CUPP Cybersecurity LLC v. Trend Micro Inc

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF TEXAS

DALLAS DIVISION

CUPP CYBERSECURITY, LLC, and CUPP §

COMPUTING AS, §

§

§

Plaintiffs,

§

§ Civil Action No. 3:18-cv-1251-M

v.

§

§ (Consolidated with

TREND MICRO, INC., TREND MICRO

§ Civil Action No. 3:20-cv-03206-M)

AMERICA, INC., and TREND MICRO

§

INCORPORATED,

§

Defendants. §

§

CLAIM CONSTRUCTION MEMORANDUM OPINION AND ORDER

This Order addresses the claim construction disputes presented by Plaintiffs CUPP

Cybersecurity, LLC, and CUPP Computing AS, and Defendants Trend Micro, Inc., Trend Micro

America, Inc., and Trend Micro Incorporated, in CUPP Cybersecurity LLC v. Trend Micro Inc.,

Case No. 3:20-cv-03206-M.1 The parties submitted opening and responsive claim construction

briefs, and on November 8, 2021, the Court held a claim construction hearing. Having

considered the arguments and evidence presented by the parties, the Court issues this Order.

I. BACKGROUND

Plaintiffs CUPP Cybersecurity, LLC and CUPP Computing AS (together, “CUPP”) are

security providers for mobile devices, and have “a robust portfolio of inventions related to, inter

alia, mobile devices and removable media, and has invested millions in pioneering new forms of

security for these devices. CUPP’s inventions cover software and hardware based solutions to

1 On November 1, 2021, CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:18-cv-01251-M (“CUPP1”)

was consolidated with CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv-03206-M (“CUPP2”). This

Order addresses claim construction disputes presented in CUPP2 prior to consolidation. The Court has already

issued a separate order discussing the claim construction disputes presented in CUPP1. See ECF No. 150.

problems in mobile device management, network security, DMZ security, and endpoint

security.” Am. Compl. (CUPP2 ECF No. 412) ¶ 8. Defendants Trend Micro, Inc., Trend Micro

America, Inc., and Trend Micro Incorporated (together, “Trend Micro”) make a number of

products falling into several categories: user protection products (e.g., Smart Protection

Complete Suit), network defense products (e.g., Advance Threat Protection and Intrusion

Protection), hybrid cloud security products (e.g., Deep Security), worry-free products (e.g.,

Worry-Free Standard), mobile security technology products (e.g., Dr. Safety), control manager

technology, XGen security technology, smart protection network technology, and XDR and

managed XDR technology. Id. ¶¶ 43–54.

CUPP alleges that Trend Micro’s products infringe nine of CUPP’s patents: U.S. Patent

No. 10,417,400 (the “’400 patent”); U.S. Patent No. 10,089,462 (the “’462 patent”); U.S. Patent

No. 10,417,421 (the “’421 patent”); U.S. Patent No. 10,621,344 (the “’344 patent”); U.S. Patent

No. 10,291,656 (the “’656 patent”); U.S. Patent No. 10,666,688 (the “’688 patent”); U.S. Patent

No. 10,162,975 (the “’975 patent”); U.S. Patent No. 10,496,834 (the “’834 patent”); U.S. Patent

No. 10,951,632 (the “’632 patent”). The parties identify one agreed construction and four

disputed terms for the Court’s resolution. The patents containing disputed terms are discussed

below.

a. The ’688 and ’656 patents.

Both the ’688 and ’656 patents are titled “Systems and methods for providing network

security using a secure digital device.” The ’688 patent is a continuation of the ’656 patent and

shares the same specification. The parties agree that the ’688 patent is representative of the ’656

patent for purposes of claim construction.

2 Citations to “CUPP2 ECF” refer to the docket in CUPP Cybersecurity LLC v. Trend Micro Inc., Case No. 3:20-cv-

03206-M.

Trend Micro describes the ’688 patent as broadly disclosing “a mechanism for

intercepting network traffic, analyzing the data in the network traffic to determine if the data is

malicious, and allowing the network traffic to proceed on its original course if the data is

determined not to be malicious.” Resp. (CUPP2 ECF No. 66) at 7. Specifically, the ’688 and

’656 patents describe a security system that can intercept network traffic of a host device, a

traffic virtualization module to generate a virtual file containing the intercepted network traffic,

and modules for enforcing security policies on the network traffic. Br. (CUPP2 ECF No. 62)

at 7. The parties dispute two claim terms appearing in the ’688 and ’656 patents, both of which

appear in claim 1 of the ’688 patent, which claims:

1. A secure digital security system comprising:

a data store;

a file management module configured to receive a transfer file from a host

device over a virtual file interface configured to assist in transferring data at file

transfer speeds between the host device and the secure digital security system,

the transfer file possibly containing a data store command or a virtual file

containing network traffic intercepted at the host device, the transfer file

including header information indicating whether the transfer file includes the

data store command or the virtual file containing the network traffic, the

network traffic including one of incoming network traffic to the host device or

outgoing network traffic from the host device, the data store command

including a particular command to retrieve or store data in the data store;

a controller configured to manage the data store command by retrieving or

storing the data in the data store;

a security policy management module configured to evaluate the network traffic

in the virtual file for compliance with a security policy;

a traffic access determination module configured to generate a security

indication whether to allow or to deny the network traffic in accordance with

the evaluation; and

a module configured to provide to the host device over the virtual file interface

the security indication whether to allow or to deny the network traffic.

’688 patent, cl.1.

b. The ’975 and ’834 patents.

Both the ’975 and ’834 patents are titled “Secure computing system.” The ’834 patent is

a continuation of the ’975 patent, and shares the same specification. The parties agree that the

’975 patent is representative of the ’834 patent for purposes of claim construction. The parties

dispute one term in the ’975 and ’834 patents.

The ’975 patent is directed towards a computer system with multiple security levels,

based, in part, on three independent “security aspects”: confidentiality, integrity, and availability.

’975 patent, at 1:62–65. The computer system described by the ’975 patent has multiple security

levels, comprising high-power and low-power processing devices, and an interface unit

comprising functions for moving classified information between the devices according to formal

rules governing the security aspects of confidentiality and/or integrity. Id. at 6:29–39. Claim 1

of the ’975 patent recites:

1. A system comprising:

a virtual machine engine for generating one or more virtual machines, each

virtual machine being generated having a virtual machine confidentiality level

and a virtual machine integrity level, the virtual machine confidentiality level

being selected from at least a higher confidentiality level and a lower

confidentiality level, the virtual machine integrity level being selected from at

least a higher integrity level and a lower integrity level, a first virtual machine

with the higher confidentiality level requiring a stronger confidentiality process

than a second virtual machine with the lower confidentiality level, a third virtual

machine with the higher integrity level requiring a stronger integrity process

than a fourth virtual machine with the lower integrity level;

a first program;

a second program;

a first datastore or data set associated with a first data confidentiality level and

a first data integrity level;

a second datastore or data set associated with a second data confidentiality level

and a second data integrity level;

at least one hardware processor configured to:

receive a request to use the first program;

execute a particular virtual machine with a particular virtual machine

confidentiality level and a particular virtual machine integrity level;

use a particular confidentiality process and a particular integrity process

before or while operating the first program by the particular virtual machine,

the particular confidentiality process being associated with the particular

virtual machine confidentiality level, the particular integrity process being

associated with the particular virtual machine integrity level;

allow the first program to read the first data set or from the first datastore,

only if the first data confidentiality level is equal to or lower than the

particular virtual machine confidentiality level, and only if the first data

integrity level is equal to or higher than the particular virtual machine

integrity level; and

allow the first program to write to the first datastore or data set, only if the

first data confidentiality level is equal to or higher than the particular virtual

machine confidentiality level, and only if the first data integrity level is

equal to or lower than the particular virtual machine integrity level.

’975 patent, cl.1.

c. The ’400 patent.

The ’400 patent is titled “Systems and methods for providing real time security and

access monitoring of a removable media device.” The “400 patent describes systems and

methods to provide data and device security in connection with a removable media device

coupled to a media device. The abstract of the ’400 patent states:

In various embodiments, a method comprises detecting a removable media device

coupled to a digital device, authenticating a password to access the removable

media device, injecting redirection code into the digital device, intercepting, with

the redirection code, a request for data, determining to allow the request for data

based on a security policy, and providing the data based on the determination. The

method may further comprise selecting the security policy from a plurality of

security policies based, at least in part, on the password and/or filtering the content

of the requested data. Filtering the content may comprise scanning the data for

malware. Filtering the content may also comprise scanning the data for confidential

information.

’400 patent, Abstract.

The parties dispute the meaning of one claim term in claim 9 of the ’400 patent, which

reads:

9. A system comprising:

an operating system of a digital device configured to detect a removable media

device being coupled to an external device port of the digital device;

one or more processors;

memory coupled to the one or more processors, the memory storing instructions

to instruct the one or more processors to implement:

a login module configured to cause, after detecting the removable media

device being coupled to the external device port of the digital device, at least

a portion of redirection code to be generated on the digital device, the

redirection code including an interceptor, a data security policy, and a data

security process, the interceptor configured to intercept a first function call

to the operating system of the digital device before the first function call is

executed by the operating system, the first function call including a request

of the operating system to retrieve data from or write data to the removable

media device, the first function call being initiated by a particular user or a

particular application, the data security process configured to perform a set

of one or more second function calls in response to intercepting the first

function call, the set of one or more second function calls not including the

first function call, the data security policy configured to evaluate data on the

removable security device for malware, and the data security policy

configured to determine whether to allow the first function call based at

least on results of the data security process.

’400 patent, cl. 9.

II. LEGAL PRINCIPLES

A. General Principles of Claim Construction

The construction of disputed claims is a question of law for the court. Markman v.

Westview Instruments, Inc., 52 F.3d 967, 971–72 (Fed. Cir. 1995), aff’d, 517 U.S. 370 (1996).

“Ultimately, the interpretation to be given a term can only be determined and confirmed with a

full understanding of what the inventors actually invented and intended to envelop with the

claim.” Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005) (en banc) (citation

omitted). Accordingly, a proper construction “stays true to the claim language and most

naturally aligns with the patent’s description of the invention.” Id. (citation omitted).

“It is a ‘bedrock principle’ of patent law that ‘the claims of a patent define the invention

to which the patentee is entitled the right to exclude.’” Phillips, 415 F.3d at 1312 (quoting

Innova/Pure Water, Inc. v. Safari Water Filtration Sys., Inc., 381 F.3d 1111, 1115 (Fed. Cir.

2004)). Courts first “look to the words of the claims themselves . . . to define the scope of the

patented invention.” Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996)

(citation omitted). The claim terms are “generally given their ordinary and customary meaning,”

but “a patentee may choose to be his own lexicographer and use terms in a manner other than

their ordinary meaning, as long as the special definition of the term is clearly stated in the patent

specification or file history.” Id. (citation omitted). The “ordinary and customary meaning” of

the terms in a claim is “the meaning that the term[s] would have to a person of ordinary skill in

the art in question at the time of the invention.” Phillips, 415 F.3d at 1313.

When the meaning of a term to a person of ordinary skill in the art is not apparent, a court

is required to consult other sources, including “the words of the claims themselves, the remainder

of the specification, the prosecution history, extrinsic evidence concerning relevant scientific

principles, the meaning of technical terms, and the state of the art.” Id. (citation omitted). A

court must consider the context in which the term is used in an asserted claim or related claims in

the patent, being mindful that “the person of ordinary skill in the art is deemed to read the claim

term not only in the context of the particular claim in which the disputed term appears, but in the

context of the entire patent, including the specification.” Id. The specification is “always highly

relevant to the claim construction analysis” and is “the single best guide to the meaning of a

disputed term.” Id. at 1315 (quoting Vitronics, 90 F.3d at 1582). For example, should the

specification reveal that a claim term has been given a special definition by the patentee that is

different from the ordinary meaning of the term, the inventor’s lexicography is controlling. Id. at

1316. Furthermore, if the specification reveals an intentional disclaimer or disavowal of claim

scope by the patentee, the claim scope dictated by the specification is controlling. Id.

Finally, in construing claims, a court may consult extrinsic evidence, including “expert

and inventor testimony, dictionaries, and learned treatises.” Phillips, 415 F.3d at 1317 (citing

Markman, 52 F.3d at 980). Technical dictionaries may assist a court in “‘better understand[ing]

the underlying technology’ and the way in which one of skill in the art might use the claim

terms.” Id. at 1318 (quoting Vitronics, 90 F.3d at 1584 n.6). Expert testimony may also be

helpful to “provide background on the technology at issue, to explain how an invention works, to

ensure that the court’s understanding of the technical aspects of the patent is consistent with that

of a person of skill in the art, or to establish that a particular term in the patent or the prior art has

a particular meaning in the pertinent field.” Id. (citation omitted).

Although extrinsic evidence may “shed useful light on the relevant art,” it is considered

“less significant than the intrinsic record.” Id. at 1317 (quoting C.R. Bard, Inc. v. U.S. Surgical

Corp., 388 F.3d 858, 862 (Fed. Cir. 2004)). More simply, “extrinsic evidence may be useful to

the court, but it is unlikely to result in a reliable interpretation of patent claim scope unless

considered in the context of the intrinsic evidence.” Id. at 1319. Accordingly, “a court should

discount any expert testimony ‘that is clearly at odds with the claim construction mandated by

the claims themselves, the written description, and the prosecution history, in other words, with

the written record of the patent.’” Id. at 1318 (quoting Key Pharms. v. Hercon Labs. Corp., 161

F.3d 709, 716 (Fed. Cir. 1998)).

III. AGREED CONSTRUCTION

The parties have agreed to the following construction set forth in their Joint Claim

Construction Chart (CUPP2, ECF No. 68):

Term Agreed Construction

“power management mode” A mode where the mobile device conserves power

• ’632 patent, claims 1, 16

IV. CONSTRUCTION OF DISPUTED TERMS

A. “file transfer speeds”

Disputed Term CUPP’s Proposed Trend Micro’s

Construction Proposed Construction

“file transfer speeds” Plain and ordinary Indefinite

• ’688 patent, claims 1, 6 meaning.

• ’656 patent, claims 1, 10

The Parties’ Positions

CUPP argues that “file transfer speeds” should be construed according to its plain and

ordinary meaning, because a POSITA would know, based on the specification and prosecution

history, that this term means “the speed a file is transferred.” Reply (ECF No. 69) at 5.

According to CUPP, the speed a file is transferred would depend on the particular device at

issue. CUPP further argues that in the context of the specification, this term means “the speed

that does not cause errors or timeouts in the underlying computer system.” Id. at 6. For support,

CUPP points to the declaration and deposition testimony of its expert, Dr. Goodrich, as well as a

dictionary definition defining “file transfer” as “[t]he process of moving or transmitting a file

from one location to another, as between two programs or over a network.” CUPP App. Vols. I,

II (ECF Nos. 63, 64) at Pltf. App. 137, 156, 315.

Trend Micro argues that the term “file transfer speeds” as it appears in the claims of the

’688 and ’656 patents is indefinite, because the claims, specifications, and file histories do not

inform a POSITA about the scope of the invention with reasonable certainty. Trend Micro notes

that both sides’ experts agree that “file transfer speed” is not a term of art, and that the only

guidance regarding the meaning of “file transfer speeds” is from the following passage of the

specification:

Portable electronic devices, such as Android® smartphones and tablet devices,

often use secure digital (SD) devices, e.g., SD cards, to store and retrieve files and

other data. Secure digital devices typically do not support network traffic for host

devices, or at best only support network traffic at transfer speeds that are

unreasonably slow (e.g., 100’s kb/s), especially compared to the file transfer

speeds of these secure storage devices (e.g., 10’s MB/s).

’688 patent, at 4:2–6 (emphasis added).

Based on this passage, Trend Micro states a POSITA would only know that “10’s MB/s”

would qualify as a file transfer speed, but “100’s kb/s” would not. Without additional data points

or information, the specification does not provide reasonable certainty about the bounds of the

claim—i.e., what would qualify as “file transfer speeds” capable of satisfying the claim. Trend

Micro further argues that to adopt CUPP’s proposal would effectively read out the requirement

in the claims that the files in question be transferred at “file transfer speeds.” According to

Trend Micro, CUPP’s proposed construction renders this limitation meaningless, because it

would permit any speed at which a file is transferred to qualify as a “file transfer speed,” making

the claim language superfluous.

Analysis

The issue presented is whether, based on the specification and prosecution history, claims

1 and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent are indefinite because the term

“file transfer speeds” used in those claims fails to inform a POSITA about the scope of the

claimed invention with reasonable certainty. The Court concludes that the term “file transfer

speeds” is indefinite.

Title 35, § 112(b) of the United States Code requires that a patent specification shall

“conclude with one or more claims particularly pointing out and distinctly claiming the subject

matter which the inventor or a joint inventor regards as the invention.” The Supreme Court has

held this definiteness provision “to require that a patent’s claims, viewed in light of the

specification and prosecution history, inform those skilled in the art about the scope of the

invention with reasonable certainty.” Nautilus, Inc. v. Biosig Instruments, Inc., 572 U.S. 898,

910 (2014). “The claims, when read in light of the specification and the prosecution history,

must provide objective boundaries for those of skill in the art.” Interval Licensing LLC v. AOL,

Inc., 766 F.3d 1364, 1371 (Fed. Cir. 2014). If a claim does not satisfy these requirements, it is

invalid as indefinite under § 112. Nautilus, 572 U.S. at 901. “[I]ndefiniteness is a question of

law and in effect part of claim construction.” ePlus, Inc. v. Lawson Software, Inc., 700 F.3d 509,

517 (Fed. Cir. 2012).

Claim 1 of the ’688 patent, which the parties agree is representative for purposes of claim

construction, describes a secure digital security system comprising, in part, “a file management

module configured to receive a transfer file from a host device over a virtual file interface

configured to assist in transferring data at file transfer speeds between the host device and the

secure digital security system.” ’688 patent, cl.1. Thus, the claim describes an interface that

assists with data being transferred between the host device and the secure digital security system

not at any speed, but specifically “at file transfer speeds.” Omitting this phrase would give the

claim a broader meaning, and accordingly, the “at file transfer speeds” language is a narrowing

limitation. See Bicon, Inc. v. Straumann Co., 441 F.3d 945, 950 (Fed. Cir. 2006) (“[C]laims are

interpreted with an eye toward giving effect to all terms in the claim.”).

CUPP first contends that “file transfer speeds” means the speed at which a file is

transferred, and at oral argument, contended that, for a given device, any speed at which a file is

transferred would satisfy the limitation. However, construing “file transfer speeds” simply to

mean the speed at which any given file is transferred would render that language purely

descriptive, as opposed to limiting; in effect, the claim term would amount to nothing more than

an observation that files should be transferred at the speed at which they are transferred. As

interpreted by CUPP, this language is effectively meaningless; indeed, during oral argument,

when pressed by the Court as to what limitation would be removed if the words “at file transfer

speeds” were omitted from the claim under its proposed construction, CUPP had no response.

Having drafted the claim to include this language, CUPP cannot now argue that “at file transfer

speeds” is merely descriptive; to do would render the scope of the patent ambiguous, “leaving

examiners and the public to guess about which claim language the drafter deems necessary to his

claimed invention and which language is merely superfluous, nonlimiting elaboration.” Bicon,

441 F.3d at 950.

CUPP’s alternative proposal—that “file transfer speed” refers to the speed that does not

cause errors or timeouts in the underlying computer system—fares no better. Nothing in the

specification references timeouts or errors, the parties’ experts agree that “file transfer speed” is

not a term of art, and CUPP points to no dictionary or treatise to support its proposal. Instead,

the only evidence in the record supporting this interpretation is deposition testimony from

CUPP’s expert, Dr. Goodrich, which the Court concludes is not specific or certain enough to

suggest a POSITA would reach the same conclusion regarding the meaning of “file transfer

speeds” in the patents. See Pltf. App. 137 (“Q: Okay. So what is the plain and ordinary meaning

of file transfer speed. A: . . . I would say, just sitting here today, it’s the speed at which a file

can be transferred without there being an errors or timeouts in the system.” (emphasis added)).

Having concluded that “file transfer speeds” must mean something beyond merely the

speed at which files are transferred, and that CUPP’s alternative proposal lacks support, the

Court looks to the specification. Apart from the claims, the only references to “file transfer

speeds,” “speed,” or “speeds” in the patents is a single passage in the specification, quoted

previously, that distinguishes between “unreasonably slow” transfer speeds in the hundreds of

kilobits per second range, and file transfer speeds of secure digital devices in the tens of

megabytes per second range. See ’688 patent, at 4:2–6. The specification next states that,

“[a]ccordingly, various embodiments . . . capitalize on the rapid file transfer capabilities of

secure digital devices to scan and evaluate network traffic for compliance with security policies.”

Id. at 4:7–10.

Based on this disclosure, a POSITA would understand that speeds of “10’s MB/s” qualify

as a “file transfer speed” as that term is used in the claim. Beyond that, the specification

provides no clear guidance as to its bounds. Speeds of “100’s kb/s” are distinguished from “file

transfer speeds” as being unreasonably slow; Dr. Goodrich, CUPP’s expert, agreed that a

POSITA would realize that “going at that alternative slow speed, that’s not a file transfer speed.”

Pltf. App. 137. However, the distinction between “slow,” “unreasonably slow,” and “file

transfer speeds” is undefined, and made further unclear by the fact that the sole data points

provided in the specification—100 kb/s and 10 MB/s—are described as being merely exemplary.

In sum, the specification does not provide sufficient guidance of the meaning of transferring data

“at file transfer speeds” to give notice to the public of the boundaries between infringing and

innocent activity.

Accordingly, the Court concludes that the specifications of the ’688 and ’656 patents do

not inform a POSITA about the scope of “file transfer speeds” with reasonable certainty. Trend

Micro has proven that claims 1 and 6 of the ’688 patent, and claims 1 and 10 of the ’656 patent

are each indefinite under § 112.

B. “virtual file”

Disputed Term CUPP’s Proposed Trend Micro’s

Construction Proposed Construction

“virtual file” Plain and ordinary Indefinite

• ’688 patent, claims 1, 6 meaning

• ’656 patent, claims 1, 10

The dispute regarding the term “virtual file” in the ’688 and ’656 patents is whether,

based on the specification and prosecution history, claims 1 and 6 of the ’688 patent, and claims

1 and 10 of the ’656 patent are indefinite because the term “virtual file” fails to inform a

POSITA about the scope of the claimed invention with reasonable certainty. CUPP argues that

“virtual file” should be construed according to its plain and ordinary meaning, whereas Trend

Micro responds that it is indefinite under § 112.

However, the Court has already concluded that these claims are each indefinite under

§ 112 for including the term “file transfer speeds,” and accordingly, does not reach the parties’

dispute as to whether these claims are indefinite for including the term “virtual file.”

C. “a login module configured to case . . . at least a portion of redirection code

to be generated on the digital device”

Disputed Term CUPP’s Proposed Trend Micro’s

Construction Proposed Construction

“a login module configured to cause, Plain and ordinary § 112 ¶ 6 (pre-AIA)

after detecting the removable media meaning

device being coupled to the external Function: Configured to

device port of the digital device, at least cause, after detecting

a portion of redirection code to be the removable media

generated on the digital device” device being coupled to

• ’400 patent, claim 9 the external device port

of the digital device, at

least a portion of the

redirection code to be

generated on the digital

device.

Structure: None

disclosed/indefinite

The parties dispute whether the “a login module . . .” term in claim 9 of the ’400 patent is

a means-plus-function claim element. A means-plus-function claim element triggers 35 U.S.C.

§ 112 ¶ 6 (pre-AIA) / § 112(f) (AIA),3 which allows an applicant to express a claim limitation

“as a means or step for performing a specified function without the recital of structure, material,

or acts in support thereof,” and provides that “such claim[s] shall be construed to cover the

corresponding structure, material, or acts described in the specification and equivalents thereof.”

35 U.S.C. § 112 ¶ 6; see also Ergo Licensing, LLC v. CareFusion 303, Inc., 673 F.3d 1361, 1363

(Fed. Cir. 2012). In other words, a means-plus-function claim element allows the patentee to use

a generic means to express a claim limitation, but the specification must disclose the

corresponding structure. Ergo Licensing, LLC, 673 F.3d at 1363 (quoting Biomedino, LLC v.

Waters Techs. Corp., 490 F.3d 946, 948 (Fed. Cir. 2007)). Thus, construction of a means-plus-

3 The ’400 patent claims priority to Application No. 12/622,386, which was filed on November 19, 2009.

Accordingly, because the priority date of the ’400 patent predates the March 16, 2013, effective date of the AIA, the

’400 patent is subject to the pre-AIA § 112 ¶ 6.

function limitation consists of two steps: (1) identifying the claimed function, and (2)

determining what, if any, structure in the specification corresponds with that function. Cardiac

Pacemakers, Inc. v. St. Jude Med., Inc., 296 F.3d 1106, 1113 (Fed. Cir. 2002). The court must

construe the function to include only those limitations in the claim language. Id. “It is improper

to narrow the scope of the function beyond claim language” or to broaden the scope by

disregarding limitations in the claims themselves. Id. (indicating further that “[o]rdinary

principles of claim construction govern interpretation of the claim language used to describe the

function”).

The Parties’ Positions

CUPP argues that the “a login module . . .” limitation is not a means-plus-function term

because the claim language describes the operation of the login module sufficiently such that the

structure is in the claim itself. In addition, CUPP points to statements made by the examiner

during prosecution indicating that the structure of the login module is software.

Trend Micro argues that the “a login module . . .” term in claim 9 of the ’400 patent

should be construed as a means-plus-function limitation, and that it does not disclose sufficient

structure and is therefore indefinite. Trend Micro points to the claim’s use of the word

“module,” which the Federal Circuit has recognized is a “well-known nonce word that can

operate as a substitute for ‘means,’” and the fact that “login module” has no established meaning

in the industry. See Resp. at 29 (quoting Rain Computing, Inc. v. Samsung Elecs. Am., Inc., 989

F.3d 1002, 1006 (Fed. Cir. 2021)). Trend Micro contends that the “a login module . . .”

limitation discloses two functions—“detecting the removable media device being coupled to the

external device port of the digital device” and, after detection, a “generating” function, namely

causing at “least a portion of redirection code to be generated on the digital device”—and that

because neither the claim nor the specification provide the associated structure for performing

those functions, the claim is indefinite.

Analysis

The parties’ first dispute is whether the “a login module . . .” claim term is a means-plus-

function limitation subject to § 112 ¶ 6. The Court concludes that it is not.

The claim does not use the word “means.” The Federal Circuit has held that avoidance of

the word “means” creates a rebuttable presumption that § 112 ¶ 6 does not apply. See Zeroclick,

LLC v. Apple Inc., 891 F.3d 1003, 1007 (Fed. Cir. 2018). To overcome that presumption, Trend

Micro must demonstrate by a preponderance of the evidence that the claim term fails to recite

sufficiently definite structure or recites function without reciting structure for performing that

function. See id.; Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1348 (Fed. Cir. 2015) (en

banc). “[T]he mere fact that the disputed limitations incorporate functional language does not

automatically convert the words into means for performing such functions.” Zeroclick, 891 F.3d

at 1008. Instead, the inquiry “depends on whether persons skilled in the art would understand

the claim language to refer to structure, assessed in light of the presumption that flows from the

drafter’s choice not to employ the word ‘means.’” Samsung Elecs., Am., Inc. v. Prisua Eng’g

Corp., 948 F.3d 1342, 1354 (Fed. Cir. 2020). “That determination must be made under the

traditional claim construction principles, on an element-by-element basis, and in light of

evidence intrinsic and extrinsic to the asserted patents.” Zeroclick, 891 F.3d at 1007.

Here, the limitation at issue does not use the word “means,” but rather “module”; § 112

¶ 6 presumptively does not apply unless Trend Micro establishes that the claim term fails to

describe sufficiently definite structure.4 See id. Claim 9 recites a system comprising an

operating system of a digital device configured to detect a removable media device being

coupled to the digital device, one or more processors, and memory coupled to said processor(s)

storing instructions to instruct the processor(s) to implement “a login module . . . ,” the term at

issue here.

CUPP maintains that the structure of the login module is software, pointing to a statement

by the patent examiner during prosecution, recognizing that “the processor implements the login

module” and “[a]s such the examiner has interpreted the structure [of the] module[] to be

software.”5 Pltf. App. 190. Similarly, the declaration of Trend Micro’s expert, Dr. Jakobsson,

states that “around 2008, a POSITA might have assumed that a ‘login module’ refers to software

that requires a username and/or password to allow access to a device or software.” Trend Micro

App. (ECF No. 67) at Def. App. 63. Dr. Jakobsson goes on to challenge that assumption in the

context of claim 9 of the ’400 patent,6 but seemingly concedes that a POSITA would understand

“login module,” as it is used in the context of the claim, to refer to software. CUPP’s expert, Dr.

Goodrich, likewise states in his declaration that a POSITA would understand “module” to refer

4 The Court notes that several of the cases holding that “module” was used a nonce word, and a substitute for

“means,” did so based on the patentee’s express acknowledgment that, as used in the claim, “module” was a nonce

word or had no commonly understood meaning and was not known by a POSITA to connote a particular structure.

See Rain Computing, Inc. v. Samsung Elecs. Am., Inc., 989 F.3d 1002, 1006 (Fed. Cir. 2021); Williamson, 792 F.3d

at 1350–51. CUPP makes no such concession here, and accordingly, the fact that the Federal Circuit has previously

recognized “module” as a nonce word similar to means is not dispositive.

5 The examiner initially rejected the claim under § 112 ¶ 6 “because it uses . . . a generic placeholder ‘module’

coupled with functional language “login . . .” without reciting sufficient structure to achieve the function” and “the

generic placeholder is not preceded by a structural modifier.” Pltf. App. 362. The claim was subsequently amended

to add the limitations “one or more processors” and “memory coupled to the one or more processors, the memory

storing instructions to instruct the processor to implement:” a login module. See U.S. Patent Application Serial No.

14/337,101, Docket No. 18EL-202029, Amendment and Response to Non-Final Office Action, at cl.11 (Dec. 1,

2015).

6 Specifically, Dr. Jakobsson states that the claimed function of the “login module” does not require verification of a

user’s identity or password, and thus “[a]n assumption that the ‘login module’ verifies a username and/or password

therefore would be incorrect.” Def. App. 64. However, Dr. Jakobsson does not contend that a POSITA’s

assumption that the login module refers to software is incorrect.

to “a collection of commands or statements in a computer program to be executed by a processor

with . . . predefine[d] routines and instructions.” Pltf. App. 317.

Trend Micro argues that, even if the login module is software, the claim still lacks

sufficient structure because the term is “untethered to any structure in the specification and

followed by purely functional claim language.” Resp. at 33. Admittedly, in claim 9, “a login

module . . .” is followed by language denoting some function; it describes how the module is

configured to cause, “after detecting the removable media device being coupled to the external

device port of the digital device, at least a portion of redirection code to be generated on the

digital device.” ’400 patent, cl.9. However, the inclusion of functional language does not alone

transform the claim into a means-plus-function limitation. See Zeroclick, 891 F.3d at 1008.

Moreover, when construing the limitation in context, the Court disagrees that the language is

untethered to any structure. For instance, Trend Micro argues that the login module performs the

function of “detecting” the coupling of the removable media device to the external device port of

the digital device; however, the claim makes clear that the operating system on the digital device

is capable of performing that exact function.7 Similarly, the claim specifies the structure and

capabilities of the redirection code generated by the login module, namely that the redirection

code includes an interceptor, a data security policy, and a data security process, and that the

interceptor is configured to intercept function calls to the operating system of the digital device

and perform other function calls in response, in accordance with the specific language of the

7 In addition, unlike other claims in the ’400 patent which specify that the login module is not located on the digital

device, where the operating system is located, there is no such limitation in claim 9. Compare ’400 patent, cl.1 (“the

removable media device having a login module”), id. cl.17 (“the removable media device having a login module”),

with id. cl.9.

claim.8 See ’400 patent, cl.9. Put differently, the claim provides the algorithm—i.e., structure—

of the redirection code.9

Moreover, the Court concludes that, reading “login module” in the context of the

specification, there is sufficient structure such that the presumption against § 112 ¶ 6 is not

rebutted. For instance, the specification describes various means by which the login module

generates redirection code:

The login module 1920 detects when the removable media device 1904 is coupled

with the digital device 1902 and executes instructions to generate the redirection

module 1910. In some embodiments, the login module 1920 requires that the user

provides a password and/or a user name prior to the generation of the redirection

module 1910. The login module 1920 may then execute a set up program to

generate the redirection module 1910 on the digital device 1902. In one example,

when the removable media device 1904 is coupled to the digital device 1902, the

digital device 1902 may see the removable media device 1904 as a CD. The login

module 1920 may provide an extended login executable file (e.g., EXT-login. Exe

1922) which may be auto-run by the digital device 1902 which generates the

redirection module 1910.

’400 patent, at 22:31–45.

Accordingly, the Court concludes that Trend Micro has not established that claim 9 fails

to describe sufficiently definite structure for the challenged “a login module . . .” limitation, and

therefore § 112 ¶ 6 does not apply. The parties raise no other claim construction dispute related

8 Specifically, claim 9 specifies that the interceptor is configured to “to intercept a first function call to the operating

system of the digital device before the first function call is executed by the operating system, the first function call

including a request of the operating system to retrieve data from or write data to the removable media device, the

first function call being initiated by a particular user or a particular application, the data security process configured

to perform a set of one or more second function calls in response to intercepting the first function call, the set of one

or more second function calls not including the first function call, the data security policy configured to evaluate

data on the removable security device for malware, and the data security policy configured to determine whether to

allow the first function call based at least on results of the data security process.” ’400 patent, cl.9.

9 The Court notes that computer-implemented claims do not necessarily need to provide an algorithm in the claims

to avoid the application of § 112 ¶ 6. See, e.g., Mad Dogg Athletics, Inc. v. Peloton Interactive, Inc., No. 2:20-CV-

00382-JRG, 2021 WL 3200994, at *15 (E.D. Tex. July 28, 2021) (“[T]he claims themselves do not necessarily need

to provide an algorithm for a computer-directed claim term to avoid the ambit” of § 112 ¶ 6 (citing Apple Inc. v.

Motorola, Inc., 757 F.3d 1286, 1298 (Fed. Cir. 2014)).

to this limitation, and accordingly, the Court construes ““a login module . . .” according to its

plain and ordinary meaning.

D. “integrity level”

Disputed Term CUPP’s Proposed Trend Micro’s

Construction Proposed Construction

“integrity level” Plain and ordinary A value, separate from

• ’975 patent, claims 1, 13 meaning. the confidentiality level,

• ’834 patent, claims 1, 15 that indicates reliability

The Parties’ Position

CUPP argues that “integrity level” should be construed according to its plain and

ordinary meaning, namely a measure of the trustworthiness or reliability of information.

According to CUPP, because the patent recites both an “integrity level” and a “confidentiality

level,” a POSITA would already understand that the two concepts are distinct. CUPP argues that

including the word “separate” in the construction would read out an embodiment of the invention

described in the specification, citing the following passage in which security aspects are

expressed as a related pair:

As noted above, different aspects of security, e.g. confidentiality, integrity and

availability, are independent of each other. Thus, if there are two levels of integrity,

e.g. {low, high} and two levels of confidentiality, e.g. {public, restricted} there

could be four different virtual machines running {low, public}, {low, restricted},

{high, public} and {high, restricted} respectively.

’975 patent, at 12:50–56; see Br. at 22–23.

In addition, based on testimony from its expert, Dr. Goodrich, CUPP contends that Trend

Micro’s proposed construction is incorrect because security aspects, while being distinct, may

still be related. CUPP further contends that Trend Micro’s inclusion of the word “value” in its

proposed construction unnecessarily adds confusion.

Trend Micro responds that while the parties agree that “integrity” levels indicate

reliability, the parties disagree as to whether the recited integrity level must be separate from the

confidentiality level recited in the claims. Trend Micro points to the ’975 patent’s description of

the confidentiality, integrity, and availability security aspects, and in particular the observation

that “[i]t should also be understood that all aspects of security herein are independent of each

other.” ’975 patent, 1:67–2:4. Trend Micro also points to a disclaimer in the specification of

prior art security models that combined integrity and confidentiality, noting that such an

approach is “a confusion of terms” and, in contrast, “[i]n this disclosure, integrity and

confidentiality are regarded as completely independent of each other.” Id. at 2:49–55.

Accordingly, because the claims and specification consistently treat the integrity level and

confidentiality level separately, Trend Micro contends that the Court should construe the

integrity level to be separate—i.e., a separate and distinct value—from the confidentiality level.

Analysis

The issue in dispute is whether the “confidentiality level” and “integrity level” are

separate. The Court concludes that they are.

The specification makes abundantly clear that integrity and confidentiality describe

different concepts and are “completely independent” of each other; the specification describes

how “information may be more or less reliable regardless of its level of confidentiality, and that

a computer process may be assigned clearance along a confidentiality axis regardless of its

assigned clearance along an integrity axis.” Id. at 2:52–60. In addition, the integrity and

confidentiality levels are treated as separate and independent by the claims. For example, claim

1 of the ’975 patent describes an engine for generating virtual machines, each with a virtual

machine confidentiality level and integrity level, the confidentiality level “being selected from at

least a higher confidentiality level and a lower confidentiality level,” and the integrity level

“being selected from at least a higher integrity level and a lower integrity level.” Id. at cl.1.

It is clear from these disclosures that the confidentiality and integrity levels are assigned

separately and independently—i.e., selection of a particular confidentiality level has no effect on

the selection of the integrity level. Moreover, there is no support in either the specification or the

claims to suggest that the confidentiality and integrity levels are not represented separately

within the system. Instead, the security aspects are referred to as separate values; for example,

the specification describes an embodiment with two levels of integrity (“{low, high}”) and two

levels of confidentiality (“{public, restricted}”), which results in four potential combinations,

{low, public}, {low, restricted}, {high, public}, {high, restricted}. Id. at 12:50–56. CUPP

points to nothing to suggest that a single level—for example, {low}—could represent both the

confidentiality level and the integrity level, while maintaining the requisite independence

articulated by the patent. In addition, CUPP’s concern that the fact that confidentiality and

integrity can be described as paired variables means they are not separate from each other is

unsupported; on the contrary, the specification makes clear that these different security aspects

can be presented as pairs but remain independent. See id.

In sum, the Court agrees with Trend Micro that based on the claims and the specification

of the ’975 and’834 patents, the “integrity level” is separate from the confidentiality level and

indicates reliability. However, the Court declines to introduce unnecessary ambiguity by using

the word “value” in its construction, and accordingly construes “integrity level” to mean “a

security aspect, separate from the confidentiality level, that indicates reliability.”

V. CONCLUSION

The Court adopts the constructions set forth above, as summarized in the following table.

The Court further finds that claims | and 6 of the ’688 patent, and claims 1 and 10 of the ’656

patent are each indefinite under § 112 because of the inclusion of the term “‘file transfer speeds.”

The parties are ORDERED not to refer, directly or indirectly, to each other’s claim

construction positions in the presence of the jury. Likewise, the parties are ORDERED to

refrain from mentioning any portion of this opinion, other than the actual definitions adopted by

the Court, in the presence of the jury. Any reference to claim construction proceedings is limited

to informing the jury of the definitions adopted by the Court.

“power management mode” A mode where the mobile device conserves

e °632 patent, claims 1, 16 power

“a login module configured to cause, after Plain and ordinary meaning

detecting the removable media device being

coupled to the external device port of the

digital device, at least a portion of redirection

code to be generated on the digital device”

e °400 patent, claim 9

“integrity level” A security aspect, separate from the

e °975 patent, claims 1, 13 confidentiality level, that indicates reliability

e °834 patent, claims 1, 15

SO ORDERED.

December 10, 2021.

i □□

Pata Mik] Lp

/SABBARA M.G.LYNN QO

{IEF JUDGE

24