UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD. EPICOR SOFTWARE CORPORATION, Petitioner,

Transcription

1 Paper No Filed: April 22, 2015 UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD EPICOR SOFTWARE CORPORATION, Petitioner, v. PROTEGRITY CORPORATION, Patent Owner. CBM Before KEVIN F. TURNER, MEREDITH C. PETRAVICK, and GREGG I. ANDERSON, Administrative Patent Judges. TURNER, Administrative Patent Judge. DECISION Institution of Covered Business Method Patent Review 37 C.F.R I. INTRODUCTION A. Background Epicor Software Corporation ( Petitioner ) filed a Petition (Paper 8, Pet. ) requesting a review under the transitional program for covered business method patents of U.S. Patent No. 6,321,201 B1 (Ex. 1001, the

2 201 Patent ). Protegrity Corporation ( Patent Owner ) filed a Preliminary Response (Paper 12, Prelim. Resp. ). We have jurisdiction under 35 U.S.C The standard for instituting a covered business method patent review is set forth in 35 U.S.C. 324(a), which provides as follows: THRESHOLD. The Director may not authorize a post-grant review to be instituted unless the Director determines that the information presented in the petition filed under section 321, if such information is not rebutted, would demonstrate that it is more likely than not that at least 1 of the claims challenged in the petition is unpatentable. Petitioner challenges the patentability of claims 1, 5, 19, 20, and ( the challenged claims ) of the 201 Patent under 35 U.S.C. 101, 102, and 103. Taking into account Patent Owner s Preliminary Response, we determine that the Petition demonstrates that it is more likely than not that at least one of the challenged claims is unpatentable. Pursuant to 35 U.S.C. 324, we institute a covered business method patent review of all of the challenged claims of the 201 Patent. B. Related Matters Petitioner identifies Protegrity Corp. v. Epicor Software Corp., No. 3:13-cv JBA (D. Conn. Dec. 2, 2013) as a related district court proceeding. Pet. 4. Patent Owner identifies numerous other related district court matters that would be affected by a decision in this proceeding. See Paper 6, 3 5. The 201 Patent is also the subject of pending proceedings CBM , CBM , and CBM The 201 Patent was also the subject of Reexamination No. 90/011,364, with some originally issued 2

3 claims confirmed and cancelled, one claim amended, and several claims added. U.S. Patent No. 8,402,281 B2 is a continuation of the 201 Patent (Ex. 1004, the 281 Patent ). The 281 Patent is the subject of pending proceedings CBM , CBM and CBM The 201 Patent was the subject of terminated proceedings CBM and CBM , where those proceedings terminated due to settlement between the parties. C. The 201 Patent The 201 Patent, titled Data Security System for a Database Having Multiple Encryption Levels Applicable on a Data Element Value Level, issued on November 20, 2001, based on Application No. 09/027,585, filed on February 23, The 201 Patent claims priority as a continuation application to PCT/SE97/01089, filed on June 18, The 201 Patent is concerned with protecting data against unauthorized access. Ex. 1001, col. 2, ll The 281 Patent states that in other fields, such as industry, banking, insurance, etc., improved protection is desired against unauthorized access to the tools, databases, applications[,] etc.[,] that are used for administration and storing of sensitive information. Id. at col. 1, ll Figure 4 is reproduced below. 3

4 Figure 4 depicts the 201 Patent s system The system shown in Figure 4 includes an operative database (O-DB) and another database, IAM-DB. O-DB database contains data element values DV that are to be protected. Id. at col. 5, ll IAM-DB database contains a data protection catalogue (DPC), which stores protection attributes (e.g., P1*) for data element types (e.g., DT1) that are associated with data element values DV. Id. at col. 9, ll The protection attributes state rules for processing the corresponding data element values DV. Id. at col. 3, ll For example, a protection attribute indicates the degree to which data element value DV is encrypted (id. at col. 7, ll ) or indicates that only accepted, or certified, programs are allowed to process data element value DV (id. at col. 9, ll ). See id. at col. 4, ll When a user initiates an attempt to process a certain data element value DV, a compelling calling is created to data protection catalogue DPC to obtain the protection attributes associated with the data element type for data element value DV. Id. at col. 2, ll The processing of data element 4

5 value DV is then controlled in conformity with the protection attributes. Id. at col. 2, ll ; col. 3, l Thus, the individual data element or data element type becomes the controlling unit for determining the level of protection. Id. at col. 4, ll Claim 1 of the 201 Patent is illustrative of the claims at issue, with all other challenged claims being dependent thereon, and read as follows: 1. A method for processing of data that is to be protected, comprising: storing the data as encrypted data element values (DV) in records (P) in a first database (O-DB), the first database (O-DB) having a table structure with rows and columns, each row representing a record (P) and each combination of a row and a column representing a data element value (DV), in the first database (O-DB) each data element value (DV) is linked to a corresponding data element type (DT); storing in a second database (IAM-DB) a data element protection catalogue (DPC), which contains each individual data element type (DT) and one or more protection attributes stating processing rules for data element values (DV), which in the first database (O-DB) are linked to the individual data element type (DT); for each user-initiated measure aiming at processing of a given data element value (DV) in the first database (O-DB), initially producing a calling to the data element protection catalogue for collecting the protection attribute/attributes associated with the corresponding data element type, and controlling the user s processing of the given data element value in conformity with the collected protection attribute/attributes. D. The Alleged Grounds of Unpatentability Petitioner sets forth grounds of unpatentability of the challenged 5

6 claims as follows: Ground Prior Art Challenged Claims 101 n/a 1, 5, 19, 20, and Denning 1 1, 5, 19, 20, and Lang 2 1, 5, 19, 20, and Atalla 3 1, 5, 19, 20, and Hwang 4 1, 5, 19, 20, and Denning, Lang, Atalla and/or Hwang 1, 5, 19, 20, and Denning, Lang, Atalla or Hwang and 1, 5, 19, 20, and Thomson Denning, Lang, Atalla or Hwang and 1, 5, 19, 20, and Abraham 6 II. ANALYSIS A. 35 U.S.C. 325(d) Patent Owner request that we exercise our discretion under 35 U.S.C. 325(d) to deny the Petition because it relies upon prior art and arguments that are the same or substantially the same as considered during the prosecution of the 201 Patent, during the reexamination of the 201 patent, during the prosecution of the 281 Patent and in CBM Prelim. Resp DOROTHY ELIZABETH ROBLING DENNING, CRYPTOGRAPHY AND DATA SECURITY, (1982) (Ex. 1005) ( Denning ). 2 U.S. Patent No. 5,065,429 issued Nov. 12, 1991 (Ex. 1006). 3 U.S. Patent No. 4,588,991 issued May 13, 1986 (Ex. 1007). 4 MIN-SHIANG HWANG and WEI-PANG YANG, A Two-Phase Encryption Scheme for Enhancing Database Security, 31 J. SYSTEMS SOFTWARE 527 (1995) (Ex. 1008). 5 U.S. Patent No. 5,751,949 issued May 12, 1998 (Ex. 1009). 6 U.S. Patent No. 5,148,481 issued Sept. 15, 1992 (Ex. 1010). 6

7 35 U.S.C. 325(d) states: In determining whether to institute or order a proceeding..., the Director may take into account whether, and reject the petition or request because, the same or substantially the same prior art or arguments previously were presented to the Office. During the prosecution of the 281 Patent, both Thomson and Abraham were cited, as well as four articles authored by Dorothy E. Denning (Exs. 2010, ), the same author who authored Denning. See Ex. 1005, 4 5. Upon review of these articles and the prosecution history of the 281 Patent (Ex. 2009), we are not persuaded by Patent Owner (see Prelim. Resp , 41 42) that Denning is the same or substantially the same as these articles or that the Petition presents the same or substantially same arguments made during the prosecution of the 281 Patent, including those involving Thomson and Abraham, in relation to these references. The 201 Patent was the subject of Reexamination No. 90/011,364, as discussed above, which was based partly upon two articles authored by Dorothy E. Denning (Ex. 2010, 2028), the same author who authored Denning (Ex. 1005), an article by Khamis A. Omar (Ex. 2003), and an article by George I. Davida et al. (Ex. 2006). See Ex Upon review of these articles and the prosecution history of the reexamination of the 201 Patent, we are not persuaded by Patent Owner (see Prelim. Resp. 6 9, 38 40) that Denning is the same or substantially the same as these articles or that the Petition presents the same or substantially the same arguments made during the prosecution of the 201 Patent in relation to these articles. Covered business method patent review was instituted in CBM based upon Denning and FIPS PUB 140-1, where Denning is the same prior art reference in this proceeding, and based upon substantially 7

8 similar arguments. See Voltage Security, Inc. v. Protegrity Corp., Case CBM , Paper 11 (PTAB Apr. 15, 2014). CBM , however, was filed by Voltage Security, Incorporated, which is not a Petitioner in this proceeding, and terminated early in the proceeding because Voltage Security, Incorporated and Patent Owner entered into a settlement agreement. See Voltage Security, Inc. v. Protegrity Corp., Case CBM , Paper 17 (PTAB May 1, 2014). The Board did not issue a final written decision in CBM For these reasons, we decline to exercise our discretion under 35 U.S.C. 325(d) to deny the Petition. B. Standing to Seek Covered Business Method Patent Review Section 18 of the AIA 7 provides for the creation of a transitional program for reviewing covered business method patents. Section 18 limits review to persons or their privies that have been sued or charged with infringement of a covered business method patent, which does not include patents for technological inventions. AIA 18(a)(1)(B), 18(d)(1). 37 C.F.R states [c]harged with infringement means a real and substantial controversy regarding infringement of a covered business method patent exists such that the petitioner would have standing to bring a declaratory judgment in Federal court. Petitioner states that it was charged with infringement of the 201 Patent in Protegrity Corp. v. Epicor Software Corp., No. 3:13-cv JBA (D. Conn. Dec. 2, 2013). Pet Patent Owner does not dispute this statement. 7 Leahy-Smith America Invents Act, Pub. L. No , 125 Stat. 284, 329 (Sept. 16, 2011) ( AIA ). 8

9 i. Financial Product or Service A covered business method patent claims a method or corresponding apparatus for performing data processing or other operations used in the practice, administration, or management of a financial product or service, except that the term does not include patents for technological inventions. AIA 18(d)(1). The legislative history explains that the definition of covered business method patent was drafted to encompass patents claiming activities that are financial in nature, incidental to a financial activity or complementary to a financial activity. Transitional Program for Covered Business Method Patents Definitions of Covered Business Method Patent and Technological Invention, 77 Fed. Reg. 48,734, 48,735 (Aug. 14, 2012) (Final Rule) (quoting 157 Cong. Rec. S5432 (daily ed. Sept. 8, 2011) (statement of Sen. Schumer)). The legislative history indicates that financial product or service should be interpreted broadly. Id. A patent need have only one claim directed to a covered business method to be eligible for review. Id. at 48,736 (Response to Comment 8). Petitioner argues that the 201 Patent claims a method for performing data processing, including protecting against unauthorized access of data, such as in banking, that is at least incidental to the practice, administration, or management of a financial product or service. Pet. 8. To support its argument, Petitioner states that claim 1 provides for control [of] the user s processing of [a] given data element value in conformity with the collected protection attribute/attributes (which are stored in the data protection catalogue and which are called responsive to each user-initiated measure), and is described in the Specification as protecting information on individuals that would be found in businesses of a financial nature, including banking. 9

10 Id. at 7. Patent Owner argues that [t]he claims of the [ ]201 Patent do not encompass activities that are financial in nature, incidental to a financial activity or complementary to a financial activity. Prelim. Resp. 14 (citing 77 Fed. Reg. at 48,374 35). Patent Owner states that Petitioner bases its entire argument on a single word, banking, found in the Specification, but that the discussion of banking was part of a more general list and illustrates that the claims have general applicability to many industries and are not specific to any one application. Id. at Patent Owner continues that the Petition does not cite to any single word in any single claim that is directed to a financial product of service; none of the prior art cited by Petitioner is directed to a financial product or service; and Petitioner does not cite any examples of actual financial product that employ the method of the claims. Id. at We are persuaded by Petitioner that at least one claim claims a method for performing data processing or other operations that are at least incidental or complementary to the practice, administration, or management of a financial product or service. Claim 1 recites controlling the user s processing of the given data element value in conformity with the collected protection attribute/attributes. The Specification discloses that protection attributes are used to protect against unauthorized access of a data portion in a database (see Ex. 1001, col. 4, ll ) and that banking is a field where protection against unauthorized access to databases that are used for administering and storing sensitive information is desired. Id. at col. 1, ll ; see also id. at Fig. 5, col. 11, ll (describing an example where Social Allowance and Housing Allowance are the protected data 10

11 and Financial manager is an authorized user). Banking is a financial activity. Upon this record, we determine that Petitioner has established that at least one claim recites a method or corresponding apparatus for performing data processing or other operations used in the practice, administration, or management of a financial product or service. ii. Technological Invention The definition of covered business method patent in Section 18(d)(1) of the AIA does not include patents for technological inventions. To determine whether a patent is for a technological invention, we consider whether the claimed subject matter as a whole recites a technological feature that is novel and unobvious over the prior art; and solves a technical problem using a technical solution. 37 C.F.R (b). Both prongs must be satisfied in order for the patent to be excluded as a technological invention. The following claim drafting techniques, for example, typically do not render a patent a technological invention : (a) Mere recitation of known technologies, such as computer hardware, communication or computer networks, software, memory, computer-readable storage medium, scanners, display devices or databases, or specialized machines, such as an ATM or point of sale device. (b) Reciting the use of known prior art technology to accomplish a process or method, even if that process or method is novel and non-obvious. (c) Combining prior art structures to achieve the normal, expected, or predictable result of that combination. 77 Fed. Reg. 48,756, 48, (Aug. 14, 2012). 11

12 Petitioner argues that the 201 Patent is not for a technological invention because none of the claims recite a technological feature that is novel and nonobvious over the prior art. Pet Petitioner, further, argues that the 201 Patent is not for a technological invention because none of the claims solve a technical problem using a technical solution. Id. at According to Petitioner, the [ ]201 patent describes no new technology for protecting data against unauthorized access and the claims only rely upon known prior art technology, the combination of which does not achieve any result that is an abnormal, unexpected or unpredictable result of that combination. Id. at 10. Patent Owner argues that the 201 Patent is for a technological invention, because it solves a technical problem with a technical solution. Prelim. Resp According to Patent Owner, the technical problem is the incomplete data protection in a database that was provided by prior art protection methods and systems, such as shell protections, under which data can often relatively easily be subjected to unauthorized access. Id. at 19 (citing Ex. 1001, col. 2, ll. 3 18). According to Patent Owner, the technical solution is (i) associating each data element type with one or more protection attributes which are stored in a separate data element protection catalogue and (ii) making compelling calls to the data element protection catalogue when data is requested. Id. (citing Ex. 1001, col. 3, l. 44 col. 4, l. 33). Patent Owner argues that this solution has the technical advantage of allowing for encryption at the field level in a database. Id. at Patent Owner does not argue that the claims of the 201 Patent recite a novel and unobvious technological feature. We are persuaded by Petitioner that the 201 Patent is not for a 12

13 technological invention because at least claim 1 does not satisfy the first prong of the test. Claim 1 does not recite a technological feature that is novel or unobvious over the prior art. Claim 1 recites a method that is storing data in multiple databases, and controlling a user s processing in conformity with the collected protection attribute/attributes. Data processing computers having databases, which store the data, and controlling access thereto, were known at the time of filing the 201 Patent. See Ex. 1001, col. 1, ll Therefore, we find that at least claim 1 does not recite a technological feature that is novel or unobvious over the prior art and does not satisfy the first prong of the test. We also we are also persuaded that claim 1 does not solve a technical problem using a technical solution and does not satisfy the second prong of the test. We are persuaded by Petitioner that the 201 Patent solves the problem of protecting data against unauthorized access. See e.g., Ex. 1001, col. 2, ll Claim 1 recites a method that grants access to data only if associated rules are satisfied. The method is computer implemented and recites maintaining a database of data and separate data protection table having the rules. Contrary to Patent Owner s argument, claim 1 does not require data element types or encryption elements. Data processing computers having databases, which store data, were known at the time of filing the 201 Patent. See id. at col. 1, ll At least claim 1 does not solve a technical problem using a technical solution, and, thus, at least claim 1 also does not satisfy the second prong. For the reasons discussed above, we are persuaded by Petitioner that the 201 Patent is eligible for covered business method patent review. 13

14 C. Claim Construction The Board interprets claims of unexpired patents using the broadest reasonable construction in light of the specification of the patent in which they appear. 37 C.F.R (b). Under the broadest reasonable construction standard, claim terms are given their ordinary and customary meaning, as would be understood by one of ordinary skill in the art in the context of the entire disclosure. In re Translogic Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). Any special definition for a claim term must be set forth with reasonable clarity, deliberateness, and precision. In re Paulsen, 30 F.3d 1475, 1480 (Fed. Cir. 1994). i. processing rules Petitioner proposes that the broadest reasonable construction of processing rules is rules for processing data. Pet. 14. Petitioner further proposes that processing should be construed to include, but is not limited to, reading, printing, altering, moving, or copying the data. Id. Petitioner argues that their proposed construction is consistent with the Specification, which describes processing as any form of reading, printing, altering, coding, moving, copying, etc. Id. (citing Ex. 1001, col. 2, ll ). Patent Owner argues that Petitioner s proposed construction is unreasonably broad and proposes that the appropriate construction is nonuser-based data processing rules for protection of data element values in a database. Prelim. Resp. 43. According to Patent Owner, Petitioner s proposed construction is unreasonably broad because a primary concern of the [ ]201 Patent is to protect data that is to be protected by requiring that certain processing rules (i.e.[,] how to decrypt it, what key to use, etc.) be 14

15 satisfied before the protected data (i.e.[,] the unencrypted data) can be processed (i.e.[,] read, printed, etc.). Id. at 44. Upon review of Petitioner s evidence and analysis, we are persuaded that the broadest reasonable construction of data processing rules is rules for processing data. Petitioner s proposed construction is consistent with the Specification, which describes not only processing rules which relate to encryption (see, e.g., Ex. 1001, col. 7, l (describing a protection attribute that indicates the degree of encryption used in generating a data element value)), but also describes processing rules which relate to conditions for accessing the data portion (see, e.g., id. at col. 9, ll (describing a protected programs rule which restricts access to only accepted or certified programs)). Petitioner s proposed construction further is consistent with the dependent claims which define the data processing rules not only as relating to encryption (e.g., see dependent claim 5), but also as rules related to what program or program version can access the data (e.g., see dependent claim 6), and related to logging the corresponding data element values in the first database (e.g., see dependent claim 7). Patent Owner s proposed construction is overly narrow and attempts to import the limitations, such as the rules being data element type-based and for protection of data element values, from the Specification (see Ex. 1001, col. 3, ll ) into the claim. Limitations appearing in the specification but not recited in the claim are not read into the claim. E-Pass Techs., Inc. v. 3Com Corp., 343 F.3d 1364, 1369 (Fed. Cir. 2003) (claims must be interpreted in view of the specification without importing limitations from the specification into the claims unnecessarily) (internal quotations and citation omitted). We see nothing in the claims that requires the data 15

16 processing rule to be data element type-based or to be specifically for protection of data element values, i.e., the rules do not necessarily provide for the encryption or the level thereof. Upon this record and for the purposes of this decision, we determine that the broadest reasonable construction of data processing rules in light of the Specification is rules for processing data. ii. data element type With respect to the claim term data element type, Petitioner argues the term is defined explicitly in the Specification of the 201 Patent. Pet. 14. The appropriate section is cited below: Data element type identifies a specific category of data. For example, identification information (name and address) could be a particular data element type. Whereas, some descriptive information (social allowance) could be a different data element type, and other descriptive information could be yet another different data element type. Ex :1 6. Patent Owner proposes a construction of data processing rules associated with a data element type, arguing that it is critical to understanding the scope of the [ ]201 Patent. Prelim. Resp. 45. Patent Owner continues that any construction should reflect an association between the defined data element type and the defined data processing rules. Id. at 46. We are not persuaded data element type must be construed to evince such an association. The broadest reasonable construction for data element type is identification of a specific category of data. Claim 1, for example, is more explicit in that context, clearly reciting collecting the protection attribute/attributes associated with the corresponding data element 16

17 type, showing the association between the attributes and the data element types. We are not persuaded that any construction of data element type must include Patent Owner s association. iii. Other Proposed Constructions Both Petitioner and Patent Owner propose constructions for various other claim terms. See Pet ; Prelim. Resp Based on our review of the record before us, however, no explicit construction of any other claim term is needed at this time. D. 35 U.S.C. 101 i. Availability of 101 As an initial matter, Patent Owner argues that 101 is not available to challenge patentability in a covered business method patent review, because it is not included in 35 U.S.C. 282(b)(2) or (3). Prelim. Resp We disagree. Under the AIA, any ground that could be raised under 282(b)(2) or (3) can be raised in a post-grant review or (with exceptions not relevant here) in a covered business method patent review. The final rules implementing post-grant review and covered business method patent review in the Federal Register state that the grounds available for post-grant review include 35 U.S.C. [ ] 101 and 112, with the exception of compliance with the best mode requirement. 77 Fed. Reg. 48,680, 48,682 (Aug. 14, 2012). This interpretation is consistent with both the relevant case law and the legislative history. See, e.g., Mayo Collaborative Servs. v. Prometheus Labs., Inc., 132 S. Ct. 1289, 1305 (2012) (addressing invalidity under 101 when it was raised as a defense to an infringement claim); 17

18 Graham v. Deere, 383 U.S. 1, 12 (1966) (stating that the 1952 Patent Act sets out the conditions of patentability in three sections, citing 35 U.S.C. 101, 102, and 103); Dealertrack, Inc. v. Huber, 674 F.3d 1315, 1330 n.3 (Fed. Cir. 2012); H.R. Rep. No , at 47 (2011); 157 Cong. Rec. S1375 (daily ed. Mar. 8, 2011). Thus, 101 is a proper ground for a review under the transitional program for covered business method patents. ii. Section 101 Subject Matter Eligiblity For claimed subject matter to be patentable eligible, it must fall into one of four statutory classes set forth in 35 U.S.C. 101: a process, a machine, a manufacture, or a composition of matter. The Supreme Court recognizes three categories of subject matter that are ineligible for patent protection: laws of nature, physical phenomena, and abstract ideas. Bilski v. Kappos, 130 S. Ct. 3218, 3225 (2010) (internal quotations and citation omitted). A law of nature or an abstract idea by itself is not patentable; however, a practical application of the law of nature or abstract idea may be deserving of patent protection. Mayo, 132 S. Ct. at To be patentable, however, a claim must do more than simply state the law of nature or abstract idea and add the words apply it. Id. In Alice Corp. Pty, Ltd. v. CLS Bank Int l, 134 S. Ct (2014), the Supreme Court recently clarified the process for analyzing claims to determine whether claims are directed to patent-ineligible subject matter. In Alice, the Supreme Court applied the framework set forth previously in Mayo, for distinguishing patents that claim laws of nature, natural phenomena, and abstract ideas from those that claim patent-eligible applications of those concepts. Alice, 134 S. Ct. at The first step in 18

19 the analysis is to determine whether the claims at issue are directed to one of those patent-ineligible concepts. Id. If they are directed to a patentineligible concept, the second step in the analysis is to consider the elements of the claims individually and as an ordered combination to determine whether the additional elements transform the nature of the claim into a patent-eligible application. Id. (quoting Mayo, 132 S. Ct. at 1298, 1297). In other words, the second step is to search for an inventive concept i.e., an element or combination of elements that is sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the [ineligible concept] itself. Id. (alteration in original) (quoting Mayo, 132 S. Ct. at 1294). Further, the prohibition against patenting abstract ideas cannot be circumvented by attempting to limit the use of the formula to a particular technological environment or adding insignificant postsolution activity. Bilski, 130 S. Ct. at 3230 (quoting Diamond v. Diehr, 450 U.S. 175, (1981)). Accordingly, utilizing this framework, we review Petitioner s allegation that claims 1, 5, 19, 20, and of the 201 Patent are directed to ineligible subject matter. iii. Statutory Category Claims 1, 5, 19, 20, and recite data processing methods, and these claimed methods nominally fall within the process category of statutory subject matter. iv. Ineligible Concept Petitioner argues that the claims of the 201 Patent are directed merely 19

20 to an abstract idea of protecting sensitive data by control [of] the user s processing of [a] given data element value in conformity with the collected protection attribute/attributes. Pet. 22. Patent Owner argues Petitioner fails to provide sufficient analysis and evidence that the claims are directed to such an abstract idea. Prelim. Resp Upon review of the Petitioner s evidence and analysis and taking into account Patent Owner s Preliminary Response, we are persuaded that the subject claims of the 201 Patent are directed to the abstract idea of determining whether access to a given data element value in a database should be granted based on whether one or more rules are satisfied. v. Inventive Concept a. Independent Claim 1 Petitioner argues that the 201 Patent contains only inconsequential limitations that are insufficient to render them patent-eligible. Pet. 24. Petitioner argues that independent claim 1 recites only the generic computer elements and functions that were well known and conventional. Id at Petitioner argues that the steps of storing data and a catalogue of attributes as well as calling up the attributes and controlling a user s processing (e.g., granting access) are merely pre- or post-processing steps that are essential to the abstract idea. Id. at 23. Petitioner states that [t]he remaining method steps likewise fail to limit practically the abstract idea of controlling user processing based on obtained attributes these are well known and purely conventional limitations. Id. at 25. Petitioner, further, argues that even claimed steps are considered as an ordered combination, they do nothing more than add an instruction to apply the abstract idea using a generic 20

21 computer. Id. Patent Owner argues that these claims are limited meaningfully to a particular practical application, which does not preempt all uses of the abstract idea. Prelim. Resp Patent Owner argues that the claims recite highly specific steps and sub-steps that require specific programming of the system computer, and therefore, the claims do not preempt all use of the abstract idea. Id. at 30. In particular, Patent Owner points to the requirement that the database containing the data element values is separate from the database containing the data element protection catalogue having the data processing rules. Id. at On this record, we are persuaded that these computer-related limitations are not meaningful limitations that can salvage these claims and make them patent eligible, and that that these computer-related limitations require nothing more than the routine and conventional use of a computer, having a database containing objects, and a database containing attributes associated with those objects, and a processor. See Mayo, 132 S. Ct. at To be limited meaningfully, the claim must contain more than mere field-of-use limitations, tangential references to technology, insignificant pre- or post-solution activity, ancillary data-gathering steps, or the like. Id. at Upon review of the Petitioner s evidence and analysis and taking into account Patent Owner s Preliminary Response, we are persuaded that it is more likely than not that claim 1 is directed to patent-ineligible subject matter under 35 U.S.C b. Dependent Claims 5, 19, 20, and

22 Petitioner argues that dependent claims 5, 19, 20, and add wellknown concepts of proscribing rules for encryption, how those data are stored in the catalogues, restricting access to data based on user identity or action, and maintaining the separation between databases and inaccessibility to end users. Pet According to Petitioner, these dependent claims present no meaningful limitation to the abstract idea of rule-based data access. Id. Patent Owner argues that Petitioner s argument is conclusory and that Petitioner provides insufficient evidence to show that the concepts covered by the dependent claims were well-known or conventional. See Prelim. Resp Upon review of Petitioner s evidence and analysis, and taking into account Patent Owner s argument, we are persuaded that dependent claims 5, 19, 20, and are more likely than not patent ineligible under 35 U.S.C. 101 because, like independent claim 1, they do not add significantly more to the abstract idea so as to make the claims patenteligible. E. Anticipation by Denning Petitioner argues that Denning anticipates claims 1, 5, 19, 20, and Pet Denning is a book titled CRYPTOGRPAHY AND DATA SECURITY and was published in In Chapter 4 Access Controls, Denning describes an access-matrix model that is used to control access to objects in a computer operating system. See Ex. 1005, Denning s Figure 4.1 is reproduced below. 22

23 Figure 4.1 depicts an access-matrix As shown in Figure 4.1, access-matrix A has rows corresponding to subjects S, such as users, processes, or domains, and columns corresponding to object O, such as files, segments of memory, and processes. Id. at 192. In database systems, the subjects correspond to users and the objects to files, relations, records, or fields within records. Id. at 194. Each entry A[s, o] is a decision rule, specifying the conditions under which user s may access data object o, and the operations that s is permitted to perform on o. Id. Denning describes that the conditions can be data-independent conditions, such as read or write access rights, but also conditions that are datadependent, time-dependent, context-dependent, and history-dependent. Id. For example, a condition can restrict a user to alter only the content of record where a data field has a certain value or restrict a user to accessing only certain data fields during a specified time or day. See id. Denning describes that a monitor, implemented in software and/or hardware, controls a user s access to the objects based upon whether the associated conditions are satisfied. See id. at 193. [T]he prior art reference in order to anticipate under 35 U.S.C. 102 must not only disclose all elements of the claim within the four corners of the document, but must also disclose those elements arranged as in the claim. Net MoneyIN, Inc. v. VeriSign, Inc., 545 F.3d 1359,

24 (Fed. Cir. 2008) (quoting Connell v. Sears, Roebuck & Co., 722 F.2d 1542, 1548 (Fed. Cir. 1983)). [I]t is not enough that the prior art reference... includes multiple, distinct teachings that the artisan might somehow combine to achieve the claimed invention. Id. at [D]ifferences between the prior art reference and a claimed invention, however slight, invoke the question of obviousness, not anticipation. Id. Claim 1 recites, in part, that a data element protection catalogue... contains each individual data element type, the protection attributes stating processing rules... linked to the individual data element type and producing a calling to the data element protection catalogue for collecting the protection attribute/attributes associated with the corresponding data element type. Claims 5, 19, 20, and all depend from claim 1. See In re Fritch, 972 F.2d 1260, 1266 (Fed. Cir. 1992) ( [D]ependent claims are nonobvious if the independent claims from which they depend are nonobvious. ). Petitioner argues that a data type is equivalent to a specific category of data (Pet. 31, 34) and argues that [a] person of ordinary skill in the art would have understood data element types as corresponding to columns of a database table. Exh. 1002, 37. Id. at 31. According to Petitioner, a data category can be a column, which is an object that is controlled by Denning s access matrix. Id. Thus, Petitioner equates the data categories to the objects at the heading of the columns of Denning s access matrix. Id. Patent Owner argues that the Petition relies on disparate portions of Denning, discussing its description of the tables in the IBM database system along with its description of the access matrix. Prelim. Resp Patent Owner also argues that the columns of Denning s access matrix model do 24

25 not correspond to data types but to the data objects, themselves, such as M1, M2. We agree with Patent Owner. Denning describes that the columns of the access matrix correspond to objects and that [e]ach object is uniquely identified by a name. Ex. 1005, 192. An object name is not a data type or category. Thus, Denning does not meet the limitations that of claim 1 that the processing rules are based on the data element type, nor determining access based on those processing rules. On this record, we are not persuaded that claims 1, 5, 19, 20, and are more likely than not anticipated under 35 U.S.C. 102 by Denning. F. Anticipation by Lang Petitioner argues that Lang anticipates claims 1, 5, 19, 20, and See Pet Lang is a U.S. patent titled Method and Apparatus for Protecting Material on Storage Media and issued on November 12, Ex. 1006, 1. Lang describes a system that restricts access to information stored in logical zones of a CD ROM using a Storage Medium Index Table. Id. at col. 2, ll Lang s Figure 4 is reproduced below. 25

26 Figure 4 depicts the Storage Medium Index Table. Figure 4 depicts Lang s Storage Medium Index Table, which includes columns listing logical zones, zone access codes (ZAC), system identification codes, and personal security keys. Id. at Fig. 4. Lang s process of gaining access to the information stored in certain logical zones includes matching a ZAC and system identification code stored on a user s smart card with the ZAC and the system identification code stored in the Storage Medium Index Table. See id. at col. 3, ll In addition, Petitioner argues that Lang s Storage Medium Index Table meets the challenged claims protection attributes. Pet Petitioner states: The data processing rules are described in Lang as follows: (1) the table is searched to see if the entered zone access code (ZAC) is present; (2) if the ZAC matches, the system 26

27 Id. identification codes in [sic] the table are searched for a match with that of the data portion; (3) if a system identification match is found, a function of the user s personal security key and system identification code is computed and compared with the results of an identical smart card computation.... This is a set of rules/attributes whose parameters are stored in the Storage Medium Index Table. Patent Owner argues that Lang s Storage Medium Index Table does not meet the claimed data element protection table because none of the entries of the index table are data processing rules. Prelim. Resp Patent Owner points out that the columns of Lang s Storage Medium Index Table provide numerical values, such as the logical zone column that includes a list of numbers, which are not rules for processing data in the logical zones or instructions of how to process data in the logical zones. Id. We agree with Patent Owner that Lang s Storage Medium Index Table does not meet the claimed data element protection table. Claim 1 requires that the data element protection table comprises processing rules for data element values, and we construed data processing rules as rules for processing data. The listed logical zones, ZAC, system identification codes, and personal security keys of the Storage Medium Index Table are not rules for processing data. As Petitioner points out, they are parameters of the data processing rules, but not the data processing rules themselves. See Pet Petitioner s alleged data processing rules are not stored in the Storage Medium Index Table. On this record, we are not persuaded that claims 1, 5, 19, 20, and are more likely than not anticipated Lang. 27

28 G. Anticipation by Atalla Petitioner argues that Atalla anticipates claims 1, 5, 19, 20, and Pet Petitioner, however, only makes arguments directed to how Atalla anticipates claim 1 and merely states [s]ee the above, in particular those portions of Atalla cited with regard to a specific recitation of claim 5, and [s]ee claims 5, above with respect to claims 19, 20, and Id. Atalla is a U.S. patent titled File Access Security Method and Means and issued on May 13, Ex. 1007, 1. Atalla describes a system that has data file storage 17 and access authorization file 15. See id. at col. 1, l. 68 col. 2, l. 2. For a user to access a file stored in data file storage 17, access authorization file 15 is first searched to determine if the user is an authorized user. Id. at col. 2, ll ; Fig. 2. As for claim 1, Petitioner argues that Atalla s access authorization file 15 meets the challenged claims data element protection table. Pet Patent Owner argues that Atalla s access authorization file 15 does not meet the claimed data element protection table because it does not contain a plurality of data process rules as recited in claim 1. Prelim. Resp We agree with Patent Owner. Atalla is silent as to the specific contents of the access authorization file 15 and does not describe that access authorization file 15 comprises a data element protection catalogue (DPC), which contains each individual data element type (DT) and one or more protection attributes stating processing rules for data element values as required by claim 1. On this record, we are not persuaded by Petitioner that claim 1 is more likely than not anticipated by Atalla. Similarly, we are not persuaded by Petitioner that claim 5, 19, 20, and are more likely than not 28

29 anticipated by Atalla. H. Anticipation by Hwang Petitioner argues that Hwang anticipates claims 1, 5, 19, 20, and Pet Petitioner again only makes arguments directed to how Hwang anticipates claim 1 and merely provides brief citations to prior analysis. Id. Figure 1 of Hwang is reproduced below. Figure 1 depicts the architecture of the secured data base system. As can be seen from Figure 1, Hwang s system includes both a module labeled Subkeys and a module labeled Locker. As for claim 1, Petitioner cites to pages 257 and 258 and Figure 1 of Hwang to meet the claim s data protection table. Pet Petitioner also states: Figure 1 illustrates the system architecture of the secured database system, including the locker and encrypted database, with each individual field data item encrypted for a record. Id. Subkeys are illustrated as a separate database relative to the encrypted database. Id. at 54. After reviewing the Petition, the cited portions of Hwang, and the Declaration of Petitioner s expert Mr. Bruce Schneier (see Ex. 1002, 48 53), it is unclear whether Petitioner is equating the Subkeys module or the Locker module to the claimed data protection table. Regardless, we 29

30 determine that the cited portions of Hwang do not establish sufficiently that either module comprises processing rules for data element values as required by claim 1. On this record, we are not persuaded by Petitioner that claim 1 is more likely than not anticipated by Hwang. Similarly, we are not persuaded by Petitioner that claim 5, 19, 20, and are more likely than not anticipated by Hwang. I. Obviousness over Denning et al. As discussed above, we determined that Denning does not describe certain limitations of claim 1. We made similar determinations with respect to Lang, Atalla, and Hwang, as well. Petitioner does not provide any other evidence or rationale, specifically, as to why theses certain limitations would have been obvious. See Pet [R]ejections on obviousness grounds cannot be sustained by mere conclusory statements; instead, there must be some articulated reasoning with some rational underpinning to support the legal conclusion of obviousness. KSR, 550 U.S. 398, 418 (2007) (citing In re Kahn, 441 F.3d 977, 988 (Fed. Cir. 2006)). For example, Petitioner s suggestion that the teachings of those references may be combined so as to further teach each and every feature of the claims, (Pet. 57), represents the sole and total analysis for that ground, and is, more or less, and invitation for the instant panel to create its own ground of unpatentability. On this record, we decline such an implicit invitation. The citations to Petitioner s declarant, Bruce Schneier (Ex. 1002), do not buttress Petitioner s bare assertions, as the efficacy of any particular ground is dependent on what is in the petition and not its 30

31 supporting documents. See 35 U.S.C. 324(a) ( the information presented in the petition filed under section 321 ). Similarly, the ground over Denning, Lang, Atalla or Hwang, and Thomson contains a long claim chart, and two paragraphs directed to the references and any rationale for their combination. Pet As Petitioner was notified (Paper 7), 37 C.F.R. 42.6(a)(2)(iii) requires that claim charts may not contain any arguments, claim construction, statements of the law, or detailed explanations as to why a claim limitation is taught or rendered obvious by the prior art. As such, any rationale to combine the references in an obviousness ground must be contained in those two paragraphs and not in the claim chart. The two paragraphs are insufficient, even with citations to Petitioner s declarant, in explaining how and/or why one of ordinary skill in the art would combine the references in the multiplicity of the possible combinations. Petitioner must identify and articulate clearly each prior art combination relied on to support an assertion of unpatentability based on obviousness. Neither Patent Owner nor the Board should have to speculate in any respect. There can be no avoidance of articulating the precise combination relied on to render a claim obvious. Petitioner s approach of offering a plurality of prior art references for consideration, with the particular and necessary combination to be selected or chosen by the Board is improper. On this record, we are not persuaded that claims 1, 5, 19, 20, and are more likely than not unpatentable under 35 U.S.C. 103 over Denning, Lang, Atalla, Hwang, Thomson, and Abraham, in the multiple proposed combinations. 31

32 J. Conclusion The Petition demonstrates that it is more likely than not that challenged claims are unpatentable on the following ground: Ground Prior Art Challenged Claims 101 n/a 1, 5, 19, 20, and The Board has not yet made a final determination as to the patentability of any claim. III. ORDER In consideration of the foregoing, it is hereby: ORDERED that pursuant to 35 U.S.C. 324(a), a covered business method patent review is hereby instituted as to: claims 1, 5, 19, 20, and under 35 U.S.C FURTHER ORDERED that pursuant to 35 U.S.C. 324(d) and 37 C.F.R. 42.4, notice is hereby given of the institution of a trial; the trial commencing on the entry date of this Order. 32

33 PETITIONER: William J. Cass Herbert M. Bedingfield CANTOR COLBURN LLP PATENT OWNER: Woodrow H. Pollack Stefan V. Stein Michael J. Colitz, III Cole Y. Carlson GRAYROBINSON, P.A. 33