Ex. D ‐ Claim Chart

U.S. Patent No. 7,664,924

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 1 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[pre] In a computercomprising a storagemedium and an

application running on

said computer, a method

of controlling writeaccess to said storagemedium by said

application comprising:

Trend Micro offers various software that performs the method of claim 1. Specific

offers many applications to protect against electronic threats such as viruses, rans

and the like (collectively “hostile applications”). That software includes but is not 

OfficeScan, Endpoint Application Control, Apex One, Antivirus+ Security, Internet 

Maximum Security.Trend Micro’s software operates and runs on a computer such as a PC, Mac, or Se

medium such as a hard disk or memory. The software controls write access to the 

medium to prevent hostile applications from writting to the device, which is a censoftware sold by Trend Micro. As illustrated in the graphic below, Trend Micro’s apsafe files while blocking malicious files.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 2 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

Trend Micro’s software detects attempts by the application to write data to said sThis attempt to write data can occur during every stage of the hostile application’

entry‐point; (2) pre‐execution; (3) runtime; and (4) exit point. The graphic below s

Micro’s software defends endpoints (e.g., the claimed “computer”) is illustrative. 

application arrives on an endpoint via for example a network, email, or USB, the sattempts to write. Second, while a hostile application is being written to the storabefore execution, the software detects the attempts to write. Third, while a hosti

running it can make attempts to write data, which the software will detect. Fourtapplication exits it can make attempts to write data, which the software will also 

CLAIM 1 TREND MICRO PRODUCTS PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 3 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The remaining slides for limitation 1[a] provide examples of Trend Micro’s softwa

attempts by hostile applications to write data to a storage medium in any of the f

above.The example on this slide shows Trend Micro’s Maximum Security detecting an at

an email attachment. In the image below, the user attempts to and or downloads 

email attachment, which would cause data to be written to the storage medium. next slide, Trend Micro’s software detects that attempt to write.

CLAIM 1 TREND MICRO PRODUCTS PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 4 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The image below shows that Trend Micro’s software detects that attempt to write 

has clicked to save the file.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 5 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The image below shows another example of Trend Micro’s Security software’s abi

attempts by hostile applications to write data to a storage medium. As the image 

scans for threats when saving or downloading files or when programs try to make 

changes to system settings.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 6 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The image below shows another example of Trend Micro’s Security software’s abi

attempts by hostile applications to write data to a storage medium. As the image 

caught as they try to enter memory or touch the hard drive.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 7 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

Trend Micro’s OfficeScan and ApexOne software also include real‐time scans, whi

by hostile applications to write data to the computer’s storage medium.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 8 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

Trend Micro’s software also includes Behavior Monitoring that detects attempts b

applications to write data to the storage medium. As explained in the excerpt belo

Monitoring constantly monitors endpoints, e.g., the claimed computers, for unus

the operating system or on installed software, e.g., attempts by hostile applicatio

the storage medium.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 9 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The Behavior Monitoring service includes ransomware protection that detects att

applications to write data to the storage medium of a computer. Those attempts t

example, in the attempts modify, delete, or rename files or in the modification of 

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 10 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The following excerpt shows that Trend Micro’s Security software (Antivirus+ SecuSecurity, and Maximum Security) also include Behavior Monitoring functionality.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 11 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

The following excerpt shows that Apex One also includes Behavior Monitoring fun

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 12 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[a] detecting an

attempt by theapplication to write data

to said storage medium;

Trend Micro’s Endpoint Application Control software also detects attempts by hos

write data to a computer’s storage medium. Endpoint Application Control detects 

prevent them from occurring. For example it detects write attempts by executabl

App store apps, device drivers, controls panels, and other portable executable file

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 13 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

In response to the write attempts discussed for limitation 1[a], OfficeScan attempts to re

value from a database comprised of data elements encoding at least one permission valu

or more applications. For example, the Behavior Monitoring functionality includes an exc

approved programs and blocked programs. If a program is on the exception list as an app

Office Scan does not monitor that program. If a program is on the exception list as a bloc

Scan blocks that program. Upon information and belief, the programs on the exception li

database that include data elements encoding permission values, e.g., approved or block

associated with the applications on the list.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 14 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

The Office Scan software also includes a Trusted Program list. Upon information and beli

that list are stored on a database that include data elements encoding permission values

that are associated with the applications on the list.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 15 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

Office Scan performs whitelist checking such as the exception list and trusted programs l

at each the stages discussed on slide 3.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 16 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

Trend Micro’s other software packages also include exception lists and trusted programs 

excerpt shows that Antivirus+ Security, Internet Security, and Maximum Security also inc

trusted program lists.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 17 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

The following excerpts also show that Apex One includes exception lists and trusted prog

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 18 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

The following excerpts also show that, during for example real‐time scans discussed abov

Apex One attempt to retrieve permission value from a database comprised of data eleme

one permission value associated with one or more applications. Those permission values 

database containing the Smart Scan Agent Pattern on the computer.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 19 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

The following excerpts shows the same Smart Scan Agent Pattern for the Apex One.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 20 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[b] in response to saidwrite attempt,attempting to retrieve apermission value from a

database comprised ofdata elements encodingat least one permissionvalue associated withone or moreapplications;

Trend Micro’s Security software also uses a local database of permission values in 

the online database of the Smart Protection Network. The signature database is mon Trend Micro Servers in the cloud,” which means that at least some of the data

locally.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 21 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

In the case where no permission value for the running application is found in the 

exception list, trusted list entry, or pattern detection, Trend Micro transmits a queindicia of identity associated with said running application to a central server opeto the computer and to at least one additional computer. For example, this step o

Micro’s Smart Protection Network. Trend Micro’s Smart Protection Network serve

monitor and collect threat data from across the globe. All Trend Micro products a

Smart Protection Network. Thus, all computers running Trend Micro’s software ar

Smart Protection Network servers.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 22 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

Trend Micro’s Smart Protection Network servers are connected to at least one ad

Those additional computers include for example honeypots, webcrawlers, zero da

customers and partners, threat researchers, and the sandbox.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 23 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[c] in the case that no

permission value for the

running application is

found in the database,transmitting to a centralserver operativelyconnected to the

computer and to at leastone additional computer,a query comprised of an

indicia of identityassociated with saidrunning application;

The computer using Trend Micro’s software transmits a query to Trend Micro’s Sm

Network comprised of an indicia of identity associated with said running applicati

the Smart Protection Network receives trillions of threat queries per year. For the 

Network to identify the suspected threat and respond to the query, the query mu

of identity associated with the running application.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 24 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The computer running Trend Micro’s software receives from said central servers o

Protection Network, data that represents the collective response of the user of th

additional computer to requests by the same application running on said at least 

computer to access the storage medium that comprises said at least one addition

example, Trend Micro’s customers and partners provide smart feedback to the Sm

Network. Once a threat is identified via that feedback, Trend Micro updates the SNetwork to block any subsequent encounters of that threat by any other Trend M

partners. Thus, the claimed computer receives from the central servers of the Sm

network data that represents the collective response to block the requests of the by all computers after the original encounter that identified the threat.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 25 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The image below further shows that the claimed computer receives from the cen

Smart Protection network data that represents the collective response to block th

hostile application by all computers after the original encounter that identified thAlternatively, if the application is benign, the Smart Protection Network sends a c

response that is representative of other responses from users that have similarly been unharmed.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 26 of 27
Ex. D – Claim Chart

U.S. Patent No. 7,664,924

1[d] receiving from said

central server, data thatrepresents the collectiveresponse of the user ofthe at least one

additional computer to

requests by the same

application running on

said at least oneadditional computer toaccess the storagemedium that comprisessaid at least oneadditional computer.

The computer running Trend Micro’s software receives from said central servers o

Protection Network, data that represents the collective response of the user of th

additional computer to requests by the same application running on said at least 

computer to access the storage medium that comprises said at least one addition

example, the additional computers in the sandbox allow the requests by the appl

their storage mediums, and if found harmless, the Smart Protection Network sendcomputer indicating that the requests by the application should be allowed.

CLAIM 1 TREND MICRO PRODUCTS

Case 6:20-cv-00394-ADA Document 1-5 Filed 05/14/20 Page 27 of 27