Federal Circuit In Part Reverses PTAB Ruling that Some Centripetal Network Threat Detection Patent Claims are Non-Obvious

The U.S. Court of Appeals for the Federal Circuit (CAFC) issued a decision Tuesday in Centripetal Networks, LLC v. Keysight Technologies, Inc., affirming in part and reversing in part a decision of the United States Patent and Trademark Office’s (USPTO) Patent Trial and Appeal Board (PTAB). The CAFC determined that the PTAB correctly found claims 1 through 3, 5 through 13, and 15 through 20 of Centripetal Networks, LLC’s patent directed to network threat detection unpatentable for obviousness. The court reversed the PTAB’s determination regarding claims 4 and 14, finding those claims unpatentable for obviousness as well.

The patent at issue, U.S. Patent No. 10,193,917, titled “Rule-Based Network-Threat Detection,” discloses a packet-filtering device that receives network packets and determines whether they correspond to criteria specified by a packet-filtering rule. The PTAB determined that Keysight Technologies, Inc. met its burden of showing claims 1 through 3, 5, 11 through 13, 15, and 20 would have been obvious over a prior art reference known as Sourcefire alone. Claims 6 through 10 and 16 through 19 would have been obvious over a combination of Sourcefire and another prior art reference known as Macaulay. The PTAB also determined that Keysight Technologies, Inc. did not meet its burden of showing that claims 4 and 14 would have been obvious.

Centripetal Networks argued the PTAB erred by construing a term that the parties had not briefed, specifically the term “packet flow entry.” Instead, it contended that the PTAB should have construed the term “packet flow,” which it argued was central to the scope of the claims. It further asserted that because the PTAB relied on portions of the patent not mentioned in the briefing or at the hearing, it never had the opportunity to address an argument raised for the first time by the PTAB. As a result, Centripetal Networks argued the decision deprived it of notice of the contested claim construction issues and an opportunity to be heard.

The Federal Circuit disagreed, explaining that the critical question for due process compliance is whether Centripetal Networks received adequate notice of the issues that would be considered and ultimately resolved at the hearing. The court noted that Centripetal Networks’ briefing clearly put the term “packet flow entry” in dispute when it proffered a meaning of “packet flow entry” based on its proposed construction of “packet flow.” At the PTAB hearing, Centripetal Networks was explicitly asked about the term and given the opportunity to respond. The court cited its own precedent confirming that the PTAB may adopt a claim construction of a disputed term that neither party proposes without running afoul of the Administrative Procedure Act (APA).

Centripetal Networks also argued the PTAB erred in its construction of “packet flow entry” because its analysis hinged on the assumption that a packet flow entry must contain information for only a single packet flow. The Federal Circuit disagreed, finding that the specification refers to an entry that reflects a set of packets with a common feature, such as a common threat identifier, and that to construe the term otherwise would run afoul of the specification.

Regarding the obviousness of the independent claims, Centripetal Networks argued the PTAB erred because Sourcefire does not disclose packet flow analysis data, a device that updates a packet flow entry, and packet time data that corresponds to the packet flow entries. The Federal Circuit found that substantial evidence supported the obviousness determination. The court noted that the PTAB adequately explained its rationale and made express findings of fact firmly grounded in the record, explaining that “the possibility of drawing two inconsistent conclusions from the evidence does not prevent an administrative agency’s finding from being supported by substantial evidence.”

On cross-appeal, Keysight Technologies, Inc. argued the non-obviousness determination as to claims 4 and 14 should be reversed because the PTAB erred by construing the phrase “responsive to” in a way that conflicted with the patent and overlooked aspects of the teachings of Sourcefire that render the claims obvious. The Federal Circuit agreed, finding that substantial evidence did not support the findings of the PTAB that Sourcefire fails to disclose an existing flow log entry, updating flow log entries responsive to a determination that each packet corresponds to one or more packet-filtering rules, and modifying the existing packet flow log entry to indicate corresponding packet-filtering rules.

The Federal Circuit found that the PTAB’s reasoning as to why Sourcefire does not disclose an existing flow log entry was “contrary to its prior factfinding” for claim 1, where the PTAB had determined that the refresh of Sourcefire will update the flow log entry to reflect additional packets that have been received. From this, the court reasoned that it logically follows that if Sourcefire can update a flow log entry, then the entry must already exist. It also found that the language of claims 4 and 14 does not require continuous updates, nor does it exclude a user selection or a refresh interval. Accordingly, the Federal Circuit reversed the PTAB’s determination regarding claims 4 and 14, “explaining that reversal is warranted where only one answer is supported by substantial evidence and there is neither a request nor an apparent reason to grant a second record-making opportunity.”