Microsoft Corp v. Biogy Inc

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: Microsoft Corp (Washington)
  • Defendant: Biogy, Inc. (Delaware)
  • Plaintiff's Counsel: Fish & Richardson P.C.
• Case Identification: 3:25-cv-04957, N.D. Cal., 06/11/2025
• Venue Allegations: Venue is alleged to be proper in the Northern District of California because Defendant Biogy, Inc. is subject to personal jurisdiction in the district and maintains its principal place of business in San Francisco.
• Core Dispute: Plaintiff Microsoft seeks a declaratory judgment that its authentication products do not infringe Defendant Biogy's patent related to systems for generating and verifying temporary passcodes.
• Technical Context: The technology at issue is multi-factor authentication, specifically the use of Time-Based One-Time Passcodes (TOTPs) to secure access to digital accounts and services.
• Key Procedural History: The complaint states that Biogy has sent notice letters to Microsoft's customers, alleging infringement of the patent-in-suit. It also notes that Biogy has filed a lawsuit against a Microsoft customer, Albertsons Companies, Inc., in the Eastern District of Texas over the same patent and technology. The complaint further mentions that Biogy is in litigation with Okta, Inc. and has communicated to Microsoft that it perceives no substantial difference between the infringement theories against Microsoft and Okta.

Case Timeline

Date	Event
2004-12-20	U.S. Patent No. 7,669,236 Priority Date
2010-02-23	U.S. Patent No. 7,669,236 Issue Date
2024-04-24	Date of exemplary notice letter sent to Microsoft customer Albertsons
2025-06-11	Complaint Filing Date

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 7,669,236 - Determining Whether to Grant Access to a Passcode Protected System

The patent is also referred to as the "'236 Patent".

The Invention Explained

• Problem Addressed: The patent's background section identifies the dual problems of password proliferation, making them difficult for users to remember, and the susceptibility of static passwords to theft and fraud ʼ236 Patent, col. 1:41-44
• The Patented Solution: The invention proposes a system comprising a user's "passcode device" and a server-side "administrator" to create temporary, single-use passcodes ʼ236 Patent, col. 3:21-28 Instead of storing the passcode itself, the administrator stores a "passcode generator" (also called a "seed"), which is initially derived from user-specific information ʼ236 Patent, col. 9:11-19 To authenticate, both the user device and the administrator use their synchronized passcode generators to independently generate a passcode; access is granted if they match ʼ236 Patent, FIG. 9 Critically, after a successful authentication, the system "applies a function to the current passcode generator to generate a new passcode generator" and stores this new generator for the next use, ensuring the old passcode is no longer valid ʼ236 Patent, cl. 5
• Technical Importance: This method aims to enhance security by ensuring passcodes are ephemeral and by removing the need for the server to store either static passwords or the temporary passcodes themselves, reducing the value of a compromised server database ʼ236 Patent, col. 4:5-15

Key Claims at a Glance

• The complaint identifies independent claims 5, 12, and 24, as well as dependent claim 14, as being asserted by Biogy Compl. ¶¶28 Compl. ¶44
• Independent Claim 5 recites a method comprising:
  • Generating a temporary passcode based on user information.
  • Determining if access is permitted by matching the generated passcode to a received passcode.
  • Wherein the generation step involves creating a "current passcode generator" and generating the passcode from it.
  • Upon a successful match, "applying a function to the current passcode generator to generate a new passcode generator" and "storing the new passcode generator in place [of] the current passcode generator."
• Independent Claim 12 recites a similar method that involves:
  • Receiving a passcode from a user.
  • Retrieving a "passcode generator" from storage.
  • Generating a passcode from the generator and comparing it to the received passcode.
  • Upon a successful match, "perturbing" the passcode generator to create a new one and storing it.
• Independent Claim 24 recites a method involving:
  • Receiving a "user-generated passcode" after a registration process.
  • In response, generating an "administrator-generated passcode" from a "current passcode generator."
  • Determining if the two passcodes match.
  • Upon a successful match, "generating a new passcode generator from the current passcode generator" and storing it.

III. The Accused Instrumentality

Product Identification

Microsoft Entra ID and Microsoft Authenticator, collectively referred to as the "Accused Products" Compl. ¶4

Functionality and Market Context

• Microsoft Entra ID is described as a cloud-based identity and access management service, and Microsoft Authenticator is an application used for account sign-in Compl. ¶¶2-3
• The specific accused functionality is an optional feature in both products that generates and processes Time-Based One-Time Passcodes (TOTPs) for multi-factor authentication Compl. ¶¶9-10 Compl. ¶13
• Biogy's infringement allegation, as characterized by the complaint, is that Microsoft's implementation of the public "RFC 6238 Standard" for TOTP infringes the ʼ236 Patent Compl. ¶6 An exhibit attached to the complaint includes a diagram illustrating the basic operation of a TOTP system, where a client token and a server system both use a shared secret key and the current time to generate and compare an OTP Compl. Ex. C at 4 Another visual shows a user being prompted to enter a one-time passcode to verify their account, demonstrating the user-facing application of the technology Compl. Ex. C at 2

IV. Analysis of Infringement Allegations

This action is for declaratory judgment of non-infringement. The table below summarizes Biogy's infringement theory against Microsoft's products, as detailed in the complaint and its exhibits, which Microsoft contends is incorrect.

'236 Patent Infringement Allegations

Claim Element (from Independent Claim 5)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
generating, via a machine, a passcode that is valid temporarily, wherein the passcode is based on information associated with a user...	The Accused Products implement the TOTP algorithm (RFC 6238), where servers generate a temporary OTP based on a shared secret key (K) unique to the user.	¶28; Ex. C at 4; Ex. C at 5	col. 9:1-5
determining whether an attempted access is permitted... by at least determining whether the passcode generated matches a passcode received;	The server-side TOTP system compares the OTP it generated with the OTP received from the user's device to determine if they are equal.	¶28; Ex. C at 4	col. 14:10-15
generating a current passcode generator based on the information...	The TOTP algorithm uses a combination of a static shared secret key (K) and a dynamic, time-based moving factor (T) as the basis for generating the passcode. This combination is alleged to function as the "passcode generator."	¶28; Ex. C at 7	col. 9:11-13
generating the passcode from the current passcode generator;	The TOTP value is generated from the TOTP algorithm (e.g., HOTP(K, T)), which allegedly constitutes generating the passcode from the generator.	¶28; Ex. C at 7	col. 13:1-5
applying a function to the current passcode generator to generate a new passcode generator;	The TOTP algorithm's moving factor is time-based, with the "timestep" (e.g., 30 or 60 seconds) advancing automatically. This automatic progression of time is alleged to be the "function" applied to create a "new" generator.	¶28; Ex. C at 8	col. 13:5-8
storing the new passcode generator in place the current passcode generator.	As time progresses, the time-based moving factor for the next timestep implicitly replaces the previous one. This is alleged to be equivalent to storing a new generator. Microsoft, however, argues its products do not store any new passcode generator.	¶28; ¶49; Ex. C at 8	col. 13:8-10

Identified Points of Contention

• Scope Questions: A primary point of contention, as framed by Microsoft's complaint, is whether the mechanisms of the standard TOTP protocol (RFC 6238) map onto the specific claim language of the ʼ236 Patent. Microsoft's complaint explicitly denies that its products "perturb a current passcode generator to generate a new passcode generator" or "store any such new passcode generator in place of a prior/current passcode generator" Compl. ¶49 This raises the question of whether the automatic progression of a time-based counter in TOTP constitutes the active steps of "applying a function" to a generator and "storing" a new one, as claimed.
• Technical Questions: The complaint raises a question about the interpretation of "based on information associated with a user" Compl. ¶49 The ʼ236 Patent specification discusses deriving the passcode generator from user-specific information like biometrics ʼ236 Patent, col. 7:1-4 The dispute may turn on whether a randomly generated "shared secret" key, as is typical in TOTP systems, satisfies this limitation, or if the claim requires information more intrinsic to the user, as suggested by the patent's examples.

V. Key Claim Terms for Construction

• The Term: "passcode generator"

• Context and Importance: This term is the central component of the claimed invention. The outcome of the case may depend on whether the combination of a static secret key and a dynamic time-step counter, as used in the accused TOTP systems, falls within the scope of this term. Microsoft's non-infringement argument appears to hinge on a narrow definition Compl. ¶49

• Intrinsic Evidence for Interpretation:

  • Evidence for a Broader Interpretation: The patent states that a "passcode generator, also known as a seed, can be a string of characters or other form of a code" ʼ236 Patent, col. 9:11-13 This could support an argument that the combination of the secret key and the current time value functions as the "passcode generator."
  • Evidence for a Narrower Interpretation: The specification repeatedly describes a discrete, state-changing process where a new generator "G_ui+1" is explicitly created from a prior one "G_ui" via a function "f" (e.g., "f(Gui)=Gui+1") and then stored (ʼ236 Patent, FIG. 9, step 916; ʼ236 Patent, col. 14:1-5). This language suggests an active, programmatic update rather than the passive, automatic progression of universal time, which may support Microsoft's position that its products do not "generate a new passcode generator" Compl. ¶49

• The Term: "perturbing" (from claim 12) / "applying a function" (from claim 5)

• Context and Importance: These action verbs define how the "passcode generator" evolves. Whether the automatic incrementing of a time counter in a standard TOTP system constitutes "perturbing" or "applying a function" to the generator itself is a critical question for the infringement analysis.

• Intrinsic Evidence for Interpretation:

  • Evidence for a Broader Interpretation: The patent offers broad examples for the perturbing function "f", including simple arithmetic like adding 1 or 2, or applying binary operators, which could be argued to be analogous to incrementing a time counter ʼ236 Patent, col. 21:1-10
  • Evidence for a Narrower Interpretation: The claim structure and specification consistently frame this as an active step taken in response to a successful authentication (e.g., "if the one passcode matches... perturbing the... passcode generator") ʼ236 Patent, cl. 12 This may support an argument that it requires a conditional, event-driven update, which is distinct from the unconditional, continuous advancement of time in a TOTP system.

VI. Other Allegations

• Indirect Infringement: The complaint acknowledges that Biogy has effectively alleged that Microsoft induces its customers to infringe by providing instructions on using the TOTP functionality of the Accused Products Compl. ¶14 Compl. ¶39
• Willful Infringement: The complaint does not mention a direct allegation of willfulness from Biogy. However, it establishes Microsoft's pre-suit knowledge of the ʼ236 Patent and Biogy's infringement allegations through correspondence and indemnification requests from customers, which could form the basis for a future willfulness claim by Biogy Compl. ¶40

VII. Analyst's Conclusion: Key Questions for the Case

• A central issue will be one of definitional scope: Can the claim term "passcode generator"-described in the patent as an entity that is actively "perturbed" or has a "function applied" to it to create a new, stored version-be construed to cover the combination of a static secret key and an automatically advancing time counter as implemented in the industry-standard TOTP protocol (RFC 6238)?
• A second key issue will be a functional comparison: Does the standard TOTP authentication process, which relies on a pre-shared secret key and synchronized time, perform the specific sequence of steps recited in the independent claims, particularly the discrete act of generating and storing a new "passcode generator" after a successful match?
• Finally, the case raises a broader question of standards and patents: The dispute will require the court to determine whether the implementation of a widely adopted public security standard (RFC 6238) infringes the specific, arguably more complex, method patented by Biogy.