US 8892600

US Patent 8,892,600 — Analyst Summary

Important sourcing note up front: I do not have direct, live access to USPTO PatentCenter/PAIR or the CAFC docket system in this session; my searches surface aggregated litigation/PTAB records (Unified Patents, Patexia, Ex Parte case summaries) rather than raw USPTO or Federal Circuit filings. The full patent document itself (Google Patents, fetched 2026-09-12) is the authoritative text I rely on for claims and specification. Where sources conflict, I flag it below. I found no evidence of any Federal Circuit 2026 docket activity involving patent 8,892,600 — treat that as "nothing located," not as proof of absence.

Bibliographic data (from the patent document)

Assignee chain of record (reassignment entries): OPTICAUTE, INC. → ROBUST NETWORKS, LLC (2012-11-30) → MINERAL LASSEN LLC (2015-11-18) → INTELLECTUAL VENTURES ASSETS 57 LLC (2017-09-26) → IQ HOLDINGS, LLC (2018-01-19) → FIRENET TECHNOLOGIES, LLC (2018-04-13). A later KEMP Technologies/Brightwood Loan Services security-interest entry appears in the reassignment log.

Title discrepancy to note: One third-party PTAB-summary source labels the patent "Security for a Network Attached Device." The patent document's own title is "Network attached device with dedicated firewall security," which I treat as controlling.

Priority family (continuation chain)

This is a continuation of U.S. App. 12/773,716 (filed 2010-05-04, now US 8,306,994), itself a continuation of U.S. App. 09/951,877 (filed 2001-09-11, now US 7,739,302), itself a continuation of U.S. App. 09/144,954 (filed 1998-09-01, now US 6,317,837, "Internal network node with dedicated firewall"). All share the 1998-09-01 priority date.

Abstract (verbatim)

Dedicated firewall security for a network attached device (NAD) is provided by a firewall management system integrated directly into the NAD or into a NAD server. A local area network arrangement includes a network client and the NAD and the firewall management system includes computer readable medium having computer-executable instructions that perform the steps of receiving a request for network access to the NAD from the network client, determining whether the request for network access to the NAD is authorized, and only if the request for network access is authorized, providing the network client with network access to the NAD.

Technical gist

The patent claims a two-tier architecture: a bastion firewall guards the LAN against external traffic, and a second, NAD‑dedicated firewall (the "NADFW‑MS," having a firewall component 111A and a data management component 111B) filters NAD‑access requests based on packet-header information. The first computing device (e.g., a proxy/intermediate node) examines and filters incoming packets, then reformulates them into new packets for a second computing device that is isolated from the internal network and hosts the attached device. Filtering tests include header completeness, arrival via an authorized network interface, valid source/destination IP addresses, and authorized port information; rejected packets may be logged (FIG. 6; spec. at the filtering discussion). Alternative embodiments place the NADFW‑MS inside each NAD (FIG. 8) or use a proxy NAD server (FIG. 7).

Plain-language overview of each independent claim

The patent has three independent claims (1, 8, 16); claims 2–7, 9–15, and 17–23 are dependent.

Claim 1 (system). A first computing device coupled to an internal network, and a second computing device in communication with it that has at least one attached device and is isolated from the internal network. The first device, per stored instructions: (a) receives data packets over the internal network, at least some of which originated from an external network; (b) examines the packets to see whether they contain an IP address associated with the attached device; (c) filters packets that contain a valid IP address in the header to decide whether to authorize access to the attached device; (d) reformulates the packets for communication to the second device; and (e) transmits the reformulated packets to the second device when access is authorized.

Claim 8 (computer-implemented method). Mirrors claim 1 as method steps performed by the first computing device: receive packets over the internal network (some from an external network); examine them for an IP address associated with an attached device coupled to a second, network-isolated computing device; filter by determining whether the header IP address is valid to decide whether to authorize access; and reformulate the packets for communication to the second computing device upon authorization.

Claim 16 (non-transitory computer-readable storage medium). Same functional core as claim 1, but framed as stored instructions that cause the first device to receive packets, examine them for an IP address associated with an attached device coupled to the isolated second device, filter packets with a valid header IP address to decide authorization, and generate new data packets based at least in part on information in the received packets for communication to the second device — with the attached device coupled to the second device by way of a communications interface.

Representative dependent-claim scope: reformulation as generating new packets (c.2); an external-facing firewall filtering externally originated traffic (c.3, 10, 18); OS-level processing and communications-interface delivery at the second device (c.4, 9, 11, 16, 17, 19); authorized-port filtering (c.5, 12, 20); authorized source network-card filtering (c.6, 13, 21); application-layer filtering (c.7, 14, 22); and logging of rejected packets (c.15, 23).

Post-grant challenges and litigation (from aggregated records — verify against primary sources)

• IPR2020-00471, Unified Patents, LLC v. Firenet Technologies, LLC, filed 2020-03-13, instituted 2020-09-01, Final Written Decision 2021-03-18 before APJs Galligan (writing), McGraw, and Cygan. Aggregated records indicate a "Unpatentable" outcome, based on obviousness grounds: Coley (US 5,826,014) alone or with Coss (US 6,098,172), plus Shand (US 6,147,976) for the rejected-packet-logging claims (15, 23), with a further Coss + Gelb (US 5,550,984) ground. Discrepancy: one source lists claims challenged as 1–17, 19–23; another lists 1–17. I cannot reconcile that from available records.
• District court litigation referenced for this family includes N.D. Cal. 3:18-cv-06502 and 3:19-cv-00798, E.D. Tex. 2:18-cv-00270 (Firenet Tech LLC v. Fujitsu Ltd), S.D.N.Y. 1:18-cv-05564, and N.D. Ga. 1:19-cv-03199. The Fujitsu complaint asserted both the '837 and '302 family members; note the '302 asserted claim text differs from the '600 claims, so those pleadings are not directly on point for claim 1/8/16 here.

Confidence and caveats

• High confidence: title, inventor, application/filing/issue/priority dates, abstract, claim text, and the independent-claim summaries — all read directly from the patent document.
• Moderate confidence: PTAB outcome and party names, sourced from third-party aggregators rather than the PTAB FWD itself; the claims-invalidated list was blank in the aggregated summary.
• Not established: any CAFC 2026 appeal or docket concerning 8,892,600. My searches returned nothing on that point. If an appeal from the March 2021 FWD was filed, it would likely have been decided long before 2026; I cannot confirm or deny this from available sources, so I will not assert it.
• Per your instruction, all identifiers above are reproduced literally as they appear in the source material; I have not normalized or corrected any patent or case numbers.

I'll research litigation involving US patent 8892600 using multiple sources.

Known Litigation Involving US Patent 8,892,600

Based on searches of patent-litigation aggregators (RPX, Unified Patents Litigation Portal, Docket Alarm/UniCourt, Patexia, Justia Dockets) and the litigation data embedded in the Google Patents record itself, the following matters are associated with US 8,892,600 ("Network attached device with dedicated firewall security").

Context first — this patent was asserted in a broader four-patent campaign

US 8,892,600 is one of a family of four patents asserted together by FireNet Technologies, LLC against network-security vendors. As the RPX report ("Network Security Campaign… Expands from New York, Texas, and California into Georgia," July 17, 2019) explains, the campaign began in summer 2018 and asserted the same four patents in each suit:

• US 6,317,837 — "Internal network node with dedicated firewall"
• US 7,739,302 — "Network attached device with dedicated firewall security"
• US 8,306,994 — "Network attached device with dedicated firewall security"
• US 8,892,600 — "Network attached device with dedicated firewall security" (the patent at issue here)

So in every district-court case below, US 8,892,600 was one of multiple asserted patents.

District Court Cases

The Google Patents "Family has litigation" entries correspond to these dockets: E.D. Tex. 2:18-cv-00270; S.D.N.Y. 1:18-cv-05564; N.D. Cal. 3:18-cv-06502; N.D. Cal. 3:19-cv-00798 (the record's text reads "3:19-cv-00798"; the docket I located is numbered 4:19-cv-00798); and N.D. Ga. 1:19-cv-03199.

PTAB Proceeding

IPR2020-00471 — Unified Patents, LLC v. FireNet Technologies, LLC

• Filed: March 13, 2020
• Challenged claims: 1–17 and 19–23 of US 8,892,600
• Grounds: Obviousness — Ground 1 (claims 1–14, 16, 17, 19–22) over Coley (US 5,826,014) in view of Coss (US 6,098,172); Ground 2 (claims 15, 23) over Coley + Coss + Shand (US 6,147,976) for the "logging rejected packets" limitation; Ground 3 (claims 1–14, 16, 17, 19–22) over Coss in view of Gelb (US 5,550,984)
• Status: The Unified Patents record shows a Final Written Decision issued. The PTAB analysis notes the challenged claim of the '600 patent was cancelled, and the analyst commentary observes that, after cancellation, the '600 count in the parallel Fujitsu case would need to be addressed.

Important note on the patent's status

According to the Google Patents legal-status data, US 8,892,600 has an anticipated expiration of 2018-09-01 (20 years from the Sep. 1, 1998 priority date) and is listed as "Expired – Fee Related." Assignments of record show the patent moved from Robust Networks, LLC → Mineral Lassen LLC (2015) → Intellectual Ventures Assets 57 LLC (2017) → IQ Holdings, LLC (2018) → FireNet Technologies, LLC (Apr. 13, 2018) — which is the entity that filed the suits above.

---

Caveats and uncertainties

• I could not confirm final dispositions for the Fujitsu (2:18-cv-00270), KEMP (1:18-cv-05564), or Fortinet (4:19-cv-00798) cases; my searches returned dockets only through their early stages. These may have settled, dismissed, or been resolved in ways not surfaced.
• The A10 Networks case is documented as "Dismissed – Settled", and the Citrix case as voluntarily dismissed with prejudice — those outcomes are grounded in the dockets cited.
• Because the '600 patent's asserted claim was cancelled in IPR2020-00471, and because the patent expired on Sept. 1, 2018, any remaining case value after 2020 would have been limited.

Sources: Google Patents record for US8892600B2 (https://patents.google.com/patent/US8892600/en); Unified Patents Litigation Portal (https://portal.unifiedpatents.com/litigation/California%20Northern%20District%20Court/case/3:18-cv-06502); RPX Empower news and case pages (https://litigation.rpxcorp.com/news/57677; https://insight.rpxcorp.com/litigation/candce-[333812](/patent/333812)-firenet-technologies-v-a10-networks; https://insight.rpxcorp.com/litigation/gandce-[266311](/patent/266311)-firenet-technologies-v-citrix-systems); Docket Alarm/Justia dockets (https://dockets.justia.com/docket/new-york/nysdce/1:2018cv05564/[496016](/patent/496016); https://dockets.justia.com/docket/texas/txedce/2:2018cv00270/[183295](/patent/183295); https://dockets.justia.com/docket/california/candce/4:2019cv00798/[338325](/patent/338325)); UniCourt (https://unicourt.com/case/pc-db1-firenet-technologies-llc-v-kemp-technologies-inc-[789691](/patent/789691); https://unicourt.com/case/pc-db5-firenet-technologies-llc-v-citrix-systems-inc-[166388](/patent/166388)); Patexia (https://services.patexia.com/lawsuits/FireNet-Technologies-LLC-v-A10-Networks-Inc-id-[182548](/patent/182548)); and PTAB analysis of IPR2020-00471 (https://ai-lab.exparte.com/case/ptab/IPR2020-00471/doc/summary/1).

I'll start by verifying the PTAB proceedings against the canonical structured block and public sources.

Found a proceeding not in the structured block. Let me dig into the FWD, claim-level outcome, and any appeal.

Let me pull the FWD itself and check for a Federal Circuit appeal.

PTAB / AIA Trial Analysis — US Patent 8,892,600

⚠️ Sourcing contradiction — flagging up front. The structured "PTAB proceedings on file" block in this prompt states that the USPTO Open Data Portal API returns no AIA trial proceedings for this patent and instructs that the default should be "no PTAB activity on file." That block is wrong for this patent. Web research independently confirms a full IPR that went to a Final Written Decision and produced a certificate canceling nearly every claim of US 8,892,600. The ODP ingest is stale or the proceeding was not indexed; the structured list should be treated as unreliable here and corrected. I did not use the empty ODP block as the canonical list, because doing so would have told a defendant the patent was untested when in fact almost all of its claims are dead.

---

Proceedings overview

There is 1 AIA trial proceeding on US 8,892,600 — IPR2020-00471 — with a status breakdown of 0 active, 1 claims-invalidated (all challenged claims held unpatentable), 0 claims sustained on the merits, 0 settled, 0 institution denied; the bottom-line defensive posture is decisive for a defendant: independent claims 1, 8, and 16 were canceled, along with claims 2–17 and 19–23, so any demand letter asserting the '600 patent's primary claims is asserting claims that no longer exist.

---

IPR2020-00471 — Unified Patents, LLC v. Firenet Technologies, LLC

• Type: Inter Partes Review (35 U.S.C. §§ 311–319)
• Filed: 2020-03-13
• Status: Final Written Decision — outcome recorded as "Unpatentable" (aggregated PTAB records). Plain-English gloss: the Board found the challenged claims unpatentable and issued a certificate canceling them. The patent's overall legal status is Expired – Fee Related (anticipated expiration 2018-09-01).
• Judge panel: Daniel J. Galligan (writing the Final Written Decision), Kimberly McGraw, Michael T. Cygan.
• Petition grounds (three grounds, all § 103 obviousness; no § 102 or § 112 grounds indicated):
  • Ground 1 — Claims 1–14, 16, 17, and 19–22 obvious over Coley (US 5,826,014) in view of Coss (US 6,098,172). Coley's firewall 318 mapped to the claimed "first computing device" on the internal network; network elements behind the firewall (e.g., web server 322) mapped to the isolated "second computing device" with an "attached device"; Coley's proxy agent alleged to "reformulat[e]" packets by initiating new connections. Coss supplied the IP-source/destination filtering detail.
  • Ground 2 — Claims 15 and 23 obvious over Coley + Coss + Shand (US 6,147,976). Shand was added solely to meet the "logging … information regarding data packets that are rejected" limitation.
  • Ground 3 — Claims 1–14, 16, 17, and 19–22 obvious over Coss in view of Gelb (US 5,550,984). Coss's firewalls 212/213 protecting sub-sites 221–223 mapped to the claimed architecture, with Gelb supplying remaining limitations.
• Institution decision: Instituted 2020-09-01, on all challenged claims. Unified Patents' own announcement states the Board "instituted trial on all challenged claims," and identifies the '600 patent as "generally directed to a proxy firewall system for protecting devices within a network."
• Final Written Decision: Issued 2021-03-18. Verdict at claim level, as best the public record establishes:
  • Independent claims 1, 8, and 16 — unpatentable/canceled. All three independent claims were within the challenged set and within the grounds above.
  • Dependent claims 2–7, 9–15, and 17, 19–23 — canceled. The IPR certificate (reported as issued 2021-10-12) is described as "cancelling claims 1-17 and 19-23." That sweeps in every dependent claim of independent claims 1, 8, and 16.
  • Claim 18 — not challenged, and therefore not addressed by the FWD. Claim 18 does not appear in any of the three petition grounds. Important caveat for any defendant: claim 18 depends from claim 16, and claim 16 was canceled. A dependent claim that incorporates every limitation of a canceled parent claim cannot be infringed on its own, so claim 18 is not a usable fallback in practice — but the FWD itself did not hold claim 18 unpatentable, and I am not aware of any FWD finding on it. Do not describe claim 18 as "canceled."
  • I was unable to retrieve the FWD PDF itself or the § 318(b) certificate in this session (search-step limit reached), so I cannot quote the panel's reasoning verbatim or reproduce the exact per-claim disposition table. The claim-level statements above are drawn from PTAB-aggregator summaries and a district-court complaint analysis that quotes the certificate.
• Settlement / termination: None. This went to a Final Written Decision; there is no indication of settlement or adverse-judgment termination.
• Appeal: No Federal Circuit appeal located. My searches returned no CAFC docket, opinion, or Rule 36 disposition referencing IPR2020-00471 or US 8,892,600. Treat this as "nothing found," not as affirmative proof that no appeal was taken. If an appeal had been filed from the 2021-03-18 FWD, it would in the ordinary course have been resolved long before 2026 (see also the note in the prior summary section that no CAFC 2026 activity was located).
• Defensive value: Claim 1 is dead, claim 8 is dead, claim 16 is dead — all three independent claims were canceled, so any infringement theory built on them is baseless and risks Rule 11 / § 285 exposure. The only formally surviving claim is unchallenged claim 18, which is legally unusable because it depends from canceled claim 16. For practical purposes, the '600 patent is asserted-proof: there is no live claim left to infringe.

---

Strategic summary

Claim status. Every independent claim of US 8,892,600 — 1 (system), 8 (method), and 16 (non-transitory CRM) — was challenged and canceled, together with essentially the entire dependent-claim set: claims 2–7, 9–15, and 17, 19–23. The only claim the petition did not reach is claim 18, which depends from canceled claim 16 and is therefore not independently assertable. So the honest framing is: claims 1–17 and 19–23 are canceled; claim 18 was never tested but is functionally dead as a dependent of claim 16. Nothing on this patent is "hardened," and nothing on it is a viable basis for an assertion, a demand, or a license-renewal pitch.

Estoppel landscape. Under 35 U.S.C. § 315(e)(2), Unified Patents, LLC — and any real party in interest or privy it named or should have named — is estopped in civil actions from asserting invalidity on any ground it raised or reasonably could have raised in IPR2020-00471. That estoppel does not run to unrelated defendants who were not privies; but those defendants do not need an estoppel defense, because the claims they are being accused of infringing have been canceled by the Director under § 318(b). Canceled claims are surrendered; infringement cannot be predicated on them. Practically, the prior-art grounds (Coley, Coss, Gelb, Shand) matter far less to a defendant than the fact that the claims themselves are gone. If Firenet or a successor nonetheless asserts the '600 patent, the defense is not "invalidity" — it is "no claim in suit exists," supported by the FWD and the IPR certificate. For a defendant also facing sibling patents in this family (US 6,317,837; US 7,739,302; US 8,306,994 — all sharing the 1998-09-01 priority date), the Coley/Coss/Gelb/Shand combinations and the Board's reasoning are persuasive, though not binding, and are worth deploying in district court; note the asserted claims in the siblings differ textually from the '600 claims, so the FWD is not a straight-line estoppel or collateral-estoppel instrument against them.

Pattern signals. Unified Patents — the defensive aggregator — is the petitioner and challenged this patent on its own initiative, with in-house counsel (David Seastrunk and Roshan Mansinghani), not on behalf of an identified defendant. Unified's public statements characterize Firenet Technologies as an "IP Investments affiliate and well-known NPE" that had asserted the '600 patent in five district court cases against Kemp Technologies, Fortinet, Citrix, A10 Networks, and Fujitsu (now terminated). This is a single IPR, not a multi-petition campaign, and there is no indication that the patent owner pursued an appeal aggressively. The remaining litigation-of-record references (N.D. Cal. 3:18-cv-06502 and 3:19-cv-00798; E.D. Tex. 2:18-cv-00270; S.D.N.Y. 1:18-cv-05564; N.D. Ga. 1:19-cv-03199) all predate the FWD and are, as to the '600 patent, moot on the canceled claims. Note also that the '600 patent's own term expired 2018-09-01, before the IPR was even filed — so any remaining exposure on this patent would have been historical (pre-expiration) damages only, independently of the cancellations.

---

Recommended next steps

1. If you received a demand or complaint citing US 8,892,600: the correct response is that the claims are canceled, not merely invalid. Cite the Final Written Decision of 2021-03-18 in IPR2020-00471 and the ensuing § 318(b) certificate (reported 2021-10-12) canceling claims 1–17 and 19–23. Quote the disposition as "Unpatentable" and the certificate's claim list exactly. If the demand specifically cites claim 8 (as the Fujitsu complaint did) or claims 1 or 16, note that the asserted claim has been canceled outright. Do not overstate claim 18: the FWD did not address it.
2. Verify the primary documents before filing. I could not retrieve the FWD PDF or the certificate in this session. Before you put anything on paper, pull the FWD and the IPR certificate from PTAB E2E / PTAB Center (https://ptacts.uspto.gov/ptabweb/) and the Board's decision page at https://www.uspto.gov/patents/ptab, and confirm (a) the exact per-claim disposition, (b) whether the certificate issued 2021-10-12 and covers claims 1–17 and 19–23, and (c) the status of claim 18. The PTAB public API is at https://developer.uspto.gov/ptab-api/.
3. Confirm no appeal exists. Run the petitioner/patent-owner names and IPR2020-00471 through CourtListener (https://www.courtlistener.com) and the Federal Circuit docket to close out the appeal question before you represent that the FWD is final and non-appealable. My searches found no appeal, but that is a negative finding, not verification.
4. No active proceedings exist, and none is needed. There are no trial-stage milestones to track and no live § 1-year clock: the IPR concluded with an FWD in 2021 and the patent is expired. If any entity re-asserts the '600 patent today, treat it as a screening failure or bad-faith assertion rather than a patent merits dispute.
5. Sibling-family risk is where the remaining fight is. The '600 patent is the weakest member of this family for a plaintiff; the asserted claims in the '837, '302, and '994 patents are textually different and were not canceled. Direct any real defensive effort there — using the IPR2020-00471 FWD as persuasive prior-art and reasoning support.

---

Confidence notes. High confidence: proceeding number, parties, filing/institution/FWD dates, panel composition and writing judge, the three grounds and their reference sets and claim groupings, "Unpatentable" outcome, and the certificate's reported cancellation of claims 1–17 and 19–23 — all corroborated across multiple independent aggregator records plus Unified Patents' own announcements. Moderate confidence: the precise claim set challenged (sources disagree — one lists 1–17, 19–23, another lists 1–17; the certificate's reported scope favors the broader set), and the exact certificate issue date of 2021-10-12, which comes from a single district-court complaint analysis. Not established: verbatim FWD reasoning, any § 102/§ 112 grounds (appear to be none), and any Federal Circuit appeal. I have not fabricated any proceeding number, and I have flagged the ODP block's "no PTAB activity" default as contradicted by the record.

I'll research the assignment record for US 8,892,600 across the sources I can reach.

Assignment & Ownership Reconstruction — US 8,892,600

Sourcing note (read before the timeline)

I was unable to retrieve reel/frame numbers or correspondent-of-record data for this patent. USPTO Assignment Center (https://assignmentcenter.uspto.gov/; mirror at https://assignment.uspto.gov/patent/index.html) was not reachable from this session — targeted searches for the reel/frame and correspondent fields returned no results. I therefore have not fabricated reel numbers, correspondent attorneys, or recording-firm names. The timeline below is reconstructed from the reassignment log exposed in the Google Patents legal-events feed for US8892600B2 (fetched 2026-09-12), which reproduces USPTO assignment dates, conveyance types, assignor and assignee names, but not reel/frame or correspondent.

This is a partial finding, not a "no records" finding: records do exist, and the event dates and party names below are the substantive content. The correspondent field — the single most probative field for your question — must be pulled from Assignment Center directly. I flag every place it is missing rather than guessing.

Two cross-reference corrections to the previously generated sections are noted inline below.

---

Inventors

Pattern notes. With a single inventor there is no "co-inventor departure" pattern to measure, so the usual fire-sale tell (all inventors leaving within 12 months of filing) is not applicable rather than absent. The relevant structural anomaly is the entity churn beneath a single, unchanged inventor: the ownership vehicle changed hands at least five times (Applianceware → Opticaute → Robust Networks → Mineral Lassen → IV Assets 57 → IQ Holdings → Firenet) while the inventive entity never changed. That is the signature of a serial asset-transfer chain, not of an operating team.

Literal-identifier note: PTAB exhibit captions in IPR2020-00471 style the ancestor patents as "'994 (Kentworthy '994)" and "'302 (Kentworthy '302)" — i.e., "Kentworthy," not Kenworthy. This is an exhibit-caption typo, not a second inventor. Reproduced literally per instruction; not normalized.

---

Original assignee

• Entity named on the issued patent: ROBUST NETWORKS LLC (Google Patents "Original Assignee" field).
• Primary line of business: The patent's own specification describes a network attached device (NAD) server — a dedicated appliance/server fronting CD-ROM towers, printers, video codecs and similar peripherals over a LAN, with heterogeneous-protocol support (AppleTalk, NetWare, TCP/IP) and an SCSI back end. The original assignee therefore sat in the network-attached storage / appliance-server space, and there is no indication in the record that Robust Networks LLC was anything other than an operating company at the time. Caveat: I could not locate product literature, SEC filings, or corporate-registry records confirming that Robust Networks LLC shipped a commercial product embodying the claims; treat "it was operating" as moderate confidence, supported by the technical character of the disclosure and the absence of any licensing activity by that entity.
• Prior links in the corporate chain: the ancestral '837 patent issued to Applianceware, Llc; an assignment recorded 2012-11-30 shows OPTICAUTE, INC. as assignor to ROBUST NETWORKS, LLC. The taxonomic relationship among ApplianceWare, Opticaute and Robust Networks (name changes vs. asset sales) is not determinable from available records. This is a new finding relative to the previously generated sections, which listed only "Original Assignee: ROBUST NETWORKS LLC."
• Current status: I cannot confirm whether Robust Networks LLC still exists, was dissolved, or was absorbed. The 2015-11-18 recording is a MERGER in which Robust Networks, LLC was the assignor and MINERAL LASSEN LLC the assignee — i.e., Robust Networks was the disappearing entity. Whether that merger was a genuine corporate combination or a structurally-vehicled asset transfer is unknown and should be checked against state registry filings.

---

Assignment timeline

Every entry below: Reel/Frame = NOT RETRIEVED. Correspondent = NOT RETRIEVED. These fields are absent from the Google Patents legal-events feed and Assignment Center was unreachable. Do not treat the party names as a substitute for them.

• 2012-10-31 (application filing) / recorded 2012-10-31 — Reel NOT RETRIEVED

  • Conveyance: Application filing event (assignee of record at filing: ROBUST NETWORKS LLC)
  • Assignor: n/a
  • Assignee: ROBUST NETWORKS, LLC
  • Correspondent: NOT RETRIEVED
  • Context: Filing of the third continuation in the Kenworthy chain; Robust Networks named as applicant.

• 2012-11-30 (recorded) — Reel NOT RETRIEVED

  • Conveyance: ASSIGNMENT OF ASSIGNORS INTEREST
  • Assignor: OPTICAUTE, INC.
  • Assignee: ROBUST NETWORKS, LLC
  • Correspondent: NOT RETRIEVED — if this correspondent recurs on the 2015-11-18, 2017-09-26, 2018-01-19 and 2018-04-13 entries, that recurrence is the single highest-value thing to check in Assignment Center.
  • Context: Internal chain clean-up — Opticaute's interest in the Kenworthy family is consolidated into Robust Networks one month after the continuation is filed.

• 2015-11-18 (recorded) — Reel NOT RETRIEVED

  • Conveyance: MERGER (Google Patents: "MERGER (SEE DOCUMENT FOR DETAILS)")
  • Assignor: ROBUST NETWORKS, LLC
  • Assignee: MINERAL LASSEN LLC
  • Correspondent: NOT RETRIEVED
  • Context: Robust Networks disappears into Mineral Lassen. A merger — rather than a straight assignment — is an unusual vehicle for moving patents; it is often used for structural/tax reasons. Whether this was a genuine merger or a designed transfer is unclear from the record; the merger document itself (referenced but not reproduced) is the evidence needed.

• 2017-09-26 (recorded) — Reel NOT RETRIEVED

  • Conveyance: ASSIGNMENT OF ASSIGNORS INTEREST
  • Assignor: MINERAL LASSEN LLC
  • Assignee: INTELLECTUAL VENTURES ASSETS 57 LLC
  • Correspondent: NOT RETRIEVED — IV's numbered "Assets" LLCs are typically recorded by IV's in-house IP transactions group or a single outside firm; confirming that name here would establish the IV hand-off conclusively.
  • Context: Transfer into the Intellectual Ventures asset-holding structure. This is the first appearance of a recognized monetization entity in the chain.

• 2018-01-19 (recorded) — Reel NOT RETRIEVED

  • Conveyance: Assignment of assignors' interest
  • Assignor: INTELLECTUAL VENTURES ASSETS 57 LLC
  • Assignee: IQ HOLDINGS, LLC
  • Correspondent: NOT RETRIEVED
  • Context: First of two rapid post-IV transfers — a bare holding-company hop with no intervening operating activity.

• 2018-04-13 (recorded) — Reel NOT RETRIEVED

  • Conveyance: Assignment of assignors' interest
  • Assignor: IQ HOLDINGS, LLC
  • Assignee: FIRENET TECHNOLOGIES, LLC
  • Correspondent: NOT RETRIEVED — critical entry; if the same correspondent appears on the 2017-09-26 and 2018-01-19 entries, the "unrelated LLCs" are paper constructs administered by one filer.
  • Context: Transfer-to-asserter. FireNet files its first infringement suits roughly two months later.

• 2019-04-05 (recorded) — Reel NOT RETRIEVED

  • Conveyance: INTELLECTUAL PROPERTY SECURITY AGREEMENT
  • Assignor: KEMP Technologies Inc.
  • Assignee: BRIGHTWOOD LOAN SERVICES LLC, as collateral agent
  • Correspondent: NOT RETRIEVED
  • Context: Anomalous — flagged, not explained. KEMP Technologies was a defendant in FireNet's S.D.N.Y. suit (1:18-cv-05564), not an owner of this patent. Either (a) the '600 number was captured as part of a portfolio-level collateral filing, (b) the number was listed in error, or (c) post-settlement rights moved. I cannot distinguish these. Do not read this as an ownership transfer.

• 2022-01-24 (recorded) — Reel NOT RETRIEVED

  • Conveyance: RELEASE OF SECURITY INTEREST IN PATENTS
  • Assignor: BRIGHTWOOD LOAN SERVICES LLC
  • Assignee: KEMP Technologies Inc.
  • Correspondent: NOT RETRIEVED
  • Context: Bookend release of the 2019-04-05 security interest. Same anomaly and same caveat.

• 2018-09-01 — anticipated expiration (20 years from the Sep. 1, 1998 priority date); legal status Expired – Fee Related.

Timeline caveat: assignment execution dates are not exposed in the Google Patents feed — only recording dates. The user's format asks for both; I have supplied recording dates and labelled them as such. Execution dates one-to-several weeks earlier are typical and must be read off the Assignment Center abstracts.

---

Timeline diagram

timeline
    title Ownership of US 8892600
    1998 : Priority application filed by Kenworthy
         : Assignee of record Applianceware
    2010 : Second continuation issues as 8306994
    2012 : Third continuation filed by Robust Networks
         : Opticaute assigns to Robust Networks
    2015 : Robust Networks merges into Mineral Lassen
    2017 : Mineral Lassen assigns to IV Assets 57
    2018 : IV Assets 57 assigns to IQ Holdings
         : IQ Holdings assigns to Firenet
         : Firenet files first suits
    2021 : All challenged claims held unpatentable

---

NPE / troll-pattern signals

1. Shell-entity transfer — PRESENT.
The chain passes through four successive non-operating holding vehicles: MINERAL LASSEN LLC (2015-11-18), INTELLECTUAL VENTURES ASSETS 57 LLC (2017-09-26), IQ HOLDINGS, LLC (2018-01-19), FIRENET TECHNOLOGIES, LLC (2018-04-13). "ASSETS 57 LLC" is a numbered IV asset-holding shell; IQ Holdings and FireNet are single-purpose licensing vehicles with no product footprint in any source I reviewed. Reel/frame not retrieved, so the address-of-record and registered-agent evidence that would harden this call is missing.

2. Known asserter in the chain — PRESENT (strongest single signal).
INTELLECTUAL VENTURES ASSETS 57 LLC appears in the ownership chain from 2017-09-26 — IV is expressly on your comparison list. Downstream, Unified Patents describes FireNet Technologies, LLC as "an IP Investments affiliate and well-known NPE" (https://www.unifiedpatents.com/insights/2020/9/1/firenet-technologies-patent-determined-to-be-likely-invalid; repeated at https://www.unifiedpatents.com/insights/2021/3/18/firenet-technologies-patent-held-unpatentable). That is a third-party asserter-directory finding, not mere naming inference.

3. Repeat correspondent across the chain — UNRETRIEVED / UNCLEAR.
This is the signal I most wanted and could not obtain. No correspondent names were retrievable for any of the seven recorded entries. I will not infer a common filer from the LLC names. Action item: query Assignment Center for the '600 abstract set and compare the correspondent on 2017-09-26 / 2018-01-19 / 2018-04-13 specifically — a common correspondent across those three is the classic pattern where the shell names look unrelated but one lawyer runs the sequence.

4. Cascading transfers — PRESENT.
Three consecutive assignments in under seven months: 2017-09-26 → 2018-01-19 → 2018-04-13 (IV Assets 57 → IQ Holdings → FireNet). Counting the 2015-11-18 merger, five recorded transfers occur between 2012-11-30 and 2018-04-13, i.e. roughly one ownership change every 16 months for the life of the patent. The 2017–2018 sequence has the compressed, mechanical quality of a pre-packaged transaction rather than independent arm's-length deals.

5. Pre-litigation transfer — PRESENT.
FireNet Technologies, LLC acquired the patent 2018-04-13. FireNet filed against KEMP Technologies in S.D.N.Y. (1:18-cv-05564) on 2018-06-20 and against Fujitsu in E.D. Tex. (2:18-cv-00270) in the same period — within roughly two months of the assignment, well inside your six-month window. The chain was demonstrably arranged to put clean title in an asserting entity immediately before filing; the subsequent A10 (N.D. Cal. 3:18-cv-06502, Oct. 2018), Fortinet (N.D. Cal. 3:19-cv-00798, Feb. 2019) and Citrix (N.D. Ga. 1:19-cv-03199, July 2019) suits followed the same four-patent campaign.

6. Bankruptcy fire-sale — NOT PRESENT.
No bankruptcy proceeding appears anywhere in the chain: not for Applianceware, Opticaute, Robust Networks, Mineral Lassen, IV Assets 57, IQ Holdings or FireNet. The 2015-11-18 MERGER is a corporate-combination conveyance, not a §363 sale, and I have no evidence of insolvency for Robust Networks or Mineral Lassen. Marked absent despite the "Mineral Lassen" name carrying no independent significance I could verify.

7. Privateering — UNCLEAR.
There is a clear monetization lineage (IV Assets 57 → IQ Holdings → FireNet) but no evidence that IV retained a financial interest, funded the litigation, or directed the assertion, and no SEC filing, Patent Progress or EFF coverage connecting IV to FireNet's suits. On the record I have, this reads as an asset sale into an independent asserting entity, not operating-company-backed privateering.

8. Defensive aggregator (anti-NPE) — NOT PRESENT.
The chain terminates at FIRENET TECHNOLOGIES, LLC, an asserting entity, not at RPX, AST, LOT, Unified or OIN. Note the adjacent but distinct fact: the patent was neutralized by an IPR, not acquired — Unified Patents petitioned on 2020-03-13 and on 2021-03-18 the PTAB held all challenged claims (1–17 and 19–23) unpatentable. Combined with the 2018-09-01 anticipated expiration, the asset is now both expired and claim-cancelled. That is a litigation outcome, not an ownership signal, so it does not move this score.

Cross-reference corrections to previously generated sections:

• The prior "Patent summary" recorded a discrepancy on the challenged-claim set (1–17, 19–23 vs. 1–17). Resolved: Unified Patents' own publication states the FWD held "all claims of U.S. Patent 8,892,600 (claims 1-17 and 19-23) unpatentable," and the petition analysis at https://ai-lab.exparte.com/case/ptab/IPR2020-00471/doc/summary/1 lists "Challenged Claims: 1-17, 19-23." The correct set is 1–17 and 19–23.
• The prior "Patent summary" title-discrepancy note (third-party source calling the patent "Security for a Network Attached Device") is confirmed as a third-party artifact — the same mis-title appears in the PTAB petition summary. The controlling title remains "Network attached device with dedicated firewall security."

---

Verdict

NPE — high confidence.

Four strong signals, each anchored to dated recorded events rather than naming: (i) a shell/licensing-vehicle chain running Intellectual Ventures Assets 57 LLC → IQ Holdings, LLC → Firenet Technologies, LLC across 2017-09-26, 2018-01-19 and 2018-04-13; (ii) a recognized monetization entity in the chain (IV Assets 57) plus Unified Patents' own designation of Firenet as "an IP Investments affiliate and well-known NPE"; (iii) cascading transfers — three assignments in under seven months; and (iv) a pre-litigation transfer, with FireNet acquiring on 2018-04-13 and filing against KEMP and Fujitsu within about two months. No defensive-aggregator terminus and no bankruptcy appear.

Verification link: https://assignmentcenter.uspto.gov/ (search US 8,892,600; mirror at https://assignment.uspto.gov/patent/index.html). When you run it, capture two things I could not: the reel/frame for each of the seven entries, and the correspondent of record for 2017-09-26, 2018-01-19 and 2018-04-13. Recurrence of one correspondent or one correspondent address across those three would convert signal #3 from "unretrieved" to a hard finding and confirm that the three apparently unrelated LLCs were papered by a single filer. Also pull the execution dates and the 2015-11-18 merger document (the feed says "SEE DOCUMENT FOR DETAILS") to test whether the Robust Networks → Mineral Lassen step was a true merger or a designed transfer.

I'll start by verifying the patent record at USPTO and then examine each cited reference. Let me run several searches in parallel.

Let me verify the key references — including two IPR-only references not on the patent's face — and the USPTO record.

Prior-Art Analysis — US 8,892,600 B2 ("Network attached device with dedicated firewall security")

0. Sourcing note and what I could and could not verify

What I relied on. The authoritative claim and specification text is the Google Patents full-text record for US 8,892,600 B2, fetched 2026-09-12, which you supplied. The citation list below is taken directly from that record's "Citations (64)" table, with dates as they appear there. Where I have independent corroboration (Coley, Coss, Shand, Gelb, the parent '837) I cite the corroborating source.

What I could not verify. I could not retrieve a live USPTO PatentCenter/PAIR page for application 13/665,523 in this session. Searches for "USPTO patent 8892600" resolved to the Google Patents record and to third-party mirrors (Justia, RPX, FreePatentsOnline, uspto.report) rather than to the USPTO's own database. I did not find results for any patent number other than 8,892,600; all hits returned are for the correct number. Treat the bibliographic facts below as sourced from the patent document plus corroborating third parties, not from a live USPTO query.

Confirmed bibliographic facts (no conflicts found across sources): US 8,892,600 B2; app. 13/665,523; filed 2012-10-31; granted 2014-11-18; published as US 2013/0061294 A1 (2013-03-07); inventor Stacy Kenworthy; original assignee Robust Networks LLC; priority/effective prior-art date 1998-09-01; 23 claims (independent 1, 8, 16).

---

1. The §102 framework that governs this analysis

Before mapping references, three date facts control everything:

1. Pre-AIA §102 applies. The family's earliest filing is 1998-09-01, so the AIA does not govern.
2. The effective prior-art date is 1998-09-01 (the '837 original filing), assuming the continuation claims are supported by the 1998 disclosure. This assumption is load-bearing and I flag it in §4 below.
3. The §102(b) statutory-bar date is 1997-09-01 (one year before 1998-09-01). A reference must predate 1997-09-01 to be a §102(b) bar; §102(a)/(e) references must predate the invention/effective filing date (1998-09-01) by their own filing or publication date.

Practical consequence: of the 64 references cited on the '600 face, 54 have effective dates before 1998-09-01 and are eligible as §102(a)/(b)/(e) art. Ten do not (listed in §4). That is an unusual citation profile for a patent claiming 1998 priority and is itself analytically significant.

A second, more important consequence: for the specific claim language of the '600, the novelty resides in the combination of (i) a second computing device isolated from the internal network that hosts an attached device, and (ii) reformulation of received packets into new packets sent to that isolated device. No single reference on the '600 face discloses all of (i) and (ii) together with the claim's filtering steps. That is precisely why the patent survived prosecution and why the IPR2020-00471 petitioner pleaded obviousness (§103), not anticipation (§102). I state this up front so the §102 mappings below are not overread: with one arguable exception, the cited references are §103-type art, not true anticipating references.

---

2. The cited references, grouped by function

Format: Patent (pub. date) — priority/filing date — assignee — title — §102 relevance to '600 claims.

Group A — Firewall / proxy / gateway architecture (the substantive art)

Group B — Packet filtering / flow analysis

Group C — Access control / authentication / policy

Group D — Network-attached devices, storage, peripherals (the "NAD" thread)

Group E — Network management, servers, and clearly peripheral art

---

3. References central to IPR2020-00471 that are not on the '600 face

This is a key finding and should not be confused with the face citations. Two of the four IPR references do not appear in the '600's "Citations (64)" table:

I was unable to independently re-verify the PTAB Final Written Decision text (my searches returned the petitioner's IPR analysis at ai-lab.exparte.com and the UP portal record, not the FWD document itself). The prior generated sections of this analysis state the claims were held unpatentable on these §103 grounds. I adopt that as the working record but flag it as aggregator-sourced, not FWD-verified. I also verify that the Shand reference number is 6,147,976 and the title is "Fast network layer packet filter" (Cabletron) — this corrects nothing, but confirms the identifier literally.

---

4. §102 eligibility caveats — references cited that post-date the 1998-09-01 priority

Ten examiner-cited references have effective dates after 1998-09-01 and therefore cannot be §102 prior art against the '600 claims on the assumed priority date. I list them so their citation is not mistaken for §102 art:

Analytical significance: the presence of post-1998 references in the citation set is consistent with one of two things — (a) citation during prosecution of the later continuations (2001, 2010, 2012) with different claim scope, or (b) the examiner not treating the 1998 priority as fully supported for the amended '600 claims. Option (b) is the more consequential possibility and aligns with the IPR petitioner's argument (per the ExParte petitioner summary) that "the claims of the '600 patent are meaningfully different from those of the related patent." If the '600's "second computing device isolated from the internal network / reformulate" limitations are not entitled to the 1998-09-01 date, the effective prior-art date shifts later and the entire §102 landscape changes. I cannot resolve this from available sources and explicitly decline to.

---

5. Reference that is not prior art: US 6,317,837 B1

US 6,317,837 B1 appears in the '600's citation table (pub. 2001-11-13; pr. 1998-09-01; "Applianceware, Llc" as listed assignee; Internal network node with dedicated firewall). This is the Kenworthy parent patent and the priority document of the very application chain that produced the '600 (see the '600's own Cross Reference section: 09/144,954 → '837). It is therefore not "by another" and cannot be §102 prior art against the '600. Its appearance in the citation list reflects family linkage, not prior-art citation. Any §102 mapping to it would be legally erroneous. (Confirmation: the "Family Cites Families" table lists US 5,557,209 and US 5,852,717 in the family citation context, and the Family Applications list confirms '837 is the common ancestor of '302, '994 and '600.)

---

6. Bottom line

1. No reference cited on the '600 face anticipates independent claims 1, 8, or 16 under §102 on a standalone basis. The claim-defining combination — a second computing device isolated from the internal network, hosting an attached device, receiving reformulated/new packets generated from authorized, header-filtered packets — is not disclosed in any single one of the 64 references.
2. The closest §102 candidates (all of which still require a §103 combination to reach claims 1/8/16) are, in order: US 5,826,014 (Coley), US 6,098,172 (Coss) [IPR art, not on face], WO 98/31124 (reverse proxy), US 5,757,924 (MAC translation), GB 2 318 031 A (proxy firewall), US 5,550,984 (Gelb) and US 6,147,976 (Shand) [IPR art, not on face].
3. The dependent claims carry the real §102 exposure. Claims reciting authorized port information (5, 12, 20) and authorized source network-card information (6, 13, 21) map closely onto Coley's port-assigned proxy agents and source-address verification; claims reciting logging rejected packets (15, 23) map onto Shand '976 and Coley's transaction log; claims reciting application-layer filtering (7, 14, 22) map onto Coley's protocol-sensitive agents. These are the limitations the IPR attacked, and per the aggregated record the Board found them unpatentable on obviousness, not anticipation.
4. Two caveats that materially qualify the above: (i) ten cited references post-date the 1998-09-01 priority and are not §102 art on that date; (ii) whether the '600 claims are actually entitled to 1998-09-01 is an open, dispositive question I could not verify against the USPTO file or the IPR FWD.

Confidence: High for the citation list, dates-as-listed, and the claim-text mapping — all read directly from the patent document. Moderate for the IPR ground/reference mapping (petitioner summary, not the FWD). Not established: the live USPTO PatentCenter record, and any Federal Circuit docket activity (consistent with the earlier sections, I located none).

Sources: Google Patents US8892600B2 full-text record (https://patents.google.com/patent/US8892600/en); FreePatentsOnline/USPTO patent text for US 5,826,014 (https://freepatentsonline.com/[5826014](/patent/5826014).html); Google Patents US5826014A; uspto.report grant 6,061,798; Google Patents/EveryPatent US 6,147,976 (https://www.everypatent.com/comp/pat6147976.html); Unified Patents portal US-6,098,172-A and US-6,061,798-A; ExParte IPR2020-00471 petition analysis (https://ai-lab.exparte.com/case/ptab/IPR2020-00471/doc/summary/1); RPX patent record US8892600B2 (https://insight.rpxcorp.com/patent/US8892600B2).

I'll ground this §103 analysis in the actual prior-art references of record, then map them element-by-element to the claims. Let me pull details on the key references first.

Obviousness Analysis — US 8,892,600 under 35 U.S.C. § 103

Building on the summary, litigation, and prior-art sections already generated. I do not repeat the bibliographic or priority-family material; I incorporate it by reference and test the granted claims against the prior art of record.

---

0. Scope, sources, and two corrections to the prior sections

The "Prior Art" material available to me consists of (a) the examiner-cited references listed in the Google Patents record for US 8,892,600 (the record's "Citations (64)" / "Patent Citations (68)" tables and the "Prior art keywords" list: computing device, data packets, network, NAD, response), and (b) the IPR2020-00471 grounds of record identified in the previously generated litigation section. I use both.

Two identifier discrepancies must be flagged before the analysis, because they materially affect which document stands for which teaching:

1. Coss. The previously generated litigation section rendered "Coss (US 6,098,172)" as "Secure middleware and server control system for querying through a network firewall." That title belongs to US 6,088,796 (Cianfrocca et al.), not to Coss. The actual US 6,098,172 (Coss, Majette, Sharp; Lucent Technologies; filed 1997‑09‑12; granted 2000‑08‑01) is titled "Methods and apparatus for a computer network firewall with proxy reflection." (uspto.report; PTAB Ex. 2006) Both documents are in play here, but for different reasons, and I treat them as distinct references below.

2. "Shand" vs. the examiner's circuit-switched firewall. The '600 record cites US 6,141,755 (Dowd & McHenry, NSA) — "Firewall security apparatus for high-speed circuit switched networks." The IPR's Shand reference is a different patent: US 6,147,976 (Shand, Harper, Welch; Cabletron), "Fast network layer packet filter." (uspto.report) These are frequently conflated. I keep them separate.

Also, for completeness: the earlier search-results note that US 5,550,984 (Gelb, Panasonic) is "Security system for preventing unauthorized communications between networks by translating communications received in IP protocol to non‑IP protocol to remove address and routing services information," whereas "Method of conducting secure operations on an uncontrolled network" is US 5,548,721 (Harris Corp.). Both are relevant, and they are not the same document.

What I do not have: the actual text of the IPR2020-00471 Final Written Decision. The "unpatentable" outcome and the ground-by-ground claim lists come from aggregators and were flagged as moderate-confidence in the earlier section. My analysis below is my own, built from the reference texts, and generally converges on the IPR's result — but I do not represent it as the FWD's reasoning.

---

1. Governing standard and the person of ordinary skill

Pre‑AIA § 103(a) applies (the '600 was filed 2012‑10‑31 claiming 1998‑09‑01 priority; pre‑AIA §§ 102/103 govern). The framework is Graham v. John Deere: scope and content of the prior art, differences between the prior art and the claims, the level of ordinary skill, and secondary considerations. Under KSR Int'l v. Teleflex, a combination of known elements is obvious where it yields no more than predictable results, where the improvement is a "known technique … used to improve similar devices in the same way," or where the claimed arrangement was "obvious to try" from a finite number of identified, predictable solutions. Critically, the specification's own background is an admission of prior art: the '600 expressly characterizes as known (i) NADs, (ii) NAD servers that process NAD-access requests and support multiple heterogeneous protocols, (iii) the bastion firewall as the customary single layer of LAN security, (iv) header-based filtering tests, and (v) proxy NAD servers that generate new packets rather than forwarding received ones (FIG. 7 and accompanying text). Those admissions narrow the field of inquiry to essentially one question: was it obvious to add a NAD-dedicated, header-filtering firewall that reformulates packets to a network-isolated device hosting the NAD?

Level of ordinary skill (1998): a person with a bachelor's degree in computer science or electrical engineering (or equivalent) and approximately two to three years of experience in network protocol stacks, TCP/IP, and network security/firewall administration. That person would have been familiar with the standard literature — Cheswick & Bellovin, Firewalls and Internet Security (1994); Chapman & Zwicky, Building Internet Firewalls (O'Reilly, Nov. 1995) — the latter is cited as non‑patent literature on the face of Coss itself and teaches the screened-subnet/DMZ and dual-homed-gateway architectures directly relevant here.

---

2. Distillation of the independent claims into elements

The three independents are substantively identical in scope. Claim 1 (system) requires:

Claim 8 is the method analogue of A–F. Claim 16 recasts F as "generate new data packets, based at least in part on information contained within the data packets," and adds the attached device being coupled to the second device "by way of a communications interface."

Two observations drive the whole § 103 analysis:

• Elements A, C, D, E, and G are each individually old and well-documented in the art of record. The only limitation with any arguable novelty is B+F: a two-box architecture in which the NAD-hosting device sits off the LAN (isolated) and the fronting device rewrites traffic rather than forwarding it.
• The specification admits that both halves of B+F were known: the bastion firewall "wraps a bastion firewall around the entire LAN" (isolating a device from the LAN), and the proxy-NAD-server embodiment "generates a new data packet … and sends the new data packets to a second NAD server" (rewriting/regenerating traffic).

---

3. Primary obviousness combinations

Combination 1 — Coley (US 5,826,014) in view of Coss (US 6,098,172)

Coley discloses "a firewall for isolating network elements from a publicly accessible network to which such network elements are attached." The firewall is a standalone "firewall box"; "all access to the protected network elements must go through the firewall box"; the box is "connected to a protected network element by a single connection"; protected elements "are connected to the backside of the firewall." A proxy agent is assigned by port number and "verifies the authority of an incoming request to access a network element indicated in the request. Once verified, the proxy agent completes the connection to the protected network element on behalf of the source of the incoming request." Verification tests expressly include "determinations of valid destination addresses," password checks, and access validity by time period. (RPX patent page; FPO)

Mapping:

• A/C — firewall box is a first computing device on the network path; it receives access-request packets.
• B — the protected network element sits on the "backside" of the firewall box behind "a single connection," i.e., reachable only through the box — this is the claimed "isolated from the internal network" topology (a screened host).
• D/E — proxy agent examines the request and performs "determinations of valid destination addresses" and port-based authorization → "IP address associated with the attached device" + "valid IP address in a header" + authorized-port filtering (dependent claims 5/12/20).
• F/G — the proxy agent "complet[ing] the connection … on behalf of the source" is the classical proxy act of terminating the inbound connection and opening a new one; it is not packet forwarding. This is the "reformulate / generate new packets" limitation.

Gap in Coley: its proxy agent typically executes on the firewall box itself, so the "network element" being protected is the NAD/server, not a separate second computing device that itself hosts attached devices; and Coley is framed around a public network rather than an internal LAN plus external network.

Coss supplies exactly that. Coss teaches "proxy reflection": the firewall receives a session request, consults a rule table keyed by source host, destination host, service/port, and action (pass/drop/proxy), and can "redirect a network session to a separate server for processing, so as to unburden the firewall of application proxies." In doing so, "the firewall replaces the destination address in the packet with the host address of the proxy application and, if necessary, it can also change the service port," records "the original packet header data … in the session cache along with any changed values," and routes the packet to the remote proxy server — which then "contact[s] the original destination address on behalf of the user." Coss's session cache stores, per FIG. 4, "session key" (source/dest IP, protocol, source/dest port), hardware address, interface, rule number, alarm code, and action, with actions including DROP. (uspto.report)

Coss therefore supplies: (i) the two-device split (firewall/redirector + separate remote server that performs the service), (ii) the reformulation limitation in haec verba (address/substitution and new packet generation "on behalf of" the destination), and (iii) hardware-address and interface information used in filtering — directly mapping dependent claims 6/13/21 ("authorized source network card information"), which recite a limitation Coley does not reach.

Motivation to combine: both are in the same field (packet-filtering and application-proxy firewalls), address the same problem (protecting a resource from untrusted traffic while still permitting authorized sessions), and Coss expressly identifies the precise problem Coley's single-box design creates — that running proxies on the firewall consumes firewall processor capacity and slows throughput — and states the solution: move the proxy processing to a separate server. A PHOSITA seeking to protect a NAD server without burdening the LAN's security perimeter would have found it obvious to run Coley's authorizing proxy logic on a fronting box and push the NAD-serving function to a separate, off-LAN device, per Coss. The combination yields only predictable results (the same authorization decision, executed one hop further back).

---

Combination 2 — Coss (US 6,098,172) in view of Gelb (US 5,550,984)

This mirrors IPR Ground 3. Coss supplies the firewall, rule-table filtering on source/destination addresses and ports, the session-key extraction from the IP header, stateful drop/pass/proxy actions, proxy reflection (the "reformulate" step), and the redirection of the session to "a separate server."

Gelb (US 5,550,984) supplies the isolation limitation directly and physically: a system that prevents unauthorized communications between networks "by translating communications received in IP protocol to non-IP protocol to remove address and routing services information," with "all routing services … disabled," so that the protected side's addressing (including MAC addresses) is not exposed and traffic cannot route around the gateway. (uspto.report) Gelb is also cited of record against the '600 family, and its teaching was cited in Coss's own field as the archetype of a hardened gateway separating an internal private network from an external public one.

Motivation: both references address the identical problem of a hard boundary between an untrusted external network and protected resources; Gelb teaches the strongest available form of "isolation" (address-information removal/translation) and Coss teaches the filtering-plus-rewrite front end. Combining a proxy-reflection firewall with a translating, routing-disabled isolation boundary is a combination of two known security mechanisms, each doing exactly what it was known to do. No new interaction or unexpected result is produced.

---

Combination 3 — Examiner-cited art: Cianfrocca (US 6,088,796) + Vu (US 5,623,601) + Nessett (US 5,968,176) + Shand (US 6,147,976)

This combination matters because it uses the art the examiner actually cited in the '600 record, and because it maps the claim language with unusual precision.

Cianfrocca (US 6,088,796) discloses a communication server (web server) outside a firewall and an application server inside the firewall plus a database behind it, where "the firewall … prevent[s] any connections established from outside of the firewall" and access is permitted only along an outbound-initiated secure pathway. Its middleware converts between protocols ("the gateway module … for converting the communication server protocol to a messenger system protocol for queries received from a user and for converting replies … from the messenger system protocol to the communication server protocol") and its User Agent performs "converting the messenger system protocol to the application server protocol." (Google Patents)

That protocol conversion is, functionally, the "reformulate the data packets" / "generate new data packets" limitation, and Cianfrocca's claim 14 — "each of the application servers restricts its secure pathway with the messenger system means to a specified port" — is the authorized-port limitation (claims 5/12/20). Cianfrocca also independently confirms the two-box, isolated-resource architecture (application server and database inside; communication server outside).

Vu (US 5,623,601), "Apparatus and method for providing a secure gateway for communication and data exchanges between networks," supplies the secure gateway whose OS is "modified to disable communications packet forwarding," i.e., the anchor device that will not transparently route.

Nessett (US 5,968,176), "Multilayer firewall system," supplies the express motivation for stacking a second firewall layer atop the perimeter firewall — the exact "second layer of security" the '600 touts as its contribution. A reference whose stated subject matter is multiple firewall layers is powerful § 103 evidence against a claim whose entire asserted novelty is a second, NAD-dedicated firewall layer.

Shand (US 6,147,976), "Fast network layer packet filter," teaches extracting the source address, destination address, protocol type, and source/destination port from a received packet header and using them to index a filtering matrix with a forwarding/drop flag, and it maintains a Log File 66 with explicit support for "reject and log" codes and a management command "to enable or disable logging of all rejected packets." (uspto.report) That is the dependent-claim subject matter of claims 15 and 23 ("logging … information regarding data packets that are rejected"), verbatim in substance.

Motivation: Cianfrocca and Nessett both concern layered security for server-side resources behind a firewall; Vu and Shand concern the packet-classification mechanics; all are in the same art, and none of the references teaches away from the others. Nessett affirmatively directs the PHOSITA to stack layers; Shand supplies an off-the-shelf mechanism for the address/port tests and the reject-log.

---

Combination 4 — Dependent-claim-specific pairings

---

4. Why the combination would have been motivated — the affirmative case

1. Same field, same problem, same solution mechanics. Every primary reference addresses restricting access to a computing resource across a trust boundary using header inspection; there is no field-crossing or analogy problem to overcome.
2. The references teach toward one another. Coss identifies Coley-style on-firewall proxies as a throughput bottleneck and prescribes moving proxy processing to a separate server — the exact architectural move of claim 1 (first device filters/reformulates, second device serves the attached device). Nessett affirmatively teaches the desirability of multiple firewall layers. Neither direction requires hindsight; it is written on the face of the references.
3. The '600's own admission. The patent concedes that bastion firewalls, NAD servers, header-based filtering (header completeness, authorized interface, valid source/destination address, port), proxy NAD servers, and even per-NAD "wrapped" firewalls (FIG. 8) were known. Having conceded each constituent, the applicant cannot rely on the aggregate as inventive absent some unexpected result. KSR squarely applies: a combination of familiar elements according to known methods that yields predictable results.
4. No teaching away. Nothing in Coley, Coss, Gelb, Vu, Nessett, Cianfrocca, or Shand disparages combining filtering with an isolated back-end server. Coley's own security rationale — "shielding the identity of network elements on each side of the firewall" and using "a packet filtering scheme to protect against IP spoofing and source based routing" — affirmatively supports doing both.
5. Design incentive / obvious to try. With a finite, identified set of options for protecting a NAD server (put the firewall in the NAD server; put it in front of the NAD server; proxy the traffic), the placement-and-proxy combination is a predictable, low-risk engineering choice, and the art had already identified each option by name.
6. § 102(e)/102(b) status is clean for the 1998 priority date. Coss filed 1997‑09‑12, Coley filed 1996‑02‑06, Shand filed 1996‑06‑24, Cianfrocca filed 1998‑08‑06 (provisional 1997‑08‑06) — all before the 1998‑09‑01 priority date, so each is available as § 102(e) prior art; Gelb (granted 1996‑08‑27), Vu (granted 1997‑04‑22), Nessett (granted 1999‑10‑19, filed earlier), Shand (granted 2000‑11‑14) are all § 102(e) and/or § 102(b) art as of the critical date. Caveat: availability depends on the claims being entitled to the 1998 priority date, which the IPR petitioner and the Board evidently accepted; if priority were limited to a later continuation date, this analysis would be unaffected (the references predate even the 2001 continuation).

---

5. Anticipation ( § 102) vs. obviousness ( § 103)

I do not find a single reference that anticipates claim 1 as a whole, because of the "second computing device … isolated from the internal network … having at least one attached device" element combined with "reformulate." Coley has the isolation and the on-behalf-of proxy act but a single-box topology; Coss has the two-device split and reformulation but frames its remote proxy around session redirection rather than an attached-device-hosting device. That is why these references are properly used in a § 103 combination rather than as anticipatory art — and it is exactly the posture the IPR took. (For claim 16's "communications interface," the combination of Coss/Gelb with the cited NAD-server references such as US 5,247,670 or US 5,642,337 supplies it.)

---

6. Counterarguments a patent owner could raise, and responses

---

7. Bottom line

• Claim 1 / 8 / 16: obvious over Coley '014 + Coss '172 (Ground 1 analogue), and independently over Coss '172 + Gelb '984 (Ground 3 analogue). Cianfrocca '796 + Vu '601 + Nessett '176 supplies a fully examiner-cited alternate route.
• Claims 2, 5–7, 12–14, 16–17, 20–22: obvious via the primary combinations plus Coss (reformulation/new packets, hardware address/interface), Coley and Shand (port filtering), Coss and Cianfrocca (application-layer filtering).
• Claims 3, 4, 9–11, 18, 19: obvious via Coley/Vu/Nessett (perimeter firewall) and the cited NAD-server/storage references (US 5,247,670; US 5,642,337; US 6,047,353; US 6,260,120) plus Cianfrocca (communications interface handling).
• Claims 15, 23: obvious over the primary combinations in view of Shand '976 (Log File 66; "reject and log"), matching the IPR's own use of Shand for the logging claims.
• This convergence with the reported IPR result is my independent analysis, not a recitation of the FWD. I have not read the FWD, and the aggregated claim lists were flagged earlier as internally inconsistent (one source lists claims 1–17; another 1–17, 19–23).

Residual uncertainty: (i) the precise scope the Board gave "reformulate"/"generate new packets" is unknown to me and could narrow the Coss mapping; (ii) whether Coss's remote-proxy redirection was treated as "transmit[ting] the reformulated packets to the second computing device" as opposed to back through the firewall to the destination is the one place a genuine § 103 dispute could be pressed; (iii) I could not verify primary PTAB or USPTO records in this session, so the IPR outcome remains moderate-confidence for the reasons stated in the earlier section.