Ex. F ‐ Claim Chart

U.S. Patent No. 10,503,418

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 1 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[pre] A method ofcontrolling write accessto a data storage device

by an applicationrunning in applicationspace on a first computer

comprising:

Sophos performs the method of claim 29 via its SophosLabs network. Specifically, 

products that can run on endpoints or end‐user devices (i.e., on a first computer) 

devices from electronic threats such as viruses, ransomware, malware, and the lik

“hostile applications”). That software includes but is not limited to, software that Anti‐Virus, Sophos Behavior Monitoring, and/or Sophos Live Protection. For exam

products include Endpoint Security and Control, Intercept X, Intercept X Advanced

Advanced with EDR, Central Endpoint Protection, Home, and Home Premium.

CLAIM 29 SOPHOS PRODUCTS

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at p. 2

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 2 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[pre] A method ofcontrolling write accessto a data storage device

by an applicationrunning in applicationspace on a first computer

comprising:

Relevant features discussed in this chart span the software of Endpoint Security aIntercept X, Intercept X Advanced, Intercept X Advanced with EDR, Central Endpo

Home Premium as shown in this charts. Upon information and belief, Endpoint Sean earlier iteration of the Intercept X & Central Endpoint Suite.

https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-endpoint-license-gui

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 3 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[pre] A method ofcontrolling write accessto a data storage device

by an applicationrunning in applicationspace on a first computer

comprising:

This chart shows an overview of the Sophos Home and Home Premium editions.

https://home.sophos.com/en-us/free-anti-virus-windows.aspx

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 4 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[a] receiving at aserver computer from aplurality secondcomputers operativelyconnected to the serverby means of a data

network, acorresponding plurality

of permission valuesassociated with theapplication operating on

the first computer;

The SophosLabs network receives at a server computer from a plurality second co

operatively connected to the server by means of a data network, a corresponding 

permission values associated with the application operating on the first computer

network includes servers that collect data via a data network from many resourceplurality of second computers, including the “Threat Intelligence Sources” shown 

permission values can be, for example, allowing the application access, denying th

access, and/or a whitelist value.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐threat‐intelligen

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 5 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[a] receiving at aserver computer from aplurality secondcomputers operativelyconnected to the serverby means of a data

network, acorresponding plurality

of permission valuesassociated with theapplication operating on

the first computer;

As another example, the SophosLabs network is operatively connected to second 

associated with Sophos’s agents (e.g., experts) who analyze malware and provide 

server based on the analysis.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/sophosendpointsecurityanddataprotect

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 6 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[b] storing said

permission values;

The SophosLabs network stores the permission values so that it can maintain the information based on, at least in part, the second computers discussed in the slidelement 29[a].

https://community.sophos.com/kb/en‐us/111334

https://community.sophos.com/kb/en‐us/110921

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 7 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[c] generating anoutput permission valuefor the application independence on the

stored permissionvalues;

The SophosLabs network generates an output permission value for the applicatio

the stored permission values. For example, the stored permission values indicate application is clean or malicious and the SophosLabs network generates an outpu

that is sent back to the computer.

https://community.sophos.com/kb/en‐us/110921

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 8 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[c] generating anoutput permission valuefor the application independence on the

stored permissionvalues;

As another example, the stored permission value may indicate whether to ignore 

treat the application as malware, or treat the detection as suspicious. The Sophosgenerates an output permissive value that is sent back to the computer to indicatbased on the stored permission value.https://community.sophos.com/kb/en‐us/111334

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 9 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The SophosLabs network servers receive at said server computer from the first co

connected to the server by means of a data network, a request for a permission v

with the application running on the first computer as a result of a process monito

requests by the application on the first computer detecting an attempt by the appdata to the data storage device, interrogating a local database of permission valuelocate a permission value associated with the application.

The computer using Sophos’s software (e.g., an endpoint) is operatively connecte

network servers by means of a data network as shown below.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐threat‐intellig

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 10 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The computer using Sophos’s software sends a query that is received at a Sophos

request for a permission value associated with the application running on the firs

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at p. 2

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 11 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

More specifically, the computer using Sophos’s software sends, for example a DN

SophosLabs server.https://community.sophos.com/kb/en‐us/110921https://community.sophos.com/kb/en‐us/111334

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 12 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

The computer using Sophos’s software sends a request (e.g., a Live Protection loo

response to that software monitoring write access requests attempts by the appldetecting an attempt by the application to write data to a storage device (e.g., ha

on the computer. For example, Sophos’s “malicious behavior detection” analyzes on the computer to detect and block known malicious activity, including attempts 

data storage medium. As shown below, using Sophos’s Behavior Monitoring, Soph

behavior detection analyzes the behavior of program and watches for signs of ma

suspicious writes to the registry or file copy actions.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at pp

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 13 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Sophos “on‐access scanning,” detects attempts by the applic

to said storage medium. For example, on‐access scanning detects any attempts to 

rename a file, which necessarily includes an attempt by the application to write dmedium. Further, “on‐access scanning” may be set to “check files on write.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at pp. 

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 14 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

In response to the “malicious and suspicious behavior detection” and/or “on‐accediscussed in the previous two slides, the Sophos software on the computer sends 

permission value (e.g., a Live Protection lookup query).

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at p. 2

https://community.sophos.com/kb/en‐us/111334

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 15 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

Sophos’s software interrogates a local database of permission values to locate a p

associated with the application in the local database. This includes interrogating dby Sophos permission values or by permission values set by the user. For examplesoftware utilizes rules, policies, whitelists, authorized lists, and/or exceptions that local database. For example, Sophos’s “Authorized list” includes at lease one perman authorization) associated with each item on the list, and each item is associateapplication. If it fails to locate a permission value associated with the application 

list in the local database, and fails to identify whether the application is clean or m

locally stored information on the computer, it sends a query to the SophosLabs ne

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at pp. 

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 16 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Sophos’s software includes “whitelists” stored in a local data

computer to limit the number of Live Protection lookups. The whitelists includes apermission value (e.g., an authorization) associated with each item on the list, anassociated with an application. If the Sophos software fails to locate a permission with the application from the whitelist in the local database, and fails to identify w

application is clean or malicious using locally stored information on the computer

the SophosLabs network.

https://community.sophos.com/kb/en-us/111334

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 17 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Sophos’s software includes an allow list. The allow list includ

permission value (e.g., an authorization) associated with each item on the list, anassociated with an application. If the Sophos software fails to locate a permission with the application from the allow list in the local database, and fails to identify w

application is clean or malicious using locally stored information on the computer

the SophosLabs network. While an allow list is maintained by SophosLabs, the list 

stored in the computer to “improve performance.”

https://community.sophos.com/kb/en‐us/110921

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 18 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Sophos’s software uses excluded lists stored in a local datab

The excluded lists use at least one permission value (e.g., an authorization) assoc

on the list, and each item is associated with an application. If the Sophos software permission value associated with the application from the excluded list in the loca

to identify whether the application is clean or malicious using locally stored informcomputer, it sends a query to the SophosLabs network.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pd

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 19 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As another example, Sophos’s software uses specified file extensions stored in a l

computer. The specified file extension are at least one permission value (e.g., a diassociated with each item on the list, and each item is associated with an applicatsoftware locates a permission value associated with the application from the file 

local database, but fails to identify whether the application is clean or malicious u

information on the computer, it sends a query to the SophosLabs network.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf, at p. 1

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 20 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[d] receiving at said

server computer fromthe first computeroperatively connected tothe server by means of a

data network, a requestfor a permission valueassociated with theapplication running on

the first computer as aresult of a process

monitoring write access

requests by the

application on the first

computer detecting anattempt by theapplication to write datato the data storage

device, interrogating a

local database ofpermission values andfailing to locate apermission valueassociated with theapplication in the localdatabase;

As yet another example, Sophos’s “threat identity (IDE)” files are stored in a local 

computer. The IDE files include at least one permission value (e.g., indicating whemalicious or if the maliciousness of the item is known) associated with each item 

each item is associated with an application. If the Sophos software fails to locate 

associated with the application from the threat identities in the local database, it 

the SophosLabs network.

https://community.sophos.com/kb/en‐us/110921

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 21 of 22
Ex. F – Claim Chart

U.S. Patent No. 10,503,418

29[e] selecting the

stored permission value

in response to receivingthe request; and29[f] transmitting to saidfirst computer theoutput permission valuederived from theplurality of receivedpermission values to thefirst computer over thedata network in order to

cause the monitoringprocess operating on the

first computer to permit

or deny write access by

the application to the

data storage device independence on the

transmitted output

permission value.

For the SophosLabs network to respond to a query or update a local database (e.g

whitelist or IDE file), it must select the stored permission value in response to rec

and transmit it to the first computer. The output permission value is derived from received permission values as discussed for limitation 29[c]. That response is sent 

Sophos software operating on the first computer to permit or deny write access b

the data storage device in dependence on the transmitted output permission valupreviously, the purpose of the SophosLabs network is to provide the first compute

threat information. And as discussed previously, that information is used to deterallow or deny write access to the application. The slides related to limitation 29[b

incorporated herein.

CLAIM 29 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-7 Filed 05/14/20 Page 22 of 22