Epicor Software Corporationv.Protegrity Corporation

Patent Trial and Appeal Board

Apr 20, 2016

09027585 (P.T.A.B. Apr. 20, 2016)

Trials@uspto.gov Paper No. 46
571.272.7822 Entered: April 20, 2016

UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

EPICOR SOFTWARE CORPORATION,1
Petitioner,

v.

PROTEGRITY CORPORATION,
Patent Owner.
____________

CBM2015-00002
Patent 6,321,201 B1
____________

Before KEVIN F. TURNER, MEREDITH C. PETRAVICK, and
GREGG I. ANDERSON, Administrative Patent Judges.

TURNER, Administrative Patent Judge.

FINAL WRITTEN DECISION
Covered Business Method Patent Review
35 U.S.C. § 328(a) and 37 C.F.R. § 42.73

1 During the course of the proceeding, Petitioner separated one of its
business units from Epicor Software Corporation to APTOS, Inc. Both
entities are indicated as being real parties-in-interest. See Paper 26.
CBM2015-00002
Patent 6,321,201 B1

2

I. INTRODUCTION
A. Background
Epicor Software Corporation (“Petitioner”) filed a Petition2 (Paper 8,
“Pet.”) requesting a review under the transitional program for covered
business method patents of claims 1, 5, 19, 20, and 27–31 of U.S. Patent No.
6,321,201 B1 (Ex. 1001, “the ’201 Patent”). Protegrity Corporation (“Patent
Owner”) filed a Preliminary Response (Paper 12, “Prelim. Resp.”). Pursuant
to 35 U.S.C. § 324, we instituted this trial on the following ground:
Ground Prior Art Challenged Claims
§ 101 n/a 1, 5, 19, 20, and 27–31
Paper 17 (“Dec.”).
Subsequently, Patent Owner filed a Patent Owner’s Response. Paper
27 (“Resp.”). Petitioner filed a Reply to Patent Owner’s Response. Paper
34 (“Reply”). As well, Patent Owner filed a Motion to Exclude Evidence.
Paper 37 (“Mot. Exclude”). Petitioner filed an Opposition to Patent Owner’s
Motion to Exclude (Paper 39, “Opp. to Mot. Exclude”), and Patent Owner
filed a Reply to the Opposition to the Motion to Exclude (Paper 42). Patent
Owner also filed a Motion for Observation Regarding Cross Examination of
Reply Witness Mr. Bruce Schneier. Paper 38 (“Mot. Observation”).
Petitioner filed an Opposition to Patent Owner’s Motion for Observation.
Paper 40.
An oral hearing was held on November 13, 2015. A transcript of the

2 We refer to the Amended Petition for Covered Business Method Patent
Review. Paper 8.
CBM2015-00002
Patent 6,321,201 B1

3

hearing is included in the record. Paper 44 (“Tr.”).
We have jurisdiction under 35 U.S.C. § 6(c). This Final Written
Decision is issued pursuant to 35 U.S.C. § 328(a) and 37 C.F.R. § 42.73.

B. Related Matters
Petitioner identifies Protegrity Corp. v. Epicor Software Corp., No.
3:13-cv-01781-JBA (D. Conn. Dec. 2, 2013) as a related district court
proceeding. Pet. 4. Patent Owner identifies numerous other related district
court matters that would be affected by a decision in this proceeding. See
Paper 6, 3–5.
The ’201 Patent is also the subject of pending proceedings CBM2015-
00014, CBM2015-00021, and CBM2015-00030. The ’201 Patent was also
the subject of Reexamination No. 90/011,364, with some originally issued
claims confirmed and cancelled, one claim amended, and several claims
added.
U.S. Patent No. 8,402,281 B2 is a continuation of the ’201 Patent (Ex.
1004, “the ’281 Patent”). The ’281 Patent is the subject of pending
proceedings CBM2014-00182, CBM2015-00006 and CBM2015-00010.
The ’281 Patent was also the subject of terminated proceedings CBM2014-
00024 and CBM2014-00121, where those proceedings terminated due to
settlement between the parties.

C. The ’201 Patent
The ’201 Patent, titled “Data Security System for a Database having
Multiple Encryption Levels Applicable on a Data Element Value Level,”
issued on November 20, 2001, based on Application No. 09/027,585, filed
CBM2015-00002
Patent 6,321,201 B1

4

on February 23, 1998. The ’201 Patent claims priority as a continuation
application to PCT/SE97/01089, filed on June 18, 1997.
The ’201 Patent is concerned with protecting data against
unauthorized access. Ex. 1001, 2:21–34. The ’201 Patent states that “in
other fields, such as industry, banking, insurance, etc[.], improved protection
is desired against unauthorized access to the tools, databases, applications[,]
etc.[,] that are used for administration and storing of sensitive information.”
Id. at 1:27–39. Figure 4 is reproduced below.

Figure 4 depicts the ’201 Patent’s system
The system shown in Figure 4 includes an operative database (O-DB)
and another database, IAM-DB. O-DB database contains data element
values DV that are to be protected. Id. at 5:53–58. IAM-DB database
contains a data protection catalogue (DPC), which stores protection
attributes (e.g., P1*) for data element types (e.g., DT1) that are associated
with data element values DV. Id. at 9:29–51. The protection attributes state
rules for processing the corresponding data element values DV. Id. at 3:46–
CBM2015-00002
Patent 6,321,201 B1

5

51. For example, a protection attribute indicates the degree to which data
element value DV is encrypted (id. at 7:57–63) or indicates that only
accepted, or certified, programs are allowed to process data element value
DV (id. at 9:20–28). See id. at 4:45–65. When a user initiates an attempt to
process a certain data element value DV, a compelling calling is created to
data protection catalogue DPC to obtain the protection attributes associated
with the data element type for data element value DV. Id. at 2:54–61. The
processing of data element value DV is then controlled in conformity with
the protection attributes. Id. at 2:64–67, 3:55–65. Thus, the individual data
element or data element type becomes the controlling unit for determining
the level of protection. Id. at 4:33–38.
Claim 1 of the ’201 Patent is illustrative of the claims at issue, with all
other challenged claims being dependent thereon, and read as follows:
1. A method for processing of data that is to be protected,
comprising:
storing the data as encrypted data element values (DV) in
records (P) in a first database (O-DB), the first database (O-DB)
having a table structure with rows and columns, each row
representing a record (P) and each combination of a row and a
column representing a data element value (DV), in the first
database (O-DB) each data element value (DV) is linked to a
corresponding data element type (DT);
storing in a second database (IAM-DB) a data element
protection catalogue (DPC), which contains each individual data
element type (DT) and one or more protection attributes stating
processing rules for data element values (DV), which in the first
database (O-DB) are linked to the individual data element type
(DT);
for each user-initiated measure aiming at processing of a
given data element value (DV) in the first database (O-DB),
initially producing a calling to the data element protection
CBM2015-00002
Patent 6,321,201 B1

6

catalogue for collecting the protection attribute/attributes
associated with the corresponding data element type, and
controlling the user’s processing of the given data element
value in conformity with the collected protection
attribute/attributes.

II. ANALYSIS
A. Claim Construction
The Board interprets claims of unexpired patents using the broadest
reasonable construction in light of the specification of the patent in which
they appear. 37 C.F.R. § 42.300(b); In re Cuozzo Speed Techs., LLC, 793
F.3d 1268, 1278–79 (Fed. Cir. 2015), cert. granted sub nom. Cuozzo Speed
Techs., LLC v. Lee, 136 S. Ct. 890 (2016) (mem.).
Under the broadest reasonable construction standard, claim terms are
given their ordinary and customary meaning, as would be understood by one
of ordinary skill in the art in the context of the entire disclosure. In re
Translogic Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). Any special
definition for a claim term must be set forth with reasonable clarity,
deliberateness, and precision. In re Paulsen, 30 F.3d 1475, 1480 (Fed. Cir.
1994).
In our Institution Decision, we construed two terms specifically:
“processing rules” and “data element type.” Dec. 14–17. Although
apparently not taking issue with our construction of “processing rules,”
Patent Owner argues that our construction for “data element type” should be
modified, and that we implicitly applied “an unreasonably broad definition
to the term ‘database.’” Resp. 17–26. We address these contentions below.

CBM2015-00002
Patent 6,321,201 B1

7

i. Database
Although we did not explicitly construe the claim term “database,”
Petitioner proposed that the broadest reasonable construction of database is
“an organized collection of structured data.”3 Pet. 13–14. According to
Petitioner, its proposed construction is the same construction taken by Patent
Owner in a district court proceeding concerning the parent ’201 Patent. Id.
Patent Owner argues that Petitioner’s proposal is unreasonably broad
and proposes that the broadest reasonable construction of “database” is “a
data processing system for managing an organized collection of structured
data.” Resp. 18–25. Patent Owner argues that Petitioner’s proposed
construction is unreasonably broad in the context of the ’201 Patent because
the database must be construed to allow for the database to make automatic
and compelling callings to the data element protection catalogue. Id. at 19.
Patent Owner argues that its construction is consistent with the ’201 Patent
and is supported by the testimony of its declarants Mr. Mattsson and
Dr. Direen, Petitioner’s declarant Mr. Schneier, and Dr. Shamos and
supported by certain database manuals and technical definitions of the era.
Id. at 19–23.
a. Claim Language
“Claim construction begins, as it must, with the words of the claims.”
Vehicular Techs. Corp. v. Titan Wheel Int'l, 141 F.3d 1084, 1088 (Fed. Cir.

3 In the Final Written Decision for CBM2014-00182, we determine that the
broadest reasonable construction of “database” is “an organization of
structure data.” The addition of the word “collection” to the construction we
adopted in CBM2014-00182, however, provides no meaningful distinction
between the constructions as an organized structure of data implies a
collection of data.
CBM2015-00002
Patent 6,321,201 B1

8

1998) (citing Bell Commc’ns Research, Inc. v. Vitalink Commc’ns Corp., 55
F.3d 615, 619–20 (Fed. Cir. 1995)). Independent claim 1 recites “[a]
method for processing of data that is to be protected” that includes, among
other steps, “storing the data as encrypted data element values (DV) in
records (P) in a first database (O-DB)” and “storing in a second database
(IAM-DB) a data element protection catalogue (DPC).” Ex. 1001, 11:12–
24. Independent claim 1 also recites that the first database has a table
structure with rows and columns. As such, claim 1, and the other challenged
claims that depend therefrom, recites that the database comprises or stores
different types of data.
Claim 1 and the claims dependent on claim 1 do not recite that the
database performs any other function, other than the storage of data.
Although claim 1 recites that for each user-initiated measure aiming at
processing of a given data element, a calling to the data element protection
catalogue is initially produced, the claim does not specify what element
produces the calling. See id. at 11:29–32. Additionally, independent claim
8, although not a challenged claim, recites an apparatus having a database
that stores data to be protected. Ex. 1001, Ex Parte Reexamination
Certificate 1:24–51 (amended claim 8). This latter claim was amended
during reexamination to recite that the apparatus, not the database, controls
the user’s processing of the data according to the data processing rules, and
the apparatus, not the database, also produces the compelling calling to the
data element protection catalogue. Id. at Ex Parte Reexamination Certificate
1:41–51.
CBM2015-00002
Patent 6,321,201 B1

9

The words of the claims of the ’201 Patent, thus, are consistent with
Petitioner’s proposed construction as being the broadest reasonable
construction.
b. Written Description
The written description is “always highly relevant” in construing a
claim, and “it is the single best guide to the meaning of a disputed term.”
Vitronics Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir. 1996).
The written description of the ’201 Patent provides specific definitions of
many terms (Ex. 1001, 2:64–3:43) but does not contain a definition of
“database.”
The claimed database for storing a plurality of data portions
corresponds to the O-DB database disclosed in the ’201 Patent. The O-DB
database is part of a larger “database management system” that includes
multiple databases. Id. at 5:49–6:12, Fig. 3. Similar to the other databases,
the O-DB database is described as containing data and, in particular, data to
be protected. Id. at 5:53–58. Contrary to Patent Owner’s argument (Resp.
20), the ’201 Patent does not describe the O-DB database, or any other
database, as performing any other data processing or managing functions. In
particular, the ’201 Patent does not describe that the O-DB database
produces the compelling calling to the data protection catalogue. See Ex.
1001, 10:44–58 (“is first collected by the system”); see id. at Abstract, 2:54–
61, 3:51–65, 4:16–22, 7:57–61 (describing a compelling calling to a data
protection catalogue, but failing to describe the compelling calling being
produced by the O-DB database).
The database managing system includes not only a number of
databases, but also, a number of modules. Id. at 6:13–45 (“The data system
CBM2015-00002
Patent 6,321,201 B1

10

in FIG. 3 further comprises a hardware component 10, a control module 20
(IAM-API), and a program module 30 (PTY-API).”); Fig. 3. The modules
include control module 20, also labeled as an Information Assets Manager
Application Program Interface (“IAM-API”), which “controls the handling
of the types of data protection that the system can supply” and “carries out
the processing requested via API . . . programing interface.” Id. at 6:34–39,
Fig. 3.
Petitioner’s proposed construction as the broadest reasonable
construction is consistent with the written description of the ’201 Patent.
c. Declarant Testimony
Patent Owner proffers the testimony of declarants Mr. Mattsson and
Dr. Direen in support of its proposed construction. Resp. 19 (citing Ex.
2045 ¶¶ 27–29; Ex. 2046 ¶¶ 58–59). Mr. Mattsson testifies that
“[d]efintions vary among practitioners but, generally, a database is meant to
be a collection of data whereby the data is held so that it can be retrieved,
manipulated, reported on, managed, queried, and protected” and that in the
context of the ’201 Patent the database does more than store data, such as
manage or process the data. Ex. 2045 ¶¶ 27–30. Specifically, Mr. Mattsson
testifies that “the Specification describes how the first database must
‘automatically produce[] a system calling to the data element protection
catalogue’” and that Petitioner’s construction “does not provide for how
system callings (or any calling or processing) could take place if database is
only to mean the data that is managed by the system.” Id. ¶ 31.
Dr. Direen’s testimony is substantially the same as Mr. Mattsson’s
testimony. See Ex. 2046 ¶¶ 54–59.
CBM2015-00002
Patent 6,321,201 B1

11

Mr. Mattsson’s and Dr. Direen’s testimony is unpersuasive because it
is inconsistent with the ’201 Patent. As discussed above, the ’201 Patent
describes the O-DB as one database in a larger database management
system. Ex. 1001, 5:49–6:12. The ’201 Patent describes the O-DB database
as containing data and describes the modules of the larger database
management system as performing data processing. Id. at 5:53–58, 6:13–45.
The ’201 Patent does not describe the O-DB database as producing
the compelling calling. See Ex. 1001, 10:44–58 (“is first collected by the
system”); see id. at Abstract, 2:54–61, 3:51–65, 4:16–22, 7:57–61
(disclosing a compelling calling to a data protection catalogue, but failing to
describe the compelling calling being produced by the O-DB database). The
assertion that the compelling calling is produced by the O-DB database is
only found in Patent Owner’s arguments, Mr. Mattsson’s testimony, and
Dr. Direen’s testimony, and not the ’201 Patent. See, e.g., Ex. 2045 ¶¶ 12–
16, 22, 29; Ex. 2046 ¶ 57. Extraneous features should not be read into the
claim. Renishaw PLC v. Marposs Societa’ per Azioni, 158 F.3d 1243, 1249
(Fed. Cir. 1998); E.I. du Pont de Nemours & Co. v. Phillips Petroleum Co.,
849 F.2d 1430, 1433 (Fed. Cir. 1988). In that regard, “extrinsic evidence
may be used only to assist in the proper understanding of the disputed
limitation; it may not be used to vary, contradict, expand, or limit the claim
language from how it is defined, even by implication, in the specification or
file history.” Bell Atl. Network Servs. v. Covad Commc'ns Grp., 262 F.3d
1258, 1269 (Fed. Cir. 2001); see Vitronics, 90 F.3d at 1584 (“expert
testimony, which was inconsistent with the specification and file history,
should have been accorded no weight”).
CBM2015-00002
Patent 6,321,201 B1

12

Further, we give little weight to Mr. Mattsson’s testimony because
Mr. Mattsson is not a disinterested witness. Mr. Mattsson is Patent Owner’s
Chief Technology Officer (Ex. 2045 ¶ 1) and has an interest in the outcome
of this proceeding.
Patent Owner also argues that the testimony of Petitioner’s declarant
Mr. Schneier and the testimony of Dr. Shamos, a declarant from a related
proceeding, support its proposed construction. Resp. 21–23 (citing Ex.
2043, 71:23–72:5, 76:2–6; Ex. 2044, 36:10–37:24). Mr. Schneier’s and
Dr. Shamos’s testimony, however, does not support Patent Owner’s
proposed construction, but supports Petitioner’s proposed construction as the
broadest reasonable construction. Mr. Schneier agreed, when questioned by
Patent Owner, that a reasonable interpretation of database is “a system that
includes blobs of data in the organization and structure to make that works”
(Ex. 2043, 76:2–6), but Mr. Schneier also testifies that Petitioner’s proposed
construction is a reasonable definition that “coincided with what the patent
seemed to say” (id. at 76:16–77:2; Ex. 1002 ¶¶ 21–23). Likewise,
Dr. Shamos testifies that “database” can have multiple definitions (Ex. 2044,
36:10–37:24), but Dr. Shamos also testifies that in the context of the ’201
Patent and under the broadest reasonable interpretation standard “database”
means an “organized collection of structured data” (id. at 37:25–38:8). The
Board construes claims using the broadest reasonable construction in light
of the specification of the patent in which they appear. 37 C.F.R.
§ 42.300(b).
d. Database Manual and Technical Encyclopedia
Patent Owner also proffers a database manual and a technical entry
for “database management system” of a technical encyclopedia to support its
CBM2015-00002
Patent 6,321,201 B1

13

construction. Resp. 22–23 (citing Exs. 2049, 2050). This extrinsic evidence
is also unpersuasive as both the database manual and the encyclopedia entry
are directed to a database management system, as opposed to simply a
database.
e. Broadest Reasonable Construction of “Database”
We determine that the broadest reasonable construction, in light of the
specification of the ’201 Patent, and the proffered evidence, of “database” is
“an organized collection of structured data.” As discussed above, this
construction is consistent with the words of the claims, the disclosure of the
’201 Patent, the testimony of Mr. Schneier and Dr. Shamos and the position
taken by Patent Owner in the related district court proceeding. We are not
persuaded by Patent Owner’s arguments, Patent Owner’s declarants’
testimony, database manual, or technical encyclopedia that this construction
is unreasonably broad.
ii. Data Element Type
In our Decision to Institute, we determined that the broadest
reasonable construction, in light of the specification, of “data element type”
is “identification of a specific category of data,” as proposed by Petitioner
and disclosed in the Specification. Dec. 16–17 (citing Pet. 13–14; Ex. 1001
3:1–6). Patent Owner contends that a portion of the construction,
“identification of,” is not supported and is not accurate, and should be
omitted from the construction. Resp. 23–24. As we are not persuaded that
there is any appreciable difference in scope, with or without the addition of
“identification of,” we adopt Patent Owner’s construction, such that the
broadest reasonable construction, in light of the specification of the ’201
CBM2015-00002
Patent 6,321,201 B1

14

Patent, and the proffered evidence, of “data element type” is “a specific
category of data.”
Patent Owner also raises the issue that we described claim 1 as not
requiring data element types (Dec. 13), that this was contrary to the
specification and the claims, and that our construction of “data element
type” should take that into consideration. Resp. 23–26. We acknowledged
the misstatement in response to Patent Owner’s Request for Rehearing,
acknowledging the error and determining it to be de minimis with respect to
our claim construction and initial determinations. Paper 45, 11–12.
iii. Processing Rule
In our Decision to Institute, we determined that the broadest
reasonable construction, in light of the specification, of “data processing
rule” is “rules for processing data,” as proposed by Petitioner. Dec. 14–16
(citing Pet. 14). Patent Owner does not dispute this construction in its Patent
Owner’s Response.
For the reasons proffered by Petitioner (Pet. 14–15), the broadest
reasonable construction, in light of the specification of the ’201 Patent, of
“data processing rules” is “rules for processing data.” See Dec. 14–16.
iv. Other Proposed Constructions
Petitioner also proposed a construction of “encryption/encrypted.”
Pet. 15. For the purposes of our review of the claims of the ’201 Patent,
however, no explicit construction of any other claim term is needed.

CBM2015-00002
Patent 6,321,201 B1

15

B. Standing to Seek Covered Business Method Patent Review
Section 18 of the AIA4 provides for the creation of a transitional
program for reviewing covered business method patents. Section 18 limits
review to persons or their privies that have been sued or charged with
infringement of a “covered business method patent,” which does not include
patents for “technological inventions.” AIA §§ 18(a)(1)(B), 18(d)(1).
37 C.F.R. § 42.302 states “[c]harged with infringement means a real and
substantial controversy regarding infringement of a covered business method
patent exists such that the petitioner would have standing to bring a
declaratory judgment action in Federal court.”
Petitioner states that it was charged with infringement of the ’201
Patent in Protegrity Corp. v. Epicor Software Corp., No. 3:13-cv-01781
(D. Conn.). Pet. 11–12. Patent Owner does not dispute this statement.
i. Financial Product or Service
A covered business method patent “claims a method or corresponding
apparatus for performing data processing or other operations used in the
practice, administration, or management of a financial product or service,
except that the term does not include patents for technological inventions.”
AIA § 18(d)(1). The “legislative history explains that the definition of
covered business method patent was drafted to encompass patents ‘claiming
activities that are financial in nature, incidental to a financial activity or
complementary to a financial activity.’” Transitional Program for Covered
Business Method Patents—Definitions of Covered Business Method Patent
and Technological Invention, 77 Fed. Reg. 48,734, 48,735 (Aug. 14, 2012)

4 Leahy-Smith America Invents Act, Pub. L. No. 112-29, 125 Stat. 284, 329
(Sept. 16, 2011) (“AIA”).
CBM2015-00002
Patent 6,321,201 B1

16

(Final Rule) (quoting 157 Cong. Rec. S5432 (daily ed. Sept. 8, 2011)
(statement of Sen. Schumer)). The legislative history indicates that
“financial product or service” should be interpreted broadly. Id.; see Versata
Dev. Grp., Inc. v. SAP America, Inc., 793 F.3d 1306, 1323–26 (Fed. Cir.
2015).
A patent need have only one claim directed to a covered business
method to be eligible for review. 77 Fed. Reg. at 48,736 (Response to
Comment 8).
Petitioner contends that the ’201 Patent “claims a method for
performing data processing or other operations that are at least incidental to
the practice, administration, or management of a financial product or
service” and, thus, is a covered business method patent. See Pet. 6–8.
Patent Owner contends that the ’201 Patent does not claim a financial
service or product. Resp. 54–58. Patent Owner argues that “not a single
word in any single claim of the ’201 Patent . . . is purportedly directed to a
‘financial product or service.’” Resp. 57.
We do not interpret the statute as requiring the literal recitation of
terms of data processing of financial products or services. As recognized in
the legislative history: “[t]o meet this [eligibility] requirement the patent
need not recite a specific financial product or service. Rather, the patent
claims must only be broad enough to cover a financial product or service.”
157 Cong. Rec. S1365 (daily ed. Mar. 8, 2011) (statement of Sen. Schumer).
In this regard, claim 1 recites “controlling the user’s processing of the
given data element value in conformity with the collected protection
attribute/attributes.” The Specification discloses that protection attributes
are used to protect against unauthorized access of a data portion in a
CBM2015-00002
Patent 6,321,201 B1

17

database (see Ex. 1001, 4:26–32) and that banking is a field where
protection against unauthorized access to databases that are used for
administering and storing sensitive information is desired. Id. at 1:27–31;
see also id. at Fig. 5, 11:1–10 (describing an example where “Social
Allowance” and “Housing Allowance” are the protected data and “Financial
manager” is an authorized user). Banking is a financial activity.
Likewise, Patent Owner’s declarant Dr. Direen testifies that “[t]he
standard examples, which are examples of market concern, are protecting
data items such as credit card numbers and social security number[s].” Ex.
2046 ¶ 27 (emphasis added). Dr. Direen’s testimony discusses such an
example. Id. ¶¶ 11, 14, 27–49; Figs. 1–15. In Dr. Direen’s example, the
data portions include credit card numbers, credit card PIN numbers, and
salary information; the data categories include credit card number and
salary; and the data processing rules include credit card protection attributes
and salary protection attributes. See, e.g., id. ¶¶ 31, 34, 44; Figs. 1, 10.
Credit card numbers, credit card PIN numbers, and salary are all data which
are financial in nature.
Although not sufficient on its own, the ’201 Patent is classified in
705/51 of the Office’s patent classification system. See 77 Fed. Reg. at
48,739; see Versata, 793 F.3d at 1324, n.14 (noting that while Class 705
“apparently served as the original template for the definition of a ‘covered
business method,’ . . . [it] was thought to be too narrow” (citation omitted));
Pet. 6. Class 51—“Usage protection of distributed data files” is a subclass
indented under subclass 705/50—“Subject matter including cryptographic
apparatus or methods uniquely designed for or utilized in . . . the processing
of financial data.” Classification Definitions (Jan. 2012),
CBM2015-00002
Patent 6,321,201 B1

18

http://www.uspto.gov/web/patents/classification/uspc705/defs705.htm.
We are persuaded by Petitioner that at least claim 1 encompasses
activities that are financial in nature, incidental to a financial activity, or
complementary to a financial activity. See 77 Fed. Reg. at 48,735.
We are not persuaded by Patent Owner’s argument that previous
Board decisions demonstrate that the ’201 Patent is not a covered business
method patent. Resp. 54–57 (citing PNC Fin. Servs Grp., Inc. v. Intellectual
Ventures I, LLC, Case CBM2014-00032, slip op. at 10 (PTAB May 22,
2014) (Paper 13); J.P. Morgan Chase & Co. v. Intellectual Ventures II LLC,
Case CBM2014-00160, slip op. at 11 (PTAB Jan. 29, 2015) (Paper 11);
Salesforce.com Inc. v. Applications in Internet Time, LLC, Case CBM2014-
00162 (PTAB Feb. 2, 2015) (Paper 11)). The cited previous Board decisions
are not precedential and are not binding on this panel.
Nonetheless, we have reviewed the allegedly conflicting decisions.
Our review of these decisions, however, reveals that the determination of
whether the patent is a covered business method patent rests upon the
specific facts of those proceedings. For example, in PNC Financial
Services, the Board determined that a showing that the patent was asserted
against a financial service in an infringement proceeding was not enough to
establish that the patent was a covered business method patent. See PNC
Fin. Servs, CBM2014-00032, Paper 13 at 14. The Board stated that whether
an allegedly infringing product was a financial service was just one factor
and that the Petitioners had not shown how “the ’298 patent, either through
its claims, Specification, or prosecution history, encompasses ‘activities that
are financial in nature, incidental to a financial activity or complementary to
a financial activity.’” Id. at 13–14. Similarly, in J.P. Morgan and
CBM2015-00002
Patent 6,321,201 B1

19

Salesforce, the Board determined whether the patent was a covered business
method patent based upon the particular facts of those proceedings. Patent
Owner does not establish that the facts in those proceedings are sufficiently
similar to the facts in this proceeding. As discussed above, we determined,
based upon the facts in this proceeding, that the ’201 Patent is a covered
business method patent.
We are also not persuaded by Patent Owner that the ’201 Patent is not
a covered business method patent, because “the entire reason behind the
invention contradicts any allegation that the invention of the ’201 Patent is
incidental to a financial service or product.” Resp. 58. According to Patent
Owner, the Swedish Data Inspection, AB, mandated protection legislation
for personally-identifiable information to protect students and “[t]hey did
not, however, mandate data protection solely for financial institutions.” Id.
(citing Ex. 2022 ¶¶ 14–16 (testimony of Mr. Mattsson); Ex. 2040 (U.S.
Patent No. 5,606,610, which allegedly discloses Patent Owner’s first attempt
to comply with the Swedish legislation)).
The ’201 Patent makes no mention of the Swedish legislation or that
the legislation was for the protection of students. The ’201 Patent makes no
mention of students at all. Notably, U.S. Patent No. 5,606,610, which Patent
Owner argues was also the result of the Swedish legislation, likewise fails to
mention the Swedish legislation or the need to protect student data, but does
disclose that banking is a sector where it is essential that stored data be
protected against unauthorized access. See Ex. 2040, 1:13–15.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 1 of the ’201 Patent encompasses a method or
corresponding apparatus for performing data processing or other operations
CBM2015-00002
Patent 6,321,201 B1

20

used in the practice, administration, or management of a financial product or
service.
ii. Technological Invention
The definition of “covered business method patent” in Section
18(d)(1) of the AIA does not include patents for “technological inventions.”
To determine whether a patent is for a technological invention, we consider
“whether the claimed subject matter as a whole recites a technological
feature that is novel and unobvious over the prior art; and solves a technical
problem using a technical solution.” 37 C.F.R. § 42.301(b). Both prongs
must be satisfied in order for the patent to be excluded as a technological
invention.
The following claim drafting techniques, for example, typically do not
render a patent a “technological invention”:
(a) Mere recitation of known technologies, such as
computer hardware, communication or computer networks,
software, memory, computer-readable storage medium,
scanners, display devices or databases, or specialized machines,
such as an ATM or point of sale device.
(b) Reciting the use of known prior art technology to
accomplish a process or method, even if that process or method
is novel and non-obvious.
(c) Combining prior art structures to achieve the normal,
expected, or predictable result of that combination.
Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756, 48,763–64 (Aug.
14, 2012).
a. A Technological Feature that Is Novel and
Unobvious over the Prior Art
Petitioner argues that the ’201 Patent is not for a technological
invention because none of the claims recite a technological feature that is
CBM2015-00002
Patent 6,321,201 B1

21

novel and nonobvious over the prior art. Pet. 8–11. According to Petitioner,
“[n]one of the ’201 claim limitations, taken alone or in combination, rises to
the level of a technological feature, let alone a novel and unobvious one.”
Pet. 9–10. Patent Owner argues that “[t]he evidence demonstrates that the
claims of the ’201 Patent recite technological features that were novel and
nonobvious over the prior art at the time of the invention.” Resp. 59.
We are persuaded by Petitioner that the ’201 Patent is not for a
technological invention because at least claim 1 does not satisfy the first
prong of the test. Claim 1 does not recite a technological feature that is
novel or unobvious over the prior art. Claim 1 recites a method that is
“storing” data in multiple “databases,” and controlling a user’s processing
“in conformity with the collected protection attribute/attributes.” Data
processing computers having databases, which store the data, and controlling
access thereto, were known at the time of filing the ’201 Patent. See Ex.
1001, 1:20–31; Pet. 10–11.
Although Patent Owner argues that the claims recite technological
features that were novel and unobvious over the prior art, Patent Owner,
does not specify which claimed technical features are allegedly novel and
unobvious. See Resp. 58–62. Patent Owner appears to argue that the novel
and unobvious technological features rely on a database that is “much more
complex than a collection of stored data” and that “[a]pplying the correct
construction of database demonstrates the novel and nonobvious aspects of
the ‘201 Patent.” See Resp. 60–61, n.16. Patent Owner’s argument,
however, is unpersuasive because, as discussed in section II(A)(i) above,
when the claim term “database” is given its proper, broadest reasonable
CBM2015-00002
Patent 6,321,201 B1

22

construction, in light of the ’201 Patent, claim 1 does not require these
alleged features.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 1 does not recite a technological feature that is
novel or unobvious over the prior art and does not satisfy the first prong of
the test. The ’201 Patent, thus, is a covered business method patent that is
not a technological invention.
b. Solves a Technical Problem with a Technical Solution
Petitioner argues that the ’201 Patent is not for a technological
invention because none of the claims solve a technical problem using a
technical solution. Pet. 10–11. According to Petitioner, the ’201 Patent is
directed to the problem of granting access to data only if associated rules are
satisfied, which is solved by maintaining a database of data and a separate
data protection table that has rules. Id. at 10. Petitioner argues that such a
use of a data processing computer with databases is known technology. Id.
at 10–11.
Patent Owner argues that the ’201 Patent is for a technological
invention, because it solves a technical problem with a technical solution.
Resp. 29–35, 58–62. According to Patent Owner, the ’201 Patent solves
three problems: 1) “separation of duties,” thereby “prevent[ing] the
[database administrator] from accessing the data” (id. at 34); 2) “the ability
to implement data protection at the data element level [in the database]
without requiring application-level changes to the various computer
programs and applications that were seeking to retrieve protected data from
the database” (id.); and 3) providing “data element level protection across
many brands of databases (e.g., Oracle, IBM DB2, Informix, and Microsoft)
CBM2015-00002
Patent 6,321,201 B1

23

that a company might be using in-house” (id. at 34–35). The alleged
solution is “data to be protected in a first database, while the rules for
protection were stored outside that database and thus outside the purview of
the [database administrator].” Id. at 35.
We are persuaded by Petitioner that the ’201 Patent does not solve a
technical problem with a technical solution. See Pet. 10–11. The ’201
Patent discloses that its objective is “to increase the protection against
unauthorized access to sensitive information.” Ex. 1001, 2:21–24; see also
id. at 2:3–18, 1:15–17 (describing that the ’201 Patent “concerns . . . a
method and apparatus for data processing . . . for accomplishing increased
protection against unauthorized processing of data”).
None of the three technical problems identified by Patent Owner are
described in the ’201 Patent. See Resp. 29–35. The ’201 Patent makes no
mention of a need to protect data from a database administrator, to eliminate
application-level changes to the various computer programs and applications
that were seeking to retrieve protected data from the database, or to provide
protection across many brands of databases. Id. Likewise, the ’201 Patent
does not describe the technical solution, alleged by Patent Owner, because
the ’201 Patent does not describe a first database that calls out to the second
database, as discussed above in section II(A)(ii). The claims of the ’201
Patent also do not require the alleged technical solution. Neither claim 1 nor
any other claim requires specifically that a first database calls out to a
second database.
Further, the cited testimony of Mr. Schneier does not support Patent
Owner’s argument. See Resp. 59 (citing Ex. 2043, 90:15–91:9). We do not
find his testimony to be persuasive because it arose in the context of a
CBM2015-00002
Patent 6,321,201 B1

24

“philosophical debate” about problems generally, such as “legal problem[s]”
and “social problem[s].” Ex. 2043, 90:15–91:9. We are not convinced that
37 C.F.R. § 42.301(b) should be satisfied through the process of elimination,
such that problems and solutions are determined to be “technical” because
they do not fall into categories of “legal,” “social,” or “spiritual.” Under
such a rubric, simple algebraic problems and solutions could be technical in
nature, but we are not persuaded that would be the intent of the regulation.
We are persuaded by Petitioner that a preponderance of the evidence
shows that at least claim 1 does not solve a technical problem using a
technical solution, and, thus, at least claim 1 also does not satisfy the second
prong. Thus, the ’201 Patent is a covered business method patent that is not
a technological invention.
For the reasons discussed above, we are persuaded by Petitioner that
the ’201 Patent is eligible for covered business method patent review.

C. 35 U.S.C. § 101
i. Section 101 Subject Matter Eligibility
For claimed subject matter to be patentable eligible, it must fall into
one of four statutory classes set forth in 35 U.S.C. § 101: a process, a
machine, a manufacture, or a composition of matter. The Supreme Court
recognizes three categories of subject matter that are ineligible for patent
protection: “laws of nature, physical phenomena, and abstract ideas.” Bilski
v. Kappos, 561 U.S. 593, 601 (2010) (internal quotations and citation
omitted). A law of nature or an abstract idea by itself is not patentable;
however, a practical application of the law of nature or abstract idea may be
deserving of patent protection. Mayo Collaborative Servs. v. Prometheus
CBM2015-00002
Patent 6,321,201 B1

25

Laboratories, Inc., 132 S. Ct. 1289, 1293–94 (2012). To be patentable,
however, a claim must do more than simply state the law of nature or
abstract idea and add the words “apply it.” Id.
In Alice Corp. Pty, Ltd. v. CLS Bank Int’l, 134 S. Ct. 2347 (2014), the
Supreme Court recently clarified the process for analyzing claims to
determine whether claims are directed to patent-ineligible subject matter. In
Alice, the Supreme Court applied the framework set forth previously in
Mayo, “for distinguishing patents that claim laws of nature, natural
phenomena, and abstract ideas from those that claim patent-eligible
applications of those concepts.” Alice, 134 S. Ct. at 2355. The first step in
the analysis is to “determine whether the claims at issue are directed to one
of those patent-ineligible concepts.” Id. If they are directed to a patent-
ineligible concept, the second step in the analysis is to consider the elements
of the claims “individually and ‘as an ordered combination’ to determine
whether the additional elements ‘transform the nature of the claim’ into a
patent-eligible application.” Id. (quoting Mayo, 132 S. Ct. at 1298, 1297).
In other words, the second step is to “search for an ‘inventive concept’ —
i.e., an element or combination of elements that is ‘sufficient to ensure that
the patent in practice amounts to significantly more than a patent upon the
[ineligible concept] itself.’” Id. (alteration in original) (quoting Mayo, 132
S. Ct. at 1294). Further, the “prohibition against patenting abstract ideas
‘cannot be circumvented by attempting to limit the use of the formula to a
particular technological environment’ or adding ‘insignificant postsolution
activity.’” Bilski, 561 U.S. at 610–11 (quoting Diamond v. Diehr, 450 U.S.
175, 191–92 (1981)).
Accordingly, utilizing this framework, we review Petitioner’s
CBM2015-00002
Patent 6,321,201 B1

26

contention that claims 1, 5, 19, 20, and 27–31 of the ’201 Patent are directed
to ineligible subject matter.
ii. Ineligible Concept
Petitioner contends that the claims of the ’201 Patent are merely
directed to an abstract idea of determining whether access to data should be
granted based on whether one or more rules are satisfied. Pet. 21–23. Patent
Owner disputes that the challenged claims of the ’201 Patent are directed to
an abstract idea. See Resp. 26–43. According to Patent Owner, “protection
of data in a first database through rules stored in a second database” provides
a solution to a problem “necessarily rooted in computer technology.” Id. at
27; see id. at 32–38 (citing DDR Holdings, LLC v. Hotel.com, L.P., 773 F.3d
1245 (Fed. Cir. 2014)).
Of the challenged claims, only claim 1 is an independent claim, and
all of the other challenged claims depend directly or indirectly on claim 1.
Claim 1 is directed to a method of processing data that is to be protected and
is nominally within the process category of statutory subject matter.
Statutory class, however, is not by itself determinative of whether a claim is
directed to patent eligible subject matter. “Regardless of what statutory
category (‘process, machine, manufacture, or composition of matter,’
35 U.S.C. § 101) a claim’s language is crafted to literally invoke, we look to
the underlying invention for patent-eligibility purposes.” CyberSource
Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1374 (Fed. Cir. 2011). See
Alice, 134 S. Ct. 2358–59; Bancorp Servs. v. Sun Life Assurance Co., 687
F.3d 1266, 1275 (Fed. Cir. 2012).
Independent claim 1 recites a data processing method that grants
access to a data element value if the rules associated with a data element
CBM2015-00002
Patent 6,321,201 B1

27

type that is associated with the requested data element value is satisfied. Ex.
1001, 11:12–37. Claim 1 also requires a database that comprises the data
element values, where the database has a table structure with each
combination of a row and a column representing a data element value. Id.
A data element protection catalogue is in a second database and comprises
data processing rules that must be satisfied before the data element value can
be accessed. Id. The data processing rules are linked with the data element
type. Id. Thus, independent claim 1 recites a method that grants access to a
requested data element value if the rules associated with a data element type
that is associated with the requested data element value are satisfied. Id.
Given the above, we are persuaded by Petitioner that the claims are
directed to the abstract idea of determining whether access to data should be
granted based on whether one or more rules are satisfied. Patent Owner
raises several counter arguments that we address below.
Patent Owner argues that solution provided by the ’201 Patent is
necessarily rooted in computer technology because is addresses the
protection of data in a first database through rules stored in a second
database. Resp. 27–28 (citing DDR Holdings, 773 F.3d 1245). Patent
Owner continues that the claims of the ’201 Patent are directed to a specific
solution for protecting data at the data element level in a databases through
use of rules stored in a separate database. Id. at 27. We do not agree.
The claims in DDR Holdings are described as providing a result that
“overrides the routine and conventional sequence of events.” DDR
Holdings, 773 F.3d at 1258. The databases and access rules recited in claim
1 perform their normal functions and achieve expected results. The
protection of data in a database at the data element level still comports with
CBM2015-00002
Patent 6,321,201 B1

28

the abstract idea of determining whether access to data should be granted
based on whether one or more rules are satisfied. Similarly, storing the rules
in a separate database does not change the expected operation of the rules or
the database, merely the location of those rules.
Patent Owner also argues that the claims of the ’201 Patent cannot
preempt the use of the abstract idea in all fields, because the Petition and
supporting declaration show that there are other way of implementing “rule-
based data access control,” none of which do so at the data element level
based on rules stored in an external database. Resp. 29 (citing Pet. 40–50;
Bilski v. Kappos, 561 U.S. 611–12). This is not persuasive, however,
because the elements that Patent Owner determines to be outside the abstract
idea, i.e., access control at the data element level based on rules stored in an
external database, may simply be a particular technological environment, as
discussed in the next section.
iii. Inventive Concept
Next, we look for additional elements that can “transform the nature
of the claim” into a patent-eligible application of an abstract idea. That is,
we determine whether the claims include an “inventive concept,” i.e., an
element or combination of elements sufficient to ensure that the patent in
practice amounts to significantly more than a patent on the abstract idea
itself. Alice, 134 S. Ct. at 2357. The Supreme Court in Alice cautioned that
merely limiting the use of abstract idea “to a particular technological
environment” or implementing the abstract idea on a “wholly generic
computer” is not sufficient as an additional feature to provide “practical
assurance that the process is more than a drafting effort designed to
monopolize the [abstract idea] itself.” Alice, 134 S. Ct. at 2358.
CBM2015-00002
Patent 6,321,201 B1

29

a. Independent Claim 1
Petitioner argues that the claims contain “only inconsequential
limitations that are insufficient to render them patent-eligible.” Pet. 24. In
this regard, Petitioner argues that the claims recite only generic computer
elements and functions that were well-known and conventional. Id.; see id.
at 23–27. Petitioner argues that the steps of maintaining a database of data
element values and maintaining a separate data element protection catalogue
are simply data-gathering steps and that receiving a request to access a data
element value and granting access to that value are insignificant pre- and
post-solution activity. Id. at 25. Petitioner states that “[t]he remaining
method steps likewise fail practically to limit the abstract idea of controlling
user processing based on obtained attributes – these are well known and
purely conventional limitations.” Id. Petitioner, further, argues that even
when the claimed steps are considered as an ordered combination, they
require nothing more than the routine and conventional use of a computer,
having a database and a processor. Id. at 26.
Claim 1 requires the steps of storing data in databases, where some
data are stored as encrypted data element values, associated with a data
element type, and a plurality of data processing rules, associated with a data
element type, are stored in a separate data protection catalogue. Ex. 1001,
11:15–28. Data processing computers having separate databases, which
store associated data and associated attributes, were well-known and
conventional at the time of filing the ’201 Patent. See Ex. 1002 ¶ 18; Ex.
1005, 192–194, 202, 213 (describing relational databases). Storing data and
associated rules in separate databases is nothing more than routine data
gathering and does not transform the abstract idea into a patent-eligible
CBM2015-00002
Patent 6,321,201 B1

30

invention. See CyberSource, 654 F.3d at 1370. Claim 1 also recites that the
first database has a table structure with rows and columns, which is also
conventional and was well-known. Restricting access to columns or fields
of databases is well-understood and conventional activity. See Ex. 1002
¶ 36; Ex. 1005, 194, 214 (discussing access right to column and fields within
records). Well-understood, routine, conventional activity does not add
significantly more to the abstract idea. Mayo, 132 S. Ct. at 1298.
Claim 1 further requires that for each user-initiated measure aiming at
processing of a given data element value, a calling is produced to the data
element protection catalogue for the protection attributes of the data element
type. Ex. 1001, 11:29–34. This is well-understood, routine, conventional
activity that does not add significantly more to the abstract idea. Mayo, 132
S. Ct. at 1298; see Pet. 24–25; Ex. 1005, 192–194 (discussing decision
rules).
Claim 1 finally requires that user’s processing of the requested data
element value occurs in conformity with the collected protection attributes.
Ex. 1001, 11:35–37. Such granting of access to a user is merely a
conventional post-solution activity. Conventional post-solution activity is
not sufficient to transform the abstract idea into patent-eligible subject
matter. See Parker v. Flook, 437 U.S. 584, 590–92 (1978).
Even when the claim elements are considered as a combination, they
add nothing that is not already present when the elements are considered
separately. Alice, 134 S. Ct. at 2359. Claim 1 conveys nothing more
meaningful than the fundamental concept of determining whether access to
data should be granted based on whether one or more rules are satisfied.
CBM2015-00002
Patent 6,321,201 B1

31

Upon review of Petitioner’s analysis and supporting evidence and
taking into account Patent Owner’s arguments, discussed below, we are
persuaded by Petitioner that independent claim 1 does not recite additional
elements that transform the claim into a patent-eligible application of an
abstract idea.
We are not persuaded by Patent Owner’s arguments that the claims
require additional elements that transform that abstract idea into a patent
eligible application (Resp. 43–49) because they are based upon an overly
narrow construction of the claimed elements, as discussed in section II(A)(i)
above, i.e., the ability of the first database calling out to the data protection
catalogue, and based on additional elements not recited or required by the
claims, as discussed in section II(B)(ii) above.
In addition, we are not persuaded by Patent Owner’s argument
regarding DDR Holdings. See Resp. 26–28. Unlike the claimed
combination of elements in DDR Holdings, the claims of the ’201 Patent
appear to combine elements according to their known functions to achieve
routine and conventional results. See DDR Holdings, 773 F.3d at 1257–58.
As discussed above, we are persuaded that the databases and access rules
recited in claim 1 perform their normal functions and achieve expected
results.
Patent Owner proffers declarations from Mr. Bill Schmidt (Ex. 2047),
Mr. Kurt Pachik (Ex. 2048), and Mr. Ulf Mattsson (Ex. 2045) to
demonstrate that the ’201 Patent provides a novel and nonobvious solution
to a problem deeply rooted in computer technology. Resp. 32–35. The
declarations allegedly show that the invention of the ’201 Patent was used to
protect the formula for Coca-Cola from unauthorized access by database
CBM2015-00002
Patent 6,321,201 B1

32

administrators or system administrators. Id. Mr. Schmidt’s, Mr. Pachik’s,
and Mr. Mattsson’s declarations, however, fail to establish a nexus between
the system provided to Coca-Cola and the claims of the ’201 Patent.
Mr. Schmidt makes no mention of the ’201 Patent and provides no details as
to the system implemented by Coca-Cola. See Ex. 2047. Mr. Pachik, a
former employee of Patent Owner, testifies that he “assisted in implementing
the solution provided in U.S. Patent Nos. 6,321,201 and 8,402,281 . . . for
Coca-Cola” but provides no details of the system. See Ex. 2048 ¶ 5.
Mr. Mattsson, Chief Technology Officer of Patent Owner, testifies generally
to the technology disclosed in the ’201 Patent, but makes no mention of the
system implemented by Coca-Cola. See Ex. 2045. Thus, we are not
persuaded by the declarations of Mr. Schmidt, Mr. Pachik, and Mr. Mattsson
that the ’201 Patent provides a novel and nonobvious solution to a problem
deeply rooted in computer technology.
b. Dependent Claim 5
Petitioner argues that the dependent claims do not “contribute
significant or material limitations to the abstract idea, or tie to any specific
computer the abstract idea of rule-based data access.” See Pet. 26–27.
According to Petitioner, these dependent claims recite fundamental and
well-known concepts of limiting access within a computer system and, thus,
do not add anything significant to the abstract idea. Id.
Patent Owner argues, with respect to claim 5, that the claim is directed
to the very goal of the ’201 Patent, i.e., protecting data in a database at the
data element level using encryption. Resp. 49–50. Patent Owner argues this
is a significant technical innovation because the prior art showed user-based
protection of data in a database. Id.
CBM2015-00002
Patent 6,321,201 B1

33

Claim 5 requires that protection attributes state rules for encryption of
the data element values. Ex. 1001, 11:54–57. Encrypting data using a
cryptographic key and providing the key to authorized users is well-
understood and conventional activity. See Ex. 1002 ¶ 36; Ex. 1005, 178,
206, 213, 229–230. Encrypting on a field level was also known. Ex. 1005,
151. Encrypting data using cryptographic keys is well-known conventional
activity. Well-understood, routine, conventional activity does not add
significantly more to the abstract idea. Mayo, 132 S. Ct. at 1298.
As such, we are persuaded by Petitioner that the additional elements
of dependent claim 5 provide no meaningful limitations to the abstract idea.
c. Dependent Claims 19 and 20
Dependent claims 19 and 20 require the storage of the data element
types and processing rules as specific types of data within the data element
protection catalogue. Ex. 1001, Ex Parte Reexamination Certificate 1:55–65
(with claim 19 being corrected by a Certificate of Correction). Petitioner
argues that these additional elements provide no meaningful limitation to the
abstract idea. Pet. 26–27. Patent Owner disputes that the additional
elements provide no meaningful limitation. Resp. 50. Patent Owner argues
that the ’201 Patent demonstrates that the claimed association between data
element types and data element values was novel. Id. We do not agree with
Patent Owner.
Encryption and other processed performed on a field level were
known. Ex. 1005, 151. Simply storing data in particular forms, without
more, is a well-understood, routine, conventional activity that does not add
significantly more to the abstract idea. Mayo, 132 S. Ct. at 1298.
As such, we are persuaded by Petitioner that the additional elements
CBM2015-00002
Patent 6,321,201 B1

34

of dependent claims 19 and 20 provide no meaningful limitation to the
abstract idea.
d. Dependent Claims 27–31
Petitioner argues that the dependent claims do not “contribute
significant or material limitations to the abstract idea, or tie to any specific
computer the abstract idea of rule-based data access.” See Pet. 26–27.
According to Petitioner, claims 27–31 mere provide “that collection of
attributes occurs for every user or every user action . . . [and] that the
database protection catalogue is inaccessible to a user and/or physically
separate from the first database.” Id.
Patent Owner argues that Petitioner has presented no evidence to
show that requiring security measures for every data request was well-
known, or that storing databases in different locations or replicating
databases for redundancy was well-known in the art. Resp. 50–52. We
agree with Patent Owner.
The Petitioner has not established that the additional limitations
required by dependent claims 27–31 are not significant or material. Unlike
the other dependent claims, Petitioner’s evidence does not establish
sufficiently that the elements recited in these dependent claims, are well-
understood, routine, conventional activities that do not add significantly
more to the abstract idea. Additionally, our review of the prior art grounds
presented in the Petition, upon which we did not institute, does not provide
any support that the claimed elements of claims 27–31 were disclosed in the
prior art references. Pet. passim. Thus, we determine that Petitioner fails to
establish by a preponderance of the evidence that claims 27–31 are patent-
ineligible under 35 U.S.C. § 101.
CBM2015-00002
Patent 6,321,201 B1

35

III. MOTION TO EXCLUDE
Patent Owner moves to exclude Exhibit 1002, Declaration of
Mr. Bruce Schneier, from the record. Mot. Exclude. Patent Owner contends
that the Schneier Declaration should be excluded because Mr. Schneier’s
declaration is improper under Federal Rule of Evidence (“FRE”) 702,
because his declaration is incomplete and based on another expert’s opinion,
and that Mr. Schneier’s declaration is substantially more prejudicial than
probative under FRE 403 due to the lack of credibility. Mot. Exclude 1.
We are not persuaded by Patent Owner’s argument that
Mr. Schneier’s declaration should be excluded under FRE Rule 702 or 403.
Patent Owner’s arguments attack the sufficiency and credibility of
Mr. Schneier’s testimony. As the Board has noted in numerous cases, “the
Board, sitting as a non-jury tribunal with administrative expertise, is well-
positioned to determine and assign appropriate weight to the evidence
presented in this trial, without resorting to formal exclusion that might later
be held reversible error.” See, e.g., Liberty Mutual Insurance Co. v.
Progressive Casualty Insurance Co., CBM2012-00002, Paper 66 at 70
(PTAB Jan. 23, 2014); Gnosis S.P.A., et al. v. S. Alabama Medical Science
Foundation, IPR2013-00118, Paper 64 at 43 (PTAB June 20, 2014); S.E.C.
v. Guenthner, 395 F. Supp. 2d 835, 842 n.3 (D. Neb. 2005); Opp. to Mot.
Exclude 4. We, thus, are not persuaded by Patent Owner to exclude Exhibit
1002 and Patent Owner’s Motion to Exclude is denied.
Nonetheless, we address Patent Owner’s arguments regarding the
credibility of Mr. Schneier’s testimony because Patent Owner makes similar
arguments in its Patent Owner Response. See Resp. 39–41. Patent Owner
CBM2015-00002
Patent 6,321,201 B1

36

argues that we should give no weight to Mr. Schneier’s testimony because
Mr. Schneier’s declaration does not provide a complete list of references that
he relied upon. Id. at 41. We find this argument unpersuasive, because as
Petitioner point outs, Petitioner provided a list in response to Patent Owner’s
objections, as provided for by 37 C.F.R. § 42.64(2). Opp. to Mot. Exclude
1–2. Further, although Mr. Schneier testifies that he did review Dr. Shamos’
testimony, Mr. Schneier’s testimony indicates that his testimony is based
upon his review of the prior art, in particular Denning, and that his testimony
is similar to Dr. Shamos’ testimony because his testimony “had a lot of
similarities to the book we relied upon.” Ex. 2043, 150:3–151:10.
We are also not persuaded that Mr. Schneier is unqualified to testify
as an expert. As Petitioner points out, Mr. Schneier has a Master’s Degree
in Computer Science and holds over 79 patents relating to cryptology,
computer security, and electronic commerce. Opp. to Mot. Exclude 4–5; See
Ex. 1002 ¶¶ 1–7 (discussing additional credentials and qualifications).
Given this, we are persuaded that Mr. Schneier is qualified to testify as an
expert as to what a person of ordinary skill in the art would know or
understand during the relevant time frame.

IV. MOTION FOR OBSERVATIONS
On October 15, 2015, Patent Owner filed a Motion for Observation
Regarding Cross Examination of Reply Witness Mr. Bruce Schneier. Mot.
Observation. Patent Owner’s observations comment on the cross-
examination testimony of Petitioner’s declarant Mr. Bruce Schneier (Ex.
2043) given on June 12, 2015. Id. at 1. The Motion for Observation
CBM2015-00002
Patent 6,321,201 B1

37

indicates that it was filed pursuant to authorization in the Scheduling Order
(Paper 18). Mot. Observation 1.
The scheduling order states “[a] motion for observation on cross-
examination provides the parties with a mechanism to draw the Board’s
attention to relevant cross-examination testimony of a reply witness because
no further substantive paper is permitted after the reply” and refers to the
Office Patent Trial Practice Guide. Paper 18, 4–5. The Trial Practice Guide
states:
In the event that cross-examination occurs after a party has
filed its last substantive paper on an issue, such cross-
examination may result in testimony that should be called to the
Board’s attention, but the party does not believe a motion to
exclude the testimony is warranted. The Board may authorize
the filing of observations to identify such testimony and
responses to observations, as defined below.
77 Fed. Reg. at 48,767–68 (emphasis added).
The scheduling order authorizes the filing of such a motion for
observations regarding cross-examination of a reply witness by Due Date 4.
Mr. Schneier cross-examination testimony was given on June 12, 2015, prior
to Patent Owner filing its Patent Owner’s Response, on June 24, 2105. The
cross-examination did not occur after Patent Owner filed its last substantive
paper.
Patent Owner’s Motion for Observation, thus, is improper. The
Scheduling Order did not authorize Patent Owner to file a Motion for
Observation of cross-examination that occurred prior to Patent Owner filing
its last substantive paper on an issue, the Patent Owner’s Response and
Patent Owner did not seek other authorization for such. The improper
observations are akin to an unauthorized sur-reply to argument made in
CBM2015-00002
Patent 6,321,201 B1

38

Petitioner’s Reply. We, thus, expunge Patent Owner’s unauthorized
observations from the record. See 37 C.F.R. § 42.7(a). Additionally, we
expunge Petitioner’s Opposition to that Observation (Paper 40) as being
unnecessary.

V. CONCLUSION
We determine that Petitioner has demonstrated by a preponderance of
the evidence that claims 1, 5, 19, and 20 are unpatentable under 35 U.S.C.
§ 101 as being directed to non-statutory subject matter.
This is a Final Written Decision of the Board under 35 U.S.C.
§ 328(a). Parties to the proceeding seeking judicial review of this Decision
must comply with the notice and service requirements of 37 C.F.R. § 90.2.

VI. ORDER
In consideration of the foregoing, it is hereby:
ORDERED that claims 1, 5, 19, and 20 of U.S. Patent No. 6,321,201
B1 are unpatentable;
FURTHER ORDERED that claims 27–31 of U.S. Patent No.
6,321,201 B1 are not shown to be unpatentable over the corresponding
ground of covered business method patent review as asserted and instituted;
FURTHER ORDERED that Patent Owner’s Motion to Exclude is
denied;
FURTHER ORDERED that Patent Owner’s Motion for Observation
(Paper 38) and Petitioner’s Opposition to that Observation (Paper 40) are
expunged from the record.

CBM2015-00002
Patent 6,321,201 B1

39

PETITIONER:
William Cass
Herbert Bedingfield
CANTOR COLBURN LLP
wcass@cantorcolburn.com
hbedingfield@cantorcolburn.com

PATENT OWNER:
Woodrow H. Pollack
Michael J. Colitz, III
Cole Y. Carlson
GRAY ROBINSON, P.A.
woodrow.pollack@gray-robinson.com
Michael.colitz@gray-robinson.com
cole.carlson@gray-robinson.com