Ex. D ‐ Claim Chart

U.S. Patent No. 7,664,924

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 1 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[pre] In a computercomprising a storagemedium and an

application running on

said computer, a method

of controlling writeaccess to said storagemedium by said

application comprising:

Sophos offers various software that performs the method of claim 1. Specifically, 

applications to protect against electronic threats such as viruses, ransomware, m

That software includes features such as Sophos Anti‐Virus, Sophos Behavior Mon

Sophos Live Protection. For example, the infringing products that incorporate tho

Endpoint Security and Control, Central Endpoint Protection, Intercept X, Intercept Intercept X Advanced with EDR, Home, and Home Premium.

CLAIM 1 SOPHOS PRODUCTS

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 2 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[pre] In a computercomprising a storagemedium and an

application running on

said computer, a method

of controlling writeaccess to said storagemedium by said

application comprising:

Relevant features discussed in this chart span the software of Endpoint Security aIntercept X, Intercept X Advanced, Intercept X Advanced with EDR, Central Endpo

Home Premium as shown in this charts. Upon information and belief, Endpoint Sean earlier iteration of the Intercept X & Central Endpoint Suite.

https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-endpoint-license-gui

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 3 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[pre] In a computercomprising a storagemedium and an

application running on

said computer, a method

of controlling writeaccess to said storagemedium by said

application comprising:

This chart shows an overview of the Sophos Home versus Premium editions.

https://home.sophos.com/en-us/free-anti-virus-windows.aspx

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 4 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[pre] In a computercomprising a storagemedium and an

application running on

said computer, a method

of controlling writeaccess to said storagemedium by said

application comprising:

Sophos’s software operates and runs on a computer such as a PC, Mac, or Server 

medium such as a hard disk or memory. The software controls write access to the 

medium to prevent malicious files from being written to the device, which is a cesoftware sold by Sophos. As shown below, Sophos’s software analyzes application

computer and blocks activity of the applications that appear to be malicious, inclu

access.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.p

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 5 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

Sophos’s software detects attempts by the application to write data to said storag

example, Sophos’s “malicious behavior detection” analyses programs running on 

detect and block known malicious activity, including attempts to write data to the 

As shown below, using Sophos’s Behavior Monitoring, Sophos’s “suspicious behavanalyzes the behavior of program and watches for signs of malware, such as suspregistry or file copy actions.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.p

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 6 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

As another example, Sophos’s “on‐access scanning,” detects attempts by the app

to said storage medium. For example, on‐access scanning detects any attempts to 

rename a file, which necessarily includes an attempt by the application to write d

medium. Further, “on‐access scanning” may be set to “check files on write.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 7

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 7 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

In response to the write attempts discussed for limitation 1[a], the Sophos software atte

permission value from a database comprised of data elements encoding at least one per

associated with one or more applications. For example, the Sophos software utilizes rule

authorized lists, and/or exceptions that are stored in a database. For example, Sophos’s “

includes at lease one permission value (e.g., an authorization) associated with each item 

item is associated with an application.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf a

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 8 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

As another example, Sophos’s software includes “whitelists.” Sophos’s “whitelist” include

permission value (e.g., an authorization) associated with each item on the list, and each i

an application.

https://community.sophos.com/kb/en-us/111334

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 9 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

In yet another example, Sophos’s software includes an allow list. Sophos’s “allow list” inc

permission value (e.g., an authorization) associated with each item on the list, and each i

an application. The items on list are stored on a database that include data elements enc

values, e.g., “authorized,” that are associated with the items on the list. While an allow li

SophosLabs, the list is provided to and stored in the computer to “improve performance.

https://community.sophos.com/kb/en‐us/110921

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 10 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

In yet another example, Sophos’s software may exclude certain files, folder, and/or drive

scanning. The information regarding the excluded files, folders, and/or drives are store o

include data elements encoding permission values, e.g., specifying not to scan. The value

one or more applications (e.g., the applications within the files, folder, and/or drives).

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pd

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 11 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

Similarly, Sophos’s software may exclude certain file types from on‐access scanning. The 

the file types are stored on a database that include data elements encoding permission v

files types to scan. The values are associated with one or more applications (e.g., by file e

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 11

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 12 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

As yet another example, Sophos’s software causes “threat identity (IDE)” files to be store

the computer. The IDE files include a permission value indicating whether the item is ma

is comprised of data elements encoding at least one permission value (malicious or not) a

one or more applications.

https://community.sophos.com/kb/en‐us/110921

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 13 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

In the case where no permission value for the running application is found in the 

application is not authorized, whitelisted, allowed, excluded or present on an IDE software transmits a query (e.g., a “DNS query”) comprised of an indicia of identisaid running application (e.g., “certain file data”) to a central server operatively cocomputer and to at least one additional computer. (e.g., Sophos’s SophosLabs serthis step occurs via “live lookups” to “check suspicious files.”

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf 

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 14 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/sophosendpointsecurityandda

As an example, the software “Automatically trigger[s] live lookups to SophosLabs 

files.”

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 15 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

More specifically, the “endpoint” (i.e., the computer) can perform cloud look‐ups 

files to determine if safe/malicious. This lookup (i.e., query) will necessarily compidentity associated with sad running application for SophosLabs to “lookup” the adatabase.

https://community.sophos.com/kb/en‐us/110921

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 16 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

Sophos’s software on the endpoint performs the lookups over DNS queries as sho

https://community.sophos.com/kb/en‐us/110921https://community.sophos.com/kb/en‐us/111334

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 17 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

The SophosLabs server is connected to at least one additional computer. For exam

with Sophos’s Live Protection technology is operatively connected to the SophosLanother example, additional computers are associated with Sophos’s agents who and provide updates to the server based on the analysis.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/sophosendpointsecurityanddataprotect

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 18 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

The server is connected to numerous additional computers, as shown below.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐threat‐intelligen

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 19 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The Sophos software causes the computer to receive from said central server, dat

the collective response of the user of the at least one additional computer to req

application running on said at least one additional computer to access the storage comprises said at least one additional computer. For example, the computer rece

from the server that includes data indicating the status of the file.

https://docs.sophos.com/esg/endpoint-security-and-control/10-6/help/en-us/PDF/sesc_h.pdf at 28

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 20 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

As another example, the computer receives a response from the server that inclu

an action to take.

https://community.sophos.com/kb/en‐us/111334

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 21 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The data in the response mentioned previously represents the collective response 

at least one additional computer. The data is based on the “aggregating telemetry

computers operatively connected to the server.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐threat‐intelligen

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 22 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

Moreover, Sophos’s agents (i.e., its experts) review threat information using an ad

operatively coupled to the server. The expert’s response via the additional compuserver and is represented by the data in the response that is sent to the compute

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐thre

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 23 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The data in the response, mentioned in the last slide represents the collective res

the at least one additional computer. For example, Sophos’s agents (its experts) ucomputer to provide responses.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/sophosendpointsecurityanddataprotect

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 24 of 25
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

As another example, Sophos uses additional computers for its sandbox. During re

sandbox, a user of the additional computer provides a response related to the file

provides the collective response to the endpoint.

https://www.sophos.com/en‐us/medialibrary/pdfs/factsheets/oem‐solutions/sophos‐threat‐intelligen

CLAIM 1 SOPHOS PRODUCTS

Case 6:20-cv-00393-ADA Document 1-5 Filed 05/14/20 Page 25 of 25