That response is sent to cause the Trend Micro softthe first computer to permit or deny write access by the application to the data st

dependence on the transmitted output permission value. As discussed previouslySmart Protection Network is to provide Trend Micro’s users with up‐to‐date informapplications are hostile. And as discussed previously, that information is used to d

to allow or deny write access to the application.

CLAIM 29 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-7 Filed 05/14/20 Page 32 of 32