DCT

3:25-cv-03330

Microsoft Corp v. Biogy Inc

Key Events

Complaint

complaint Intelligence

I. Executive Summary and Procedural Information

Parties & Counsel:
- Plaintiff: Microsoft Corp (Washington)
- Defendant: Biogy, Inc. (Delaware)
- Plaintiff's Counsel: Fish & Richardson P.C.
Case Identification: 3:25-cv-03330, N.D. Cal., 04/14/2025
Venue Allegations: Venue is alleged to be proper in the Northern District of California because Defendant Biogy, Inc. has its principal place of business in San Francisco and therefore "resides" in the district.
Core Dispute: Plaintiff Microsoft seeks a declaratory judgment that its Microsoft Entra ID product does not infringe Defendant Biogy's patent related to temporary passcode authentication systems.
Technical Context: The lawsuit concerns time-based one-time passcode (TOTP) technology, a widely used standard for multi-factor authentication to secure access to digital services.
Key Procedural History: The complaint states that this declaratory judgment action was filed in response to Biogy sending notice letters to Microsoft's customers, alleging their use of Microsoft Entra ID infringes the patent-in-suit. Biogy has also filed a patent infringement lawsuit against at least one Microsoft customer, Albertsons Companies, Inc., in the Eastern District of Texas, based on the same allegations.

Case Timeline

Date	Event
2004-12-20	'236 Patent Priority Date
2010-02-23	U.S. Patent No. 7,669,236 Issues
2024-04-24	Biogy sends notice letter to Microsoft customer Albertsons
2025-04-14	Complaint for Declaratory Judgment Filed

II. Technology and Patent(s)-in-Suit Analysis

Patent Identification: U.S. Patent No. 7,669,236, "DETERMINING WHETHER TO GRANT ACCESS TO A PASSCODE PROTECTED SYSTEM," issued February 23, 2010.
The Invention Explained:
- Problem Addressed: The patent's background section describes the problems associated with traditional passwords, namely that users have too many to remember and that they are susceptible to fraud if stolen '236 Patent, col. 1:40-44
- The Patented Solution: The patent proposes a system where a user device generates a new, temporary passcode for each access attempt '236 Patent, col. 3:20-24 This is achieved using a "passcode generator" (also referred to as a "seed") that is stored on both the user device and an authenticating "administrator" system '236 Patent, col. 9:11-25 After a successful authentication, both the device and the administrator independently update their respective passcode generators by applying the same function, ensuring they remain synchronized for the next access request '236 Patent, col. 5:47-53 '236 Patent, Fig. 8 This process of generating a new passcode from an evolving "passcode generator" makes any single intercepted passcode invalid for future use '236 Patent, col. 4:47-54
- Technical Importance: The invention describes a method for dynamic, one-time-use credentials, which provides significantly higher security than static, reusable passwords.
Key Claims at a Glance:
- The complaint identifies independent claims 5, 12, and 24 as being at issue Compl. ¶19
- Independent Claim 5: A method comprising:
  - generating a temporary passcode based on user information;
  - determining if access is permitted by matching the generated passcode to a received passcode;
  - wherein the passcode generation includes generating a "current passcode generator" and then generating the passcode from that "current passcode generator";
  - if a match occurs, granting access, "applying a function to the current passcode generator to generate a new passcode generator", and "storing the new passcode generator".
- Independent Claim 12: A method comprising:
  - receiving a passcode from a user;
  - retrieving a "passcode generator" from storage;
  - generating a passcode from the generator and determining if it matches the received passcode;
  - if a match occurs, granting access, "perturbing" the passcode generator to create a new one, and storing the new one.
- Independent Claim 24: A method comprising:
  - receiving a "first user-generated passcode";
  - in response, an automated administrator generates an "administrator-generated passcode" from a "current passcode generator";
  - determining if the two passcodes match;
  - if a match occurs, permitting access, "generating a new passcode generator from the current passcode generator", and storing it.
- The complaint also mentions dependent claim 14 Compl. ¶19

III. The Accused Instrumentality

Product Identification: Microsoft Entra ID, specifically its optional functionality for generating and processing Time-based One-time Passcodes ("TOTPs") for multi-factor authentication Compl. ¶2
Functionality and Market Context:
- Microsoft Entra ID is described as a cloud-based identity and access management service Compl. ¶2 The accused functionality is its implementation of the TOTP standard, as defined in IETF RFC 6238, to provide temporary verification codes for users Compl. ¶10 Compl. Ex. C, p. 2
- Biogy's allegations, referenced in the complaint, contend that "any implementation of the 'TOTP Algorithm' infringes" the asserted claims Compl. ¶20 Biogy's attached claim chart shows a diagram of the TOTP process, which involves a shared secret key and a time-based moving factor to generate a one-time password Compl. Ex. C, p. 4

IV. Analysis of Infringement Allegations

The infringement allegations are based on Biogy's exemplary claim chart attached to the complaint as Exhibit C, which was created for litigation against a Microsoft customer Compl. ¶16 Compl. ¶21 This chart alleges that use of the standard TOTP algorithm infringes the '236 patent.

'236 Patent Infringement Allegations

Claim Element (from Independent Claim 12)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
receiving at a machine a passcode from a user;	The validation server (machine) in a TOTP system receives an OTP (passcode) from a user's device Compl. Ex. C, p. 10	¶19	col. 22:5-7
retrieving at least one passcode generator from a storage unit associated with the machine;	The server retrieves the time-based variant of the HOTP algorithm, which is based on a shared secret key (K) that functions as the passcode generator Compl. Ex. C, p. 11	¶19	col. 27:54-57
generating at least one passcode from the at least one passcode generator;	The server calculates a TOTP value (passcode) using the shared secret key (K) and the current time value (T) as inputs to the HOTP algorithm Compl. Ex. C, p. 11	¶19	col. 27:58-61
determining whether the at least one passcode...matches the passcode received;	The server compares its generated TOTP value with the OTP value received from the user to see if they are equal Compl. Ex. C, p. 12	¶19	col. 28:1-5
if the one passcode matches...granting the user access to a secure entity;	If the passcodes match, the system grants the user access to the secured network application (e.g., VPN, web application) Compl. Ex. C, p. 12	¶19	col. 28:6-9
perturbing the at least one passcode generator...to create a new passcode generator;	The moving factor in TOTP is time-based, not counter-based. The system "perturbs" the generator by changing the time-based counter to create a new passcode Compl. Ex. C, p. 13	¶19	col. 28:10-14
storing the new passcode generator in place of the at least one passcode generator.	The new passcode generator (based on the new time value) is stored in place of the previous one Compl. Ex. C, p. 13	¶19	col. 28:15-17

Identified Points of Contention:
- Scope Questions: Microsoft's complaint raises fundamental questions about the scope of the patent claims relative to the standard TOTP algorithm. The complaint asserts that the accused product does not perform several claimed steps Compl. ¶¶28-32 A central issue may be whether the term "passcode generator", which the patent describes as being updated via a function "f(G_i)=G_i+1" '236 Patent, col. 9:42-44, can be construed to cover the TOTP algorithm's use of a static shared secret combined with an independently advancing time value. Microsoft explicitly argues its product does not "perturb a current passcode generator to generate a new passcode generator" or "store any such new passcode generator" Compl. ¶32
- Technical Questions: A key technical question is whether the TOTP algorithm's reliance on time as a "moving factor" Compl. Ex. C, p. 13 is equivalent to the claimed act of "perturbing" or "applying a function to" a "current passcode generator" to create and store a "new passcode generator". Microsoft's position suggests a fundamental operational mismatch, arguing that its product does not generate a new generator at all, but rather computes a passcode from a static key and the current time Compl. ¶32 This is contrasted with Biogy's allegation, shown in a diagram, that the time-based "Moving Factor" acts on a "Secret Key" to produce the OTP Compl. Ex. C, p. 13

V. Key Claim Terms for Construction

The Term: "passcode generator"
Context and Importance: This term is the core of the claimed invention's state-keeping mechanism. The patent repeatedly describes a process where a "current passcode generator" is used and then updated to become a "new passcode generator" for the next cycle '236 Patent, col. 9:42-44 '236 Patent, claim 5 The dispute centers on whether the components of the standard TOTP algorithm (a static secret key and a time value) meet this definition. Practitioners may focus on this term because if TOTP's mechanism is found not to be a "passcode generator" that is "perturbed" and "stored," Biogy's infringement theory may fail.
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The patent states a "passcode generator, also known as a seed, can be a string of characters or other form of a code" '236 Patent, col. 9:11-13 This broad language could support an argument that the shared secret key in TOTP is a "seed" and thus a "passcode generator".
- Evidence for a Narrower Interpretation: The patent consistently describes a process where the generator itself is changed and stored, as in "f(G_i)=G_i+1" and "storing the new passcode generator" '236 Patent, col. 9:42-44 '236 Patent, claim 12 This suggests an iterative, state-dependent process. This could support an argument that the TOTP algorithm, which uses a static key and an external, independently advancing time value, does not "perturb" and "store" a "new" generator as claimed, but rather performs a calculation with one static and one dynamic input.
The Term: "based on information associated with a user"
Context and Importance: Claims 5 and 24 require the passcode to be based on user-associated information. Microsoft denies its product does this Compl. ¶32 The viability of Biogy's infringement case against TOTP implementations depends on whether the "shared secret" key used in TOTP qualifies as this claimed "information."
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The patent notes that the item used to generate passcodes "is uniquely associated with the user" '236 Patent, col. 4:42-43 A party could argue that the shared secret key in TOTP, which is unique to each user's enrollment, fits this description.
- Evidence for a Narrower Interpretation: The specification provides examples of "identifying information" such as "fingerprints, a name, a birthday, a favorite number, a social security number, and/or a driver's license" '236 Patent, col. 4:26-30 This list of personal, biometric, or biographic data could support a narrower construction that excludes a randomly generated, static secret key that the user themselves does not know.

VI. Other Allegations

Indirect Infringement: Microsoft seeks a declaratory judgment that it is not liable for indirect infringement Compl. ¶26 The complaint notes that Biogy's allegations against its customers are premised on Microsoft providing the accused product and "allegedly instructing them on the use of the Accused Product" Compl. ¶24, which are the foundational elements for claims of induced and contributory infringement.
Willful Infringement: While not an explicit count in this DJ action, the factual predicate for willfulness is present. The complaint is filed in response to Biogy's "near-identical letters" sent to Microsoft's customers, putting them and, by extension, Microsoft on notice of the alleged infringement Compl. ¶¶16-17

VII. Analyst's Conclusion: Key Questions for the Case

This case appears to be a direct challenge to the applicability of the '236 patent to the widely adopted, industry-standard TOTP authentication protocol. The resolution will likely depend on the court's interpretation of a few key claim terms and their application to the specific mechanics of the TOTP algorithm. The central questions for the court include:

A core issue will be one of definitional scope: Can the patent's concept of a "passcode generator" that is iteratively "perturbed" or updated and then "stored" ("f(G_i)=G_i+1") be construed to read on the TOTP algorithm, which uses a static secret key combined with an external, independently advancing time value?
A second key issue will be one of technical interpretation: Does the term "based on information associated with a user" encompass the static, shared secret key used in the TOTP standard, or does the patent's specification limit this term to more personal or biometric data like fingerprints and birthdays?
An overarching question of process equivalence: Does the accused TOTP functionality, as a whole, operate in a manner equivalent to the specific, multi-step generation and update cycles claimed in the patent, or is there a fundamental mismatch between the patent's stateful, iterative generator model and the TOTP algorithm's stateless computational model?

Loading Complaint