Today, the U.S. Court of Appeals for the Federal Circuit (CAFC) issued a pair of rulings on appeals filed by cybersecurity developer Centripetal Networks, following decisions by the Patent Trial and Appeal Board (PTAB) that invalidated its patent claims to network threat detection technologies. Affirming the PTAB’s obviousness findings in both rulings, the Federal Circuit found substantial evidence supporting the Board’s claim constructions underlying those obviousness determinations, despite a sometimes-unclear separation between the Board’s claim construction and analysis.

‘Responsive To’ Limitation Not Satisfied by Threat Indicator Alone

In one ruling, the Federal Circuit affirmed the PTAB in a pair of inter partes review (IPR) proceedings challenging claims of Centripetal’s U.S. Patent No. 10542028, Rule-Based Network-Threat Detection; and U.S. Patent No. 10757126 of the same title. The patents’ common specification discloses the use of a packet-filtering device for receiving data packets and determining whether each packet satisfies criteria specified by a packet-filtering rule corresponding to network-threat indicators.

In IPR proceedings petitioned by Palo Alto Networks challenging these patents, the Board construed the meaning of the claim term “responsive to,” a limitation indicating that the claimed method communicates threat indicators and applies operators following the determination that a packet satisfies the packet-filtering rule. The Board found this limitation disclosed by user guides for the Sourcefire 3D System, an enterprise threat management system that analyzes network traffic according to intrusion rules that can trigger different intrusion actions.

Centripetal appealed the PTAB’s IPR determinations, arguing that the Board impermissibly failed to construe the “responsive to” limitation. The Federal Circuit acknowledged that the proper standard of agency review on claim construction was made more difficult to reach by the Board’s conflation of claim construction and application. However, the appellate court found that the PTAB’s discussion of the Sourcefire prior art established that the claimed invention’s “responsive[ness] to” sources indicating network threats includes an action taken based on source information in combination with other criteria. This finding nixed Centripetal’s argument that the communicating and applying steps should be triggered by a determination based on network-threat indicators alone.

Affirming this construction led the Federal Circuit to uphold the rest of the PTAB’s obviousness determinations in these IPRs. The Board found that Sourcefire’s intrusion rules trigger when Internet protocol (IP) addresses, “which are undisputedly ‘network-threat indicators,’” and other optional criteria are satisfied. The Federal Circuit found Centripetal’s remaining arguments, including that intrusion rules can be triggered by an IP address alone, to be duplicative of its failed claim construction arguments.

‘Boundary’ Limitation Met Even Under Centripetal’s Narrow Claim Construction

In the second ruling issued today, the Federal Circuit affirmed the PTAB’s obviousness finding in a separate IPR petitioned by Palo Alto Networks to challenge the validity of Centripetal’s U.S. Patent No. 10567413, same title as the ‘028 and ‘126 patents. In that IPR, the PTAB found the challenged claims to be invalid over the Sourcefire user guide in combination with U.S. Patent Application No. 20150207809 (“Macaulay”), which discloses a real-time system for information sharing on threat agents that assigns reputation scores reflecting the extent to which network traffic has been compromised.

Centripetal appealed the PTAB’s construction of claim terms limiting a packet-filtering device to a location “at a boundary” between protected and unprotected networks. Centripetal argued that the plain and ordinary meaning of the “boundary” limitation required that the claimed packet-filtering device be the first point-of-contact between a user’s network and the unprotected Internet. However, the Federal Circuit noted diagrams in the ‘413 patent’s specification showing the packet-filtering devices interfacing with tap or network devices that provide the first point-of-contact to the Internet.

The Federal Circuit also found substantial evidence supporting Sourcefire’s disclosure of the “boundary” limitation, noting that installation guides for the threat management system discuss the placement of network traffic sensors between a border router and a network firewall to analyze all traffic. Even under Centripetal’s proposed construction, the appellate court found language in Sourcefire’s installation guide that could be reasonably interpreted as showing the traffic sensor as the first interface between a protected network device and an unprotected network.

Centripetal also challenged the sufficiency of the analysis set out by Palo Alto Network’s IPR petition, arguing that a cross-reference label used by the petition limited the patentability challenge to Macaulay alone. However, the Federal Circuit found that the petition was cross-referencing relevant arguments made on independent claims with limitations related to those challenged under the combination of Sourcefire and Macaulay.

Finally, the Federal Circuit dismissed Centripetal’s argument that the PTAB improperly rejected evidence that prior art taught away from combining the references. Although the court conceded that the PTAB misstated the legal standard from Syntex (U.S.A.) v. Apotex (2005), incorrectly raising a sufficient condition for teaching away into a necessary condition, the error was harmless in context. The PTAB applied the correct legal rule when finding that there is no teaching away, the Federal Circuit concluded, and reasonably found that the inability to bodily incorporate Macaulay into the Sourcefire system did not mean that Sourcefire taught away from the combination.

Image Source: Deposit Photos
Image ID: 70164509
Author billperry