Informatica Corporationv.Protegrity Corporation

Patent Trial and Appeal Board

May 9, 2016

12916274 (P.T.A.B. May. 9, 2016)

Trials@uspto.gov Paper No. 48
571.272.7822 Entered: May 9, 2016

UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

INFORMATICA CORPORATION,
Petitioner,

v.

PROTEGRITY CORPORATION,
Patent Owner.
____________

CBM2015-00010
Patent 8,402,281 B2
____________

Before KEVIN F. TURNER, MEREDITH C. PETRAVICK, and
GREGG I. ANDERSON, Administrative Patent Judges.

PETRAVICK, Administrative Patent Judge.

FINAL WRITTEN DECISION
Covered Business Method Patent Review
35 U.S.C. § 328(a) and 37 C.F.R. § 42.73

CBM2015-00010
Patent 8,402,281 B2

2

I. INTRODUCTION
A. Background
On October 14, 2014, Informatica Corporation (“Petitioner”) filed a
Petition (Paper 1, “Pet.”) requesting a review under the transitional program
for covered business method patents of claims 1–60 of U.S. Patent No.
8,402,281 B2 (Ex. 1001, “the ’281 patent”). On May 11, 2015, pursuant to
35 U.S.C. § 324, we instituted this trial on the following grounds:
Ground Prior Art Challenged Claims
§ 101 n/a 1–60
§ 102 Denning1 1–4, 6, 9, 17–20, 22, and 25
§ 103 Denning and FIPS PUB 140-12 12–14, 16, 28–30, and 32
§ 103 Denning and Shear3 11 and 27
Paper 13 (“Dec. to Inst.”).
On July 6, 2015, Protegrity Corporation (“Patent Owner”) filed a
Patent Owner’s Response. Paper 22 (“PO Resp.”). Petitioner filed a Reply
to Patent Owner’s Response. Paper 27 (“Pet. Reply”).
On July 6, 2015, Patent Owner also filed a Motion to Amend. Ex.
20984 (“Mot. Amend”). Petitioner filed an Opposition to Patent Owner’s

1 DOROTHY ELIZABETH ROBLING DENNING, CRYPTOGRAPHY
AND DATA SECURITY, 1–400 (1982) (Ex. 1006) (“Denning”).
2 U.S. DEPT. OF COMM., NATIONAL INSTITUTE OF STANDARDS
AND TECHNOLOGY, FEDERAL INFORMATION PROCESSING
STANDARDS PUBLICATION: SECURITY REQUIREMENTS FOR
CRYPTOGRAPHIC MODULES FIPS-PUB 140-1, 1–48 (Jan. 11, 1994)
(retrieved from: http://csrc.nist.gov/publications/fips/fips1401.htm) (last
visited Aug. 16, 2010) (Ex. 1007) (“FIPS PUB 140-1”).
3 U.S. Patent No. 5,050,213 (issued Sept. 17, 1991) (Ex. 1008).
4 Patent Owner intended to file its Motion to Amend as Paper 23. A second
copy of the Patent Owner’s Response, however, was filed mistakenly as
CBM2015-00010
Patent 8,402,281 B2

3

Motion to Amend (Paper 28, “Opp. to Mot. Amend”), and Patent Owner
filed a Reply to Opposition to Motion to Amend (Paper 29, “PO Reply to
Opp. to Mot. Amend”).
On October 13, 2015, Petitioner filed a Motion to Exclude Evidence.
Paper 33 (“Mot. Exclude”). Patent Owner filed an Opposition to Petitioner’s
Motion to Exclude (Paper 39, “Opp. to Mot. Amend”), and Petitioner filed a
Reply to Opposition to Motion to Exclude (Paper 42, “Pet. Reply to Opp. to
Mot. Exclude”).
On October 13, 2015, Patent Owner filed a Motion for Observation
Regarding Cross Examination of Reply Witness Dr. Michael Shamos. Paper
31 (“Mot. Observation”). Petitioner filed an Opposition to Patent Owner’s
Motion for Observation. Paper 40 (“Opp. to Mot. Observation”).
An oral hearing was held on November 12, 2015. A transcript of the
hearing is included in the record. Paper 45 (“Tr.”).
We have jurisdiction under 35 U.S.C. § 6(c). This Final Written
Decision is issued pursuant to 35 U.S.C. § 328(a) and 37 C.F.R. § 42.73.

B. Patent Owner’s Request to Cancel Claims 1–32
In the Patent Owner’s Response and the Motion to Amend, Patent
Owner requests cancellation of claims 1–32 of the ’281 patent. PO Resp. 2–
3; Mot. Amend 1. Patent Owner’s request to cancel these claims is not
contingent on the claims being determined to be unpatentable or on the entry
of the proposed substitute claims. Patent Owner’s request to cancel claims
1–32 is granted and we need not address these claims further.

Paper 23. Patent Owner, subsequently, filed the Motion to Amend as
Exhibit 2098. See Paper 43.
CBM2015-00010
Patent 8,402,281 B2

4

The remaining ground is as follows:
Ground Prior Art Challenged Claims
§ 101 n/a 33–60

C. Related Matters
Petitioner identifies numerous related district court matters and
covered business method reviews that would be affected by a decision in this
proceeding. Pet. 77–80. Patent Owner identifies numerous other related
district court matters and covered business method reviews that would be
affected by a decision in this proceeding. See Paper 4, 3–5.
The ’281 patent was the subject of terminated proceedings CBM2013-
00024 and CBM2014-00121. Those proceedings terminated due to
settlement between the parties. The ’281 patent is also the subject of
pending proceedings CBM2014-00182 and CBM2015-00006. A Final
Written Decision was entered in CBM2014-00182 on March 2, 2015 and in
CBM2015-00006 on April 18, 2016.
The ’281 patent is a continuation of U.S. Patent No. 6,321,201 B1
(Ex. 1009, “the ’201 patent”). The ’201 patent is the subject of proceedings
CBM2015-00002, CBM2015-00014, CBM2015-00021, and CBM2015-
00030. A Final Written Decision was entered in CBM2015-00002 on April
20, 2016 and in CBM2015-00014 on April 28, 2016. The ’201 patent was
also the subject of Reexamination No. 90/011,364, with some originally
issued claims confirmed and some cancelled, one claim amended, and
several claims added.

CBM2015-00010
Patent 8,402,281 B2

5

D. The ’281 Patent
The ’281 patent, titled “Data Security System for a Database,” issued
on March 19, 2013, based on Application No. 12/916,274, filed on October
29, 2010. Ex. 1001, [45], [54], [65]. The ’281 patent claims priority
through a chain of continuation applications to the ’201 patent, filed on June
18, 1997. Id. at [63].
The ’281 patent discloses an apparatus for protecting data. Id. at
Abstract. Figure 3 of the ’281 patent is reproduced below.

Figure 3 schematically illustrates a “data managing system.” Id. at
5:53–54. The database management system includes multiple databases,
including an operative database (“O-DB”) and an information assets
manager database (“IAM-DB”). Id. at 5:49–6:22. The database
management system also includes multiple modules, such as Control
Module 20, also known as the information assets manager application
program interface (“IAM-API”). Id. at 6:23–56.
The “operative database O-DB contains data that is to be protected.”
Id. at 5:62–63. The IAM-DB “contains a data element protection catalogue
with protection attributes for such data element types as are associated with
data element values in records in the operative database O-DB” and “is
CBM2015-00010
Patent 8,402,281 B2

6

preferably physically separated from the other O-DB.” Id. at 6:7–13. With
regards to the Control Module 20 or IAM-API, the ’281 patent states that
“[t]he control module controls the handling of the types of data protection
that the system can supply. The control module carries out the processing
requested via API (Application Program Interface) programming interface.”
Id. at 6:45–50.
Figure 4 of the ’281 patent is reproduced below.

Figure 4 “schematically shows the principle of data processing according to
the invention with compelling callings to a data element protection
catalogue.” Id. at 5:39–41. As shown above, the data protection catalogue
(DPC) of IAM-DB associates data element types (e.g., DT1) with protection
attributes (e.g., P1*) and the data element types are associated with data
element values (“DV”). Id. at 6:6–11.
The protection attributes state rules for processing the corresponding
data element values DV. Id. at 3:58–59. For example, a protection attribute
indicates the degree to which data element value DV is encrypted (id. at
CBM2015-00010
Patent 8,402,281 B2

7

7:66–8:3) or indicates that only accepted, or certified, programs are allowed
to process data element value DV (id. at 9:26–33). See id. at 4:51–5:6.
When a user initiates an attempt to process certain data element value
DV, a compelling calling is created to data protection catalogue DPC to
obtain the protection attributes associated with the data element type for data
element value DV. Id. at 2:65–3:4; see also id. at Abstract, 3:59–4:2, 4:26–
31, 10:53–64 (describing the compelling calling). The processing of data
element value DV is then controlled in conformity with the protection
attributes. Id. at 3:3–5. Thus, the individual data element or data element
type becomes the controlling unit for determining the level of protection. Id.
at 4:42–47.
Claims 33 and 47 of the ’281 patent are illustrative of the claims at
issue and read as follows:
33. A computer-implemented data processing method
comprising:
maintaining a database comprising a plurality of data
portions, each data portion associated with a data category;
maintaining a separate data protection table comprising,
for at least one data category, one or more data processing rules
associated with the data category that must each be satisfied
before a data portion associated with the data category can be
accessed;
receiving a request to access a data portion associated
with a first data category from a user;
determining whether each of the one or more data
processing rules associated with the requested data portion are
satisfied; and
granting the user access to the requested data portion
responsive to each of the retrieved one or more data processing
rules being satisfied.
CBM2015-00010
Patent 8,402,281 B2

8

47. A computer system, comprising:
a database storing a plurality of data portions, each data
portion associated with a data category;
a data protection table comprising, for at least one data
category, one or more data processing rules associated with the
data category that must each be satisfied before a data portion
associated with the data category can be accessed; and
a processor configured to:
in response to a request to access a data portion
associated with a first data category from a user, determine
whether each of the one or more data processing rules
associated with the requested data portion are satisfied; and
grant access to the requested data portion
responsive to each of the retrieved one or more data processing
rules being satisfied.

II. ANALYSIS
A. Claim Construction
The Board interprets claims of unexpired patents using the broadest
reasonable construction in light of the specification of the patent in which
they appear. 37 C.F.R. § 42.300(b); In re Cuozzo Speed Techs., LLC, 793
F.3d 1268, 1278–79 (Fed. Cir. 2015), cert. granted sub nom. Cuozzo Speed
Techs., LLC v. Lee, 84 U.S.L.W. 3218 (U.S. Jan. 15, 2016) (No. 15-446).
Under the broadest reasonable construction standard, claim terms are
given their ordinary and customary meaning, as would be understood by one
of ordinary skill in the art in the context of the entire disclosure. In re
Translogic Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). Any special
definition for a claim term must be set forth with reasonable clarity,
deliberateness, and precision. In re Paulsen, 30 F.3d 1475, 1480 (Fed. Cir.
CBM2015-00010
Patent 8,402,281 B2

9

1994).

i. Database
Petitioner proposes that the broadest reasonable construction of
database is “an organized collection of structured data.” 5 Pet. 13–14.
According to Petitioner, its proposed construction is the same construction
taken by Patent Owner in a district court proceeding concerning the parent
’201 patent and is consistent with the ’281 patent’s use of “database.” Id.;
Pet. Reply. 6–7.
Patent Owner argues that Petitioner’s proposal is unreasonably broad
and proposes that the broadest reasonable construction of “database” is “a
data processing system for managing an organized collection of structured
data.” PO Resp. 20–25. Patent Owner argues that Petitioner’s proposed
construction is unreasonably broad in the context of the ’281 patent because
the database must be construed to allow for the database to make automatic
and compelling callings to the data element protection catalogue. Id. at 21–
22. Patent Owner argues that its construction is consistent with the ’281
patent and is supported by the testimony of its declarants Mr. Mattsson and
Dr. Direen, Petitioner’s declarant Dr. Shamos, and Mr. Schneier and
supported by certain database manuals and technical definitions of the era.
Id.

5 In the Final Written Decision for CBM2014-00182, we determine that the
broadest reasonable construction of “database” is “an organization of
structure data.” The addition of the word “collection” to the construction we
adopted in CBM2014-00182, however, provides no meaningful distinction
between the constructions as an organized structure of data implies a
collection of data.
CBM2015-00010
Patent 8,402,281 B2

10

a. Claim Language
“Claim construction begins, as it must, with the words of the claims.”
Vehicular Techs. Corp. v. Titan Wheel Int'l, 141 F.3d 1084, 1088 (Fed. Cir.
1998) (citing Bell Commc’ns Research, Inc. v. Vitalink Commc’ns Corp., 55
F.3d 615, 619–20 (Fed. Cir. 1995)). Independent claim 33 recites “[a]
computer-implemented data processing method” that includes, among other
steps, a step of “maintaining a database comprising a plurality of data
portions.” Ex. 1001, 13:38–41. Similarly, independent claim 47 recites “[a]
computer system” that includes, among other elements, “a database storing a
plurality of data portions.” Id. at 14:47–48. As can be seen from the above,
claims 33 and 47 recite that the database comprises or stores data portions.
Neither of claims 33 and 47, nor any claims dependent, therefrom,
recite that the database performs any other function, such as producing a
compelling calling to the data protection catalogue to retrieve the data
processing rules. See id. at 13:38–16:29. Indeed, unlike the parent ’201
patent, none of the claims of the ’281 patent recite a compelling calling at
all. See id.; Ex. 1004, Ex Parte Reexamination Certificate 1:24–51
(amended claim 8). Notably, independent claim 8 of the parent ’201 patent
recite an apparatus having a database that stores data to be protected. Ex.
1004, Ex Parte Reexamination Certificate 1:24–51 (amended claim 8).
Claim 8 of the parent ’201 patent was amended during reexamination to
recite that the apparatus, not the database, controls the user’s processing of
the data according to the data processing rules, and the apparatus, not the
database, also produces the compelling calling to the data element protection
catalogue. Id. at Ex Parte Reexamination Certificate 1:41–51.
CBM2015-00010
Patent 8,402,281 B2

11

The words of the claims of the ’281 patent, thus, are consistent with
Petitioner’s proposed construction as the broadest reasonable construction.

b. Written Description
The written description is “always highly relevant” in construing a
claim, and “it is the single best guide to the meaning of a disputed term.”
Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996).
The written description of the ’281 patent does not contain a definition of
“database.”
The claimed database for storing a plurality of data portions
corresponds to the O-DB database disclosed in the ’281 patent. The O-DB
database is part of a larger “database management system” that includes
multiple databases. Id. at 5:53–6:22; Fig. 3. Similar to the other databases,
the O-DB database is described as containing data and, in particular, data to
be protected. Id. at 6:62–67; Fig. 4. Contrary to Patent Owner’s argument
(PO Resp. 17–18), the ’281 patent does not describe the O-DB database, or
any other database, as performing any other data processing or managing
functions. In particular, the ’281 patent does not describe that the O-DB
database produces the compelling calling to the data protection catalogue.
See Ex. 1001, 10:48–60 (“is first collected by the system”); see id. at
Abstract, 2:65–3:5, 3:59–4:2, 4:26–31, 7:63–67, 8:53–61 (describing a
compelling calling to a data protection catalogue, but failing to describe the
compelling calling being produced by the O-DB database).
The database managing system includes not only a number of
databases, but also, a number of modules. Id. at 6:23–56 (“The data system
in FIG. 3 further comprises a hardware component 10, a control module 20
CBM2015-00010
Patent 8,402,281 B2

12

(IAM-API), and a program module 30 (PTY-API).”); Fig. 3. The modules
include control module 20, also labeled as an Information Assets Manager
Application Program Interface (“IAM-API”), which “controls the handling
of the types of data processing that the system can supply” and “carries out
the processing requested via API . . . programing interface.” Id. at 6:45–50,
Fig. 3.
Petitioner’s proposed construction as the broadest reasonable
construction is consistent with the written description of the ’281 patent.

c. Declarant Testimony
Patent Owner proffers the testimony of declarants Mr. Mattsson and
Dr. Direen in support of its proposed construction. PO Resp. 20–25 (citing
Ex. 2055 ¶¶ 27–29; Ex. 2056 ¶¶ 58–59). Mr. Mattsson testifies that
“[d]efintions vary among practitioners but, generally, a database is meant to
be a collection of data whereby the data is held so that it can be retrieved,
manipulated, reported on, managed, queried, and protect” and that in the
context of the ’281 patent the database does more than store data, such as
manage or process the data. Ex. 2055 ¶¶ 27–30. Specifically, Mr. Mattsson
testifies that “the Specification describes how the first database must
automatically and compellingly produce[] a system calling to the data
element protection catalogue” and that Petitioner’s construction “does not
provide for how [a] system calling (or any calling or processing) could take
place if database is only to mean the data that is managed by the system.”
Id. ¶ 31. Dr. Direen’s testimony is substantially the same as Mr. Mattsson’s
testimony. See Ex. 2056 ¶¶ 58– 61.
CBM2015-00010
Patent 8,402,281 B2

13

Mr. Mattsson’s and Dr. Direen’s testimony is unpersuasive because it
is inconsistent with the ’281 patent. As discussed above, the ’281 patent
describes the O-DB as one database in a larger database management
system. Ex. 1001, 5:52–6:22. The ’281 patent describes the O-DB database
as containing data and describes the modules of the larger database
management system as performing data processing. Id. at 5:62–67, 6:23–56.
The ’281 patent does not describe the O-DB database as producing the
compelling calling. See Ex. 1001, 10:48–60 (“is first collected by the
system”); see id. at Abstract, 2:65–3:5, 3:59–4:2, 4:26–31; 7:63–67; 8:53–61
(disclosing a compelling calling to a data protection catalogue, but failing to
describe the compelling calling being produced by the O-DB database). The
assertion that the compelling calling is produced by the O-DB database is
only found in Patent Owner’s arguments, Mr. Mattsson’s testimony, and Dr.
Direen’s testimony, and not the ’281 patent. E.g., see Ex. 2055 ¶¶ 12–16,
22, 29; Ex. 2056 ¶ 19. Extraneous features should not be read into the
claim. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1249
(Fed. Cir. 1998); E.I. du Pont de Nemours & Co. v. Phillips Petroleum Co.,
849 F.2d 1430, 1433 (Fed. Cir. 1988). In that regard, “extrinsic evidence
may be used only to assist in the proper understanding of the disputed
limitation; it may not be used to vary, contradict, expand, or limit the claim
language from how it is defined, even by implication, in the specification or
file history.” Bell Atl. Network Servs. v. Covad Commc'ns Grp., 262 F.3d
1258, 1269 (Fed. Cir. 2001); see Vitronics Corp. v. Conceptronic, Inc., 90
F.3d 1576, 1584 (Fed. Cir. 1996) (“expert testimony, which was inconsistent
with the specification and file history, should have been accorded no
weight”).
CBM2015-00010
Patent 8,402,281 B2

14

Further, we give little weight to Mr. Mattsson’s testimony because
Mr. Mattsson is not a disinterested witness. Mr. Mattsson is Patent Owner’s
Chief Technology Officer and Co-founder (Ex. 2034, 1–2) and has an
interest in the outcome of this proceeding.
Patent Owner also argues that the testimony of Patent Owner’s
declarant Dr. Shamos and the testimony of Mr. Schneier, a declarant from a
related proceeding, support its proposed construction. PO Resp. 21 (citing
Ex. 2054, 71:2–6, 71:23–72:5; Ex. 2053, 36:10–37:24). Mr. Schneier’s and
Dr. Shamos’s testimony, however, does not support Patent Owner’s
proposed construction, but support Petitioner’s proposed construction as the
broadest reasonable construction. Mr. Schneier agreed, when questioned by
Patent Owner, that a reasonable interpretation of database is “a system that
includes blobs of data in the organization and structure to make that works”
(Ex. 2054, 76:2–6), but Mr. Schneier also testifies that Petitioner’s proposed
construction is a reasonable definition that “coincided with what the patent
seemed to say” (id. at 76:16–77:2; Ex. 1002 ¶ 22). Likewise, Dr. Shamos
testifies that “database” can have multiple definitions (Ex. 2053, 36:10–
37:24), but Dr. Shamos also testifies that in the context of the ’281 patent
and under the broadest reasonable interpretation standard “database” means
an “organized collection of structure data” (id. at 37:25–38:8). The Board
construes claims using the broadest reasonable construction in light of the
specification of the patent in which they appear. 37 C.F.R. § 42.300(b).

d. Database Manual and Technical Encyclopedia
Patent Owner also proffers a database manual and a technical entry
for “database management system” of a technical encyclopedia to support its
CBM2015-00010
Patent 8,402,281 B2

15

construction. PO Resp. 24–25 (citing Ex. 2059, 2060). This extrinsic
evidence is also unpersuasive as both the database manual and the
encyclopedia entry are directed to a database management system, as
opposed to simply a database.

e. Broadest Reasonable Construction of “Database”
We determine that the broadest reasonable construction, in light of the
specification of the ’281 patent, and the proffered evidence, of “database” is
“any organization of structured data.” As discussed above, this construction
is consistent with the words of the claims, the disclosure of the ’281 patent,
the testimony of Dr. Shamos, and the position taken by Patent Owner in the
related district court proceeding. We are not persuaded by Patent Owner’s
arguments, Patent Owner’s declarants’ testimony, database manual, or
technical encyclopedia that this construction is unreasonably broad.

ii. Data Portion
In our Decision to Institute, we determined that the broadest
reasonable construction, in light of the specification, of “data portion” is
“part or share of the database.” Dec. to Inst. 17–18. Patent Owner disagrees
with this claim interpretation and contends that the broadest reasonable
construction of “data portion” is “data element value,” because the ’281
patent describes the invention as working on the “data element level.” PO
Resp. 26. Petitioner does not respond to Patent Owner’s claim construction.
We are not persuaded by Patent Owner that the broadest reasonable
construction, in light of the specification of the ’281 patent, of “data portion”
is “data element value.” The ’281 patent contains no lexicographic
CBM2015-00010
Patent 8,402,281 B2

16

definition of “data portion” and, therefore, “data portion” is given its plain
and ordinary meaning, as would be understood by one of ordinary skill in
the art in the context of the entire disclosure. Petitioner’s construction is
consistent with the plain and ordinary meaning of “portion,” which is an
individual’s part or share of something. See Ex. 3001 (MERRIAM-
WEBSTER’S COLLEGIATE DICTIONARY 908 (10TH ED. 1998)). Petitioner’s
proposed construction is also consistent with the words of independent
claims 33 and 47, which require that the data portions are part of a database.
E.g., see Ex. 1001, 11:18–19 (claim 1 recites “maintaining a database
comprising a plurality of data portions”). Petitioner’s proposed construction
is further consistent with dependent claims 37, 38, 51, and 52, which further
define the claimed data portions to be “a column of data in the database” or
“a field of data in the database.”
Patent Owner’s proposed construction is overly narrow and
improperly attempts to import the limitations from the Specification of the
’281 patent into the claim. Limitations appearing in the specification but not
recited in the claim are not read into the claim. E-Pass Techs., Inc. v. 3Com
Corp., 343 F.3d 1364, 1369 (Fed. Cir. 2003) (claims must be interpreted “in
view of the specification” without importing limitations from the
specification into the claims unnecessarily) (internal quotations and citation
omitted). Although the ’281 patent describes the invention as working on
the cell or data element level (see Ex. 1001, 3:52–59), we see nothing in the
claims, themselves, that require the data portions to be data element values.
Dependent claims 37 and 51 are inconsistent with Patent Owner’s proposed
construction, because they define the data portion as a column of data, which
is a larger portion of data than a data element value.
CBM2015-00010
Patent 8,402,281 B2

17

We determine that the broadest reasonable construction, in light of the
specification of the ’281 patent, of “data portion” is a part or share of the
database.

iii. Data Category
In our Decision to Institute, we determined that the broadest
reasonable construction, in light of the specification, of “data category” is
“any class or division of data sharing one or more characteristics or
attributes,” as proposed by Petitioner. Dec. to Inst. 17 (citing Pet. 15).
Patent Owner contends that the term needs no explicit construction. PO
Resp. 25–26. For the reasons proffered by Petitioner (Pet. 15–16), the
broadest reasonable construction, in light of the specification of the ’281
patent, of “data category” is any class or division of data sharing one or
more characteristics or attributes.

iv. Data Processing Rule
In our Decision to Institute, we determined that the broadest
reasonable construction, in light of the specification, of “data processing
rule” is “rules for processing data,” as proposed by Petitioner. Dec. to Inst.
14–15 (citing Pet. 14). Patent Owner does not dispute this construction in its
Patent Owner’s Response.
For the reasons proffered by Petitioner (Pet. 14–15), the broadest
reasonable construction, in light of the specification of the ’281 patent, of
“data processing rules” is rules for processing data. See Dec. to Inst. 14–15.

CBM2015-00010
Patent 8,402,281 B2

18

v. Other Proposed Constructions
Petitioner also proposed a construction of “encryption/encrypted” and
“separate data protection table.” Pet. 15–18. Patent Owner also proposed a
construction of “data element type.” PO Resp. 27–28. For the purposes of
our review of the claims of the ’281 patent, however, no explicit
construction of any other claim term is needed.

B. Standing to Seek Covered Business Method Patent Review
Section 18 of the AIA6 provides for the creation of a transitional
program for reviewing covered business method patents. Section 18 limits
review to persons or their privies that have been sued or charged with
infringement of a “covered business method patent,” which does not include
patents for “technological inventions.” AIA §§ 18(a)(1)(B), 18(d)(1).
37 C.F.R. § 42.302 states “[c]harged with infringement means a real and
substantial controversy regarding infringement of a covered business method
patent exists such that the petitioner would have standing to bring a
declaratory judgment action in Federal court.”
Petitioner states that it was charged with infringement of the ’281
patent and that it filed a complaint for declaratory judgment of non-
infringement in Protegrity Corp. v. Informatica Corp., No. 3:13-cv-01410 (
D. Ct. Sept. 25, 2013). Pet. 7–8 (citing Ex. 1002). Patent Owner does not
dispute this statement.
Petitioner and Patent Owner, however, dispute whether Petitioner’s
previously filed action for declaratory judgment of non-infringement and

6 Leahy-Smith America Invents Act, Pub. L. No. 112-29, 125 Stat. 284, 329
(Sept. 16, 2011) (“AIA”).
CBM2015-00010
Patent 8,402,281 B2

19

invalidity of the ’281 patent bars this proceeding. Pet. 7–127; PO Resp. 3;
Pet. Reply 22–24. Petitioner argues that because its previously filed
declaratory judgment action was dismissed without prejudice the proceeding
is not barred. Pet. 8–10; Pet. Reply 22–24. Patent Owner argues that 35
U.S.C. § 325(a)(1), precludes the present Petition because Petitioner filed a
civil action challenging the validity of a claim of the ’281 patent prior to
filing the Petition. PO Resp. 3 (citing SecureBuy, LLC v. Cardinal
Commerce Corp., CBM2014-00035 (PTAB April 25, 2014) (Paper 12)
(precedential)).
A party may not petition for post-grant review if it has filed a civil
action challenging the validity of a claim of the patent before the petition is
filed. 35 U.S.C. § 325(a)(1); 37 C.F.R. § 42.201(a).
In SecureBuy, LLC, the Board determined the 35 U.S.C. § 325(a)(1)
applied to covered business method review proceedings, but made no
determination as to whether or not a dismissal without prejudice triggered
the statutory bar. See SecureBuy, LLC, CBM2014-00035 (PTAB April 25,
2014) (Paper 12). Here, Petitioner’s filing of a civil action before filing the
Petition did not trigger the statutory bar because the civil action was
dismissed without prejudice. See id. Dismissal without prejudice does not
trigger the statutory bar. See Decision 9 (citing Cyanotech Corp. v. Bd. of
Trustees of the Univ. of Ill., IPR2013-00401, slip op. at 11–12 (PTAB Dec.
19, 2013) (Paper 17) (“Excluding an action that de jure never existed from
the scope of § 315(a)(1) is consistent with both relevant case law and

7 On May 4, 2015, Petitioner, via email, informed the Board of a clerical
typographical error on page 11 of the Petition. The sentence starting with
“[i]n the prior cases, petitioner was sued . . .” should be read as “[i]n the
prior cases, petitioner was not sued . . . .”
CBM2015-00010
Patent 8,402,281 B2

20

legislative history.”); Callidus Software, Inc. v. Versata Software, Inc.,
CBM2013-00052, slip op. at 5–7 (PTAB Mar. 4, 2014) (Paper 21). “The
dismissal of an action without prejudice leaves the parties as though the
action had never been brought.” Ariosa Diagnostics v. Isis Innovation Ltd.,
IPR2012-00022, slip op. at 16–18 (PTAB Sept. 2, 2014)(Paper 166) (citing
Graves v. Principi, 294 F.3d 1350, 1356 (Fed. Cir. 2002)).

i. Financial Product or Service
A covered business method patent “claims a method or corresponding
apparatus for performing data processing or other operations used in the
practice, administration, or management of a financial product or service,
except that the term does not include patents for technological inventions.”
AIA § 18(d)(1). The “legislative history explains that the definition of
covered business method patent was drafted to encompass patents ‘claiming
activities that are financial in nature, incidental to a financial activity or
complementary to a financial activity.’” Transitional Program for Covered
Business Method Patents—Definitions of Covered Business Method Patent
and Technological Invention, 77 Fed. Reg. 48,734, 48,735 (Aug. 14, 2012)
(Final Rule) (quoting 157 Cong. Rec. S5432 (daily ed. Sept. 8, 2011)
(statement of Sen. Schumer)). The legislative history indicates that
“financial product or service” should be interpreted broadly. Id.; see Versata
Dev. Grp., Inc. v. SAP America, Inc., 793 F.3d 1306, 1323–26 (Fed. Cir.
2015).
A patent need have only one claim directed to a covered business
method to be eligible for review. 77 Fed. Reg. at 48,736 (Response to
Comment 8).
CBM2015-00010
Patent 8,402,281 B2

21

Petitioner contends that the ‘281 patent “claims systems and methods
that are used in the practice, administration or management of a financial
product or service, including activities that are financial in nature, incidental
to a financial activity or complementary to a financial activity.” See Pet. 4–
5.
Patent Owner contends that the ’281 patent does not claim a financial
service or product. PO Resp. 54–59. Patent Owner argues that “not a
single word in any single claim of the ’281 Patent [] is purportedly directed
to a ‘financial product or service.’” PO Resp. 58.
We do not interpret the statute as requiring the literal recitation of
terms of data processing of financial products or services. As recognized in
the legislative history: “[t]o meet this [eligibility] requirement the patent
need not recite a specific financial product or service. Rather, the patent
claims must only be broad enough to cover a financial product or service.”
157 Cong. Rec. S1365 (daily ed. Mar. 8, 2011) (Statement of Sen. Schumer).
In this regard, claim 33 recites a “computer-implemented data
processing method” and includes a step of “determining whether each of the
one or more data processing rules associated with [a] requested data portion
are satisfied.” The ’281 patent discloses that protection attributes (i.e., the
claimed data processing rules) are used to protect against unauthorized
access of a data portion in a database (see Ex. 1001, 4:35–47) and that
banking is a field where protection against unauthorized access to databases
that are used for administering and storing sensitive information is desired.
Id. at 1:35–39. Banking is a financial activity.
The ’281 patent, further, discloses an example of a user interface that
is used to alter protection attributes in the data protection catalogue. Id. at
CBM2015-00010
Patent 8,402,281 B2

22

11:9–15; see also Fig. 5 (depicting the user interface.). In the example,
“Housing allowance” and “Social allowance” are data element types or data
categories. Id. at 11:8–10; Fig. 5. Figure 5 of the ’281 patent depicts a
Financial Manager as a person authorized to access the Social allowance
data. Allowances and a Financial Manager are financial in nature.
Likewise, Patent Owner’s declarant Dr. Direen testifies that “[t]he
standard examples, which are examples of market concern, are protecting
data items such as credit card numbers and social security number.” Ex.
2056 ¶ 27 (emphasis added). Dr. Direen’s testimony discusses such an
example. Id. ¶¶ 11, 14, 27–53; Figs. 1–15. In Dr. Direen’s example, the
data portions include credit card numbers, credit card PIN numbers, and
salary information; the data categories include credit card number and
salary; and the data processing rules include credit card protection attributes
and salary protection attributes. E.g., see id. ¶¶ 32, 35, 46; Figs. 1, 9. Credit
card number, credit card PIN numbers, and salary are all data financial in
nature.
Although not sufficient on its own the ’281 patent is classified in
705/51 of the Office’s patent classification system. See 77 Fed. Reg. at
48,739; see Versata at 1324, n.14 (noting that while Class 705 “apparently
served as the original template for the definition of a ‘covered business
method,’ . . . [it] was thought to be too narrow”) (citation omitted). Class
51—“Usage protection of distributed data files” is a subclass indented under
subclass 705/50—“Subject matter including cryptographic apparatus or
methods uniquely designed for or utilized in . . . the processing of financial
data.” Classification Definitions (Jan. 2012),
http://www.uspto.gov/web/patents/classification/uspc705/defs705.htm.
CBM2015-00010
Patent 8,402,281 B2

23

We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 33 encompasses activities that are financial in
nature, incidental to a financial activity, or complementary to a financial
activity.
We are not persuaded by Patent Owner’s argument that previous
Board decisions demonstrate that the ’281 patent is not a covered business
method patent. PO Resp. 55–56 (citing PNC Fin. Servs Grp., Inc. v.
Intellectual Ventures I, LLC, Case CBM2014-00032, slip. op. at 10 (PTAB
May 22, 2014) (Paper 13); J.P. Morgan Chase & Co. v. Intellectual
Ventures II LLC, Case CBM2014-00160, slip op. at 11 (PTAB Jan. 29,
2015) (Paper 11); Salesforce.com Inc. v. Applications in Internet Time, LLC,
Case CBM2014-00162, (PTAB Feb. 2, 2015) (Paper 11).) The cited
previous Board decisions are not precedential and are not binding on this
panel. Nonetheless, we have reviewed the allegedly conflicting decisions.
Our review of these decisions, however, reveals that the determination of
whether the patent is a covered business method patent rests upon the
specific facts of those proceedings. For example, in PNC Financial
Services, the Board determined that a showing that the patent was asserted
against a financial service in an infringement proceeding was not enough to
establish that the patent was a covered business method patent. See PNC
Fin. Servs, CBM2014-00032, Paper 13 at 14. The Board stated that whether
an allegedly infringing product was a financial service was just one factor
and that the Petitioners had not shown how “the ’298 patent, either through
its claims, Specification, or prosecution history, encompasses ‘activities that
are financial in nature, incidental to a financial activity, or complementary to
a financial activity.’” Id. at 13–14. Similarly, in J.P. Morgan and
CBM2015-00010
Patent 8,402,281 B2

24

Salesforce, the Board determined whether the patent was a covered business
method patent based upon the particular facts of those proceedings. Patent
Owner does not establish that the facts in those proceedings are sufficiently
similar to the facts in this proceeding. As discussed above, we determined,
based upon the facts in this proceeding, that the ’281 patent is a covered
business method patent.
We are also not persuaded by Patent Owner that the ’281 patent is not
a covered business method patent, because “the entire reason behind the
invention contradicts any allegation that the invention of the ’281 Patent is
incidental to a financial service or product.” PO Resp. 58–59. According to
Patent Owner, the Swedish Data Inspection, AB, mandated protection
legislation for personally-identifiable information to protect students and
“[t]hey did not, however, mandate data protection solely for financial
institutions.” Id. at 59.
The ’281 patent makes no mention of the Swedish legislation or that
the legislation was for the protection of students. The ’281 patent makes no
mention of students at all. Notably, U.S. Patent No. 5,606,610, which Patent
Owner argues was also the result of the Swedish legislation, likewise fails to
mention the Swedish legislation or the need to protect student data, but does
disclose that banking is a sector where it is essential that stored data be
protected against unauthorized access. See Ex. 2040, 1:13–15.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 33 of the ’281 patent encompasses a method or
corresponding apparatus for performing data processing or other operations
used in the practice, administration, or management of a financial product or
service.
CBM2015-00010
Patent 8,402,281 B2

25

ii. Technological Invention
The definition of “covered business method patent” in Section
18(d)(1) of the AIA does not include patents for “technological inventions.”
To determine whether a patent is for a technological invention, we consider
“whether the claimed subject matter as a whole recites a technological
feature that is novel and unobvious over the prior art; and solves a technical
problem using a technical solution.” 37 C.F.R. § 42.301(b). Both prongs
must be satisfied in order for the patent to be excluded as a technological
invention.
The following claim drafting techniques, for example, typically do not
render a patent a “technological invention”:
(a) Mere recitation of known technologies, such as
computer hardware, communication or computer networks,
software, memory, computer-readable storage medium,
scanners, display devices or databases, or specialized machines,
such as an ATM or point of sale device.
(b) Reciting the use of known prior art technology to
accomplish a process or method, even if that process or method
is novel and non-obvious.
(c) Combining prior art structures to achieve the normal,
expected, or predictable result of that combination.
77 Fed. Reg. 48,756, 48,763–64 (Aug. 14, 2012).

a. A Technological Feature that is Novel and Unobvious over the Prior Art
Petitioner argues that the ’281 patent is not for a technological
invention because none of the claims recite a technological feature that is
novel and nonobvious over the prior art. Pet. 6–7. According to Petitioner,
“the ’281 Patent does not identify any technologies beyond generic
CBM2015-00010
Patent 8,402,281 B2

26

computer components” and none of the “’281 claim limitations, taken alone
or in combination, rises to the level of a technological feature, let alone a
novel and nonobvious technical feature.” Pet. 7.
Patent Owner argues that “[t]he evidence demonstrates that the claims
of the ’281 Patent recite technological features that were novel and
nonobvious over the prior art at the time of the invention.” PO Resp. 59–60.
Patent Owner, however, does not particularly point out what evidence or
which elements of the claims demonstrate the novel and unobvious
technological feature. See id. Patent Owner may be arguing that the novel
and unobvious technological features are a database comprising data element
values and a data protection table because, according to Patent Owner, claim
33’s database must be a data processing system for managing an organize
collection of data and for making a compelling calling to the data protection
table and claim 33’s data portion must be a data element value so that
protection is a data element level. See PO Resp. 60–61, n. 23. Patent
Owner’s argument, however, is unpersuasive because, as discussed in
section II(A) above, when a database and data portion are given their
broadest reasonable construction, in light of the ’281 patent, claim 33 does
not require these alleged features.
We are persuaded by Petitioner that the ’281 patent is not for a
technological invention because at least claim 33 does not satisfy the first
prong of the test. Claim 33 does not recite a technological feature that is
novel or unobvious over the prior art. Claim 33 recites a data processing
method that is computer-implemented and includes maintaining a database
of data portions and maintaining a separate data protection table comprising
data processing rules associated with a data category for a data portion.
CBM2015-00010
Patent 8,402,281 B2

27

Data processing computers having separate databases, which store
associated data and associated rules, were known at the time of filing the
’281 patent. See Ex. 1001, 1:28–33; Ex. 1010 ¶¶ 16–18; Ex. 1006, 192–194,
202, 213 (describing relational databases); Pet. 20–22.
Claim 33 also recites steps of receiving a request to access a data
portion, determining whether the data processing rules are satisfied, and
granting the user access in response to each of the data processing rules
being satisfied. Claim 33 is silent as to how these steps are computer-
implemented. Claim 47, however, specifies that a processor is configured to
perform these steps. A processor is a known computer element. See Ex.
1010, ¶¶ 16–18.
Patent Owner may be arguing that the novel and unobvious
technological features are a database comprising data element values and a
data protection table because, according to Patent Owner, claim 33’s
database must be a data processing system for managing an organize
collection of data and for making a compelling calling to the data protection
table and claim 33’s data portion much be a data element value so that
protection is a data element level. See PO Resp. 3–9, 51–52, n.5. Patent
Owner’s argument, however, is unpersuasive because, as discussed in
section II(A) above, when a database and data portion are given their
broadest reasonable construction, in light of the ’281 patent, claim 33 does
not require these alleged features.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 33 does not recite a technological feature that is
novel or unobvious over the prior art and does not satisfy the first prong of
the test. The ’281 patent, thus, is a covered business method patent that is
CBM2015-00010
Patent 8,402,281 B2

28

not a technological invention.

b. Solves a Technical Problem with a Technical Solution
Petitioner argues that the ’281 patent is not for a technological
invention because none of the claims solve a technical problem using a
technical solution. Pet. 6–7; Pet. Reply 13–15. According to Petitioner, “the
claims generically recite known general purpose computing devices and
techniques such as a ‘database’ and a ‘computer system’ including a
‘processor’” and, thus does not recite a technical solution. Id. at 7.
Petitioner argues that the general purpose computing device is known
technology. Id.
Patent Owner argues that the ’281 patent is for a technological
invention, because it solves a technical problem with a technical solution.
PO Resp. 59–61. According to Patent Owner, the ’281 patent solves three
problems: 1) to provide separation of duties and prevent database
administrators from accessing the data (id. at 37); 2) “the ability to
implement data protection on the data element level in the database without
requiring application-level changes to the various computer programs and
application that were seeking to retrieve protected data from the database”
(id.) ; and 3) “providing data element level protection across many brands of
databases [] that a company might be using in-house” (id. at 37–38 ). The
alleged solution is “data to be protected in a first database, while the rules
for protection were stored outside that database and thus outside the purview
of the DBA [database administrator].” Id. at 38; see id. at 35–38.
We are persuaded that the ’281 patent does not solve a technical
problem with a technical solution. See Pet. 6–7. The ’281 patent discloses
CBM2015-00010
Patent 8,402,281 B2

29

that its objective is “to increase the protection against unauthori[z]ed access
to sensitive information.” Ex. 1001, 2:29–33; see also id. at 2:10–25, 1:23–
24 (describing that the ’281 patent “concerns . . . a method and apparatus for
data processing . . . for accomplishing increased protection against
unauthorized processing of data.”). The solution to this problem was
achieve by the claimed methods and apparatuses. Id. at 2:49–52.
None of the three technical problems identified by Patent Owner are
described in the ’281 patent. See PO Resp. 35–38. The ’281 patent makes
no mention of a need to protect data from a database administrator, to
eliminate application-level changes to the various computer programs and
application that were seeking to retrieve protected data from the database, or
to provide protection across many brands of databases. Id. Likewise, the
’281 patent does not describe the technical solution, alleged by Patent
Owner, because the ’281 patent does not describe a first database that calls
out to the second database. The claims of the ’281 patent also do not require
the alleged technical solution. Neither claim 33 nor any other claim requires
a first database that calls out to a second database or, indeed, any other
compelling calling.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 33 does not solve a technical problem using a
technical solution, and, thus, at least claim 33 also does not satisfy the
second prong. The ’281 patent, thus, is a covered business method patent
that is not a technological invention.
For the reasons discussed above, we are persuaded by Petitioner that
the ’281 patent is eligible for covered business method patent review.
CBM2015-00010
Patent 8,402,281 B2

30

C. 35 U.S.C. § 101
i. Section 101 Subject Matter Eligiblity
For claimed subject matter to be patentable eligible, it must fall into
one of four statutory classes set forth in 35 U.S.C. § 101: a process, a
machine, a manufacture, or a composition of matter. The Supreme Court
recognizes three categories of subject matter that are ineligible for patent
protection: “laws of nature, physical phenomena, and abstract ideas.” Bilski
v. Kappos, 130 S. Ct. 3218, 3225 (2010) (internal quotations and citation
omitted). A law of nature or an abstract idea by itself is not patentable;
however, a practical application of the law of nature or abstract idea may be
deserving of patent protection. Mayo Collaborative Servs. v. Prometheus
Laboratories, Inc., 132 S. Ct. 1289, 1293–94 (2012). To be patentable,
however, a claim must do more than simply state the law of nature or
abstract idea and add the words “apply it.” Id.
In Alice Corp. Pty, Ltd. v. CLS Bank Int’l, 134 S. Ct. 2347 (2014), the
Supreme Court recently clarified the process for analyzing claims to
determine whether claims are directed to patent-ineligible subject matter. In
Alice, the Supreme Court applied the framework set forth previously in
Mayo, “for distinguishing patents that claim laws of nature, natural
phenomena, and abstract ideas from those that claim patent-eligible
applications of those concepts.” Alice, 134 S. Ct. at 2355. The first step in
the analysis is to “determine whether the claims at issue are directed to one
of those patent-ineligible concepts.” Id. If they are directed to a patent-
ineligible concept, the second step in the analysis is to consider the elements
of the claims “individually and ‘as an ordered combination’” to determine
CBM2015-00010
Patent 8,402,281 B2

31

whether the additional elements ‘transform the nature of the claim’ into a
patent-eligible application.” Id. (quoting Mayo, 132 S. Ct. at 1298, 1297).
In other words, the second step is to “search for an ‘inventive concept’ —
i.e., an element or combination of elements that is ‘sufficient to ensure that
the patent in practice amounts to significantly more than a patent upon the
[ineligible concept] itself.’” Id. (alteration in original) (quoting Mayo, 132
S. Ct. at 1294). Further, the “prohibition against patenting abstract ideas
‘cannot be circumvented by attempting to limit the use of the formula to a
particular technological environment’ or adding ‘insignificant postsolution
activity.’” Bilski, 130 S. Ct. at 3230 (quoting Diamond v. Diehr, 450 U.S.
175, 191–92 (1981)).
Accordingly, utilizing this framework, we review Petitioner’s
contention that claims 33–60 of the ’281 patent are directed to ineligible
subject matter.

ii. Ineligible Concept
Petitioner contends that the claims of the ’281 patent are merely
directed to an abstract idea of “determining whether access to data should be
granted based on whether one or more rules are satisfied.” Pet. 19. Patent
Owner disputes that the claims of the ’281 patent are directed to an abstract
idea. See PO Resp. 28–32, 42–46. According to Patent Owner, “protection
of data at the data element level based on rules stored in a separate database,
where the first database calls out to the second database, is not an abstract
idea.” Id. at 28; see id. at 30–38 (citing DDR Holdings, LLC v. Hotel.com,
L.P., 773 F.3d 1245 (Fed. Cir. 2014)).
CBM2015-00010
Patent 8,402,281 B2

32

Claims 33–46 recite data processing methods, and claims 47–60 recite
corresponding computer systems. Nominally, the claimed methods and
system fall within the process or machine categories, respectively, of
statutory subject matter. Statutory class, however, is not by itself
determinative of whether a claim is directed to patent eligible subject matter.
“Regardless of what statutory category (‘process, machine, manufacture, or
composition of matter,’ 35 U.S.C. § 101) a claim's language is crafted to
literally invoke, we look to the underlying invention for patent-eligibility
purposes.” CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366,
1374 (Fed. Cir. 2011). See Alice, 134 S. Ct. 2358–59; Bancorp Servs. v. Sun
Life Assurance Co., 687 F.3d 1266, 1275 (Fed. Circ. 2012).
Independent claim 33 recites a data processing method that grants
access to a requested data portion if the rules associated with a data category
that is associated with the requested data portion is satisfied. Ex. 1001,
13:38–54. Claim 33 requires a database that comprises the data portions and
requires a separate data protection table comprising data processing rules
that must be satisfied before the data portion can be accessed. Id. The data
processing rules are associated with the data category. Id. Independent
claim 47 recites a corresponding computer system. Id. at 14:47–63.
Independent claims 33 and 47, thus, recite a method or system that grants
access to a requested data portion if the rules associated with a data category
that is associated with the requested data portion are satisfied. Ex. 1001,
13:38–54.
Given the above, we are persuaded by Petitioner that the claims are
directed to the abstract idea of determining whether access to data should be
granted based on whether one or more rules are satisfied.
CBM2015-00010
Patent 8,402,281 B2

33

We are not persuaded by Patent Owner that the claims are not directed
to an abstract idea, because Patent Owner’s argument is based upon
elements not required by the claims. See PO Resp. 28–46. Given our
construction of “data portion” and “database” in section II (A) above, the
claims do not require protection on the data element level based on rules
stored in a separate database, where the first database calls out to the second
database. Patent Owner’s argument is not commensurate with the scope of
the claims.

iii. Inventive Concept
Next, we look for additional elements that can “transform the nature
of the claim” into a patent-eligible application of an abstract idea. That is,
we determine whether the claims include an “inventive concept,” i.e., an
element or combination of elements sufficient to ensure that the patent in
practice amounts to significantly more than a patent on the abstract idea
itself. Alice, 134 S. Ct. at 2357. The Supreme Court in Alice cautioned that
merely limiting the use of abstract idea “to a particular technological
environment” or implementing the abstract idea on a “wholly generic
computer” is not sufficient as an additional feature to provide “practical
assurance that the process is more than a drafting effort designed to
monopolize the [abstract idea] itself.” Alice, 134 S. Ct. at 2358.

a. Independent Claims 33 and 47
Petitioner argues that the claims contain “only inconsequential
limitations that are insufficient to render them patent-eligible.” Pet. 19–22.
In this regard, Petitioner argues that the claims recite only generic computer
CBM2015-00010
Patent 8,402,281 B2

34

elements and functions that were well-known and conventional. Id.
Petitioner argues that the steps of maintaining a database of data portions
and maintaining a separate data protection table are simply data-gathering
steps and that receiving a request to access a data portion and granting
access to a data portion are insignificant pre- and post-solution activity. Id.
Taking claim 33 as representative, claim 33 requires that the method
is “computer-implemented.” Ex. 1001, 13:48. Merely reciting a generic
computer cannot transform a patent-ineligible abstract idea into a patent-
eligible invention. Alice, 134 S. Ct. at 2358.
Claim 33 also requires a step of maintaining a database comprising
data portions, associated with a data category and a step of maintaining a
separate data protection catalogue comprising a plurality of data processing
rules associated with a data category. Ex. 1001, 13:40–46. Data processing
computers having separate databases, which store associated data and
associated attributes, were well-known and conventional at the time of filing
the ’281 patent. See Ex. 1010 ¶¶ 16–18; Ex. 1006, 192–194, 202, 213
(describing relational databases). Storing data and associated rules in
separate databases is nothing more than routine data gathering and does not
transform the abstract idea into a patent-eligible invention. See
CyberSource, 654 F.3d at 1370.
Claim 33 further requires a step of receiving a request to access a data
portion and a step of determining whether the data processing rules
associated with the request data portion are satisfied. Ex. 1001, 13:47–51.
This is well-understood, routine, conventional activity that does not add
significantly more to the abstract idea. Mayo, 132 S. Ct. at 1298; see Pet.
22; Ex. 1006, 192–194 (discussing decision rules).
CBM2015-00010
Patent 8,402,281 B2

35

Claim 33 finally requires a step of granting the user access to the
requested data portion in response to the data processing rules being
satisfied. Ex. 1001, 13:52–54. Claim 47 recites that a processor is
configured to perform these steps. A processor is a known computer
element. See Ex. 1010 ¶¶ 16–18. Such granting of access to a user is
merely a conventional post-solution activity. Conventional post-solution
activity is not sufficient to transform the abstract idea into patent-eligible
subject matter. See Parker v. Flook, 437 U.S. 584, 590–92 (1978).
Even when the claim elements are considered as a combination, they
add nothing that is not already present when the elements are considered
separately. Alice, 134 S. Ct. at 2359. Claims 33 and 47 convey nothing
more meaningful than the fundamental concept of determining whether
access to data should be granted based on whether one or more rules are
satisfied.
Upon review of Petitioner’s analysis and supporting evidence and
taking into account Patent Owner’s arguments, discussed below, we are
persuaded by Petitioner that independent claims 33 and 47 do not recite
additional elements that transforms the claim into a patent-eligible
application of an abstract idea.
We are not persuaded by Patent Owner’s arguments that the claims
require additional elements that transform that abstract idea into a patent
eligible application (PO Resp. 32–42) because it is based upon an overly
narrow construction of the claimed elements, as discussed in section II (A)
above, and based on additional elements not recited or required by the
claims, as discussed in section II (B)(ii) above.
CBM2015-00010
Patent 8,402,281 B2

36

In addition, we are not persuaded by Patent Owner’s argument
regarding DDR Holdings, LLC v. Hotels.com, LP., 773 F.3d 1245 (Fed. Cir.
2014). See PO Resp. 29–31. Unlike the claimed combination of elements in
DDR Holdings, the claims of the ’281 patent appear to combine elements
according to their known functions to achieve routine and conventional
results. See DDR Holdings¸ 773 F.3d at 1257–58.
Patent Owner proffers declarations Mr. Bill Schmidt (Ex. 2057) and
Mr. Kurt Pachik (Ex. 2058) to demonstrate that the ’281 patent provides a
novel and nonobvious solution to a problem deeply rooted in computer
technology. PO Resp. 35–38. The declarations allegedly show that the
invention of the ’281 patent was used to protect the formula for Coca-Cola
from unauthorized access by database administrators or system
administrators. Id. Mr. Schmidt’s and Mr. Pachik’s declarations, however,
fail to establish a relationship between the system provided to Coca-Cola
and the claims of the ’281 patent. Mr. Schmidt makes no mention of the
’281 patent and provides no details as to the system implemented by Coca-
Cola. See Ex. 2057. Mr. Pachik, a former employee of Patent Owner,
testifies that he “assisted in implementing the solution provided in U.S.
Patent Nos. 6,321,201 and 8,402,281 [] for Coca-Cola” but provides no
details of the system. See Ex. 2058 ¶ 5. We, thus, are not persuaded by the
declarations of Mr. Schmidt and Mr. Pachik that the ’281 patent provides a
novel and nonobvious solution to a problem deeply rooted in computer
technology.

b. Dependent Claims 34–36, 41, 42, 48–50, 55, and 56
Petitioner argues that dependent claims 34–36, 41, 42, 48–50, 55, and
CBM2015-00010
Patent 8,402,281 B2

37

56 add well-known concepts of restricting access to data based on user
identity, program, version of program, and occurrence of activity logging.
Pet. 21–22; Pet. Reply 198. According to Petitioner, these are fundamental
and well-known concepts of limiting access within a computer system and,
thus, do not add anything significant to the abstract idea. Id. Patent Owner
does not address these dependent claims specifically, but rather contends
that the dependent claims generally “add additional significant technical
innovations demonstrating that the ’281 patent is necessarily rooted in
computer technology.” PO Resp. 52.
Dependent claims 34–36, 41, 42, 48–50, 55, and 56 further define the
claimed data processing rules. Claims 34, 41, 48, and 55 further define the
data processing rules as restricting access to a user, group of users, or users
that are owners of a subset of data. Ex. 1001, 12:55–58, 14:15–18, 64–67,
15:27–31. Restricting access to data based upon a user is a well-known and
conventional activity. See Ex. 1010 ¶ 5; Ex. 1006, 192–194 (textbook
discussing user based access rules, including based upon ownership).
Claims 35, 36, 49, and 50 further define the data processing rules as
restricting access to a program, a group of programs, or a specified version
of a program. Ex. 1001, 12:59–67, 15:1–10. Restricting access to data
based upon a program or version of a program is a well-known and
conventional activity. See Ex. 1010 ¶20; Ex. 1006, 192–193, Fig. 4
(textbook illustrating access right based on processes P1 and P2).
Claims 42 and 56 further define the data processing rules as restricting

8 Page 22 of the Petition and page 19 of the Petitioner’s Reply contains
typographical errors as to the numbering of some dependent claims. See
Paper 47 and Ex. 3001. Our decision reflects the corrected numbering of the
dependent claims. Id.
CBM2015-00010
Patent 8,402,281 B2

38

access based on whether activity logging is occurring. Ex. 1001, 14:19–24,
16:1–6. Restricting access to data based upon whether activity logging is
occurring is a well-known and conventional activity. See Ex. 1010 ¶ 22.
We are persuaded by Petitioner that claims 34–36, 41, 42, 48–50, 55,
and 56 further define the data processing rules as well-understood and
conventional data access rules. Well-understood, routine, conventional
activity does not add significantly more to the abstract idea. Mayo, 132 S.
Ct. at 1298.

c. Dependent Claims 37, 38, 51, and 52
Dependent claims 37, 38, 51, and 52 require that the data portion be a
column or field in a database. Ex. 1001, 14:1–4, 15:10–15. Petitioner
argues that these additional elements provide no meaningful limitation to the
abstract idea. Pet. 21–22; Pet. Reply 19. Patent Owner disputes that the
additional elements provide no meaningful limitation. PO Resp. 52.
We are persuaded by Petitioner that the additional elements of
dependent claims 37, 38, 51, and 52 provide no meaningful limitation to the
abstract idea. Restricting access to columns or fields of databases is well-
understood and conventional activity. See Ex. 1010 ¶ 14; Ex. 1006, 194,
214 (discussing access right to column and fields within records). Well-
understood, routine, conventional activity does not add significantly more to
the abstract idea. Mayo, 132 S. Ct. at 1298.

d. Dependent Claims 39, 40, 43–46, 53, 54, and 57–60
Petitioner argues that dependent claims 39, 40, 43–46, 53, 54, and 57–
60 add limitations directed to basic aspects of data encryption which do not
CBM2015-00010
Patent 8,402,281 B2

39

“contribute significant or material limitations to the abstract idea.” Pet. 18–
22, 25; Pet. Reply 19. According to Petitioner, the use of different levels of
encryption to store and transmit encrypted data is well-known. Pet. 64.
Patent Owner disputes that the additional limitations provide no meaningful
limitation and that “claims 39-40, 43-46, 53-54, [and] 57-60 [] add a fourth
critical component, namely the ability to perform encryption at the data
element level in a database where the rules for protection are stored in the
separate data protection table.” PO Resp. 50–52.
Claims 39, 40, 53, and 54 further define the access rules as restricting
access to users or programs that use a specified level of encryption to
subsequently store or transmit the accessed data. Ex. 1001, 14:5–14; 15:54–
31. Different levels of encryption and storing and transmitting encrypted
data is well-known. Ex. 1010 ¶ 23
Claims 43, 44, 57, and 58 require that access to a first or second data
portion is restricted to a user or program that possess a first or second
cryptographic key. Ex. 1001, 14:25–40, 16:7–22. Claims 46 and 60 recite
“wherein at least one data portion comprises encrypted data.” Ex. 1001,
14:45–46, 16:28–29. Claims 45 and 59 require that “granting access to the
requested data portion comprises providing the cryptographic key to a
requesting entity.” Id. at 14:41–44, 16:23–27. Encrypting data using a
cryptographic key and providing the key to authorized users is well-
understood and conventional activity. See Ex. 1010 ¶ 23; Ex. 1006, 178,
206, 213, 229–230. Encrypting on a field level was also known. Pet. Reply
9; Ex. 1006, 151. Encrypting data using cryptographic keys is well known
conventional activity.
Well-understood, routine, conventional activity does not add
CBM2015-00010
Patent 8,402,281 B2

40

significantly more to the abstract idea. Mayo, 132 S. Ct. at 1298.

III. MOTION TO EXCLUDE
i. Exhibits 2017, 2018, 2014, 2092, and 2093
Petitioner moves to exclude Exhibits 2017, 2018, 2014, ¶¶ 10, 12, 16–
18, 21, 22, and 24–26 of Exhibit 2092, and ¶¶ 9–11, 13–15, 17–21, 23–25,
and 27 of Exhibit 2093. Mot. to Exclude. We do not rely on these exhibits
or portions of the exhibits in reaching our Decision and, thus, dismiss Patent
Owner’s motion to exclude these exhibits as moot.

ii. Exhibits 2057 and 2058
Petitioner moves to exclude Exhibits 2057 and 2058 because,
according to Petitioner, the exhibits are not relevant to any of the validity
issues. Mot. Exclude 3–4; Pet. Reply to Opp. to Mot. Exclude 4.
We are not persuaded that Exhibits 2057 and 2058 should be
excluded as irrelevant under Federal Rules of Evidence 401, 402, and 403.
As the Board has noted in numerous cases, “the Board, sitting as a non-jury
tribunal with administrative expertise, is well positioned to determine and
assign appropriate weight to the evidence presented in this trial, without
resorting to formal exclusion that might later be held reversible error.” See
e.g. Liberty Mutual Insurance Co. v. Progressive Casualty Insurance Co.
(CBM2012-00002, Paper 66, January 23, 2014); Gnosis S.P.A., et al. v. S.
Alabama Medical Science Foundation, (IPR2013-00118, Paper 64 June 20,
2014); S.E.C. v. Guenthner, 395 F. Supp. 2d 835, 842 n.3 (D. Neb. 2005).
CBM2015-00010
Patent 8,402,281 B2

41

IV. MOTION FOR OBSERVATION
On October 13, 2015, Patent Owner filed a Motion for Observation
Regarding Cross Examination of Reply Witness Dr. Michael Shamos. Mot.
Observation. Patent Owner’s observations comment on the cross-
examination testimony of Petitioner’s declarant Dr. Michael Shamos (Ex.
2053) given on June 10, 2015. Id. at 1. The Motion for Observation
indicates that it was filed pursuant to authorization in the Scheduling Order
(Paper 14). Mot. Observation 1. Petitioner requests that we expunge the
Motion for Observation from the record because Dr. Shamos is not a reply
witness. See Opp. to Mot. Observation 1–2.
The Scheduling Order states “[a] motion for observations on cross-
examination provides the parties with a mechanism to draw the Board’s
attention to relevant cross-examination testimony of a reply witness because
no further substantive paper is permitted after the reply” and refers to the
Office Patent Trial Practice Guide. Paper 14, 3–4. The Trial Practice Guide
states:
In the event that cross-examination occurs after a party has
filed its last substantive paper on an issue, such cross-
examination may result in testimony that should be called to the
Board’s attention, but the party does not believe a motion to
exclude the testimony is warranted. The Board may authorize
the filing of observations to identify such testimony and
responses to observations, as defined below. 77 Fed. Reg. at
48768 (emphasis added). The scheduling order authorizes the
filing of such a motion for observations regarding cross-
examination of a reply witness by Due Date 4.
77 Fed. Reg. at 48768 (emphasis added).
CBM2015-00010
Patent 8,402,281 B2

42

Dr. Shamos’ cross-examination testimony was given on June 10,
2015, prior to Patent Owner filing its Patent Owner’s Response, on July 6,
2015. The cross-examination did not occur after Patent Owner filed its last
substantive paper.
Patent Owner’s Motion for Observation, thus, is improper. The
Scheduling Order did not authorize Patent Owner to file a Motion for
Observation of cross-examination that occurred prior to Patent Owner filing
its last substantive paper on an issue, and the Patent Owner’s Response and
Patent Owner did not seek other authorization for such. The improper
observations are akin to an unauthorized sur-reply to argument made in
Petitioner’s Reply. We, thus, expunge Patent Owner’s unauthorized
observations from the record. See 37 C.F.R. § 42.7(a).

IV. MOTION TO AMEND
Patent Owner’s Motion to Amend seeks to substitute new claims 61–
68 for challenged claims 1–32. Mot. Amend. 1. For the reasons discussed
below, Patent Owner’s Motion to Amend is denied.
Section 326(d)(3) states that “[a]n amendment under this subsection
may not enlarge the scope of the claims of the patent or introduce new
matter.” Similarly, Rule 42.221(2) provides that a motion to amend may be
denied where the amendment does not respond to a ground of
unpatentability involved in the trial and where the amendment seeks to
enlarge the scope of the claims of the patent or introduces new subject
matter. Rule 42.20(c) places the burden on the patent owner, as the moving
party, to establish that it is entitled to the requested relief. See Microsoft
Corp. v. Proxyconn, Inc.¸ 739 F.3d 1292, 1306 (Fed. Cir. 2015) (affirming
CBM2015-00010
Patent 8,402,281 B2

43

the Board’s denial of a motion to amend claims where the patent owner
failed to establish the patentability of the substitute claims over the prior art
of record). Patent Owner, thus, must show that the proposed substitute
claims are responsive to a ground of patentability, do not enlarge the scope
of the claims of the patent, or introduce new matter.

i. Proposed Substitute Claims
Patent Owner proposes to substitute independent claims 61 and 65 for
challenged independent claims 1 and 17, respectively. Mot. Amend 16–19,
Appendix A. Patent Owner also proposes to substitute dependent claims 62,
63, 64, 66, 67, and 68 for challenged dependent claims 12, 14, 16, 28, 30 and
32, respectively. Id.
Proposed substitute claim 61 is illustrative and reproduced below with
markings showing the differences with original claim 1. Deletions are
shown in brackets and additions are underlined.
61. A computer-implemented data processing method for
protecting data in a database comprising:
maintaining [[a]] the database comprising a plurality of
protected data [[portions]] element values, each protected data
element value associated with a data element type;
maintaining a separate data protection table comprising,
for each [[of one or more of the]] data [[portions]] element type,
a plurality of data processing rules associated with the data
[[portion]] element type that must each be [[satisfied before]]
applied to the protected data [[portion]] element value
associated with the data element type before the data element
value can be accessed;
receiving at the database a request to access a protected
data [[portions]] element value stored in the database;
CBM2015-00010
Patent 8,402,281 B2

44

[[determining]] automatically calling from the database
to the separate data protection table to collect [[whether]] each
of the [[one or more]] plurality of data processing rules
associated with the data element type associated with the
requested protected data [[portions are satisfied]] element
value; and
[[granting access to]] controlling the accessing of the
requested data [[portion responsive to]] element value in
conformity with each of the [[one or more]] collected plurality
of data processing rules associated with the data element type
associated with the requested protected data [[portion being
satisfied]] element value.
Notably, proposed substitute claim 61 is amended to add a limitation
that requires “automatically calling from the database to the separate data
protection table to collect each of the plurality of data processing.”
Proposed substitute claim 61 is also amended to delete the limitation that
requires “determining whether each of the one or more plurality of data
processing rules associated with the request data portion are satisfied.”
Proposed substitute claim 65 contains corresponding amendments.

ii. Enlarging the Scope of the Claims and Non-Responsive
Specifically, with regard to 37 C.F.R. § 42.221(a)(2)(i), a proposed
substitute claim is not responsive to an alleged ground of unpatentability of a
challenged claim if it does not either include or narrow each feature of the
challenged claim being replaced. A patent owner may not seek to broaden a
challenged claim in any respect, in the name of responding to an alleged
ground of unpatentability. A proper substitute claim under 37 C.F.R.
§ 42.221(a)(2)(i) must only narrow the scope of the challenged claim it
replaces. Similarly, under 37 C.F.R. § 42.221(a)(2)(ii), a substitute claim
CBM2015-00010
Patent 8,402,281 B2

45

may not enlarge the scope of the challenged claim it replaces by eliminating
any feature. See Idle Free Systems, Inc. v. Bergstom, Inc., Case IPR2012-
00027, slip op. at 5 (PTAB June 11, 2013) (Paper 26).
Petitioner argues that the proposed substitute claims substantially
rewrite the challenged claims and eliminate certain requirements of the
challenged claims. Opp. to Mot. Amend 2–5. Patent Owner responds that
the proposed claims replace the original limitations with narrower
limitations. PO Reply. to Opp. to Mot. Amend 2–3.
As can be seen from proposed substitute claim 61 above, Patent
Owner substantially rewrote the step of “determining whether each of the
one or more data processing rules associated with the requested data portions
are satisfied” (Ex. 1001, 11:26–28) to “automatically calling from the
database to the separate data protection table to collect each of the plurality
of data processing rules associated with the data element type associated
with the requested data element value” (Mot. Amend 27). This effectively
eliminated the determining limitation from the claim. “A proposed
substitute claims in not responsive to a ground of unpatentability of a
challenged claim if it removes any feature of the challenged claim being
replaced.” Nichia Corp. v. Emcore Corp., Case IPR2012-00005, slip op. at
53 (PTAB Feb. 11, 2014) (Paper 68). Further, no other limitation in the
proposed substitute claims requires determining whether each of the one or
more data processing rules associated with the requested data portions is
satisfied.
Patent Owner also substantially rewrote the step of “granting access to
the requested data portion responsive to each of the one or more data
processing rules associated with the requested data portion being satisfied”
CBM2015-00010
Patent 8,402,281 B2

46

(Ex. 1001, 11:29–31) to “controlling the accessing of the requested data
element value in conformity with each of the collected plurality of data
processing rules associated with the data element type associated with the
requested protected data element value” (Mot. Amend 27). Petitioner argues
that “[c]ontrolling the accessing of relates to both granting and denying
access to the data, whereas the original claims related only to granting
access.” Opp. to Mot. Amend 3.
Amending the claims to require controlling access in conformity with
the collected data processing rules instead of requiring granting access to the
protected data if the data rules are satisfied impermissibly enlarges the scope
of the challenged claims. As Petitioner argues, controlling the access
encompasses not only granting, but also denying access. See Opp. to Mot.
Amend 3.
Patent Owner, thus, fails to show that the proposed substitute claims
are responsive to a ground of patentability and do not enlarge the scope of
the claims of the patent, as required by 35 U.S.C. § 326(d)(3) and 37 C.F.R.
§ 42.221(2).

iii. New Subject Matter
New or amended claims which introduce elements or limitations
which are not supported by the original disclosure of the patent fail to satisfy
the written description requirement of 35 U.S.C. § 112, first paragraph.9
Section 112, first paragraph, requires that the “specification shall contain a
written description of the invention . . . .” To satisfy the written description

9 We refer to the pre-AIA version of the 35 U.S.C. § 112, first paragraph,
due to the date of the ’281 patent.
CBM2015-00010
Patent 8,402,281 B2

47

requirement, the disclosure must reasonably convey to skilled artisans that
the patentee possessed the claimed invention as of the filing date. Ariad
Pharms., Inc. v. Eli Lilly & Co., 598 F.3d 1336, 1351 (Fed. Cir. 2010) (en
banc). Although the description requirement under § 112 does not demand
(1) any particular form of disclosure or (2) that the specification recite the
claimed invention verbatim, a description that merely renders the invention
obvious does not satisfy the requirement. Id. at 1352 (citations omitted).
The proposed substitute claims require automatically calling from the
database to the separate data protection table to collect each of the plurality
of data processing rules. Mot. Amend 27. Patent Owner argues that “[t]he
’281 Patent’s original disclosure and specification clearly define
‘automatically calling from the database to the separate data protection
table’” and points to page 4, lines 14–21; page 6, lines 6–9; page 6, line 36–
page 7, line 8; and page 11, line 21–page 12, line 14 of the original
disclosure as support for this limitation. Mot. Amend 6.
The ’281 patent and its original disclosures, however, do not “clearly”
define or describe a calling from the database to the separate date protection
table. Although the ’281 patent describes a calling to collect the data
protection attributes, it does not describe that the calling is from the
database. See Ex. 1001, 10:48–60 (“is first collected by the system”); see id.
at Abstract, 2:65–3:5, 3:59–4:2, 4:26–31, 7:63–67, 8:53–61 (describing a
compelling calling to a data protection catalogue, but failing to describe the
compelling calling being produced by the O-DB database).
As discussed in section II (A) above, we are persuaded by Dr.
Shamos’ testimony that one of ordinary skill in the art would know from the
’281 patent that control module 20 provides the compelling calling (see Ex.
CBM2015-00010
Patent 8,402,281 B2

48

1010 ¶¶ 15–21) and not the database and we are not persuaded by the
testimony of Mr. Mattsson and Dr. Direen to the contrary (see Ex. 2055 ¶¶
27–29; Ex. 2056 ¶¶ 58–59).
Patent Owner, thus, fails to show that the proposed substitute claims
are adequately supported by the written description and do not add new
matter to the claims, as required by 35 U.S.C. § 326(d)(3) and 37 C.F.R.
§ 42.221(2).

V. CONCLUSION
We determine that Petitioner demonstrates by a preponderance of the
evidence that claims 33–60 are unpatentable under 35 U.S.C. § 101 as being
directed to non-statutory subject matter.
We also determine that Patent Owner fails to demonstrate that
proposed substitute claims 61–68 are patentable.
This is a Final Written Decision of the Board under 35 U.S.C.
§ 328(a). Parties to the proceeding seeking judicial review of this Decision
must comply with the notice and service requirements of 37 C.F.R. § 90.2.

VI. ORDER
In consideration of the foregoing, it is hereby:
ORDERED that claims 33–60 of U.S. Patent No. 8,402,281 B2 are
unpatentable;
FURTHER ORDERED that Petitioner’s Motion to Exclude is denied
as moot;
FURTHER ORDERED that Patent Owner’s Motion for Observation
(Paper 31) is expunged from the record;
CBM2015-00010
Patent 8,402,281 B2

49

FURTHER ORDERED that Patent Owner’s Motion to Amend is
granted as to its request to cancel claims 1–32 of U.S. Patent No. 8,402,281
B2; and
FURTHER ORDERED that Patent Owner’s Motion to Amend is
denied as to its request to add proposed substitute claims 61–68.

PETITIONER:
Marc S. Kaufman
Mark Vogelbacker
John Bovich
REED SMITH LLP
mskaufman@reedsmith.com
mvogelbacker@reedsmith.com
JBovich@ReedSmith.com

PATENT OWNER:
Woodrow H. Pollack
Michael J. Colitz, III
GRAYROBINSON, P.A.
woodrow.pollack@gray-robinson.com
Michael.colitz@gray-robinson.com