US 12563103

I'll search for this specific patent number across USPTO and litigation sources.

Let me run more targeted searches on the specific number and on 2026 Federal Circuit dockets involving this assignee.

Let me run a few final targeted searches for any litigation/PTAB activity on this exact number.

Search result summary — US 12,563,103 B2

Important limitation on what I found: I searched for this exact identifier (including "12,563,103", "12563103", and "US12563103") across general web indexes that surface USPTO/PTAB filings, EDVA and ITC litigation documents, and Federal Circuit opinions/orders. I found no result tying US 12,563,103 to any specific CAFC 2026 docket, IPR, ITC investigation, or district-court case. The 2026 Centripetal-related appellate activity I found concerns other patents in the same portfolio (see "Related-family context" below). Treat the litigation/docket portion of this answer as negative result only — absence of a hit is not proof that no such proceeding exists.

The bibliographic and claim data below is taken from the authoritative full text supplied for this patent (Google Patents, https://patents.google.com/patent/US12563103/en), cross-checked against Espacenet family data.

1. Bibliographic data

Family / priority chain (as recited in the patent's Cross‑Reference section): continuation of 17/230,425 (2021‑04‑14) → continuation of 17/027,436 (2020‑09‑21) → continuation of 16/909,327 (2020‑06‑23) and continuation‑in‑part of 16/728,766 (2019‑12‑27, now US 10,785,266) → continuation of 16/448,969 (now US 10,749,906) → continuation of 16/158,868 (2018‑10‑12) → continuation of 15/414,117 (now US 10,142,372) → divisional of 14/253,992 (2014‑04‑16, now US 9,565,213). Root priority: US 13/657,010 (now US 9,137,205).

2. Abstract

"Methods and systems for protecting a secured network are presented. For example, one or more packet security gateways may be associated with a security policy management server. At each packet security gateway, a dynamic security policy may be received from the security policy management server, packets associated with a network protected by the packet security gateway may be received, and at least one of multiple packet transformation functions specified by the dynamic security policy may be performed on the packets."

3. Plain-language overview of the three independent claims

All three independent claims recite the same substance in three statutory formats — claim 1 as a security policy management server (apparatus), claim 9 as a method, and claim 17 as non‑transitory computer‑readable media. The substance is:

(a) Multi-source threat-feed ingestion. The server receives, from a plurality of malicious host tracker services, network address(es) identifying malicious hosts that at least one of those tracker services determined had transmitted malicious traffic.

(b) Correlation across feeds. The server compares a first portion of addresses from a first tracker service against a second portion from a second tracker service and determines they are correlated (dependent claims narrow this to duplicate addresses, claim 5, or overlapping address ranges, claim 6).

(c) Automatic rule generation. Based on receiving the addresses and on the correlation, the server automatically creates a packet filtering rule for a dynamic security policy. The rule has (i) packet matching criteria that encompass both correlated portions (claim 8: a range of network addresses encompassing both portions; claim 7: a set of network addresses plus a Session Initiation Protocol (SIP) URI), and (ii) corresponding packet transformation function(s) applicable to matching packets.

(d) Push to a boundary gateway, with a specific transformation. The rule is sent to a packet security gateway located at the boundary between a first (protected) network and a second network, and is configured to cause the gateway to:

1. encapsulate each matching packet with an IP header specifying a network address;
2. strip that IP header on a packet-by-packet basis from the encapsulated packet(s); and
3. forward the matching packet(s) toward their respective destinations without that IP header.

In plain terms: a central policy server fuses threat intelligence from multiple malicious-host feeds, de‑duplicates/merges the overlapping address data into a single auto-generated filtering rule, and deploys that rule to an in-line boundary gateway that encapsulates matching traffic with a (different) destination IP header, then removes that header and passes the packet onward — i.e., the claim language describes the redirect/monitoring-style transformation used elsewhere in this specification (encapsulate → route/divert → strip → deliver to the original destination).

Dependent-claim map:

• Apparatus (1): 2 (add rule to the policy; sending = transmitting the policy), 3 (gateway filters by applying the transformation functions), 4 (create a set of rules including second rules with different criteria/functions), 5 (correlation = duplicate address), 6 (correlation = overlapping ranges), 7 (criteria = set of addresses + SIP URI), 8 (criteria = encompassing address range).
• Method (9): claims 10–16 mirror 2–8.
• Media (17): claims 18–24 mirror 2–8.

⚠️ Uncertainty flagged: the claim text available to me truncates at the end of claim 23, mid-way through "a session initiation protocol u…". I therefore cannot authoritatively quote claim 24's full text, though it is listed as issued (24 claims) and, from the 2–8 / 10–16 pattern, most likely corresponds to the "encompassing range of network addresses" dependent claim.

4. Related-family context (do not attribute these to the '103 patent)

Because the '103 patent shares a long continuation family with several patents that have been litigated, note these 2026 items surfaced in my search — they concern other patent numbers:

• Centripetal Networks, LLC v. Keysight Technologies, Inc., Nos. 24‑1406 and 24‑1416 (Fed. Cir. Apr. 23, 2026) — affirmed unpatentability of claims of US 10,193,917 ("Rule-Based Network-Threat Detection") over Sourcefire and addressed ITC/§ 337 issues on another patent (reported; CAFC/Justia).
• Keysight Techs., Inc. v. Centripetal Networks, LLC, No. 2025‑1053 (Fed. Cir. July 21, 2026) — affirmed the PTAB's finding that Keysight failed to carry its burden on claims 6, 14, 22, 30, 33 of US 11,012,474, itself titled "Methods and systems for protecting a secured network" (opinion PDF).
• Palo Alto Networks, Inc. v. Centripetal Networks, Inc., No. 2023‑2027 (Fed. Cir. Oct. 22, 2025) — vacated/remanded on copying-evidence grounds re US 9,917,856 (opinion PDF).
• Separately, my search returned a PTAB/AIA brief addressing a Centripetal patent with claims reciting "at least one third party malicious host tracker service" and aggregated malicious traffic information, argued against Law in view of Wood/Jungck (PTAB document). I could not confirm from the retrieved excerpt which patent number that proceeding targets, and it referenced a "'266 Patent" with claim 26 in one ground — i.e., a different claim count than the '103 patent's 24 claims. I am not asserting it is or is not directed at the '103 patent.

5. Confidence statement

• High confidence in the title, inventors, assignee, application/filing/issue dates, priority date, abstract, claim count, and the substance of independent claims 1, 9 and 17 — sourced from the authoritative patent text, with the publication number/date, filing date, priority date and assignee independently corroborated by Espacenet family data (Espacenet citing documents entry).
• Low confidence / not established: any 2026 CAFC docket, IPR, ITC § 337 investigation, or district-court action naming US 12,563,103 specifically. Given the patent issued 2026‑02‑24, it is also chronologically unlikely to have a decided 2026 Federal Circuit appeal; any such docket would be in its earliest stages or not yet indexed. If you need a definitive answer on that point, the reliable next steps are a direct query of the CAFC docket system (CM/ECF) and USPTO Patent Public Search / PTAB API by patent number rather than open web indexing.

I'll research litigation involving US Patent 12563103 across patent litigation databases.

Let me search more specifically for this patent number.

Let me check litigation portals and dockets directly for this specific patent number.

Bottom line

I found no litigation that names or asserts U.S. Patent No. 12,563,103. As of the date of my searches, there is no complaint, ITC complaint, PTAB petition, or appellate docket that identifies this patent number. I want to be explicit that this is a negative finding limited by what public search sources returned, not a certified "no cases exist" statement.

Identification of the patent (as given, interpreted literally)

Note a practical point: this patent granted Feb. 24, 2026, i.e., only recently relative to the stated current date. Any suit asserting it would have to be filed after that date (or the patent would have to be added to an existing case by amended contentions), so the window for litigation to appear is narrow.

What I searched

I searched for the literal strings "12563103," "US12563103," "12,563,103," and combinations with "Centripetal" and "litigation/lawsuit," and I reviewed results surfaced from patent-litigation-oriented sources (Law360, IPWatchdog, CourtListener/UniCourt dockets, Docket Alarm, PTAB/PTActs, and the ITC). I was not able to run direct queries against PACER or the Unified Patents litigation case list within my tool budget, so I cannot claim complete coverage of every district court docket.

Two cautions on identifier collisions: the bare number "12563103" also returns unrelated hits — a CIK/EDGAR identifier tied to NextDecade Corporation and a UK Companies House number for "Digital Dental Solutions Ltd." Those are not the patent and I excluded them.

Closely related litigation (context — none of these names the '103 patent)

US 12,563,103 sits in Centripetal's large "protecting a secured network" continuation family (2012 priority; see the cross-reference chain in the specification running through US 9,565,213 and US 10,785,266). Centripetal has been an active litigant, but the patents asserted in its campaigns are different patents:

Two of these are worth flagging because they are family-adjacent, not because they assert the '103:

• US 10,785,266 — a parent/continuation-in-part relative in the '103's priority chain — is asserted against Keysight (Keysight II, 2:22-cv-00002) and appears in the Palo Alto Networks case (E.D. Va. 2:21-cv-00137).
• US 9,565,213 (the '213 patent, an ancestor via US 14/253,992) was asserted against Keysight/Ixia in Keysight I, which settled.

Caveats

1. Negative result, not proof of absence. Very recent patents often show up in dockets before they show up in aggregator searches; my sources are not guaranteed to index filings from the last few weeks.
2. Date consistency issue. The user-supplied current date is April 26, 2026, but several of my search results are dated after that (e.g., Law360 Apr. 29, 2026; IPWatchdog Sept. 23, 2026). I have reported the sources as they were returned rather than silently reconciling the dates.
3. No PTAB or ITC record found naming US 12,563,103. Given the Feb. 24, 2026 issue date, any IPR would have to be filed within one year of service of an infringement complaint, so none would be expected yet.
4. I could not verify directly against PACER or the Unified Patents litigation portal, so a definitive check of those two systems is recommended before relying on this as a complete clearance-style search.

Proceedings overview

AIA trial proceedings naming U.S. Patent No. 12,563,103: 0 — 0 active, 0 with claims invalidated, 0 with claims sustained, 0 settled, 0 institution denials. The USPTO Open Data Portal list in the structured block is the canonical answer, and my independent web sweep surfaced nothing that contradicts it. The defensive posture this produces is "untested," not "hardened" — and the reason matters: the '103 patent only granted on 2026-02-24, so under 35 U.S.C. § 311(c) no IPR petition against it could even be filed before 2026-11-24 (nine months post-grant). The empty docket is a timing artifact, not a record of challengers who tried and lost. Contrast that with the patent's own family, which has been IPR'd repeatedly and has taken heavy losses (details below) — so the "no IPRs" signal here is much weaker than it would be for an older patent.

Threshold caveat on scope: the section headers below use sibling-patent numbers, because every PTAB proceeding I could verify is directed at a different patent in the same Centripetal priority family (priority 2012-10-22). I am not relabeling those as proceedings on the '103 patent — they are context you can use, and they are not statutory estoppel against anyone with respect to the '103.

No proceedings on 12,563,103 — verification trail

Consequence: because grant was 2026-02-24 and today is 2026-09-30, the '103 has been enforceable for ~7 months. The earliest lawful IPR petition date is 2026-11-24. Any "IPR2026-xxxxx" you see that appears to target this patent before that date is either miscaptioned or was filed prematurely (cf. IPR2026-00166, where the petitioner had to withdraw a petition filed before the nine-month window closed — a real and recent example of that failure mode).

Family-level PTAB activity (context — not proceedings on this patent)

These share the '103's specification and/or priority chain (US 13/657,010 → US 9,137,205; US 14/253,992 → US 9,565,213 per the priority data, and the continuation chain through the '266/'906/'372 patents).

IPR2018-01436 and IPR2018-01437 — Cisco Systems, Inc. v. Centripetal Networks, Inc.

• Type: Inter Partes Review (US 9,124,552 and US 9,160,713)
• Status: Final Written Decision — all claims unpatentable
• Panel: Not captured here (FWD 2020-01-23)
• Grounds: § 103 obviousness over the Sourcefire 3D System User Guide ("Sourcefire"), asserted as a printed publication
• Outcome: Board found all claims unpatentable; Fed. Cir. affirmed on 2021-03-10, Nos. 2020-1635/-1636, 847 F. App'x 869 — holding, inter alia, that Sourcefire was publicly accessible and qualified as a printed publication, and rejecting Centripetal's objective-indicia arguments. CourtListener
• Defensive value: Sourcefire is judicially blessed as prior art as of April 2015 (and earlier for other family members). That finding is reusable ammunition in litigation against the '103 if the '103's effective filing date is 2015 or later for the claims at issue — which is worth checking, given the 2012 vs. 2014 vs. 2019+ continuation chain.

IPR2018-01760 — Cisco Systems, Inc. v. Centripetal Networks, Inc.

• Type: Inter Partes Review (US 9,413,722)
• Filed: 2018-09-18 | Instituted: 2019-05-20 | FWD: 2020-05-18 (Paper 41)
• Panel: John W. Lee, Brian J. McNamara, John P. Pinkerton (Lee writing)
• Grounds: § 103 over Sourcefire, claims 1–25 challenged
• Outcome: Most challenged claims held unpatentable. Appeal No. 2020-2057; affirmed, 847 F. App'x 881 (Fed. Cir. 2021)
• Defensive value: Sixth Sourcefire-based win in the family. If your invalidity theory is "Sourcefire + POSITA," you are on well-litigated ground, not novel ground.

IPR2022-01525 — Keysight Technologies, Inc. v. Centripetal Networks, LLC

• Type: Inter Partes Review (US 10,284,526)
• FWD: 2024-04-15 — claims 1–20 unpatentable
• Grounds: § 102 anticipation by Cisco IronPort AsyncOS 7.1 for Web User Guide ("IPUG"); § 102 by U.S. Pub. 2012/0290829 ("Altman"); § 103 over IPUG; § 103 over Altman + U.S. Pub. 2015/0121449 ("CP")
• Appeal: Fed. Cir. No. 2024-2246, decided 2026-04-02 (nonprecedential) — affirmed on the IPUG anticipation ground; other grounds moot. Panel: Lourie, Prost, and Burroughs (D.J.). CAFC opinion PDF
• Defensive value: IPUG is now a court-approved anticipation reference for this family's selective-decryption claims. Note, however, the '103's claim 1 is not a decryption claim — its distinguishing limitations (multi-source malicious-host-tracker correlation; encapsulate-then-strip-and-forward) are not what IPUG/Altman/CP were mapped against. Do not assume preclusion.

IPR on U.S. 11,012,474 — Keysight Technologies, Inc. v. Centripetal Networks, LLC

• Type: Inter Partes Review
• FWD: all challenged claims unpatentable except claims 6, 14, 22, 30, and 33, which survived solely because Keysight failed to argue them (header-and-chart only)
• Appeal: Fed. Cir. No. 2025-1053, decided 2026-07-21 (nonprecedential) — affirmed. The court flagged the anomaly directly: "The ghost in the room here whispers that we are allowing plainly unpatentable claims to continue to live on. … Be that as it may, we do not opine on the patentability of [those] claims." Opinion PDF, analysis at PTAB Watch
• Defensive value: A claim-by-claim cautionary tale — five claims remain presumptively valid purely on petitioner-side drafting failure. Also note the court's § 315(e) estoppel comment: those surviving claims are now shielded from Keysight-raised or reasonably-raisable grounds.

IPR2021-01150 — Palo Alto Networks, Inc. v. Centripetal Networks, Inc.

• Type: Inter Partes Review (US 10,530,903)
• Filed: 2021-07-20 | Instituted: 2022-02-16 | FWD: 2022-11-16 (Paper 9 per the Finn declaration citation, though that exhibit list conflates papers)
• Outcome: Board found PAN had not shown the claims obvious. Fed. Cir. No. 2023-1636 VACATED AND REMANDED — the Board failed to explain its motivation-to-combine reasoning.
• Defensive value: A rare Centripetal win at the Board, but one that was procedurally fragile on appeal. Treat the "Patent Owner prevailed" framing with caution.

The denial cohort (Palo Alto Networks v. Centripetal)

Verified from the Finn declaration filed in E.D. Va. No. 2:21-cv-00137:

• IPR2021-01151 (US 10,659,573) — institution denied 2022-02-16
• IPR2021-01153 (US 10,567,437) — institution denied 2022-01-24
• IPR2021-01156 (US 10,735,380) — institution denied 2022-01-24
• PGR2021-00108 (US 10,931,797) — post-grant review denied 2022-02-22
• IPR2021-01520 — denied under 35 U.S.C. § 325(d) (Advanced Bionics/Becton framework; reexam references counted in the § 325(d) analysis)
• Source: Declaration of Christina M. Finn, E.D. Va. 2:21-cv-00137, Dkt. 465
• Defensive value: The Board has repeatedly denied PAN's petitions in this family — on the merits, and under § 325(d). Recycling previously-presented art is a live denial risk.

Unverified / flagged: I did not confirm whether any AIA trial was ever filed against US 9,137,205 (the earliest family member, from application 13/657,010) or against the intermediate continuations in the '103's own chain. I am not going to invent docket numbers for those. Directory links to check: USPTO PTAB Center / PTAB E2E and the PTAB decisions library.

Strategic summary

Claims CANCELED vs. SUSTAINED vs. UNTESTED for the '103 patent. All 24 claims of the '103 are UNTESTED. No claim of U.S. 12,563,103 has been canceled, narrowed, disclaimed, or sustained by the PTAB, because no petition has ever been filed against it. The 24 claims break down as three independent claims (claim 1 system, claim 9 method, claim 17 CRM) plus dependents. Family members have fared badly — claims 1–20 of the '526 patent canceled (affirmed); claims 1–21 of the '552 and 1–20 of the '713 canceled (affirmed); most claims of the '722 canceled (affirmed); U.S. 11,012,474 largely canceled (affirmed, with 5 claims surviving on petitioner error) — but none of those rulings addressed the '103's claim 1 limitations: multi-source malicious-host-tracker ingestion, correlation of overlapping address portions (claims 5 and 6/13/14/21/22 cover duplicates and overlapping ranges), creation of a rule with matching criteria encompassing both portions, plus the encapsulate/strip/forward packet-transformation sequence. That combination is genuinely untested art-wise.

Estoppel landscape. Statutory IPR estoppel under § 315(e)(2) is patent-specific — it applies to a petitioner only as to grounds it raised or reasonably could have raised in a proceeding on that patent. Since no IPR has been filed on the '103, no § 315(e)(2) estoppel exists against anyone with respect to the '103; every prior-art ground remains available to any challenger who is not time-barred. Two caveats cut in opposite directions: (i) a defendant's own § 315(b) one-year clock starts on service of a complaint asserting the '103 — if you were served and it has been more than a year, IPR is off the table for you; (ii) the Federal Circuit has shown willingness to consider offensive collateral estoppel over shared claim terms and prior-art findings (PAN pressed exactly that in No. 23-1654, arguing "issue preclusion (collateral estoppel) bars Centripetal from relitigating the Board's previous factual findings about the teachings of Sourcefire"), but in that appeal the court expressly declined to reach the issue preclusion argument — so invalidity-by-preclusion remains an argument, not a rule. Assert it, but do not build your case on it.

Pattern signals. Keyed to this family: (1) Multiple repeat petitioners, no aggregator. Cisco (three IPRs), Keysight (at least two), and Palo Alto Networks (a dozen-plus petition filings) have all attacked Centripetal patents; I found no Unified Patents or other defensive-aggregator involvement. (2) Centripetal litigates PTAB losses aggressively and to the hilt — appeals in 2020-1635/-1636, 2020-2057, 2023-1636, 2024-2246, 2025-1053, plus two SCOTUS cert petitions (the second, filed on the Cisco recusal/claim-construction line, is at the petition stage as of 2026-09-23 — IPWatchdog). Expect a newly asserted '103 patent to be defended with appeals, IPR-side claim amendments, and parallel ITC/domestic-industry positioning — Centripetal expressly lists 12,563,103 on its product patent notice (centripetal.ai/legal-notice), which is the raw material for a § 337 domestic-industry showing. (3) The current discretionary environment is hostile to institution. Director-level § 314(a)/§ 324(a) review now drives institution, institution rates have dropped sharply, and practitioners report IPR filings plunging with ex parte reexamination surging in response (Law360, 2026-03-17). For a 2012-priority network-security patent being commercially asserted, that lowers your probability of getting a trial at all.

Recommended next steps

1. Do not represent to a court or a counterparty that the '103 has "survived IPRs." It has never been challenged. The accurate statement is: the patent is new (granted 2026-02-24) and no AIA petition was legally available before 2026-11-24.
2. Diarize 2026-11-24. That is the first day an IPR petition can be filed under § 311(c) and the last day of the PGR window if the patent is PGR-eligible. Flag: PGR eligibility requires the patent to be subject to first-inventor-to-file. The '103 claims priority to 2012-10-22 (pre-AIA), so if every claim is supported by the 2012 disclosure, PGR is likely unavailable and IPR is the only AIA route — but if any claim's effective filing date lands on or after 2013-03-16, PGR (with its broader § 112/§ 101 grounds) opens for nine months. Pull the 18/657,111 file history and the '205/'010 priority disclosure and make this determination before you commit to a theory. Note also that CBM review is unavailable — the AIA § 18 transitional program sunset for petitions filed after 2020-09-16.
3. Build your invalidity case on the '103's added limitations, not the family's known art. The FWDs I cited dealt with decryption/rule-filtering/packet-identification claims. Claim 1 of the '103 requires (a) ingestion from a plurality of malicious host tracker services, (b) a correlation determination across the portions, (c) a rule whose matching criteria encompasses both portions, and (d) a gateway that encapsulates matching packets with an IP header, strips it, and forwards them onward. The best art may be in the third-party threat-intel aggregation space and the IP-in-IP/tunnel-decapsulation space, not Sourcefire. If you are going to reuse Sourcefire-family art, expect a § 325(d) fight — the Board has already denied PAN's petitions in this family on that basis.
4. Run the § 315(b) clock immediately on any complaint asserting the '103. If you are inside the year, file or preserve; if you are outside, your invalidity case lives in district court and, increasingly, in an ex parte reexamination request or a Director-ordered reexamination under § 303(a) — the route commentators are actively pushing for claims that never got a merits review (PTAB Watch, 2026-07).
5. Monitor PTAB E2E weekly through Q1 2027. Given the family's litigation posture and the 2026-11-24 window opening, a first petition against the '103 is a live possibility; a first institution decision would run roughly five to six months later, with a statutory FWD deadline one year from institution.
6. If the assertion turns on the encapsulate/strip/forward limitations, scrutinize them closely for written-description and enablement support in the 2012 priority application — the "strip the header and forward toward their respective destinations" step appearing in the same gateway that performed the encapsulation is an unusual recitation, and the '103 is a continuation-in-part-lineage filing (2024-05-07) whose new matter, if any, could reset the effective filing date and unlock both post-AIA art and PGR. That is the single highest-value document review on this patent right now, and I have not verified it from the materials available to me.

Confidence and gaps, stated plainly: High confidence that no AIA trial proceeding on US 12,563,103 exists on file as of 2026-09-30, and high confidence in the nine-month § 311(c) bar explaining why. Family-level proceeding numbers, dates, panels, and dispositions above are drawn from the documents linked; where I relied on a secondary source I said so. I did not verify (a) whether any AIA trial ever targeted US 9,137,205 or the intermediate '213/'372/'266/'906 patents in the '103's own chain, (b) the precise claim-support picture for the '103's added limitations, or (c) the current litigation status of the '103 specifically. Do not treat the family history as if it were a record on this patent.

I'll start by pulling the assignment-record sources and cross-references for US 12563103.

Now let me try to pin down the specific reel/frame records and the correspondent of record.

Inventors

All four inventors are named on the face of US 12,563,103 and on its parent U.S. Pat. No. 9,565,213 (the "Rogers et al." family):

Determination of employer: the front page of the family's issued members (e.g., US 9,565,213, US 11,477,237, US 11,012,474) lists "Applicant: Centripetal Networks, Inc., Reston, VA / Portsmouth, NH," and the four inventors are the assignors on the recorded assignment to Centripetal Networks, Inc. (see timeline below). They are therefore employee-inventors of the operating company, not independent inventors.

Unusual patterns: none observed. I found no evidence of any inventor leaving Centripetal within 12 months of filing, and no inventor-to-NPE re-assignment by the individuals. Steven Rogers has remained the publicly identified principal/founder of Centripetal throughout the assertion campaign (Cisco, Palo Alto Networks, Fortinet, Keysight litigation). Note this is a negative finding — I could not verify current employment status from an authoritative filing for each inventor, so the absence of a departure pattern is an observation about the record, not a certification.

Original assignee

Centripetal Networks, Inc. (now Centripetal Networks, LLC), of Reston, VA / Portsmouth, NH / Herndon, VA.

• Primary line of business: network security / threat-prevention products — the company develops and sells packet-filtering and network-threat-detection technology (publicly marketed products include the CleanINTERNET and RuleGATE lines, and the patents-in-suit are described in the specification as packet security gateway / security policy management server technology).
• Did they ship a product embodying the claims? Yes, on the record available. Centripetal is an operating vendor, not a licensing vehicle: it is the named plaintiff in district-court actions against Cisco Systems (E.D. Va. 2:18-cv-00094), Palo Alto Networks (2:21-cv-00137), Keysight Technologies (2:22-cv-00002) and Fortinet, i.e., it asserts against actual competitors in the market it sells into. The patent family is also the subject of multiple IPRs/PGRs filed against Centripetal by those competitors (e.g., Cisco IPR2018-01443/01444; Palo Alto IPR2021-01157; Keysight IPR2022-01199, IPR2022-01535), which is the inverse of the NPE posture.
• Current status: Operating. On 2022-12-30 the Delaware corporation converted to a Delaware limited liability company, Centripetal Networks, LLC, which "remains the same entity by operation of law" under Del. Code Ann. tit. 6, § 18-214 (Centripetal's own Notice of Name Change for and Conversion of Plaintiff, E.D. Va. 2:18-cv-00094 Dkt. 673 and 2:22-cv-00002 Dkt. 55, and its RPI modification filed 2023-01-19 in IPR2022-01535). The company is privately held; I found no SEC registrant filings for it (the "12563103" hit in a third-party SEC feed in my search resolved to NextDecade Corporation and is a numeric coincidence, not Centripetal).

Assignment timeline

Important limitation, stated plainly: Google Patents' legal-events feed for US 12,563,103 shows exactly two recorded post-issuance/ownership events, both recorded 2024-05-15. However, neither the Google Patents feed nor the sources I could reach exposed the reel/frame numbers or the correspondent of record for those two entries. I am therefore reporting the events that are documented and flagging the reel/frame and correspondent fields as not verified rather than inventing them. Verify directly at the Assignment Center for this patent number.

1. 2012-10-23 (executed) / recorded 2012 (date not verified) — Reel not verified/Frame not verified

   • Conveyance: Assignment of assignor's interest (inventors → company)
   • Assignor: Steven Rogers; Sean Moore; David K. Ahn; Peter P. Geremia
   • Assignee: Centripetal Networks, Inc., Reston, VA / Portsmouth, NH
   • Correspondent: not verified. The assignment cover sheet in the parent file history (app. 13/657,010, "Methods and Systems for Protecting a Secured Network," docket 007742.00017) was signed "William E. Wooten" for assignee, Customer No. 22907, dated 10-23-2012 (Cisco Exhibit 1002, IPR2018-01443/01444 file history).
   • Context: original employee-inventor assignment on formation/filing of the patent family — not a sale.

2. 2022-12-30 (effective) / recorded 2024-05-15 — Reel not verified/Frame not verified

   • Conveyance: Change of Name (Delaware statutory conversion, corporation → LLC)
   • Assignor: Centripetal Networks, Inc.
   • Assignee: Centripetal Networks, LLC (same entity by operation of law)
   • Correspondent: not verified (no attorney/firm visible in the sources reached)
   • Context: internal corporate conversion / change of name only — no change in beneficial ownership.

3. 2024-05-15 — Reel not verified/Frame not verified

   • Conveyance: Assignment of assignor's interest
   • Assignor: Ahn, David K.; Moore, Sean; Rogers, Steven; Geremia, Peter P.
   • Assignee: Centripetal Networks, Inc.
   • Correspondent: not verified
   • Context: recordation of the underlying 2012 inventor assignment against the newly filed continuation (US 18/657,111, filed 2024-05-07), i.e., a chain-of-title docketing clean-up recorded alongside the name change. Not a transfer to a third party.

The statutory priority chain for this document runs: 13/657,010 (2012-10-22) → 14/253,992 (US 9,565,213) → 15/414,117 (US 10,142,372) → 16/448,969 (US 10,749,906) → 16/728,766 (US 10,785,266) → 16/909,327 / 16/158,868 → 17/027,436 (US 11,012,474) / 17/230,425 (US 11,477,237) → 18/657,111 → US 12,563,103. All of these are continuations/divisionals within the same company — there is no third-party link anywhere in the chain.

Timeline diagram

timeline
    title Ownership of US 12563103
    2012 : Inventors assign to Centripetal Networks Inc
    2014 : Parent patent 9565213 filed
    2017 : Parent 9565213 issued
    2022 : Delaware conversion to Centripetal Networks LLC
    2024 : Continuation 18 657 111 filed
         : Inventor assignment recorded
         : Change of name recorded
    2026 : US 12563103 issued

NPE / troll-pattern signals

1. Shell-entity transfer — not present. The only entity-name change in the chain is Centripetal Networks, Inc. → Centripetal Networks, LLC, effective 2022-12-30 by Delaware statutory conversion, which by Del. Code Ann. tit. 6, § 18-214 vests all property and causes of action in the converted entity — "the same entity by operation of law." That is a change of form, not a transfer to a licensing-only vehicle. The LLC is the operating vendor itself, not a "Holdings/IP/Licensing/Ventures" conduit, and there is no evidence of a single-purpose LLC or registered-agent-as-address arrangement. The "LLC" suffix alone is not a finding.

2. Known asserter in the chain — not present. Centripetal Networks/LLC does not appear on any of the enumerated NPE directories (Acacia, Marathon, Intellectual Ventures, IPNav, Wi-LAN, Mosaid/Conversant, Vringo, Pendrell, Innovatio, MPHJ, Lumen View, Round Rock, Document Generation Corp, Spangenberg entities), and I found no Unified Patents or RPX high-frequency-plaintiff listing naming Centripetal as an NPE. To the contrary, Unified Patents' portal indexes Centripetal's patents as targets (PVIX/RNIX/SVIX scoring on US 10,749,906) and the IPR/PGR record shows Centripetal on the patent-owner side against Cisco, Palo Alto Networks, Keysight and Fortinet. Centripetal is an aggressive but conventional operating-company assertor.

3. Repeat correspondent across the chain — unclear. This is the one signal I cannot close out. The Assignment Center correspondent fields for the 2024-05-15 records were not retrievable from the sources I reached, so I cannot state whether one attorney/firm of record handled both recording events. Partial data point: the original 2012 assignment transmittal was signed "William E. Wooten," Customer No. 22907, on behalf of Centripetal Networks, Inc. — but an assignee's authorized signatory on a Part 3 cover sheet is not the same as the recording correspondent, and a single appearance would not be a finding anyway (recurrence is the signal). Flagged for direct Assignment Center review.

4. Cascading transfers — not present. There is no chain of consecutive assignments through successive LLCs. The entire post-2012 record is two entries recorded on the same day (2024-05-15), one of which is a name-change conversion and the other a re-recordation of the original inventor assignment. No <24-month cascade exists.

5. Pre-litigation transfer — not present. The patent family has been continuously owned by Centripetal since the 2012 inventor assignment. No assignment was executed in the six months before any suit naming this family; the 2024-05-15 recordings post-date the bulk of the litigation (Cisco filed 2018; Palo Alto 2021; Keysight 2022) and are contemporaneous with the filing of this continuation, not with a new complaint.

6. Bankruptcy fire-sale — not present. No Chapter 7/11 record for Centripetal Networks, Inc./LLC surfaced, and no assignment to a liquidating trustee or purchaser appears in the record.

7. Privateering — not present / unclear. No operating-company-to-NPE transfer exists here: Centripetal owns and asserts its own patents. Defendants in the sector have characterized the campaign as aggressive, but I found no documentary evidence (SEC filing, EFF/Patent Progress coverage, funding arrangement) of a third party funding or directing assertions. Marked not present on the evidence available.

8. Defensive aggregator (anti-NPE) — not present. The chain does not terminate at RPX, AST, LOT Network, Unified Patents or OIN; it terminates at the operating assertor. The patent has not been neutralized.

Verdict

Operating-company assertion.

US 12,563,103 (filed 2024-05-07, issued 2026-02-24) sits at the end of an unbroken Centripetal Networks chain: the four employee-inventors' 2012 assignment to Centripetal Networks, Inc., followed only by the 2022-12-30 Delaware conversion to Centripetal Networks, LLC and the 2024-05-15 paired recordings of that name change and the underlying inventor assignment. There is no third-party transfer, no shell LLC, no cascading assignment and no coincidence with a first-filed suit, and the company is an operating network-security vendor that asserts this family against direct competitors (Cisco, Palo Alto Networks, Keysight, Fortinet) while those competitors file IPRs/PGRs against it. That profile is the inverse of an NPE pattern, so the call is operating-company assertion — with the caveat that the reel/frame numbers and the correspondent of record for the two 2024-05-15 entries were not verifiable from the sources reachable here and should be confirmed directly.

Verification: search patent number 12563103 at the USPTO Assignment Center (https://assignmentcenter.uspto.gov/), and cross-check the legal-events block at https://patents.google.com/patent/US12563103/en#legalEvents. If the Assignment Center confirms only the two 2024-05-15 entries described above, the verdict stands unchanged.

I'll research US 12563103 and its cited prior art. Let me run several searches.

Let me look directly for the citation list on US 12563103's own Google Patents page.

Verification status first (important)

I retrieved the full authoritative text of US 12,563,103 B2 from Google Patents, and it confirms the document is real and matches the details you supplied. However, the fetched text contains only the Abstract, Description, and Claims — it does not include the (56) "References Cited" front-page section. I was unable to isolate the Citations table on the US12563103B2 Google Patents page itself; the search results kept returning citation tables belonging to sibling family members (US 9,137,205; US 9,565,213; US 10,944,792; US 11,477,237) rather than to the '103 patent.

So: I cannot certify the exact (56) list printed on the face of US 12,563,103 B2. What follows is (a) the citation set that is verifiably shared across this patent family, and (b) art I could confirm was applied against family members in PTAB/litigation. I flag confidence explicitly rather than fabricating a citation list.

1. Confirmed bibliographic data for US 12,563,103 B2

Priority chain (from the '103 specification): 18/657,111 ← 17/230,425 (2021-04-14) ← 17/027,436 (2020-09-21) ← 16/909,327 (2020-06-23) and CIP of 16/728,766 (2019-12-27, US 10,785,266) ← 16/448,969 (2019-06-21, US 10,749,906) ← 16/158,868 (2018-10-12, US 11,477,237) ← 15/414,117 (2017-01-24, US 10,142,372) ← divisional of 14/253,992 (2014-04-16, US 9,565,213) ← priority to 13/657,010 (2012-10-22, US 9,137,205).

Critical drafting note: the claim 1 / 9 / 17 subject matter (correlating network addresses across a plurality of malicious host tracker services) maps to the FIG. 13 / "malicious host tracker service 508" disclosure, which entered this chain via the CIP filed 2019-12-27 (16/728,766). That is directly relevant to which references can even qualify as § 102 art (see §5).

2. References cited in this patent family (verified from sibling front pages)

These are the US/foreign patent documents I could positively verify appear in the "References Cited" sections of family members US 9,137,205, US 9,565,213, US 10,944,792 and/or US 11,477,237. They are the most probable content of the '103's own (56) list, but I could not confirm that directly.

Non-patent literature confirmed as cited:

• Reumann, John et al., "Adaptive Packet Filters," Dept. of Electrical Engineering and Computer Science, University of Michigan, Ann Arbor, MI, IEEE, 2001 (cited in US 9,565,213).
• Mizuno et al., "A New Remote Configurable Firewall System for Home-use Gateways," Jan. 2005, Second IEEE Consumer Communications and Networking Conference, pp. 599–601 (cited in US 9,137,205).

3. References the '103 specification itself incorporates by reference

These are named inside the '103 description and are therefore fair game as prior art for the filtering-throughput aspects:

• U.S. Patent Application Publication No. 2006/0195896 (Fulp et al.)
• U.S. Patent Application Publication No. 2006/0248580 (Fulp et al.)
• U.S. Patent Application Publication No. 2011/0055916 (Ahn) — note David K. Ahn is a named inventor on the '103 patent, which raises a § 102(b)(1)(A) / § 102(b)(2)(C)‑type exception question if his own earlier publication is used as art.

The specification also discusses IETF RFC 2827 / BCP 38 ingress filtering (anti-spoofing) and IETF RFC 2003 (IP-in-IP encapsulation) as known techniques — both directly relevant to the "encapsulate … with an Internet Protocol header"/"strip … the Internet Protocol header" limitations of claims 1, 9 and 17.

4. Art applied against family members in PTAB and litigation (highly probative)

Note: US 9,913,856 appears in one source as US9917856. I am reporting both as returned rather than reconciling them.

5. § 102 anticipation analysis against the granted claims

Independent claims 1 (server), 9 (method), 17 (media) share one element set:
(i) receive network addresses from a plurality of malicious host tracker services; (ii) determine correlation between a first portion from service #1 and a second portion from service #2; (iii) automatically create a rule whose matching criteria encompass both portions; (iv) send the rule to a packet security gateway at a network boundary; (v) the gateway encapsulates matching packets with an IP header specifying a network address, strips that IP header on a packet-by-packet basis, and forwards the packets toward their destinations without the IP header.

The single most important art question for this patent is therefore not the (56) list at all — it is whether claims 1/9/17 are entitled to the 2012-10-22 priority date. If they are not, an entirely different and much more dangerous body of intervening art (2012–2019) opens up.

6. What I could NOT establish (stated explicitly)

1. The literal (56) list on US 12,563,103 B2. I could not retrieve it. Do not treat §2 above as that list.
2. Titles/technical content for several cited numbers (e.g., US 6,317,837; US 6,484,261; US 6,662,235; US 7,478,429; US 7,539,186; US 8,806,638; US 8,856,926; US 8,935,785; EP 1313290 A1; EP 1677484 A2; AU 2005328336; AU 2006230171). I have not verified these and have marked them as hypotheses rather than describing them.
3. Whether US 12,563,103 B2 carries the terminal-disclaimer notice seen on its siblings (the "anticipated expiration 2032-10-22" entry is consistent with one, but I did not confirm the notice text).
4. The disposition of the CAFC appeal in Centripetal v. Cisco (the source table truncated at "Reverse Opinion &").

7. Recommended next steps to close the gap

• Pull the exact (56) list and any PTO-892/IDS filings from USPTO PatentCenter for application 18/657,111, and from Global Dossier / Espacenet "Citing documents" for US12563103 — Espacenet's citing-documents view is the fastest route to the true citation list (example entry returned for US 2025/047715 A1 / US 12563103 B2).
• Pull the file histories of IPR2018-01506, IPR2021-01157 and IPR2023-00445 to see which references the Board actually credited, since those are the art most likely to threaten this family.
• Independently run a § 102/§ 112 priority analysis to determine whether the "plurality of malicious host tracker services" and "encapsulate/strip/forward" limitations trace to 2012-10-22 or only to 2019-12-27 — the answer determines the entire prior-art universe for claims 1, 9 and 17.

I'll ground this analysis by researching the prior-art references associated with this patent and its family.

Obviousness Analysis — U.S. Patent No. 12563103 B2

"Methods and systems for protecting a secured network" — Centripetal Networks, LLC
Application No. 18/657,111 (filed 2024‑05‑07); publication US 2025/0047715 A1; granted 2026‑02‑24; earliest priority asserted 2012‑10‑22 (from US 13/657,010). Source: https://patents.google.com/patent/[US12563103](/patent/US12563103)/en

Sourcing note. I interpret all identifiers literally and have not corrected any. I rely on (i) the prior‑art references named in the patent text itself ("Use the results from the Prior Art section of this page") and (ii) related‑proceeding records surfaced by search, which I flag explicitly. Where I could not verify a reference number to a high confidence, I say so rather than fabricating one.

1. Which references count as the prior‑art base

Named in the patent (field-of-endeavor art, all in H04L63):

The patent's "Prior art keywords" (packet, network, network addresses, security policy, packets) and its CPC placement (H04L63/0209, /0218, /0227, /0236, /0263, /1408, /1425, /20, /168) confirm the field of endeavor is boundary packet filtering driven by network addresses.

Related‑proceeding art (search‑derived — flagged, not from the page):

• Liebmann, US 2014/0245424 A1 (Trend Micro), Distributed system and method for tracking and blocking malicious Internet hosts — a centralized "Global Threat Intelligence cloud" aggregating IP‑address data from many distributed network appliances and pushing coordinated block configuration back to them.
• Thomas et al. (ThreatMETRIX), US 2007/0124801 A1 and US 9,444,835 B2 — receiving information about nodes/IP addresses from a plurality of submitters, assigning node/submitter reputation, and correlating attributes to decide whether a host is malicious. (These are self‑described "malicious host tracker" systems.)
• Cisco, US 2016/0359888 A1 — analyzing a malware tracker's infected‑host IP list and applying a conditional policy.
• Sourcefire materials (D19/D19a in the EPO opposition to EP 3 550 795) — the Defense Center distributing an automatically updated rule content ("SEU") produced by the VRT from public vulnerability/threat feeds to sensors. Per the opposition record, "the SEU is stated explicitly to contain 'updated intrusion rules'."
• Jungck / Shah / Law / Golnabi / Freimuth (US 2003/0005122) / Chesla (US 2004/0250124) / Van Der Merwe (US 2010/0082811) — grounds used by Palo Alto Networks against family members in IPR2021‑01157, ‑01520, ‑01521, ‑01522. I have not independently verified the bibliographic numbers for "Jungck," "Shah," "Law," "Golnabi," or "Ke," and do not assign them numbers here.

2. Effective filing date — threshold issue for §103

The 2012‑10‑22 priority chain runs through continuations only until the claimed chain reaches US 17/027,436, which the cross‑reference describes as a continuation‑in‑part of US 16/728,766 (filed 2019‑12‑27). A CIP in the chain means the new matter is entitled only to the later date. Critically, the EPO opposition record argued that the "routing [of] the packet to a monitoring device" / encapsulation feature was added matter relative to the parent — i.e., that it is not supported by the 2012/2014 disclosure.

Consequence: if the §103 analysis is run on the encapsulation/correlation‑and‑merge limitations, the effective date is likely 2019‑12‑27 or later. On that date, Liebmann (2014), ThreatMETRIX (2007/2016), Cisco (2016) and Sourcefire are all AIA §102(a)(1) printed publications. Only family publications are sheltered, and only via AIA §102(b)(2)(C) common ownership — so the parent US 9,137,205 and the sibling '474/'906 patents cannot be used as art, but the third‑party references above can.

3. Claim 1 broken into elements

Claims 9 and 17 are the method and CRM counterparts. Claims 5/13/21 (duplicate address), 6/14/22 (overlapping ranges), 8/16 (single range encompassing both portions), and 7/15/23 (set of network addresses + SIP URI) are the meaningful dependents.

4. Proposed §103 grounds

Ground 1 (primary): Liebmann + Fulp '580 + RFC 2003

• 1b — Liebmann. The GTI cloud receives IP/reputation data on suspect hosts from a plurality of distributed appliances and subscribers; that is the claimed "plurality of malicious host tracker services."
• 1c — Liebmann + Fulp '580. Liebmann's cloud necessarily compares inbound reports (to decide a global block) and — per the opposition‑record characterizations of the same design pattern — combines overlapping entries. Fulp '580 expressly teaches combining/reordering rules and reducing rule‑set size while preserving the aggregate policy, which is the claimed "encompassing" criteria.
• 1d — Fulp '580 + Ahn '916. Ahn '916 teaches that rule construction happens on a management platform separate from the firewall; Fulp '580 teaches automatic policy optimization. Automating the merge of two overlapping address sets into one rule is routine data processing.
• 1e — Liebmann. Coordinated blocking configuration is pushed to network appliances sitting at network boundaries.
• 1f — RFC 2003. IP‑in‑IP encapsulation is the textbook mechanism; RFC 2003 also specifies the de‑encapsulating egress that strips the outer header and forwards the inner packet to its original destination. The patent itself concedes RFC 2003 supplies this step.

Ground 2: Thomas/ThreatMETRIX + Fulp '5896 + Ahn '916 + RFC 2003

Thomas is the cleanest §103 mapping of 1b–1c: it claims receiving information about nodes from "a plurality of submitters numbered 1 through N," assigning reputation, and correlating evidence (IP address, IP range, ISP, country) to determine that a host is malicious. Combine with Fulp '5896's packet‑filter‑to‑transformation‑function architecture and Ahn '916's central rule distribution.

Ground 3: Sourcefire (D19/D19a) + Ahn '916 + RFC 2003

The Defense Center/VRT arrangement maps 1b–1e almost element‑for‑element: third‑party feeds → automatically updated intrusion rules → distribution to boundary sensors. Add RFC 2003 for 1f.

Ground 4 (alternative): Cisco US 2016/0359888 + Fulp/Ahn + RFC 2003

Cisco teaches consuming a malware tracker of infected host IPs and applying a conditional policy — a §103‑sufficient teaching of "network addresses identifying malicious hosts."

5. Motivation to combine (KSR factors)

1. Same field, same problem, same architecture. All references address filtering traffic at a protected‑network boundary using rule sets; equivalence of function is strong motivation. KSR, 550 U.S. 398, 417 (2007).
2. Explicit performance motivation, conceded in the patent. The specification states that firewall performance "may be dependent on the size of and/or correlations within dynamic security policies" and that duplicate addresses are removed and overlapping ranges are combined. Fulp '580 supplies exactly this optimization objective — the reason to merge two correlated feed portions into one encompassing rule.
3. Automation pressure / long‑felt need. The Background admits prior approaches were "reactive rather than proactive" and that scaling high‑resolution filtering was thought infeasible. Centripetal's own litigation record (ESG/Gartner materials cited in Centripetal v. Cisco, Sup. Ct. No. 21‑193) documents a recognized need for "customized threat intelligence … converting indicators to rules that drive actions across a risk spectrum." A recognized need with a finite number of identified solutions supports obviousness.
4. Known technique for the disputed step. Encapsulating and de‑encapsulating IP packets is a named, pre‑existing IETF technique (RFC 2003), used for redirect/monitoring precisely as the spec describes. Relocating the "strip the header" step from a downstream monitoring device to the gateway is a predictable redistribution of a known function among known elements, and the patent itself acknowledges that the monitoring device performs the strip+forward.
5. No teaching away. None of the references disparages automated feed ingestion, rule merging, or encapsulation.

6. Dependent claims

7. Where the obviousness case is vulnerable (and a §112 flag)

• The correlation‑and‑merge limitation is the crux. In the IPR/opposition record, the Patent Owner successfully argued that "Law alone or in view of Golnabi" fails the correlation limitation, and that Petitioners were reaching into the patent's own disclosure to supply it (impermissible hindsight). A challenger must therefore lead with Liebmann and/or Thomas/ThreatMETRIX, whose express plurality‑of‑sources‑and‑correlation teachings break the "single‑feed" pattern the Patent Owner exploited. This is why Ground 1 above is built on Liebmann rather than on a generic feed reference.
• Claim language deviates from the specification. Claim 1 recites that the packet security gateway "strip[s] … the Internet Protocol header," whereas the specification has the monitoring device do the stripping. This is a written‑description/enablement exposure under §112(a) and, at minimum, means the claim covers an embodiment the patent does not describe — useful leverage, but not a §103 argument.
• Claim 7's SIP URI (above) resists a clean motivation‑to‑combine showing.
• Secondary considerations. Centripetal has tried long‑felt‑need and industry‑praise evidence before; in Centripetal v. Cisco the Federal Circuit affirmed the Board's finding of no nexus between the ESG/Gartner evidence and the claim limitations. That precedent should be applied here: the claimed advance is the automated merge‑and‑apply of threat intelligence, and praise for "converting indicators to rules that drive actions" is directed at the result, not the specific claim elements.

8. Bottom line

• Claim 1, 9, 17 are, in my assessment, reasonably likely obvious under AIA §103 over Liebmann (US 2014/0245424) in view of Fulp '580 (US 2006/0248580) and Ahn '916 (US 2011/0055916), further in view of RFC 2003, with Thomas/ThreatMETRIX (US 2007/0124801; US 9,444,835) as the leading substitute for the correlation element and Sourcefire (D19/D19a) + Ahn '916 + RFC 2003 as a strong parallel ground.
• Claims 5, 6, 8, 13, 14, 16, 21, 22 are highly likely obvious as routine deduplication/range‑merging.
• Claims 7, 15, 23 (SIP URI) present the strongest non‑obviousness argument and should be treated as the fallback position.
• The effective filing date question (CIP in the chain) must be resolved first; it materially expands or contracts the available art.

Confidence: moderate‑to‑high on the element mapping for Liebmann/Thomas/Fulp/Ahn/RFC 2003; low on the exact bibliographic identities of "Jungck," "Shah," "Law," "Golnabi," and "Ke," which I did not verify and deliberately did not number. The Sourcefire D19/D19a characterization rests on the EPO opposition record as summarized in search results, not on the primary documents.