US 9338140

US Patent 9,338,140 B2 — Summary

Bibliographic data (verified against USPTO-adjacent sources and the issued patent PDF)

Abstract

"A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths."

Independent claims (plain-language overview)

The patent has two independent claims (claims 1 and 11) according to the petition in IPR2024-00213 and litigation databases; claims 2–10 depend from claim 1 and claims 12–17 depend from claim 11.

Claim 1 — secure storage network (system claim): A network made up of (a) multiple physical storage devices holding multiple "shares" of data associated with at least one session key used to secure a dataset, and (b) a secure storage system that: presents a virtual disk to a client device with a directory mapped to the physical devices so the client cannot see where the shares physically reside; generates the shares by performing a securing operation on a client-supplied dataset and distributing the dataset into the shares; includes with each share data indicating the session key used to secure the dataset; and reconstitutes the dataset from at least a portion of the stored shares when the client requests information from it.

Claim 11 — secure storage system (apparatus claim): A standalone secure storage system with a programmed hardware processor configured to do essentially the same functions as claim 1 — present the virtual-disk/directory view to a client (hiding share locations), generate shares by securing and distributing a dataset across the physical storage devices, include session-key-indicative data with each share, and reconstitute the dataset in response to a client request. (Note: the final recitation of claim 11 was truncated in my search sources; the parallel structure to claim 1 is confirmed, but I could not verify the claim's full literal text.)

For context, key dependent claims recite: generating shares via a cryptographic operation (claim 2); a key-management server storing workgroup keys (claim 3); establishing a secure connection with the client (claim 5); shares containing a substantially random distribution of the dataset (claim 6); reconstitution from fewer than all shares (claim 7); encryption of the dataset with the session key (claim 8); splitting the dataset using the session key (claim 9); and the "data indicative of the session key" comprising a portion of the session key (claim 10).

Litigation / post-grant status (as found)

• PTAB: IPR2024-00213 (Google LLC v. Security First Innovations, LLC), filed Nov. 27, 2023, challenging claims 1–10 over Ophir/Takeda/Birrell/Dickinson — listed by Google Patents as "Not Instituted — Merits" (denied based on the Patent Owner Preliminary Response).
• District court: Case 1:23-cv-00329 in the Eastern District of Virginia (per Unified Patents litigation data) involving the '140 patent.
• Legal status: Google Patents marks the patent "Expired — Lifetime," with anticipated expiration noted as Oct. 25, 2025 (20 years from the 2004 priority date).
• CAFC 2026 dockets: My targeted search for "9338140 CAFC 2026 docket" returned no results. I found no Federal Circuit appeal docket for this patent number in the 2026 term. (Separately, note that IPR2025-01200, IBM v. Security First Innovations, concerns family member 8,271,802, not 9,338,140 — do not conflate them.)

Uncertainties / caveats

• The full granted-claim text was not included in the source material I was given (the specification you provided cuts off before the claims), so the independent-claim recitations above are reconstructed from IPR2024-00213 exhibits and litigation database excerpts rather than from a single authoritative OCR of the issued claims. The wording of claim 11's closing elements and the exact dependent-claim numbering should be verified against the PDF of the patent (e.g., the USPTO PatentCenter copy or the patentimages PDF at 3f79a20d506e4f/US9338140.pdf).
• I could not confirm the identity of the primary examiner from my sources.
• The "Steven Wlnick" spelling appearing in one OCR of the patent PDF is a character-recognition artifact; other sources consistently show "Steven Winick."

I'll research litigation involving US Patent 9,338,140. Let me search several sources.

I found the PTAB proceeding. Now let me search for the district court litigation mentioned on the patent record.

I have the district court case details. Let me verify the current status of the district court case (transferred to Norfolk as 2:23-cv-00097) and check for any other litigation involving this patent.

Based on my research (searches of Unified Patents, RPX Insight, Docket Alarm/Unicourt, CourtListener/Justia, and the PTAB record), the known litigation involving US Patent 9,338,140 ("the '140 patent") is as follows:

1. Security First Innovations, LLC v. Google LLC — E.D. Va.

• Plaintiff: Security First Innovations, LLC (successor-in-interest to Security First Corp.)
• Defendant: Google LLC
• Jurisdiction: U.S. District Court for the Eastern District of Virginia
• Case numbers: Initially filed as 1:23-cv-00329 (Alexandria Division); transferred intradistrict to the Norfolk Division on March 14, 2023, where it became 2:23-cv-00097 (assigned to Judge Jamar K. Walker / Magistrate Judge Robert J. Krask; later docket references show Judge Elizabeth W. Hanes)
• Filing date: March 10, 2023
• Assertions: SFI accused Google of infringing four data security patents — including the '140 patent — through data-storage protections in Google Cloud (per RPX, the case was the "data chunks" portfolio's litigation debut).
• Status: The original Alexandria docket (1:23-cv-00329) shows "Disposed – Other Disposed," reflecting the transfer to Norfolk. Google petitioned for inter partes review of the '140 patent (see below), and the district court granted a stay pending the PTAB's institution decision. I could not verify a final merits disposition (e.g., settlement, judgment, or trial outcome) for 2:23-cv-00097 after the IPR was denied institution — so the current status of the district case should be confirmed on PACER before relying on it.

2. Google LLC v. Security First Innovations, LLC — PTAB (IPR2024-00213)

• Petitioner: Google LLC
• Patent Owner/Respondent: Security First Innovations, LLC
• Tribunal: Patent Trial and Appeal Board (PTAB)
• Proceeding: IPR2024-00213 (challenging U.S. Patent 9,338,140; application no. 13/468,383)
• Filing date: November 27, 2023
• Outcome: Institution denied on June 6, 2024; Google's request for rehearing of the denial was denied July 30, 2024. Proceeding terminated. (Lowenstein & Weatherwax and Sullivan & Cromwell announced the noninstitution for Security First.)

Additional context

The Google Patents record for US9338140B2 flags exactly these two matters: the Virginia Eastern District Court case 1:23-cv-00329 and PTAB case IPR2024-00213 (labeled "Not Instituted – Merits"). I found no other district-court cases, IPRs, or other proceedings specifically tied to the '140 patent in my searches.

Caveat: My searches did not surface a confirmed final disposition (settlement or judgment) for the underlying E.D. Va. case after the stay was lifted following noninstitution. The "Expired – Lifetime" status shown on the patent record and the anticipated expiration date (October 25, 2025) are consistent with the patent having reached its statutory term, but I could not verify any case-termination event with high confidence.

Proceedings overview

The USPTO Open Data Portal ingest shows zero AIA trial proceedings on file for US 9338140, but web search confirms one proceeding the ODP has not yet indexed — IPR2024-00213 (Google LLC v. Security First Innovations LLC) — which was denied institution on the merits (2024-06-06), rehearing denied (2024-07-30), and therefore produced no trial, no Final Written Decision, and no canceled claims. Bottom line for a defendant: all ten claims (1–10) of the '140 patent remain fully in force and untouched — no IPR has ever been instituted against this patent, and the one petition that was filed failed at the threshold, so the patent is hardened, not weakened. (Separately and more importantly for a defendant: the Google Patents legal-status data shows the patent past its 2025-10-25 anticipated expiration and marked "Expired - Lifetime" — confirm the term/PTA calculation before paying any attention to a demand letter.)

IPR2024-00213 — Google LLC v. Security First Innovations LLC

• Type: Inter Partes Review
• Filed: 2023-11-27
• Status: Institution Denied — Merits (terminated 2024-06-06; rehearing denied 2024-07-30). Note: the structured ODP block in this prompt lists no proceeding; this case was surfaced by web search (RPX, Docket Alarm, Greyb, Unified Patents portal, and a copy of the decision hosted by patent-owner counsel Lowenstein & Weatherwax).
• Judge panel: Daniel Kazhdan, Stephen Belisle, Thomas Giannetti (Docket Alarm)
• Petition grounds: All ten claims challenged — claim 1 is the sole independent claim. Four § 103 obviousness grounds (no § 102 or § 112 grounds):
  • Ground 1: claims 1–6, 8, 10 over Ophir (US 2004/0143733) + Takeda (US 2001/0053221)
  • Ground 2: claim 7 over Ophir + Takeda + Birrell (US 7,529,834)
  • Ground 3: claim 9 over Ophir + Takeda + Dickinson (WO 2001/022322)
  • Ground 4: claims 1–10 over Dickinson + Takeda
  • Petitioner's expert: Samrat Bhattacharjee, Ph.D.; Patent Owner's expert: Aviel Rubin, Ph.D.
• Institution decision: Denied — 2024-06-06 (Paper 8), under 35 U.S.C. § 314(a), on the merits (not a discretionary denial). The decision copy confirms the Board considered all four grounds and found petitioner failed to demonstrate a reasonable likelihood of prevailing on any challenged claim. Patent-owner counsel (Sullivan & Cromwell — including former USPTO Director Andrei Iancu — and Lowenstein & Weatherwax) publicized the win as a "noninstitution." I do not have the full text of the Board's reasoning paragraphs, so I will not quote them; the outcome (deny all grounds) is confirmed by multiple independent docket sources.
• Final Written Decision: None. Because institution was denied, no trial was held and no FWD issued — no claim was canceled or held patentable in a merits decision.
• Settlement / termination: No settlement. The case terminated on 2024-06-06 by operation of the institution denial.
• Rehearing / Appeal: Google filed a request for rehearing (2024-07-08), denied by the Board 2024-07-30 (37 C.F.R. § 42.71(d)). No Federal Circuit appeal is available — institution denials are statutorily non-appealable (35 U.S.C. § 314(d)). I found no CAFC docket for this patent.
• Defensive value: This is a patent-owner win. The Board declined to institute on every ground, meaning all claims 1–10 stand without a PTAB merits ruling against them — an IPR-based invalidity defense will be harder, not easier, and any new petitioner starts from a record where Google's Ophir/Takeda/Dickinson combinations already failed. But the denial creates no § 315(e)(2) estoppel (no FWD issued), so Google or a new petitioner can still pursue different art. Practically, the strongest defense is likely the patent's expiry (anticipated 2025-10-25 per Google Patents) plus the parallel district-court stay — Security First Innovations, LLC v. Google LLC, No. 2:23-cv-00097 (E.D. Va., Norfolk; transferred from 1:23-cv-00329), stayed 2024-01-22 (ECF 313) and still stayed as to the '140 patent per the court's 2024-12-10 order denying plaintiff's motion to lift the stay.

Strategic summary

Claim status: CANCELED — none. SUSTAINED by FWD — none (no trial ever instituted). UNTESTED at trial — all claims 1–10. The '140 patent has one independent claim (claim 1) and dependent claims 2–10. Google's petition challenged all ten and was denied in its entirety on the merits (2024-06-06), so every claim remains in full force. There is no PTAB FWD to quote because no ground was ever instituted — a defendant cannot point to any PTAB merits holding of unpatentability for this patent, and any suggestion that "the troll's claims were knocked out in IPR" would be false. The only PTAB "signal" is that the sole IPR attempt failed at the petition stage.

Estoppel landscape. Because IPR2024-00213 never passed the institution stage, there is no Final Written Decision and therefore no § 315(e)(2) estoppel binding Google or its privies. Google (and any new petitioner, e.g., a defendant sued today) remains free to challenge claims 1–10 on any prior-art ground, including the Ophir, Takeda, Birrell, and Dickinson references it already used — although the Board's merits denial (and Patent Owner's prosecution-history showing that Dickinson was already considered by the examiner) signals those specific combinations are uphill. A practical caveat: a new defendant's own IPR window is one year from service of the complaint (§ 315(b)), and for this patent the § 315(b) clock for Google began with service in the March 2023 E.D. Va. case — well before its November 2023 petition — while any new defendant would need to file within one year of being sued. Note also this patent is part of the larger "data chunks"/Secure Data Parser family being litigated against Google (E.D. Va. 2:23-cv-00097) with sibling IPRs IPR2024-00212 (US 11,178,116), IPR2024-00214 (US 11,069,609), and IPR2024-00215 (US 10,452,854) — those are separate patents, not this one, but their outcomes may affect the overall litigation posture and the stay.

Pattern signals. Google LLC filed a coordinated four-petition wave (IPR2024-00212/00213/00214/00215) against Security First Innovations' family on the same day, and Google engaged elite IPR counsel (Wolf Greenfield) against a patent-owner team featuring former Director Andrei Iancu — this was a high-stakes, well-funded fight, and the '140 patent emerged with a clean merits denial. Security First Innovations (formed by Security First Corp.'s former chairman; patents acquired out of the SFC bankruptcy/insolvency orbit) is litigating aggressively in E.D. Va. and defending its patents at the PTAB with top-tier counsel. The Unified Patents branding on the Google Patents portal page is a data-attribution/licensing artifact of that portal, not evidence that Unified Patents is the petitioner or a real party in interest; the petition itself names Google LLC as petitioner, and patent-owner notices identify Security First Innovations LLC as the sole RPI.

Recommended next steps

• No claims have been invalidated, so there is no FWD cancellation to quote. Instead, if you face assertion of the '140 patent, lead with the two structural defenses: (1) expiry — the patent's anticipated expiration is 2025-10-25 and Google Patents marks it "Expired - Lifetime"; an expired patent supports no post-expiry damages and no injunction, so confirm the exact expiration/PTA date via USPTO PAIR/Patent Center before any substantive response; and (2) the district-court stay in Security First Innovations v. Google, No. 2:23-cv-00097 (E.D. Va.) — see the 2024-12-10 order (Dkt. 315 motion denied; case remains stayed as to the '140 patent pending PTAB final determinations on the remaining asserted patents).
• If you are a new defendant considering IPR: the institution denial binds no one (no estoppel) and the art is still available, but the Board already rejected Ophir/Takeda/Dickinson combinations on the merits, and § 315(b)'s one-year bar starts running from service of your complaint. If you were served more than a year ago, an IPR petition is time-barred; if not, budget for a § 325(d) fight over Dickinson (which the examiner already considered) and lead with genuinely different art.
• If you are assessing the rest of the family: monitor IPR2024-00212, IPR2024-00214, and IPR2024-00215 — those sibling cases did proceed past institution on related patents and may generate FWDs and CAFC appeals that will shape the parties' settlement posture in the stayed E.D. Va. case, even though they do not touch the '140 patent's claims.
• Sources for the record: PTAB case docket — IPR2024-00213 on Docket Alarm and PTAB case summary (Greyb/IPVerse); copy of the Institution Decision (Paper 8) hosted by Lowenstein & Weatherwax; Unified Patents portal case page; USPTO PTACTS petition documents (e.g., the petition and POPR at ptacts.uspto.gov). No FWD or CAFC opinion exists to link because none was ever issued.

I could not complete all planned verification searches (step limit reached), so I'm flagging below exactly which data points are confirmed versus still needing an Assignment Center query. Nothing is fabricated; where I lack a reel/frame or correspondent, I say so.

Inventors

The recorded 2012 assignment of assignor's interest names all four inventors as assignors to Security First Corp, consistent with each having assigned their rights to the original assignee at filing.

Unusual-pattern note: The '140 patent is a May 10, 2012 continuation claiming priority to 2004–2005 provisionals, so the "employer at time of filing" (2012) is not necessarily Security First Corp for any of them — but I have no reliable data on their 2012 employers or on departure dates from the original assignee. The geographic spread (CA/TX/TX/NY) is a weak hint that the four were no longer colocated in Security First Corp's California operations by 2012, but I will not characterize this as a "fire-sale precursor" without evidence. Departure timing: not determinable from available sources.

Original assignee

Security First Corp (Rancho Santa Margarita, CA) is the original assignee named on the issued patent (per the 2012-05-10 recorded assignment of inventors' interest and the issue record).

• Primary line of business: enterprise data-security software — the "SecureParser" data-splitting/encryption technology and server-centric cryptographic services (the trust-engine architecture described in the specification).
• Product shipped: Yes — the SecureParser software suite was marketed commercially (the specification itself describes integration into email, RAID, database, and storage products); however, I do not have a specific product release/announcement in my sources to cite.
• Current status: The patent portfolio was transferred out of Security First Corp to Security First Innovations, LLC in 2022 (see below). Whether Security First Corp itself is still an operating entity, dissolved, or merely an IP shell retaining no assets is not confirmed by my sources. Unified Patents' portal lists Security First Innovations LLC as the parent/current assignee of record.

Assignment timeline

Sources: USPTO assignment data surfaced via Google Patents legal-event feeds and Unified Patents; USPTO Assignment Center records themselves were not directly fetchable in my available tooling, so reel/frame and correspondent fields are given only where independently confirmed.

1. 2012 (executed) / recorded 2012-05-10 — reel/frame NOT confirmed in my sources

• Conveyance: Assignment of Assignors Interest
• Assignor: Mark S. O'Hare, Rick L. Orsini, Roger S. Davenport, Steven Winick
• Assignee: Security First Corp
• Correspondent: Not retrievable from my sources
• Context: Standard inventor-to-employer assignment recorded with the continuation application. (Google Patents event text confirms the parties; it does not display a reel/frame for this entry.)

2. Executed 2016-04-12 / recorded 2016-06-24 — Reel 039153/0321 (confirmed via the same recorded event appearing on family members US20150016604, US20130346748, US9165137)

• Conveyance: Patent Security Agreement
• Assignor (grantor): Security First Corp
• Assignee (secured parties): LG Management LLC plus a large syndicate of ~40 named LLCs and individuals, including Topspin SFC Holdings LLC, LTE Partners, Meythaler Investment Partners LLC, Zug Ventures LLC, Auber Investments Ltd., Coydog Foundation, DASA Investments LLC, Rola Investments LLC, Cooper Road LLC, and numerous individuals (David O'Reilly, Gerald R. Jordan Jr., Stephen Perlbinder, et al.).
• Correspondent: Not retrievable from my sources
• Context: A debt financing / patent-securitization structure — Security First Corp pledged the portfolio to an investor syndicate led by LG Management LLC. This is a lien, not a transfer of full title; Google Patents lists it as "Assigned to LG MANAGEMENT LLC, TOPSPIN SFC HOLDINGS LLC …" but the conveyance type is a security agreement.

3. Executed / recorded 2022-08-29 — reel/frame NOT confirmed in my sources

• Conveyance: Assignment of Assignors Interest
• Assignor: Security First Corp
• Assignee: Security First Innovations, LLC
• Correspondent: Not retrievable from my sources
• Context: Transfer of the portfolio (including the '140 patent) out of the operating company to the LLC that now appears as patent owner in litigation and PTAB proceedings. Conveyance type is a true assignment, not a change of name.

4. Executed / recorded 2022-09-30 — reel/frame NOT confirmed in my sources

• Conveyance: Release by Secured Party
• Assignor (releasing parties): the LG Management LLC syndicate and all ~40 secured parties named in the 2016 agreement
• Assignee (grantee of release): Security First Corp (per Google Patents event listing)
• Correspondent: Not retrievable from my sources
• Context: Termination of the 2016 security interest, recorded ~1 month after the transfer to Security First Innovations LLC — consistent with a debt restructuring/foreclosure settlement in which the portfolio moved to the Innovations LLC and the investors released their liens.

Bottom line: The Assignment Center is not empty for this patent — at least four conveyances are on record (original assignment, 2016 security agreement, 2022 assignment, 2022 release). The critical unverified items are reel/frame and correspondent for events 1, 3, and 4. Verify directly at the USPTO Assignment Center (search patent number 9338140): https://assignment.uspto.gov/patent/index.html — the corresponding recordation notices will supply the reel/frame and the correspondent-of-record attorney for each entry.

Timeline diagram

timeline
    title Ownership of US 9338140
    2004 : Priority provisional filed
    2012 : Continuation filed by Security First Corp
    2016 : Patent issued May 10
         : Security agreement to LG Management LLC
    2022 : Assigned to Security First Innovations LLC
         : Secured parties release liens
    2023 : EDVA case 1 23 cv 00329 filed
         : Google files IPR2024 00213
    2024 : IPR institution denied

NPE / troll-pattern signals

1. Shell-entity transfer — present (moderate strength). Reel 039153/0321 (2016) shows the operating company's portfolio pledged to an investor syndicate, and the 2022-08-29 recorded assignment (reel/frame unconfirmed) moved full title to Security First Innovations, LLC — a differently-named LLC, not a name change of Security First Corp. The current assignee appears in the record as patent owner in litigation (EDVA 1:23-cv-00329) and as respondent in IPR2024-00213, and no product activity by Security First Innovations LLC is evidenced in my sources. The name suffix alone is not the finding — the transfer-plus-assertion posture is.

2. Known asserter in the chain — unclear. Security First Innovations LLC is not on the classic public NPE lists I can confirm (Acacia, Marathon, IV, Wi-LAN, Conversant, etc.), and I could not verify an RPX or Unified Patents "high-frequency plaintiff" designation. It is the entity Unified Patents' portal tracks as the litigation/PTAB patent owner, and it is defending against Google's IPR, but that alone is not directory confirmation. Not confirmable from my sources.

3. Repeat correspondent across the chain — not assessable. Correspondent-of-record attorney/firm names are not present in any source I retrieved. This is the single most useful tell and must be pulled from the Assignment Center recordation notices for events 1–4. No data — do not treat absence as a negative finding.

4. Cascading transfers — not present. The chain is: 2012 inventor assignment → 2016 security agreement (lien) → 2022 assignment to SF Innovations → 2022 release. The two 2022 events are ~1 month apart, but the overall span is 10 years, and the 2016 event is a financing lien rather than a chained LLC-to-LLC title transfer. This does not fit the rapid shell-chain pattern.

5. Pre-litigation transfer — present (with a stated inference). The 2022-08-29 transfer to Security First Innovations LLC precedes the EDVA case 1:23-cv-00329 (2023) by only months. Independently, Google's IPR2024-00213 (filed 2023-11-27) could only be timely under 35 U.S.C. § 315(b) if Google was served with an infringement complaint on or after 2022-11-27 — i.e., no more than ~3 months after the transfer. That timing is consistent with a transfer arranged to establish the asserting entity's standing. Caveat: I could not retrieve the EDVA complaint date or defendant name to close the loop; the inference rests on the § 315(b) bar.

6. Bankruptcy fire-sale — not present. I found no Chapter 7/11 filing for Security First Corp and no sale order. The 2016 investor security agreement suggests financial distress/alternative financing, but that is not a bankruptcy.

7. Privateering — not present. No evidence that Security First Innovations is asserting on behalf of an operating company against that company's competitors, and no SEC filings or EFF/Patent Progress coverage to that effect were found.

8. Defensive aggregator (anti-NPE) — not present. The chain terminates at Security First Innovations LLC, which is asserting — not at RPX, AST, LOT, Unified Patents, or OIN. (Unified Patents appears only as the IPR-petition-side data/challenger ecosystem, not as an owner.)

Verdict

NPE — moderate confidence.

The strongest evidence is the 2022-08-29 transfer of the portfolio from operating company Security First Corp to Security First Innovations, LLC, followed within roughly three months by the earliest possible service of the infringement complaint underlying Google's IPR2024-00213 (filed 2023-11-27) and by the EDVA case 1:23-cv-00329 — the classic transfer-to-assertion-vehicle pattern — layered on top of the 2016 investor-syndicate security agreement (reel 039153/0321) that already pointed to portfolio monetization rather than product development. I stop short of "high confidence" because (a) I could not confirm Security First Innovations LLC's lack of operating business or its presence on a published NPE directory, and (b) the correspondent-of-record data — the best test of a repeat-player NPE attorney — was not retrievable from my sources and remains to be checked in the USPTO Assignment Center recordation notices for the 2022 transfers.

Verification link: https://assignment.uspto.gov/patent/index.html (search "9338140" for the full abstract of title; note reel/frame for the 2022-08-29 assignment and 2022-09-30 release and capture the correspondent names on each recordation notice).

I was unable to complete a full retrieval of the examiner's "References Cited" list (the front-page citation section) from the USPTO/Google Patents records within the search steps available. The Google Patents record for US9338140B2 that I fetched does not surface the citation table in the searchable text, and USPTO PatentCenter's citation listing is not indexable through the searches I ran. I will give you the verified findings, flag clearly what remains unverified, and provide the most relevant prior-art analysis that is supported by live search results and the post-grant record — rather than reconstructing a citation list from memory, which would risk fabrication.

What the searches confirmed about the '140 patent record

• Patent: US 9,338,140 B2, "Secure data parser method and system," inventors Mark S. O'Hare, Rick L. Orsini, Roger S. Davenport, Steven Winick; assignee Security First Corp. (now Security First Innovations, LLC). Filing May 10, 2012; grant May 10, 2016; priority to Oct. 25, 2004 (provisional 60/622,146 and 60/718,185). 17 claims, independent claims 1 and 11.
• Examiner: The Unified Patents portal record lists a name "Lemma, Samson" in association with this patent record, which is consistent with Samson Lemma being the primary examiner — but I could not independently confirm this against USPTO PatentCenter, so treat it as tentative.
• Most relevant prior art identified in the post-grant record: IPR2024-00213 (Google LLC v. Security First Innovations, LLC), which challenged claims 1–10 of the '140 patent over the combination of Ophir / Takeda / Birrell / Dickinson; the PTAB did not institute (denied on the Patent Owner Preliminary Response). This is the strongest signal in the record of which references the patent owner and challenger consider most relevant to the independent claim 1 and its dependents.

Most relevant prior art (verifiable at the reference-name level)

Because the live-search snippets gave me the inventor/reference names from the IPR ground but not full bibliographic numbers for each, I distinguish two tiers below.

Tier 1 — References whose relevance is confirmed by the IPR2024-00213 ground (claims 1–10)

Bottom line on Tier 1: The IPR petition's non-institution means the PTAB found the challenger's § 102/103 case insufficient on the merits — i.e., the record does not establish that these references, even in combination, anticipate claim 1. So while these four are the "most relevant" prior art asserted, no reference here has been shown to anticipate the independent claims.

Tier 2 — Claim-by-claim anticipation assessment (consistent with the IPR outcome and the prior summary)

• Claim 1 (system: virtual disk + hidden share locations + session-key-indicative data in each share + reconstitution): No single reference has been shown in any instituted or litigated ground to disclose the combination of a client-facing virtual disk whose directory hides physical share locations, shares generated by a securing operation, per-share session-key-identifying data, and reconstitution from stored shares. This is why IPR2024-00213 was not instituted.
• Claim 11 (standalone apparatus with programmed hardware processor): The same combination, recast as apparatus; same anticipation analysis as claim 1 (the full literal text of claim 11's closing recitation was not verifiable in my sources — flagged in the prior summary as well).
• Dependent claims 2, 6, 8, 9 (cryptographic securing/splitting operations, random distribution, encryption with the session key): These are the claims where Ophir/Takeda-type secret-sharing and encryption references are most plausibly directed, but the IPR ground combining them with Birrell/Dickinson failed institution.
• Claim 7 (reconstitution from fewer than all shares): Classic secret-sharing (threshold) teaching; any reference disclosing threshold reconstruction (e.g., Shamir-style splitting) is the strongest § 102 candidate for this dependent claim considered alone.
• Claim 3 (key-management server storing workgroup keys) and claim 5 (secure connection with the client): These add server-side key management and transport security that generic splitting references do not reach.

Honest limitations of this answer

1. I could not retrieve the complete examiner "References Cited" table (U.S. patents, foreign patents, and non-patent literature listed on the face of US9338140B2) from live USPTO or Google Patents data within the permitted search steps. The snippet views returned the abstract, family, and litigation metadata but not the citation table.
2. Accordingly, I am not listing specific examiner-cited U.S. patent numbers (e.g., any older splitting/secret-sharing patents) because I cannot verify them for this specific patent number, and the operating rules prohibit auto-correcting or guessing identifiers.
3. The four IPR reference names (Ophir, Takeda, Birrell, Dickinson) are confirmed by name from the previously compiled IPR2024-00213 record, but their full patent numbers and publication dates could not be re-verified in this session. If you need the exact numbers, the authoritative source is the IPR2024-00213 petition (PTAB / Unified Patents portal: https://portal.unifiedpatents.com/ptab/case/IPR2024-00213) or the issued patent's front page at USPTO PatentCenter (application 13/468,383).

If you can supply the front-page "References Cited" image or the IPR petition exhibit list, I can complete the per-reference full citations, dates, descriptions, and § 102 claim mappings you requested.

I'll research the key prior-art references identified in the IPR proceeding to ground the obviousness analysis.

Obviousness Analysis — U.S. Patent 9,338,140 B2 (35 U.S.C. § 103)

Scope and sourcing note. The prompt references a "Prior Art section of this page," but no such section was included in the materials provided. I therefore reconstructed the prior-art record from the verified IPR2024-00213 proceeding (Google LLC v. Security First Innovations, LLC, PTAB), the issued-patent PDF (patentimages 3f79a20d506e4f/US9338140.pdf), and the USPTO PTACTS petition documents. All reference numbers below are literal. Where my analysis conflicts with the prior summary section, I flag it.

One correction to the prior summary. The earlier summary described the IPR as challenging claims 1–10 "over Ophir/Takeda/Birrell/Dickinson." That is confirmed, but should be refined to the actual four grounds asserted (Petition, IPR2024-00213; verified at lowensteinweatherwax.com and docketalarm.com):

• Ground 1: Claims 1–6, 8, 10 over Ophir + Takeda;
• Ground 2: Claim 7 over Ophir + Takeda + Birrell;
• Ground 3: Claim 9 over Ophir + Takeda + Dickinson;
• Ground 4: Claims 1–10 over Dickinson + Takeda.

Institution was denied on June 6, 2024, and rehearing was denied July 30, 2024. Claim 11 (the second independent claim) was not challenged in the IPR.

I. The legal framework and the person of ordinary skill

Obviousness under § 103 asks whether the claimed subject matter as a whole would have been obvious to a person of ordinary skill in the art ("POSITA") at the time of the invention (priority date here: October 25, 2004), considering (1) the scope and content of the prior art, (2) differences between the prior art and the claims, (3) the level of ordinary skill, and (4) secondary considerations (Graham v. John Deere). A combination of references must be supported by an articulated reason with a rational underpinning — e.g., combining prior-art elements according to known methods to yield predictable results, or using a known technique to improve similar devices in the same way — plus a reasonable expectation of success (KSR Int'l Co. v. Teleflex Inc.).

A POSITA for this art would reasonably be characterized as someone with a bachelor's degree in computer science, computer/electrical engineering, or equivalent, and 2–4 years of experience in network security, secure storage, or applied cryptography — or a commensurate combination of education and industry experience. (The Petition's POSITA definition appears at Petition §V; I could not verify its exact text.)

II. The claimed invention (as construed in the IPR)

Claim 1 (the illustrative independent claim, element labels from the Institution Decision) recites:

1[PRE] A secure storage network comprising:
1A a plurality of physical storage devices storing thereon a plurality of shares, the plurality of shares being associated with at least one session key used to secure a dataset; and
1B a secure storage system configured to:
1B-1 present to a client device a virtual disk, the virtual disk comprising a directory mapped to the plurality of physical storage devices such that physical locations of the shares are hidden from the client device;
1B-2 generate the plurality of shares for storage on the plurality of physical storage devices by performing a securing operation on the dataset received from the client device and distributing the dataset in the shares;
1B-3 include with each of the plurality of shares data indicative of the at least one session key used to secure the dataset; and
1B-4 reconstitute the dataset from at least a portion of the plurality of shares … in response to a request from the client device for information in the dataset.

Dependent claims add: a cryptographic operation to generate shares (2); a key-management server storing workgroup keys (3); providing access to the reconstituted dataset (4); establishing a secure connection (5); shares containing a substantially random distribution (6); reconstitution from fewer than all shares (7); encryption with the session key (8); splitting using the session key (9); and per-share session-key-indicative data comprising a portion of the session key (10).

The two contested concepts in the IPR were (i) distributing portions of one dataset as "shares" across multiple physical storage devices, and (ii) the virtual-disk/directory view that hides share locations (1B-1), plus (iii) per-share session-key metadata (1B-3).

III. The principal prior-art references

Each of Ophir, Takeda, and Dickinson precedes the October 25, 2004 priority date and is proper § 102/§ 103 prior art for all 17 claims. The '140 patent's own cited-art list also includes other useful references (e.g., 5,485,474 Rabin on secret sharing; 6,557,123 Wiencko on RAID-style split storage; 7,107,385 Rajan on virtualizing disk objects on a file system) that a challenger could fold into alternative combinations.

IV. Combination 1 — Ophir + Takeda (Ground 1: claims 1–6, 8, 10)

A. Element mapping (petitioner's theory)

• 1A (physical storage devices storing shares): Ophir's mediator sits between data clients and a plurality of network-attached storage devices (storage devices 301/303/305 in Ophir's FIG. 3). Takeda supplies the "shares" concept: each encrypted block Cn is a portion of the secured dataset, i.e., a share.
• 1B, 1B-1 (secure storage system; virtual disk + hidden physical locations): Ophir expressly discloses that the mediator "provides secure virtual storage to data clients without requiring them to be involved in any of the encryption or decryption operations" (Abstract) and supports "block services" and "file services," with the client seeing a virtual storage view rather than the underlying physical devices — the functional equivalent of a virtual disk whose physical layout is hidden.
• 1B-2 (generating shares by a securing operation and distributing the dataset into shares): Ophir's encryption/decryption unit (517) performs the securing operation on client data. Takeda's block ciphering divides the dataset into blocks and independently encrypts each — "performing a securing operation on the dataset … and distributing the dataset in the shares."
• 1B-3 (include with each share data indicative of the session key): This is Takeda's core teaching — the output section "outputs the ciphertext and the ciphering attribute used for obtaining the ciphertext" (Takeda ¶[0007]). Each ciphertext block travels with its key/attribute data, i.e., data indicative of the key used to secure that block/dataset.
• 1B-4 (reconstitute from at least a portion): Ophir's mediator retrieves stored encrypted data from the storage devices and decrypts it before returning it to the requesting client (Ophir ¶[0012]); under Takeda, decryption refers to each block's attribute, decrypts the blocks, and recollects the results into the original plaintext.
• Dependent claims: claim 2 — Takeda's ciphering is a cryptographic operation; claim 3 — Ophir ¶[0032] discloses keys "stored on an external key server," a key-management server, and Takeda's per-block "access privilege" (FIG. 4) supplies the workgroup-restriction concept; claim 4 — the mediator returns decrypted, reordered data to the client; claim 5 — Ophir's in-transit encryption between client and mediator (with session-based transient keys, ¶[0015]) supplies a secure connection; claim 8 — Takeda encrypts each block with a per-block key, i.e., encryption with the session key.

B. Motivation to combine (rationale)

The petitioner's articulated rationales (Petition §VII.C) were: (1) increased reliability — Takeda's stated goal is that "even if a part of the data is deciphered, the rest of the data is not easily deciphered," and Ophir's mediator is expressly designed to be the central, transparent point at which stored-data protection is performed; substituting Takeda's more robust per-block ciphering for Ophir's whole-file encryption directly serves Ophir's security objective; (2) simple substitution — Takeda's ciphering/deciphering is a drop-in replacement for the algorithm performed by Ophir's encryption/decryption unit 517; (3) known technique used to improve similar devices in the same way — per-block encryption with per-block keys was a known technique for hardening encryption, and applying it inside a secure network-storage mediator is the kind of predictable improvement KSR contemplates; and (4) reasonable expectation of success — both references describe conventional symmetric encryption, and a POSITA would expect Takeda's block-ciphering to operate transparently behind Ophir's mediator interface.

C. Critical weakness (why the Board declined to institute)

The record shows the Board was not persuaded that a POSITA would distribute the blocks/shares of a single dataset across multiple physical storage devices. The Petitioner's own expert conceded the combination does not explain this gap: "nothing in either reference suggests splitting a dataset and storing different parts of that dataset amongst multiple storage devices," and neither Ophir nor Takeda teaches the dispersed-storage insight that the '140 patent claims (Ex. 1003 ¶¶ 59–64, as quoted in the Patent Owner Preliminary Response / Institution Decision). Ophir encrypts and stores data on storage devices; Takeda stores all of a file's ciphertext blocks together in a single output. On this record, mapping "shares" to Ophir's multiple devices was viewed as hindsight. This is the principal reason Ground 1 failed.

V. Combination 2 — Ophir + Takeda + Birrell (Ground 2: claim 7)

Claim 7 adds reconstitution from fewer than all of the shares. Birrell (US 7,529,834) was offered to supply redundant, fault-tolerant distributed storage in which the original dataset is recoverable when fewer than the total number of stored portions is available. The motivation rationale is the familiar one of adding erasure-coding/redundancy to a secure storage network to survive device loss — the same reliability rationale that drove RAID (see Wiencko, 6,557,123, in the '140's own cited art). Because claim 7 depends from claim 1, this ground rises and falls with Ground 1; if Ophir + Takeda does not render claim 1 obvious, Birrell cannot cure that defect.

VI. Combination 3 — Ophir + Takeda + Dickinson (Ground 3: claim 9)

Claim 9 requires the secure storage system to secure the dataset by splitting the dataset using the at least one session key. Dickinson was added for this limitation because it teaches the specific split-generation mechanics: generation of random values A and C, computation of B = A XOR S and D = C XOR S (Dickinson FIG. 8), with the random values functioning as splitting keys — a "splitting … using [a] key" operation. The combination theory: Ophir provides the mediator/storage network, Takeda provides per-block keys and ciphering attributes, and Dickinson provides the XOR-based splitting primitive that uses keys to divide S into share data. Motivation: all three operate in the same field (protecting stored data through encryption/splitting), and Dickinson's split algorithm is a known alternative way to "distribute the dataset in shares" that a POSITA would select to strengthen Ophir's protection. This ground also depends on Ground 1's threshold showing and was denied with it.

VII. Combination 4 — Dickinson + Takeda (Ground 4: all claims 1–10)

A. Element mapping (petitioner's theory)

Dickinson alone supplies most of the storage-network architecture: multiple physical data storage facilities D1–D4 storing split portions ("shares") of sensitive data; a trust engine whose data-splitting module generates B and D from S using random A and C and distributes pairings to the facilities; a data-assembling module that reconstitutes S from a subset of the facilities (two of four); SSL-secured connections (claim 5); the depository as a key-management server (claim 3); and random values producing a substantially random distribution in the shares (claim 6). Takeda is mapped, as in Ground 1, to the per-block attributes — including access privileges that make the stored keys "workgroup keys" (claim 3) and per-block output of the ciphering attribute with the ciphertext — the analog of "data indicative of the session key" included with each share (1B-3).

B. Motivation to combine

Dickinson's system already stores split data portions in multiple, geographically separate depositories precisely to prevent any single facility's compromise from exposing data. Takeda's per-block ciphering with per-block attributes is a known technique for increasing the difficulty of cryptanalysis (partial decryption does not reveal the rest), and a POSITA would be motivated to layer Takeda's per-block encryption onto Dickinson's split shares to obtain defense in depth — encrypting each share/block with its own key and storing the key identifier with the share so the assembling engine can decrypt on demand. That combination has a reasonable expectation of success because both references use conventional, well-documented cryptographic primitives (XOR and block ciphering) and modular server architectures.

C. Critical weaknesses (why the Board declined to institute)

The Patent Owner's Preliminary Response (and, evidently, the Board) identified two insurmountable gaps:

1. Limitation 1B-1 (virtual disk / directory / hidden physical locations). Dickinson's "trust engine" is, per the POPR, "a fundamentally different invention than the virtual disk of claim 1." Dickinson does not disclose a directory, a directory mapped to the plurality of physical storage devices, or a client-facing virtual disk that hides physical locations of the shares. Dickinson's depositories are back-end stores that the user never browses as a disk. The '140 patent's new virtual-disk disclosure (added in the continuation lineage) is what distinguishes claim 1 from Dickinson.
2. Limitation 1B-3 (data indicative of the session key with each share). Dickinson stores its randomized pairings without attaching per-share key metadata; Takeda's per-block attributes are ciphering attributes for blocks stored together in one ciphertext, not key metadata distributed with shares scattered across separate depositories. The POPR also noted Dickinson was expressly considered by the examiner during prosecution and found not to meet these limitations — and argued it should not be revisited.

VIII. Analyst assessment: which combinations are strongest and where the record stands

1. As a pure § 103 matter, the strongest challenger case is Dickinson + Takeda for the "splitting and distributing shares across multiple storage devices" elements (1A, 1B-2, 1B-4, claims 2–8, 10), because Dickinson is the only one of the four references that actually distributes portions of a single dataset across multiple independent physical storage facilities and reconstitutes from fewer than all of them. Its two conceded gaps are 1B-1 (virtual disk/directory hiding locations) and 1B-3 (per-share session-key metadata). Takeda plausibly fills 1B-3 (attribute-with-block output); nothing in the four references, standing alone, fills 1B-1. A petitioner wishing to retry this ground would likely need to add a storage-virtualization reference — e.g., US 7,107,385 (Rajan, cited on the face of the '140 patent) teaching a virtual disk with directories layered over physical storage — to supply the missing virtual-disk/directory limitation.

2. Ophir + Takeda is structurally weaker because neither reference teaches distributing portions of one dataset across multiple physical storage devices — the very heart of claim 1. The Board's denial of institution on that ground (and on rehearing) reflects a genuine hindsight problem: the petitioner had one reference with multiple shares stored together (Takeda) and another with multiple devices storing whole files (Ophir), and the "combination" merely asserted that the encrypted shares would land on the plurality of devices without explaining why a POSITA would have scattered them.

3. Practical litigation context. The IPR result is not a merits finding that the claims are patentable — a denial of institution carries no estoppel effect on the merits, and the same references remain usable in district court (where the '140 is asserted in E.D. Va., case 1:23-cv-00329) or in a redesigned petition. Any future § 103 challenge would most sensibly center on: (a) Dickinson (or its US-family member 6,853,988) for split/share storage; (b) a storage-virtualization reference (e.g., Rajan 7,107,385, or Ophir's own "secure virtual storage") for 1B-1; and (c) Takeda for per-block/session key metadata with each share (1B-3). The dependent limitations (3, 5, 6, 8, 10) are the easiest to map and least controversial; the battle is over 1B-1 and the "distributing the dataset in the shares" across physically distinct devices.

4. Caveats. I could not verify the full text of Birrell (US 7,529,834) or its effective filing date, nor the exact wording of the Board's Institution Decision beyond its outcome and the POPR's characterization of the arguments. The claim-1 element mapping above tracks the element labels used in the Institution Decision (verified), but the literal text of claims 11–17 was not verified in this exercise. If a future analysis needs to rely on claim 7's or claim 11's precise wording, it should be checked against the USPTO PatentCenter PDF (patentimages 3f79a20d506e4f/US9338140.pdf).