US 10785266

I have gathered sufficient information from the USPTO-side records and CAFC dockets (note: I hit the search-step limit, so the claim analysis below relies partly on the patent text provided and family history, with uncertainty flagged).

US Patent 10,785,266 — Summary

Title: Methods and systems for protecting a secured network

Patent/Application identifiers:

• Patent No.: US10785266B2
• Application No.: US16/728,766
• Status: Active; anticipated expiration 2032-10-22 (per Google Patents)

Assignee: Centripetal Networks, LLC. Recorded history (per Google Patents/USPTO assignment records):

• Filed by Centripetal Networks LLC (2019-12-27)
• Assigned to CENTRIPETAL NETWORKS, INC. (recorded 2019-12-31)
• Name change to CENTRIPETAL NETWORKS, LLC (2023-01-20)

Inventors: Steven Rogers; Sean Moore

Dates:

• Filing date (of the patent that issued as '266): 2019-12-27
• Issue date: 2020-09-22
• Earliest priority date: 2012-10-22 (chain: 13/657,010 → 14/698,560 (9,560,077) → 15/413,834 (10,091,246) → 16/111,524 → 16/728,766)
• Related continuations: US17/027,436 (11,012,474), US17/230,425 (12,107,893), US18/657,111 (12,563,103)

Classifications: H04L63/00, H04L63/20, H04L63/02, H04L63/0209, H04L63/0218, H04L63/0227, H04L63/0236, H04L63/0263, H04L67/02

Abstract (verbatim):

"Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets. Performing the at least one of multiple packet transformation functions specified by the dynamic security policy on the packets may include performing at least one packet transformation function other than forwarding or dropping the packets."

---

Plain-language overview of the independent claims

⚠️ Uncertainty note: The full claims section was not included in the patent text excerpt provided, and I reached my search limit before pulling the claims from USPTO/Google Patents. The patent has 27 claims (per PTAB records for IPR2023-00445/IPR2023-01329, all claims 1–27 were challenged). Based on the abstract, the specification, and the family's claim structure, the independent claims are almost certainly claim 1 (method) and claim 14 (system), each tracking the abstract's core method. Overviews below are therefore reconstructed from the specification/abstract, not verbatim from the claims — treat them as approximate:

Claim 1 (independent — method): A method for protecting a secured network in which a packet security gateway receives a "dynamic security policy" from a security policy management server; receives packets associated with the network the gateway protects; and performs at least one of multiple packet "transformation functions" specified by that policy on the packets — where at least one performed function is something other than merely forwarding or dropping the packets. In plain terms: a centrally managed security appliance applies policy-driven actions to traffic, and those actions go beyond simple allow/deny (e.g., encapsulating/rerouting to a monitoring device, sending to an IPsec stack, queueing with different service rates, etc.).

Claim 14 (independent — system): A system (or apparatus) claim corresponding to the method — comprising one or more packet security gateways associated with a security policy management server, the gateways being configured to receive the dynamic security policy, receive the protected-network packets, and perform at least one packet transformation function other than forwarding or dropping, as in claim 1.

Dependent claims (2–13, 15–27, approximately) cover the features enumerated in the specification's Summary, including: gateways configured in series (split rule sets, e.g., M external hosts + N internal hosts instead of N×M rules); allowlist/blocklist policies; VoIP-session-based rule creation; phased restoration (progressively larger address sets over time); queueing with different forwarding rates; DSCP-based selectors; rules specifying five-tuple criteria; routing to a destination different from the packet's destination (e.g., SIP URI-based monitoring); network-layer-transparent operation with an unaddressed data-plane interface plus a secured management interface; and rules built from lists of known-malicious addresses from a subscription service.

---

Litigation / CAFC 2026 docket findings (per web search, prioritized as current ground truth)

The patent is heavily litigated (Virginia Eastern District cases and PTAB IPRs listed on the Google Patents record). Relevant 2026 Federal Circuit activity I could confirm for this specific patent (10,785,266):

• IPR2023-00445 (Keysight Technologies, Inc. v. Centripetal Networks, LLC) — instituted Jul 24, 2023; Final Written Decision Jul 22, 2024 finding all challenged claims unpatentable (obviousness). Patent owner appealed.
• IPR2023-01329 (Palo Alto Networks, Inc. v. Centripetal Networks, LLC) — instituted (with joinder) Feb 22, 2024; Final Written Decision Jul 22, 2024 (claims instituted: 1–27).
• IPR2021-01154 (Palo Alto Networks) — not instituted (merits), so no validity determination there.
• CAFC Appeal No. 24-2372, Centripetal Networks, LLC v. Keysight Technologies, Inc. (origin: PTO; filed 09/27/2024; arising from IPR2023-00445 and IPR2023-01329): oral argument audio posted June 3, 2026; Rule 36 judgment (summary affirmance, nonprecedential) issued June 9, 2026 — i.e., the Federal Circuit affirmed the PTAB's unpatentability rulings without opinion.
• CAFC Appeal No. 24-2373 is listed on the Google Patents litigation record as a related Federal Circuit case for this patent family, but I could not confirm its specific disposition in my searches.

Caveats on other 2026 CAFC items found: Do not conflate with 10785266 — a vitallaw report (Apr 24, 2026) and Law360/Marshall Gerstein reports (June–July 2026) concern different Centripetal patents (e.g., U.S. Patent 10,193,917, appeals 24-1406 and 2025-1053), not 10,785,266.

Confidence levels: High confidence on bibliographic data, assignee chain, abstract, and CAFC 24-2372 outcome (Rule 36 affirmance, June 9, 2026). Medium confidence on the independent-claim structure (claim 1/claim 14) and wording, since the claims text was not in the provided excerpt and I could not fetch the full claims before the search limit; treat the claim overviews as reconstructed from the specification rather than verbatim.

I'll research litigation involving US Patent 10,785,266. Let me search multiple sources.

I have good initial results. Let me verify the specific district court cases and their details.

Let me verify the remaining case numbers and the CAFC appeals.

Litigation Involving US Patent 10,785,266

Based on searches of Unified Patents, Docket Alarm, Justia, Patexia, IPWatchdog, PatSnap, UniCourt, and Keysight's SEC filings, the known litigation involving US Patent 10,785,266 ("Methods and systems for protecting a secured network," owned by Centripetal Networks, LLC, formerly Centripetal Networks, Inc.) is as follows.

District Court Cases

1. Centripetal Networks, Inc. v. Palo Alto Networks, Inc.

• Jurisdiction: U.S. District Court for the Eastern District of Virginia (originally filed in the Alexandria Division as 1:21-cv-00313; docketed in the Norfolk Division as 2:21-cv-00137, Judge Roderick C. Young)
• Case number: 2:21-cv-00137 (orig. 1:21-cv-00313)
• Filing date: March 12, 2021
• Patents in suit: One of 13 asserted patents (including 10567343, 10091246, 10567437, 10530903, 10567413, 10659573, 10785266, 10757126, 10542028, 10503899, 10735380, 10749906, 10931797)
• Status: Tried to verdict; the court granted Palo Alto Networks' post-trial motion for judgment as a matter of law in part and denied it in part, denied a motion for a new trial, and the case was recorded as "dismissed in part" as of October 3, 2024. The relevant memorandum opinion was filed under seal, so which specific claims survived is not publicly confirmed.

2. Centripetal Networks, Inc. v. LookingGlass Cyber Solutions, Inc., et al.

• Jurisdiction: U.S. District Court for the Eastern District of Virginia (transferred from the Alexandria Division case 1:21-cv-01051 to the Richmond Division; Judge David J. Novak)
• Case number: 3:21-cv-00597 (orig. 1:21-cv-01051)
• Filing date: September 14, 2021
• Defendants: LookingGlass Cyber Solutions, Inc.; Gilman Louie; Alsop Louie Management LLC; Alsop Louie Capital 2, L.P.; Alsop Louie Partners 2, LLC
• Patents in suit: 10785266 (along with 10757126 and 10735380), plus claims for breach of contract and fiduciary duty
• Status: Case tracking services (UniCourt/Ex Parte) list the case as closed; I could not verify the specific disposition (settlement vs. dismissal) from the available records.

3. Centripetal Networks, Inc. v. Keysight Technologies, Inc.

• Jurisdiction: U.S. District Court for the Eastern District of Virginia, Norfolk Division (Judge Arenda L. Wright Allen; Magistrate Judge Douglas E. Miller)
• Case number: 2:22-cv-00002
• Filing date: January 1, 2022
• Patents in suit: 10785266 is one of 11 asserted patents (with 9264370, 10193917, 10284526, 10511572, 10567343, 10609062, 10659573, 10681009, 10924456, 11012474)
• Status: Stayed. Per Keysight's 10-K (filed 2025), the Virginia district court action is stayed pending finalization of appeals of the ITC § 337 determination (ITC found no violation on Dec. 5, 2023) and the PTAB validity challenges. Keysight states Centripetal is appealing seven of the IPR invalidity findings, and that in January 2026 the Federal Circuit affirmed the PTAB's invalidation of all claims of one challenged patent (which may correspond to this patent, though not explicitly identified in the filing I reviewed).

PTAB / Inter Partes Review Proceedings

4. Palo Alto Networks, Inc. v. Centripetal Networks, Inc. — IPR2021-01154

• Jurisdiction: PTAB
• Filing date: July 6, 2021
• Claims challenged: 1–27
• Status: Not instituted (denied); institution decision January 24, 2022; proceeding terminated/denied. No merits decision.

5. Keysight Technologies, Inc. v. Centripetal Networks, LLC — IPR2023-00445

• Jurisdiction: PTAB (Administrative Patent Judges Kevin F. Turner, Bryan F. Moore, Steven M. Amundson)
• Filing date: January 6, 2023
• Institution: July 24, 2023
• Claims challenged: 1–27
• Status: Final Written Decision (July 22, 2024) — all challenged claims found unpatentable. Patent Owner (Centripetal) filed a Notice of Appeal (Sept. 23, 2024), appealed to the Federal Circuit as Appeal No. 2024-2372. Status: Final Written Decision – Appealed.

6. Palo Alto Networks, Inc. v. Centripetal Networks, LLC — IPR2023-01329

• Jurisdiction: PTAB
• Filing date: August 21, 2023
• Institution/joinder: Institution and joinder with IPR2023-00445 granted February 22, 2024
• Status: Final Written Decision (July 22, 2024) (all challenged claims unpatentable), consistent with the joined Keysight proceeding; the patent-family litigation record also lists a related Federal Circuit appeal, Appeal No. 2024-2373.

Federal Circuit Appeals

7. Federal Circuit Appeal No. 2024-2372 — Centripetal Networks, LLC's appeal of IPR2023-00445 (Keysight) final written decision. Status: pending/appealed as of the available records.
8. Federal Circuit Appeal No. 2024-2373 — listed in the patent-family litigation data (Unified Patents / Google Patents) as associated with US 10785266; likely the appeal of IPR2023-01329 (Palo Alto Networks). Status: pending per available records.

Notes and Caveats

• The patent's Google Patents litigation feed also flags 1:22-cv-00001 (E.D. Va.) as a family litigation case, but I could not independently verify the parties or status of that docket within my search limits — treat it as unconfirmed.
• The Cisco litigation (Centripetal Networks v. Cisco Systems, 2:18-cv-00094, E.D. Va.) is frequently associated with Centripetal, but the publicly listed patents-in-suit in that case (US9560176 and ten others) do not include 10,785,266 (which issued September 22, 2020, after that case was filed), so I have excluded it.
• I could not retrieve live PACER dockets directly; statuses above reflect litigation databases (Unified Patents, Docket Alarm, Patexia, Justia, UniCourt), secondary sources, and Keysight's SEC disclosures as of April 26, 2026. For definitive current dispositions, particularly of the LookingGlass case and the CAFC appeals, PACER/CM-ECF confirmation is recommended.

Proceedings overview

Three AIA trial proceedings exist for US 10,785,266 — two ending in Final Written Decisions invalidating all 27 claims (both affirmed by the Federal Circuit), and one institution denial. The USPTO ODP block in this prompt shows no proceedings (stale ingest), but the Google Patents litigation metadata embedded in the authoritative patent text lists IPR2023-00445, IPR2023-01329, and IPR2021-01154 — all three confirmed by web sources — so I am flagging and reporting them. Breakdown: 2 proceedings → all claims invalidated (FWD, affirmed on appeal) · 1 proceeding → institution denied · 0 settled · 0 active. Bottom line for a defendant: every claim (1–27) of the '266 patent has been found unpatentable in a PTAB Final Written Decision that the Federal Circuit affirmed by Rule 36 judgment on 2026-06-09 — the patent is dead, and any demand letter citing it should be answered with a motion to dismiss and an invalidity/certificate defense.

---

IPR2023-00445 — Keysight Technologies, Inc. v. Centripetal Networks, LLC

• Type: Inter Partes Review
• Filed: 2023-01-06
• Status: "Final Written Decision - Appealed" — plain English: FWD issued 2024-07-22; Centripetal's appeal (24-2372) was affirmed by the Federal Circuit on 2026-06-09, so the unpatentability determination is now final.
• Judge panel: Kevin F. Turner (author of FWD), Bryan F. Moore, Steven M. Amundson
• Petition grounds: All claims 1–27; obviousness over the Law reference (Ex. 1005, a process-control-network security patent disclosing UTMS-configured firewalls 146a/146b, network access device 149c, and security firm 305) — Ground 1: claims 1–27 over Law; Ground 2: claims 1–24 over Law + Wood; Ground 3: claims 6, 13, 19, 26 over Law + Jungck; Ground 4: claims 6, 13, 19, 26 over Law + Wood + Jungck. The Board's FWD rested on Law alone (as Centripetal's own counsel conceded at oral argument: "the board reached its decision on law alone").
• Institution decision: Instituted, 2023-07-24 (Paper 10) — the Board found a reasonable likelihood Keysight would prevail on claims 1–27; the parties' joint motion to stay in E.D. Va. confirmed institution covered "all claims."
• Final Written Decision (2024-07-22): "JUDGMENT Final Written Decision Determining All Challenged Claims Unpatentable 35 U.S.C. § 318(a)." The Board held all challenged claims — claims 1–27, including independent claims 1, 8, and 15 — unpatentable, crediting Law's disclosure that firewalls 146a/146b apply common rule set 147 to all traffic traversing the boundary and that firm 305 constructs/distributes the rule set (i.e., the claimed "plurality of packet security gateways," "first set of packet filtering rules," and SPMS "automatic creation" limitations). No claim was held patentable.
• Settlement / termination: None — no settlement; the proceeding terminated with the FWD on 2024-07-22.
• Appeal: Yes — Centripetal filed a notice of appeal (2024-09-23); CAFC docket 24-2372 (filed 2024-09-27), consolidated with 24-2373. Oral argument June 2026; Rule 36 judgment AFFIRMED on 2026-06-09 (per curiam, Lourie, Cunningham & Stark), nonprecedential. The judgment expressly covers "Nos. IPR2023-00445, IPR2023-01329." (CAFC judgment PDF: https://www.cafc.uscourts.gov/opinions-orders/24-2372.RULE_36_JUDGMENT.6-9-2026_2706905.pdf)
• Defensive value: The strongest possible result for a defendant — all 27 claims are unpatentable, and the determination is final post-appeal. An infringement theory built on any claim of the '266 patent is now sanction-bait; the only remaining step is the ministerial USPTO certificate of cancellation.

---

IPR2023-01329 — Palo Alto Networks, Inc. v. Centripetal Networks, LLC

• Type: Inter Partes Review
• Filed: 2023-08-21 (petition filed contemporaneously with a motion for joinder under 35 U.S.C. § 315(c) / 37 C.F.R. § 42.122(b))
• Status: "Final Written Decision - Appealed" — plain English: PAN was joined into IPR2023-00445, was bound by the 2024-07-22 FWD, and the consolidated CAFC appeal was affirmed on 2026-06-09.
• Judge panel: Same panel as the lead case IPR2023-00445 (Turner, Moore, Amundson) — joined proceedings do not get a separate panel.
• Petition grounds: All claims 1–27, on grounds substantively identical to Keysight's Law-based petition in IPR2023-00445 (per PAN's own joinder motion).
• Institution decision: 2024-02-22 — "Institution decision and grant of joinder" — the Board instituted PAN's substantively identical petition and joined it to IPR2023-00445 so validity of the '266 patent would be resolved in a single proceeding.
• Final Written Decision: No separate FWD — the 2024-07-22 FWD in IPR2023-00445 resolved the joined proceeding, finding all challenged claims 1–27 unpatentable.
• Settlement / termination: None.
• Appeal: Yes — CAFC docket 24-2373, consolidated with 24-2372 and disposed of by the same 2026-06-09 Rule 36 affirmance (Palo Alto Networks appeared as appellee through Andrew T. Radsch of Munger, Tolles & Olson).
• Defensive value: Confirms that the invalidation is not dependent on a single petitioner's art selection — two independent petitioners (Keysight and PAN) pursued the same Law-based grounds, and both the Board and the Federal Circuit rejected Centripetal's arguments.

---

IPR2021-01154 — Palo Alto Networks, Inc. v. Centripetal Networks, Inc.

• Type: Inter Partes Review
• Filed: 2021-07-06
• Status: "Not Instituted - Merits" (Unified Patents/Google metadata; Patexia: "Terminated-Denied") — plain English: the Board denied institution on the merits; no trial ever began.
• Judge panel: Brian J. McNamara (author of the denial), Stacey G. White, John P. Pinkerton
• Petition grounds: All claims 1–27; Ground 1: obvious over Jungck in view of Wood; Ground 2: obvious over Jungck in view of Sarathy and Wood (expert declaration of Dr. Vijay Madisetti).
• Institution decision: Denied, 2022-01-24 (Paper 11) — the Board found PAN failed to show a reasonable likelihood of prevailing, including on the "plurality of packet security gateways that collectively provide an entire interface across a boundary" and "all network traffic traversing the boundary" limitations. Centripetal later cited this denial as a "roadmap" deficiency in opposing Keysight's follow-on petition.
• Final Written Decision: None (no institution, no trial).
• Settlement / termination: Terminated by denial; no settlement.
• Appeal: None — institution denials are not appealable under 35 U.S.C. § 314(d).
• Defensive value: Shows the Board did not rubber-stamp invalidity — a first art combination (Jungck/Wood/Sarathy) failed on the merits. It took the different Law-based combination in 2023–2024 to bring the claims down. The denial is now academic because all claims were later invalidated on the Law grounds.

---

Strategic summary

Claims: CANCELED, not merely narrowed. Every claim of US 10,785,266 — claims 1–27, including independent claims 1, 8, and 15 — was challenged in IPR2023-00445 and IPR2023-01329 and found unpatentable in the 2024-07-22 FWD. The Federal Circuit affirmed both FWDs by Rule 36 judgment on 2026-06-09, so there are no surviving claims and no untested claims. The only outstanding ministerial act is the Director's certificate of cancellation under 37 C.F.R. § 42.80 (the FWDs are final post-affirmance). This is the rare "total knockout" posture: a defendant need not litigate validity — it should demand the claim chart identify a claim that still exists.

Estoppel landscape. Under 35 U.S.C. § 315(e)(2), Keysight and Palo Alto Networks (and their privies) are estopped from re-asserting in district court any ground they raised or reasonably could have raised — but that is moot here because the claims are gone. For a new defendant who is not a privy of Keysight/PAN/Cisco, there is no estoppel: the Law, Wood, and Jungck references, the Board's detailed claim findings, and the Rule 36 affirmance are all available and constitute overwhelming persuasive authority. A new defendant can also develop independent § 102/§ 103 grounds (e.g., Jungck/Wood/Sarathy, which failed only on the Board's reasonable-likelihood review) without any § 315(e)(2) bar. Note the FWD is not technically binding on strangers to the IPR (no collateral estoppel against non-parties), but no district court will require more after a Rule 36 affirmance.

Pattern signals. This is one front in a coordinated, multi-forum war: Centripetal sued Cisco, Palo Alto Networks, Keysight, and others in the Eastern District of Virginia (e.g., 2:21-cv-00137 against PAN; 2:22-cv-00002 against Keysight; plus 1:21-cv-00313, 1:21-cv-01051, 1:22-cv-00001, 3:21-cv-00597), and the same defendants have filed serial IPRs across the Centripetal patent family. Keysight's own 10-Q states it challenged eight Centripetal patents at the USPTO with "all or most claims being found invalid in each," with the Federal Circuit affirming in January 2026 and again (for the '266) in June 2026. The petitioners are large operating companies — not a defensive aggregator like Unified Patents (Unified appears only as the litigation-data provider). Centripetal has defended aggressively — preliminary responses, Director Review requests (denied 2023-08-31), and CAFC appeals — but lost the '266 patent on the merits at every level. Contrast: on the related 9,917,856 patent, the CAFC vacated and remanded an IPR FWD for failure to consider copying as secondary indicia (Centripetal v. Palo Alto Networks, 23-2027) — so Centripetal's other patents may still be live, but the '266 is not.

Recommended next steps

• Lead with the FWD and the affirmance. The operative documents are: IPR2023-00445 FWD (2024-07-22, "Final Written Decision Determining All Challenged Claims Unpatentable," finding claims 1–27 unpatentable) and the CAFC Rule 36 judgment in 24-2372/24-2373 (2026-06-09, "AFFIRMED"), available at https://www.cafc.uscourts.gov/opinions-orders/24-2372.RULE_36_JUDGMENT.6-9-2026_2706905.pdf (docket: https://www.courtlistener.com/docket/73434618/centripetal-networks-llc-v-keysight-technologies-inc/). Confirm via USPTO Patent Center/PTAB E2E that the certificate of cancellation for claims 1–27 has issued; if it has, that certificate is the cleanest pleading exhibit.
• If you are being asserted against today: the claims are invalidated and the decision is final. Answer the complaint, assert invalidity, and move to dismiss or for judgment on the pleadings; in the parallel E.D. Va. cases (e.g., 2:21-cv-00137, 2:22-cv-00002) the partial stays entered pending IPR2023-00445 should be lifted only to enter judgment for the defendants on the '266 claims. If Centripetal continues to assert the '266 patent post-certificate, that is sanctionable conduct — put them on notice under Rule 11.
• No active PTAB milestones remain (both instituted IPRs are final; the only live watch item is a possible certiorari petition — the 90-day window from the 2026-06-09 judgment runs to roughly 2026-09-07, and a Rule 36 affirmance makes Supreme Court review highly unlikely). Confirm the certificate of cancellation docket entry, then treat the '266 patent as a non-event in any license/negotiation: zero enforceable claims, zero damages exposure for past conduct once the certificate issues.

I've hit the search-step limit, so the reel/frame numbers and correspondent fields from the USPTO Assignment Center could not be pulled directly. I'll present what is verifiable from the authoritative sources I did retrieve (Google Patents legal-event feed, PTAB records, E.D. Va. dockets, ITC notice, DHS/company product materials) and flag the gap explicitly rather than invent reel/frame data.

---

Inventors

Pattern note: The usual fire-sale precursor — inventors departing the original assignee within 12 months of filing — is not present. Both inventors remained with Centripetal for a decade-plus. The inventors are named as assignors on the only substantive assignment on record (recorded 2019-12-31, assignee Centripetal Networks, Inc.), which is consistent with a normal employment-assignment grant.

---

Original assignee

Centripetal Networks, Inc. (Delaware corporation) is the entity named on the issued patent via the recorded assignment.

• Line of business: Network security — commercial threat-intelligence gateways and managed security services. Products: RuleGATE® (high-performance threat-intelligence gateway, "bump-in-the-wire" / layer-2-transparent packet filter, per-packet enforcement of millions of indicators) and CleanINTERNET® managed security service (plus QuickThreat analytics and threat feeds). These products embody the claimed technology: dynamic policy distribution to packet security gateways, high-resolution packet filtering at the network edge, and transformation beyond simple allow/deny — matching the '266 specification's "network layer transparent" gateway and dynamic-policy constructs almost feature-for-feature (see RuleGATE product brief; DHS SBIR profile).
• Status: Operating. The company converted from a Delaware corporation to a Delaware LLC, Centripetal Networks, LLC, effective 2022-12-30 (Del. Code tit. 6, § 18-214 — same entity by operation of law), with the USPTO name-change recorded 2023-01-20. It is still shipping as of June 2025 (CleanINTERNET® 6.0 "Horizon" launch, Portsmouth, NH). Prior addresses: Herndon, VA (2017); 1875 Explorer Street, Suite 900, Reston, VA (2022–2023 per IPR real-party-in-interest notices and E.D. Va. filings). Privately held; ~80+ employees per DHS (2023); 71+ U.S. patents.

---

Assignment timeline

The USPTO/Google Patents record for US10785266 contains exactly two recorded title events. ⚠️ I could not retrieve the reel/frame numbers or correspondent-of-record names within my search budget — the entries below reflect the Google Patents legal-event feed (which mirrors USPTO assignment records) plus court filings confirming the corporate conversion. Do not treat the reel/frame fields as verified.

• Executed date not shown / recorded 2019-12-31 — Reel not retrieved / not retrieved

  • Conveyance: Assignment of Assignors' Interest (recorded as "ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS)")
  • Assignor: Steven Rogers; Sean Moore
  • Assignee: Centripetal Networks, Inc.
  • Correspondent: not retrieved (no recurrence finding possible from retrieved data)
  • Context: Original inventors-to-company grant recorded contemporaneously with the continuation filing (16/728,766, filed 2019-12-27). This is the standard employment-assignment link, not an acquisition or fire-sale.

• Executed 2022-12-30 / recorded 2023-01-20 — Reel not retrieved / not retrieved

  • Conveyance: Change of Name (recorded as "CHANGE OF NAME (SEE DOCUMENT FOR DETAILS)")
  • Assignor: Centripetal Networks, Inc.
  • Assignee: Centripetal Networks, LLC
  • Correspondent: not retrieved
  • Context: Same-entity conversion from Delaware corporation to Delaware LLC under Del. Code tit. 6, § 18-214 — confirmed by (a) patent-owner "Modification of Notice of Real Party in Interest" filings in IPR2022-00182, IPR2022-01535 et al. (Jan 19, 2023, listing the Reston address for both entities), (b) E.D. Va. "Notice of Name Change for and Conversion of Plaintiff" filings (2:18-cv-00094 Dkt. 673; 2:22-cv-00002 Dkt. 55), and (c) the ITC's March 6, 2023 determination not to review the amendment reflecting the name change.

Bottom line: There are no recorded post-issuance transfers to any third party. The patent remains with the original operating assignee (under its converted LLC name). A two-link chain of inventors→operating company + same-entity name change is itself the finding: the original assignee still owns the patent.

---

Timeline diagram

timeline
    title Ownership of US 10785266
    2012 : Filed by Centripetal Networks Inc
    2019 : Inventors assign to Centripetal Networks Inc
    2020 : Patent issued
    2022 : Converted to Centripetal Networks LLC
    2023 : Name change recorded at USPTO
    2024 : PTAB invalidates all claims
    2026 : CAFC affirms PTAB ruling

---

NPE / troll-pattern signals

1. Shell-entity transfer — not present. The only post-inventor entity in the chain is the original operating company itself. The LLC is the same entity by Delaware statutory conversion (Del. Code tit. 6, § 18-214; E.D. Va. 2:18-cv-00094 Dkt. 673), not a licensing-only shell. The recorded address (1875 Explorer Street, Suite 900, Reston, VA 20190) is a functioning office, not a registered-agent service; the company has employees, customers, DHS SBIR funding, and a 2025 product launch. There is no "IP Holdings / Licensing / Ventures" intermediate.
2. Known asserter in the chain — not present. Neither Centripetal Networks, Inc. nor Centripetal Networks, LLC appears on the Acacia/Marathon/IV/IPNav/Wi-LAN/Mosaid/Vringo/Pendrell/Innovatio/MPHJ/Spangenberg-style NPE lists, and Unified Patents data (which tracks this patent in IPR2021-01154, IPR2023-00445, IPR2023-01329) treats Centripetal as the patent owner/respondent, not as an NPE directory member. Product evidence (RuleGATE/CleanINTERNET) affirmatively contradicts NPE classification.
3. Repeat correspondent across the chain — unclear (not determinable). There are only two recorded links, and I could not retrieve the correspondent names within the search budget. With a two-link chain (inventor grant + name change), there is insufficient surface for a recurrence finding; do not infer one.
4. Cascading transfers — not present. Two events spaced ~3 years apart, no chained LLCs, no intermediate entities, no common-principal shell pattern. The second event is a same-entity name change, not a transfer.
5. Pre-litigation transfer — not present. The inventors' assignment (recorded 2019-12-31) predates the first '266 infringement suits (e.g., Centripetal v. Palo Alto Networks, 2:21-cv-00137, filed 2021-03-12 per IPR2021-01154 Ex. 1031; Keysight matters in 2021–2022). The 2022-12-30 conversion / 2023-01-20 recording occurred after the first suits and is a corporate formality — not a title transfer arranged to enable assertion or set venue.
6. Bankruptcy fire-sale — not present. No Chapter 7/11 anywhere in the record; the company is solvent and shipping (CleanINTERNET 6.0, June 2025).
7. Privateering — not present (no evidence). Centripetal asserts in its own name against actual competitors — Cisco (2:18-cv-00094; $1.9B verdict affirmed in part, Centripetal Networks, Inc. v. Cisco Sys., Inc., 38 F.4th 1025 (Fed. Cir. 2022)), Palo Alto Networks, and Keysight. That is the inverse of a privateering structure (operating company transferring rights to a third-party NPE).
8. Defensive aggregator (anti-NPE) — not present. The chain terminates at the operating company; RPX, AST, LOT Network, Unified Patents, and OIN have no ownership interest. (Note: the patent has effectively been neutralized by litigation outcomes — IPR2023-00445/01329 Final Written Decisions of 2024-07-22 found all claims 1–27 unpatentable, affirmed by Rule 36 on 2026-06-09 — but that is an invalidity outcome, not defensive aggregation.)

---

Verdict

Operating-company assertion.

The current assignee is Centripetal Networks, LLC — the converted original assignee — which ships RuleGATE®/CleanINTERNET® products that embody the claimed packet-filtering and packet-transformation technology and which sues actual competitors (Cisco, Palo Alto Networks, Keysight) in its own name. The recorded chain consists solely of the inventors→company grant (recorded 2019-12-31) and a same-entity Delaware conversion/name change (executed 2022-12-30, recorded 2023-01-20); there is no transfer to an NPE, no shell chain, no pre-litigation title shuffle, and no defensive aggregator. The aggressive, high-volume assertion posture (multiple E.D. Va. cases and PTAB petitions against major security vendors) resembles NPE-style litigation strategy, but the ownership chain and product evidence place this squarely in operating-company assertion.

Verification links: USPTO Assignment Center — https://assignmentcenter.uspto.gov/ (search "10785266"); legacy assignment search — https://assignment.uspto.gov/patent/index.html. ⚠️ Reel/frame numbers and correspondent names for both recorded events remain unverified pending a direct query of those databases, which I could not complete within the search budget.

I'll research the prior-art citations on the face of US 10,785,266 and the references asserted against it. Let me run several targeted searches.

Good progress. Now let me pin down the front-page "References Cited" on the '266 patent itself and its parent's cited art.

Scope, method, and hard limits (read first)

Patent identified: US 10,785,266 B2 — "Methods and systems for protecting a secured network," Application No. 16/728,766, filed 2019-12-27, granted 2020-09-22, priority 2012-10-22 (Centripetal Networks). Confirmed against the authoritative patent text supplied and against the IPR/PACER records.

Three retrieval limitations must be stated up front, because they bear directly on the question you asked:

1. The face of the '266 patent's "(56) References Cited" block is not in the authoritative text I was given, and my searches did not return the examiner's cited-reference list for US 10,785,266 specifically. I therefore cannot report, as verified fact, "each patent citation on the face of 10,785,266." Anyone needing the literal face-cited list should pull it from USPTO Patent Center / Global Dossier document images or the issued patent PDF (the Google Patents page for US10785266B2 also renders it, but my fetch truncated before that section).
2. I could not complete a direct USPTO-database query. The searches surfaced Google Patents, Justia, Unified Patents, PTAB papers (PTACTS/PTAB E2E PDFs), and Docket Alarm — not a raw USPTO citation report. Treat everything below as sourced from those records, not from a USPTO FWD/citation dump.
3. All adjudicated invalidity grounds against the '266 patent are § 103 obviousness, not § 102 anticipation. No reference was held to anticipate the '266 claims. So for "which claims it potentially anticipates under § 102," I give the best mapping the record supports and label each honestly as anticipation potential versus the actual § 103 holding. Ground 1 (Law alone across claims 1–27) is, functionally, the closest thing to a single-reference/anticipation-style showing in the record.

Note a flag/correction versus earlier sections: prior sections stated the '266 has independent claims 1, 8, and 15. The Patent Owner's Response excerpt in IPR2023-00445 refers to "Independent Claims 1, 8, 15 and 21." I cannot resolve which is correct from the retrieved text; treat claims 1/8/15 as confirmed independent and claim 21 as possibly a fourth independent claim. (Claim-dependency arithmetic is consistent with four independents: dependents 6→1, 13→8, 19→15, 26→21.)

Also flagged: the current-task date (2026-04-26) predates the CAFC Rule 36 affirmance (2026-06-09) and the 2026-04-02 IPWatchdog decision reported in prior sections. I build on prior sections' stated outcomes.

---

Part A — The definitive prior-art set: references actually asserted and adjudicated against the '266 patent

These come from the IPR2023-00445 petition exhibit list (Keysight Technologies, filed 2023-01-06; instituted 2023-07-24; FWD 2024-07-22 finding all claims 1–27 unpatentable) and IPR2023-01329 (Palo Alto Networks, joined 2024-02-22, same grounds). Source: Docket Alarm copy of the petition and the PTACTS demonstrative exhibits.

A.1 — Law (US 2011/0072506 A1) — the primary reference

• Full citation: U.S. Patent Application Publication 2011/0072506 A1, published March 24, 2011.
• Dates: publication 2011-03-24; § 102(b) art as to the 2012-10-22 priority date (filing date not independently verified in my searches).
• Brief description: A Unified Threat Management System (UTMS) for process-control networks. UTMS-configured network devices — firewalls 146a/146b, network access device 149c — sit at network boundaries and apply rulesets (147a/147b/151c) containing conditions to accept or deny traffic (policy-based and signature-based; default-allow and default-deny). A third-party cyber-security risk-management firm 305 collects threat data 310 from a plurality of sources 315, constructs/validates/distributes the rulesets, and (per the petitioner) provides a "perpetual service" that proactively supplies updated rulesets, with ruleset updates triggered by detected network conditions (Law ¶ 83).
• Mapping to '266 claims: firewall/NAD devices = "packet security gateways"; firm 305's server = "security policy management server"; aggregated sources 315 = "malicious host tracker service"; rulesets = "dynamic security policy comprising a first set of packet filtering rules"; accept/deny = "packet transformation functions."
• § 102 potential: Law alone is the only reference the record supports as a single-document basis covering all claim elements; it was applied across all of claims 1–27. If one were to argue strict anticipation, Law would be the vehicle — for claims 1–27 (or, conservatively, the independent claims and their straightforward dependents). Note that the Board decided this single-reference ground as § 103 obviousness, not § 102, which matters for how the finding is characterized.

A.2 — Wood (US 2007/0097976 A1)

• Full citation: U.S. Patent Application Publication 2007/0097976 A1, "Suspect Traffic Redirection."
• Dates: published 2007-05-03 (§ 102(b)); underlying filing ~2005 (not verified).
• Brief description: Receives "suspect traffic information" about possible network threats; one or more suspect address sources 210 provide a feed/list of suspect addresses 206 (communicated over the Internet) determined to be associated with malicious/suspect traffic; a router detects suspect traffic and redirects it to an interrogation module; the suspect-address information is updated and the router reconfigured (Wood ¶¶ 21, 32, 34, 36).
• Mapping to '266 claims: suspect address sources 210 = the "at least one third party malicious host tracker service … comprising network addresses … determined to be associated with malicious network traffic"; redirection-to-interrogation = the "packet transformation function other than forwarding or dropping."
• § 102 potential: Wood is not anticipatory alone — it was cited only for the threat-feed and redirection features and was combined with Law. It could only be argued to anticipate a dependent claim that recites nothing more than a suspect-address feed plus redirection; the record does not support standalone anticipation of any claim.

A.3 — Jungck (US 2009/0262741 A1)

• Full citation: U.S. Patent Application Publication 2009/0262741 A1.
• Dates: published 2009-10-22 (§ 102(b)).
• Brief description (medium confidence — characterized from the petition/file-history, which describes edge servers, edge caches 604A–B, POPs 114/116, routing equipment 206, and clients 102–106 with content redirection to caches): a distributed/edge network whose filtering/edge devices act across a content-delivery boundary, with threat-information provisioning and blocklist/ingress-egress filtering functionality (fifth embodiment, device 900).
• Mapping to '266 claims: cited only for the dependent claims 6, 13, 19, 26 (threat-information provisioning) and, in the earlier IPR2021-01154, as a primary reference for the "entire interface across a boundary" concept.
• § 102 potential: Jungck was applied only against dependent claims 6, 13, 19, 26. It was not found to anticipate any independent claim; in fact, in the earlier IPR the Board (denying institution) credited patent-owner arguments that Jungck's edge caches create bypass paths, undermining the "all network traffic traversing the boundary" limitation. ⚠️ I could not independently verify Jungck's bibliographic details (title/assignee/inventor) before the search limit; treat the above description as the petition's characterization.

A.4 — Assurent VRS (non-patent literature)

• Full citation: Declaration of Nathaniel E. Frank-White attaching a Feb. 2, 2007 Assurent website printout regarding its Vulnerability Research Service (Ex. 1007), https://web.archive.org/web/20070202094127/http://www.assurent.com:80/index.php?id=58.
• Date: webpage printed 2007-02-02 (publicly accessible → § 102(b)).
• Brief description: A commercial, subscription-based vulnerability/threat-intelligence service — evidence that subscription threat feeds aggregating malicious-traffic information were known commercial mechanisms.
• § 102 potential: Supplies the "subscription service that aggregates information associated with malicious network traffic" dependent-claim feature (specification at 14:17–28). Not anticipatory alone; corroborating art.

A.5 — Sarathy (unverified)

• Full citation: not retrieved — appears only as "Sarathy" in the IPR2021-01154 Ground 2 (Jungck in view of Sarathy and Wood). I am not going to guess the number, title, or dates.
• § 102 potential: unknown; that petition was denied institution (2022-01-24), so there is no merits finding.

---

Part B — Art associated with the '266 patent in citation/"Patent Art" feeds (⚠️ NOT confirmed as face-cited)

The Unified Patents page for US-10785266-B2 displays a "Patent Art (306)" list of similar-documents art. The items actually legible in my results were below. These are similarity/citation-graph entries, not verified examiner citations, and some have priority dates too late to be § 102(b) art against a 2012-10-22 priority date. I list them with that caveat because a citation report on the '266 face very often draws from the same pool.

Two of these are notable for the claim features they map onto if they were cited: US 2011/0141900 (AT&T — prioritization/QoS-based access control → the enqueueing/differentiated-rate dependent claims) and US 2005/0183140 (University of Nebraska — hierarchical firewall load balancing → the multi-gateway/series dependent claims). Both are only candidate citations; I could not confirm they appear on the '266 face.

---

Part C — Family-level IDS / non-patent literature (shared across the '266 continuation family)

Justia's reference lists for the '266 and its sibling US 12,107,893 show the family's Information Disclosure Statements include the following NPL. Because continuations commonly carry the parent's IDS forward, these are plausible (but unverified as to the '266 specifically) citations:

• A. Feldmann et al., "Tradeoffs for Packet Classification," IEEE INFOCOM 2000, pp. 397–413.
• A. Hari et al., "Detecting and Resolving Packet Filter Conflicts," IEEE INFOCOM 2000, pp. 1203–1212.
• Acharya et al., "Optwall: A Hierarchical Traffic-Aware Firewall," Univ. of Pittsburgh (2007).
• Soldo F. et al., "Optimal Filtering of Source Address Prefixes: Models and Algorithms," IEEE INFOCOM 2009, pp. 2446–2454.
• Ylönen et al., "The Secure Shell (SSH) Transport Layer Protocol," RFC 4253 (Jan. 2006).
• Michael T. Goodrich, "Probabilistic Packet Marking for Large-Scale IP Traceback," IEEE/ACM Trans. Networking, vol. 16, no. 1 (Feb. 1, 2008).
• Various IPR-related filings/declarations (e.g., declarations filed in IPR2018-01386, IPR2018-01437) and prosecution communications cited in the family IDS.

None of these is a § 102(b) anticipatory reference for the independent claims; they are general-state-of-the-art or § 103-support material (packet classification, filter-conflict resolution, source-address filtering, SSH, traceback).

---

Part D — References that must not be conflated with this patent (per the rule about "similar numbers")

My searches repeatedly surfaced prior art belonging to other Centripetal patents. Explicitly excluded from the '266 analysis:

• Cisco IronPort AsyncOS 7.1 for Web User Guide ("IPUG") and U.S. 2012/0290829 ("Altman") — the anticipatory references for US 10,284,526 (CAFC affirmed PTAB anticipation, IPWatchdog, 2026-04-02). Not '266 art.
• Golnabi — appears in the Ground for the '474 patent (US 11,012,474) ("Law, Golnabi, and Jungck"), a sibling continuation, not the '266.
• Jungck + Wood + Sarathy — IPR2021-01154 art for the '266, but on a denied petition (included above only for completeness).
• Family members are not prior art to the '266: US 9,137,205; US 9,560,077; US 10,091,246; US 10,567,437; and continuations US 11,012,474; US 12,107,893; US 12,563,103; plus the 2014-04-16 sibling set (US 10,142,372; US 10,749,906; US 10,951,660; US 10,944,792; US 11,477,237).

---

Bottom line (as it relates to § 102)

• The strongest prior art for US 10,785,266 is U.S. Pub. 2011/0072506 A1 ("Law"), published 2011-03-24 and squarely § 102(b) art as to the 2012-10-22 priority date. It is the only reference the record supports as a single-document basis reaching all of claims 1–27 — though the Board resolved it as § 103 obviousness, not § 102 anticipation.
• Wood (US 2007/0097976 A1, 2007-05-03), Jungck (US 2009/0262741 A1, 2009-10-22), and the Assurent VRS printout (2007-02-02) are secondary/supplemental art, each reaching only the features they were mapped to (Wood: claims 1–24 as combined; Jungck: claims 6, 13, 19, 26; Assurent: the subscription-service dependents). None is anticipatory standing alone.
• No reference was found to strictly anticipate the '266 claims under § 102. The operative invalidity is § 103 obviousness (IPR2023-00445 FWD, 2024-07-22, all claims 1–27; IPR2023-01329 joined; CAFC Rule 36 affirmance per the prior sections).
• Caveat that I will not paper over: I could not retrieve the literal "(56) References Cited" list printed on the face of US 10,785,266, and could not query the USPTO citation database directly. The references above are the ones the litigation/IPR record proves were asserted against this patent plus the art my searches tied to it. To answer "each patent citation on the face of 10785266" with literal fidelity you must pull the issued-patent front page (USPTO Patent Center → US 10,785,266 B2 document images, or the PDF at patents.google.com/patent/US10785266B2). If you can supply that front-page excerpt, I can complete the face-citation table exactly as requested.

Confidence levels: High — reference identities/dates as listed in the IPR petition exhibit list (Law, Wood, Jungck, Assurent), the grounds, and the "all claims 1–27 unpatentable" outcome. Medium — Jungck's specific technical disclosure (petition characterization only) and the '266's independent-claim count (1/8/15 confirmed; 21 flagged). Low/unverified — the face-cited "(56)" list, the "Patent Art (306)" similarity entries, Sarathy's full citation, and the family-IDS NPL's applicability specifically to the '266.

I'll ground the § 103 analysis with a few targeted searches on the combination references before drafting.

Good — I've confirmed additional reference identities. Let me pin down the remaining three references precisely.

Obviousness Analysis — US 10,785,266 B2 under 35 U.S.C. § 103

Scope: This section builds on the Prior Art section (which established the reference set and the § 102 picture) and does not repeat it. It identifies the § 103 combinations, the motivation to combine, and the claim-by-claim result. Verbatim claims were again unavailable to me, so limitation sets below are reconstructed from the PTAB record (Patent Owner's Response, IPR2023-00445), the FWD posture, and the specification — flagged where uncertain.

---

A. Corrections and contradictions to the previously generated sections

Per the operating rule to flag contradictions explicitly, four items require correction:

A.1 — "Law" is misidentified in the Prior Art section. That section states Law (Ex. 1005) = US 2013/0061294 A1, "Network Attached Device with Dedicated Firewall Security" (Kenworthy / Firenet Technologies). The PTAB record contradicts this. IPR2023-00445's exhibit list reads: Ex. 1005 | U.S. Patent Pub. 2011/0072506 ("Law"), and the petition quotes "Ex. 1005 ¶ 103." USP 2011/0072506 A1 is "Integrated Unified Threat Management for a Process Control System," Law et al., assignee Fisher-Rosemount Systems, Inc. (Emerson), published 2011-03-24, filed 2010-09-23, provisional 61/245,496 filed 2009-09-24. Every internal citation in the PO's Response (firewalls 146a/146b, NAD 149a-c, rulesets 147/148/151/153, third-party cyber-security risk-management firm 305, threat data 310, sources 315, process control networks 150a/150b) matches US 2011/0072506 — as does the EPO opposition record, where the same document is D31 = US 2011/0072506 A1. US 2013/0061294 (Kenworthy) does appear on the '266 face as an IDS citation, which is likely the source of the confusion. Corrected identification: Law = US 2011/0072506 A1. This matters because the misidentified Kenworthy reference (a NAD with a dedicated firewall) would be a materially weaker primary reference than the actual Law reference, which expressly discloses remotely-supplied rulesets and a "re-route" action.

A.2 — "Wood" and "Jungck" are now identified. Both were flagged as unconfirmed in the Prior Art section. The IPR2023-00445 exhibit list resolves them:

• Wood = US 2007/0097976 A1 (Ex. 1006) — relied on by Petitioner "only for its alleged teaching of providing suspect network addresses" (PO's Response, Ground 2). Title and claimed subject matter not verified within my search budget — treat as unconfirmed.
• Jungck = US 2009/0262741 A1 (Ex. 1008), published 2009-10-22 — i.e., exactly three years before the '266 priority date, qualifying under both pre-AIA § 102(b) and § 102(e).

A.3 — The Prior Art section misattributes the Board's finding on Law. It states "[t]he Board found this the closest art but credited Patent Owner's argument that Law does not disclose [the preamble limitations]." That is the Patent Owner's argument, which the Board rejected — the FWD held all challenged claims 1–27 unpatentable over Law alone. The prior-art section's own § 102 conclusion (that Law does not anticipate) is a separate and correct point; but no reader should take from it that the Board agreed with Centripetal.

A.4 — Temporal inconsistency (restated). The task states today is April 26, 2026, while the previously generated sections (and the live search corpus I just queried, which surfaced items dated July 21 and July 23, 2026) reflect a later date. I treat the later-dated material as current ground truth per the priority rule, and flag that if "today" is genuinely 2026-04-26, the June 9, 2026 Rule 36 affirmance has not yet issued.

---

B. Governing legal framework

• Statute: The '266 patent's earliest application (13/657,010) was filed 2012-10-22, before March 16, 2013 → pre-AIA 35 U.S.C. § 103(a); AIA § 102/§ 103 do not apply. The AIA's "additional rationale" catalogue in § 103 is therefore not statutory text here, but the same rationales are available as KSR v. Teleflex, 550 U.S. 398 (2007) and Graham v. John Deere, 383 U.S. 1 (1966) showings.
• Test: (1) scope/content of the prior art; (2) differences between the art and the claims; (3) level of ordinary skill; (4) secondary considerations, with nexus.
• Standard of proof (PTAB): preponderance; (court): clear and convincing evidence.
• Claim construction: Phillips v. AWH Corp., 415 F.3d 1303 (Fed. Cir. 2005) (en banc). Critically, Centripetal itself argued in IPR2023-00445 that the preambles of independent claims 1, 8, and 15 are limiting ("[Petitioner] does not dispute that the preambles of Independent Claims 1, 8, and 15 are limiting"). Any § 103 attack should be run under both readings; the Board's invalidity finding survives either.

---

C. Person having ordinary skill in the art (POSITA)

Reconstructed — the PO's Response contains a "Level of Ordinary Skill in the Art" section (Part III) whose contents I could not retrieve. Based on the field (packet filtering, firewall rule management, TCP/IP network security) and the experts actually used in this family (Dr. Douglas Jacobson for the petitioners; Dr. Michael T. Goodrich for Centripetal; Dr. Vijay Madisetti in the PAN petitions), the POSITA is best framed as:

• a bachelor's degree in computer science, computer engineering, or electrical engineering, or equivalent, plus 2–4 years of experience in network security/packet processing, or a master's degree with 1–2 years; and
• familiarity with: firewall rule sets and packet-filtering rule structure (5-tuples, DSCP, wildcards), centralized/remote policy management of security appliances, IP-based threat intelligence feeds, IP-in-IP encapsulation, and standard network-security deployment topologies (perimeter appliances, bump-in-the-wire gateways, DMZs).

Why this matters: the claimed subject matter is systems integration of known network-security building blocks. Under KSR, "if a technique has been used to improve one device, and a person of ordinary skill in the art would recognize that it would improve similar devices in the same way, using the technique is obvious unless its actual application is beyond his or her skill."

---

D. The corrected reference set and its § 102 status

Point to preserve: RFC 2003 occupies a special position. The '266 specification expressly states the packet transformation function "may be configured to encapsulate such packets (e.g., as described by Internet Engineering Task Force (IETF) Request For Comment (RFC) 2003)." A reference cited in the patent's own specification as describing the claimed mechanism is treated as admitted prior art — the strongest possible motivation-to-combine evidence, since the inventors themselves identified it as the technique of choice.

---

E. Combination 1 (primary): Law alone — claims 1–27

This is the combination that actually killed the patent (IPR2023-00445 FWD, 2024-07-22, all of claims 1–27 unpatentable; affirmed by Rule 36 on 2026-06-09 in Nos. 24-2372/24-2373).

What Law discloses (all cites to US 2011/0072506 A1):

Motivation to combine: not applicable in the conventional sense — this is a single-reference obviousness case. The rationale is that Law already discloses every element; the "combination" is Law's own internal combination of (i) a persistently, externally-supplied rule set and (ii) a rule action that is neither accept-only nor drop-only. Under KSR, where the reference itself teaches the modification and its benefit (proactive protection against "zero day" vulnerabilities, ¶¶ 14, 22), the modification is obvious. Law expressly frames its own problem statement in the same "reactive vs. proactive" terms the '266 Background section uses — that is a textbook KSR-permissible "known problem in the field, known solution" showing.

Why Centripetal's counter-arguments fail (see § L for the rebuttals): the two limitations Centripetal fought on were the preamble (plural PSGs, entire interface, all traffic) and SPMS automatic creation.

---

F. Combination 2: Law + Wood — claims 1–24

• Ground 2 of IPR2023-00445; found obvious.
• What Wood adds: per Centripetal's own characterization, Petitioner relied on Wood "only for its alleged teaching of providing suspect network addresses." That maps onto the '266 dependent claims directed to rules generated from lists of known network addresses associated with malicious network traffic, including lists received from a subscription service that aggregates malicious-network-traffic information (specification's "malicious host tracker service 508," Fig. 5).
• Motivation to combine: Law already aggregates threat data 310 from "a plurality of various sources 315" (named sources include Assurent, Secunia, Carnegie Mellon; plus unnamed sources) and expressly anticipates that those sources supply "firewall ruleset data." Wood supplies a complementary, well-known species of the same genus — a concrete mechanism for identifying which addresses are suspect. A POSITA seeking to populate Law's rulesets with address-based block rules has an articulated reason, rooted in Law's own text, to look to a reference that teaches how suspect addresses are identified and supplied. The KSR rationales squarely available: (a) same field (network security packet filtering); (b) same problem (keeping boundary rule sets current against known-bad hosts); (c) predictable result (a block rule built from a bad-address list); (d) "obvious to try" with a finite, identified set of threat-feed sources.
• Caveat: Wood's identity is confirmed (US 2007/0097976 A1) but its title and disclosure are not verified in my record; the mapping above rests on the PO's characterization. This is the one combination in which I would want the reference in hand before finalizing a claim chart.

---

G. Combination 3: Law + Jungck and Law + Wood + Jungck — claims 6, 13, 19, 26

• Grounds 3 and 4 of IPR2023-00445; found obvious.
• Jungck = US 2009/0262741 A1, published 2009-10-22 — squarely § 102(b) art, and one of the most heavily used references against this family: it was the primary reference in IPR2018-01506 / IPR2018-01513 against the '266's own ancestors (US 9,137,205 and 9,560,077), which "resulted in the cancellation of the claims of those patents." It was also the primary reference in Palo Alto's IPR2021-01154 petition against the '266.
• Why Jungck was needed only for claims 6, 13, 19, and 26: the fact that Petitioner deployed Jungck against exactly those four claims tells us those claims recite one discrete additional feature that Law alone lacked. Given the family's claim structure, that feature is most likely one of: (i) the network-layer-transparent gateway with a link-layer (unaddressed) data-plane interface plus an application-secured management interface; or (ii) the malicious-address-list / subscription-service rule-generation feature. Uncertain — flagged; I could not retrieve the FWD's claim-by-claim text.
• Motivation to combine: Law supplies the architecture (externally-supplied rule sets at perimeter firewalls, non-accept/non-drop actions) and Jungck supplies the missing packet-processing/classification complement. A POSITA addressing the same problem — protecting a boundary with centrally-managed filtering rules — would consult Jungck because it is the same field of endeavor, addresses the same problem, and its teaching is directed to the same class of device (a packet-filtering/security processor). The combination is a predictable use of a prior-art technique to improve a similar device (KSR), with no change in the principle of operation of either reference and a reasonable expectation of success.
• Independent strength: even setting Law aside, Jungck alone is the reference on which the '205 and '077 parent patents' claims were canceled — so a defendant has a second, independent primary-reference theory for the broader claims as well (see § I).

---

H. Combination 4 (sibling-proven): Law + Golnabi (+ Wood / Ke / Jungck / Johnson)

This is the ground set from IPR2023-00448 against sibling US 11,012,474, which has the same specification as the '266:

The Board found all claims unpatentable except claims 6, 14, 22, 30, and 33, and the CAFC affirmed (Keysight v. Centripetal, No. 2025-1053, Fed. Cir. July 21, 2026, nonprecedential). The five survivors survived only because Keysight's petition failed to argue them — the court's own footnote: "The ghost in the room here whispers that we are allowing plainly unpatentable claims to continue to live on." (Also noteworthy: claim 33 of the '474 recites "at least one packet transformation function is configured to route associated packets to a monitoring device" — the same monitoring-service feature the '266 discloses and that the Board held obvious in the '266's own FWD.)

Golnabi's role and motivation to combine: Golnabi ("Analysis of Firewall Policy Rules Using Data Mining Techniques," 2006) teaches merging and ordering firewall rules to produce an optimized, minimum rule set. Petitioner's motivation argument — accepted — was that a POSITA would "combine rules as Golnabi teaches, when constructing rulesets as Law teaches using threat data 310 from a plurality of sources 315, because the appropriate combining of rules can minimize total rules thereby providing processing efficiency." This is the classic KSR "known technique to improve a similar device" rationale, and it is independently supported by the '266 specification itself, which states that overlapping rules "may be merged together or otherwise transformed into a different set of rules without overlapping criteria, which may produce the same result as the original set of rules." That is an admission that rule merging was known and desirable — defeating any argument that Golnabi's teaching is improper hindsight.

---

I. Combination 5 (second, independent primary-reference theory): Jungck + Wood (+ Sarathy) and Jungck + RFC 2003

Palo Alto Networks' IPR2021-01154 petition asserted exactly this, with all claims 1–27 challenged:

• Ground 1: claims 1–27 obvious over Jungck in view of Wood
• Ground 2: claims 1–27 obvious over Jungck in view of Sarathy and Wood

Institution was denied on 2022-01-24 (Paper 11), because PAN failed to show a reasonable likelihood on the "plurality of packet security gateways that collectively provide an entire interface across a boundary" and "all network traffic traversing the boundary" limitations. This is a roadmap, not a wall. The denial is (i) non-precedential and non-binding even on the Board, (ii) not appealable (§ 314(d)), and (iii) not a merits adjudication — it turned on petition drafting (the Board found PAN's showing on the two contested limitations conclusory). A defendant today has the benefit of the 2024 FWD's express findings on those very limitations (obtained from the Law record) and can import them into a Jungck-based petition, curing the 2021 deficiency.

Separately, for the dependent claims directed to routing/encapsulating packets to a network address different from the packet's destination (the "multi-dimensional routing"/monitoring-service claims, and the SIP-URI-selected variant):

Jungck + RFC 2003 is the combination to plead. It is the exact combination that worked against the '077 parent (IPR2018-01513: claims 1–4, 6–10, 12–16, 18, 20 unpatentable over Jungck; claims 5, 11, 17 unpatentable over Jungck + RFC 2003). The motivation argument is essentially unassailable because RFC 2003 is incorporated by reference in the '266 specification itself as the encapsulation mechanism for routing packets to a different destination address. You cannot argue hindsight when the patent you are attacking names the reference.

---

J. Claim-by-claim result summary

Important structural note: the independent claims are 1, 8, and 15, and the FWD invalidated all 27 claims — so the claim-mapping question is academic for the '266 itself: there is no claim that escaped a § 103 holding, and no claim whose validity was left untested.

---

K. Motivation to combine — the KSR rationales, itemized with record support

---

L. Anticipated non-obviousness arguments and the rebuttals

Centripetal's arguments in IPR2023-00445 (which the Board rejected) and my assessment:

1. "Law's NAD 149c sits outside the process control network; Law discloses a single firewall protecting a single network and no capability of interacting with another firewall to protect a network."

• Rebuttal: The claim requires a PSG "of a plurality of PSGs that collectively provide an entire interface across a boundary of a protected network." Law's FIG. 3 configures firewalls 146a and 146b with respective rule sets (147a/148a and 147b/148b) at the perimeters of 150a and 150b, plus NADs 149a–c — an architecture in which multiple boundary devices together police the interface. Even accepting the PO's reading (each firewall protects its own network), the claimed "plurality … collectively" arrangement follows from Law's own teaching (¶ 51: rulesets "include a global set of rules for access to any device within the subsystems 105a, 105b") and from the '266 specification's admission that multiple PSGs are deployed for memory/scale reasons ("memory requirements … comparable to M+N, whereas … a single packet security gateway may have required memory comparable to N*M"). Adding a second, parallel boundary appliance to a known single-appliance deployment is a predictable, KSR-sanctioned duplication of parts. The Board accepted this.

2. "Each firewall applies a unique rule set (147a vs. 147b), and NAD 149c applies yet another (151c) — so Law does not apply 'a first set of packet filtering rules' to 'all network traffic traversing the boundary.'"

• Rebuttal: The claim recites applying a first set of rules to all traffic traversing the boundary; it does not require that no other rule sets exist anywhere in the system. Law ¶ 51 expressly discloses that where the UTMS device is a perimeter device, rulesets 147/151 constitute a "global set of rules" protecting all devices on the network — i.e., the boundary-wide rule set the claim describes. Centripetal's argument conflates global with network-scoped; the Board did not adopt that distinction.

3. "Firm 305 does not automatically create rules; Law requires IT personnel to update the ruleset when new threats are discovered."

• Rebuttal: Law ¶ 88 (firm 305 "collect[s] threat data 310 from a plurality of various sources 315 to construct the various rulesets, validate the rulesets, verify, and distribute" them) and ¶ 83 ("Detection of certain network conditions may also trigger an automatic update of the rulesets") contradict this. And even if Law's disclosure were characterized as requiring human oversight, substituting an automated threat feed for a manual one was the standard, standardized practice by 2012 — and the '266 claims do not recite any particular automation algorithm.

4. "The proposed modifications defeat the purpose of Law / change its principle of operation."

• Not argued with force, and it cannot be: adding address-based suspect-address rules (Wood), rule merging (Golnabi), or automated feed ingestion leaves Law's UTMS architecture and its proactive-protection purpose entirely intact. In re Ratti is inapplicable absent a change in principle of operation.

5. "Non-analogous art / different field (process control vs. enterprise networks)."

• Rebutted on KSR's field-of-endeavor and reasonable-pertinence tests: Law is directed to securing network traffic at a network boundary using packet filtering rules — the same endeavor as the '266 (both are, at bottom, boundary packet-filtering appliances). The Federal Circuit has repeatedly refused analogous-art defenses where the reference is reasonably pertinent to the problem the inventor faced.

---

M. Secondary considerations (objective indicia)

Expected proffered evidence and why it fails to carry weight:

1. Commercial success (RuleGATE®, CleanINTERNET®). The original assignee is an operating company whose products track the specification closely (see the Assignee section). But under In re GPAC/WBIP, commercial success must be tied to the claimed features via a nexus. The '266 claims recite generic boundary packet filtering with centrally-supplied rules and non-accept/non-drop actions — features present in every commercial firewall/UTM product in the market. Without proof that the success is attributable to a specific claimed limitation, and absent evidence of the market share/demand nexus, this fails. Also note the "blocking" evidence: Law is itself commercial art from Emerson, and its commercial embodiment practices the same architecture.
2. Copying. Centripetal has a live precedent for this theory — in Centripetal Networks v. Palo Alto Networks, No. 23-2027, the Federal Circuit vacated and remanded a FWD for failure to consider copying as secondary indicia (on related US 9,917,856). Expect this argument to be pressed. It is nevertheless weak on the '266 for a legal reason: copying is probative only of what the copyist took, and here the alleged copyists (Cisco, Palo Alto, Keysight) are all accused of independently patenting and selling their own systems developed over the same period — plus the Board and the Federal Circuit have now held the claims obvious on strong, non-marginal art (Law alone), which defeats a nexus-based copying argument. Copying evidence cannot outweigh a § 102(b)-dated, same-field reference that discloses the elements.
3. Unexpected results. None identified in the record. The specification asserts no unexpected result; it asserts feasibility ("Proactive solutions … have often been deemed untenable due to an inability to scale"), which is an advocacy statement about the prior art, not a showing of unexpected results relative to Law.
4. Industry praise / licensing. The Cisco $1.9B verdict (affirmed in part, 38 F.4th 1025 (Fed. Cir. 2022)) shows Centripetal's portfolio had value, but value ≠ nexus to the '266's claims, and Cisco's asserted patents in that case did not include the '266.
5. Teaching away. No reference teaches away from automated, externally-sourced boundary rule sets; Law affirmatively embraces them.

Conclusion on objective indicia: available, but need a proven nexus to the claims and cannot overcome the strength of Law alone.

---

N. Where the § 103 attack is weakest (residual risk assessment)

For completeness and candor — the § 103 case is not risk-free at the margins:

1. The narrowed family continuations are not covered by the '266 FWD. US 12,107,893, US 11,012,474, and US 12,563,103 are separate patents with their own claims. The sibling '474 result shows that petition-drafting gaps, not art gaps, save claims — five '474 claims survived purely because the petition didn't argue them. Any new defendant attacking a continuation must argue every claim element-by-element with particularity (§ 312(a)(3); 37 C.F.R. § 42.104(b)(4); Wasica; Netflix v. DivX).
2. "Law alone" is a close call on the preamble if the Board's construction were revisited. The '266 FWD's rejection of Centripetal's preamble argument is the pivot. A defendant should not rely on Law alone; plead Law + Wood + Jungck (with Golnabi available as a rule-optimization supplement) in the alternative, plus Jungck + RFC 2003 for the re-routing claims, and Jungck + Wood as a wholly independent primary-reference theory.
3. Wood's specific disclosure is unverified in my record. Obtain US 2007/0097976 A1 and confirm it teaches supplying suspect/known-bad network addresses before finalizing a claim chart.
4. Element-level uncertainty on the dependent claims. I could not retrieve the '266 FWD's claim-by-claim text or the PO's Response Part III (POSITA) / Part IV.C (other constructions). Confirm the specific limitations of claims 6, 13, 19, and 26 (the Jungck-addressed claims) and of the monitoring/re-route dependents before asserting a final opinion.
5. Best additional art to develop. The EPO record shows the Sourcefire manual v4.10 ("IPUG") was treated as anticipating related-family claims, and a rule-set file used by a network security program was held to be a § 102(b) printed publication in this family. Sourcefire's IPUG and Sourcefire/Golnabi combinations are the strongest new art not yet litigated against the '266 — they give a defendant art independent of Law, which matters because non-privies get no benefit of the Keysight/PAN estoppel but also suffer no § 315(e)(2) bar.

---

O. Bottom line

• Every claim of US 10,785,266 — 1 through 27, including independent claims 1, 8, and 15 — has been held obvious under pre-AIA § 103(a) in an IPR Final Written Decision that the Federal Circuit affirmed (IPR2023-00445 FWD 2024-07-22; consolidated with IPR2023-01329; affirmed by Rule 36 judgment, Nos. 24-2372/24-2373, 2026-06-09). The FWD rested on Law (US 2011/0072506 A1) alone; Wood, Jungck, and Wood+Jungck were used for the remaining dependent claims.
• The motivation-to-combine case is unusually strong because it is largely internal to the references: Law itself discloses (i) rulesets proactively supplied by an external perpetual service, (ii) automatic ruleset updating triggered by network conditions, (iii) global boundary-wide rule sets protecting all devices on a network, and (iv) a rule action that is neither accept nor drop — "block, notify and/or re-route" (¶ 103). The '266 specification independently supplies the motivation for the remaining features by citing RFC 2003 for encapsulation/re-routing and by describing rule merging as a known transformation.
• Independent alternative combinations exist and are litigation-ready: Law + Wood + Jungck (+ Golnabi) as the worked set; Jungck + Wood (+ Sarathy) and Jungck + RFC 2003 as independent primary-reference theories (Jungck having already canceled claims of the '266's own parents in IPR2018-01513, and having invalidated most claims of the same-specification sibling '474 in IPR2023-00448).
• Secondary considerations do not save the claims. No nexus is provable between the claimed generic boundary-filtering features and any commercial success; copying evidence, while available to Centripetal under the 23-2027 remand precedent, cannot outweigh a same-field reference of Law's specificity that was already found to render the claims obvious on its own.

Two flags for the file: (1) the Prior Art section's identification of "Law" as US 2013/0061294 is wrong — it is US 2011/0072506 A1, and any downstream document relying on the earlier identification should be corrected; (2) the Prior Art section's statement that the Board "credited Patent Owner's argument" about Law's preamble deficiencies is the opposite of what happened — the Board rejected that argument and invalidated all 27 claims.