Taasera Licensing LLC v. Bitdefender Holding BV

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: Taasera Licensing LLC (Texas)
  • Defendant: BITDEFENDER HOLDING B.V. (The Netherlands); Bitdefender Netherlands BV. (The Netherlands); Bitdefender SRL. (Romania)
  • Plaintiff's Counsel: Dematteo Law LLC
• Case Identification: 2:26-cv-00391, E.D. Tex., 05/21/2026
• Venue Allegations: Plaintiff alleges venue is proper because Defendants are not U.S. residents and may be sued in any judicial district. Venue is also alleged to be proper based on Defendants being subject to personal jurisdiction and having committed acts of patent infringement in the district.
• Core Dispute: Plaintiff alleges that Defendant's Bitdefender GravityZone Platform infringes five U.S. patents related to cybersecurity technologies, including managed security control, application attestation, runtime risk detection, and mobile device management.
• Technical Context: The lawsuit concerns the field of enterprise cybersecurity, where platforms are used to protect computer endpoints and mobile devices from malware, unauthorized access, and other digital threats.
• Key Procedural History: No prior litigation, inter partes review proceedings, or other significant procedural events are mentioned in the complaint.

Case Timeline

Date	Event
2002-01-04	U.S. Patent No. 7,673,137 Priority Date
2010-03-02	U.S. Patent No. 7,673,137 Issue Date
2011-02-17	U.S. Patent No. 8,327,441 Priority Date
2011-07-01	U.S. Patent No. 9,071,518 Priority Date
2012-05-01	U.S. Patent No. 8,990,948 Priority Date
2012-12-04	U.S. Patent No. 8,327,441 Issue Date
2013-01-15	U.S. Patent No. 8,850,517 Priority Date
2014-09-30	U.S. Patent No. 8,850,517 Issue Date
2015-03-24	U.S. Patent No. 8,990,948 Issue Date
2015-06-30	U.S. Patent No. 9,071,518 Issue Date
2026-05-21	Complaint Filing Date

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 7,673,137 - "System and Method for the Managed Security Control of Processes on a Computer System"

• Patent Identification: U.S. Patent No. 7,673,137, "System and Method for the Managed Security Control of Processes on a Computer System," issued March 2, 2010.

The Invention Explained

• Problem Addressed: The patent's background section notes that conventional security approaches are insufficient to deal with sophisticated "malware." It highlights that virtual execution methods for pre-screening code are limited and produce many false positives, while real-time monitoring solutions often detect malicious activity too late, after harm has already occurred '137 Patent, col. 1:49-2:68
• The Patented Solution: The invention proposes a two-phase security system operating at the kernel level. In the first "pre-execution" phase, the system determines if a new program has been previously approved and validates its integrity. If validated, the program runs with minimal monitoring. If not, it enters a second phase where its activities are closely monitored at the kernel level, allowing suspicious actions to be intercepted before they can damage the system '137 Patent, abstract '137 Patent, col. 3:25-4:18 The architecture is illustrated in the patent's Figure 1 '137 Patent, FIG. 1
• Technical Importance: This two-phase approach was designed to provide robust protection against both known and unknown threats while minimizing the performance overhead and user interruptions typically associated with continuous, intensive security monitoring.

Key Claims at a Glance

• The complaint asserts independent claim 1 Compl. ¶26
• Claim 1 of the '137 patent requires a system comprising:
  • A "pre-execution module" operable for receiving notice from the operating system that a new program is being loaded.
  • A "validation module" coupled to the pre-execution monitor and operable for determining program validity.
  • A "detection module" coupled to the pre-execution monitor for intercepting triggers from the operating system.
  • An "execution module" coupled to the detection module for monitoring the program at the operating system kernel.
• The complaint alleges infringement of "one or more claims" of the patent, which may include dependent claims Compl. ¶26

U.S. Patent No. 8,327,441 - "System and Method for Application Attestation"

• Patent Identification: U.S. Patent No. 8,327,441, "System and Method for Application Attestation," issued December 4, 2012.

The Invention Explained

• Problem Addressed: The patent background describes the trend toward cloud computing, where enterprises lose direct ownership and control of their IT infrastructure, creating a need for new security models to ensure the trustworthiness of applications running on remote, third-party platforms '441 Patent, col. 1:18-24
• The Patented Solution: The invention describes an "attestation service" that acts as a trusted broker. It receives a "runtime execution context" (e.g., what a program is doing) from an application and a "security context" (e.g., threat intelligence) from various "collaboration services." Based on these inputs, the server generates a formal "attestation result" in the form of a report or "application statement" that quantifies the security risks of the running application '441 Patent, abstract '441 Patent, FIG. 2 This attestation can then be used by other systems to make access control decisions.
• Technical Importance: This technology provides a framework for establishing and communicating a level of trust for applications operating in distributed or zero-trust environments, such as cloud and mobile computing.

Key Claims at a Glance

• The complaint asserts independent claim 1 Compl. ¶36
• Claim 1 of the '441 patent requires a method comprising:
  • Receiving, by a remote "attestation server", a "runtime execution context" and a "security context" for an application.
  • Wherein the attributes of the context comprise one or more "executable file binaries" and "loaded components".
  • Generating, by the server, a report indicating security risks based on the received contexts, as an "attestation result".
  • Sending, by the server, the attestation result associated with the application.
• The complaint alleges infringement of "one or more claims," which may include dependent claims Compl. ¶36

U.S. Patent No. 8,850,517 - "Runtime Risk Detection Based on User, Application, and System Action Sequence Correlation"

• Patent Identification: U.S. Patent No. 8,850,517, "Runtime Risk Detection Based on User, Application, and System Action Sequence Correlation," issued September 30, 2014.
• Technology Synopsis: The patent describes a method for assessing runtime risk by storing rules that identify specific "action sequences" (e.g., a user action followed by a system action) '517 Patent, col. 1:49-56 The system uses assessment policies to evaluate these sequences, identify a runtime risk, and generate a "behavior score" reflecting that risk '517 Patent, abstract
• Asserted Claims: Independent claim 1 Compl. ¶46
• Accused Features: The complaint alleges that the GravityZone Platform's rules databases (e.g., PHASR, HyperDetect, EDR rules), policy management features, and risk scoring modules (e.g., EDR Severity Score, ATC/Process Inspector scores) perform the claimed method Compl. Ex. C, pp. 2-13

U.S. Patent No. 8,990,948 - "Systems and Methods for Orchestrating Runtime Operational Integrity"

• Patent Identification: U.S. Patent No. 8,990,948, "Systems and Methods for Orchestrating Runtime Operational Integrity," issued March 24, 2015.
• Technology Synopsis: The invention provides a method for ensuring the operational integrity of applications in a computing environment. It involves monitoring various sensory inputs (e.g., network activity, system configuration), generating real-time events, correlating those events to classify threats based on their temporal sequence, and displaying the resulting status on runtime dashboards '948 Patent, abstract
• Asserted Claims: Independent claim 1 Compl. ¶56
• Accused Features: The complaint alleges that Bitdefender's BEST agent provides the "sensory inputs", the GravityZone backend performs "threat classifications" via its correlation engine, and the GravityZone Control Center and Executive Summary dashboards display the "real-time status indications" Compl. Ex. D, pp. 3-23 The complaint includes a diagram from Bitdefender's technical documentation showing the layered architecture of the GravityZone Platform Compl. Ex. D, p. 3

U.S. Patent No. 9,071,518 - "Rules Based Actions for Mobile Device Management"

• Patent Identification: U.S. Patent No. 9,071,518, "Rules Based Actions for Mobile Device Management," issued June 30, 2015.
• Technology Synopsis: The patent claims a method for managing a diverse fleet of mobile devices. The method involves a server gathering status information from multiple devices running different operating systems, formatting that information into a uniform structure, and storing it in a database '518 Patent, col. 1:52-2:2 This allows administrator-defined rules to be applied uniformly across the heterogeneous devices to automatically evaluate compliance and initiate actions '518 Patent, abstract
• Asserted Claims: Independent claim 1 Compl. ¶66
• Accused Features: The complaint alleges that the GravityZone Security for Mobile add-on infringes by gathering status from iOS, Android, and ChromeOS devices, normalizing this data in the GravityZone console, and allowing administrators to apply uniform Threat, Apps, and Content policies to initiate actions Compl. Ex. E, pp. 2-19 A screenshot from the Mobile Security console's OS Risk page shows a unified view of vulnerabilities across different operating systems Compl. Ex. E, p. 5

III. The Accused Instrumentality

Product Identification

The Bitdefender GravityZone Platform Compl. ¶23

Functionality and Market Context

The complaint describes the Accused Instrumentality as a comprehensive, multi-layered cybersecurity solution for enterprise environments. Its functionality includes endpoint protection, extended detection and response (EDR/XDR), risk management, behavioral monitoring, mobile threat defense, and incident investigation Compl. ¶23 The platform architecture consists of a centralized cloud-based management console (Control Center), endpoint agents (Bitdefender Endpoint Security Tools or "BEST"), and various security modules and sensors that operate across endpoints, mobile devices, and cloud services Compl. ¶23 The complaint alleges the platform uses rules, policies, and threat intelligence feeds to identify and respond to security risks Compl. ¶23

IV. Analysis of Infringement Allegations

7,673,137 Infringement Allegations

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
a pre-execution module operable for receiving notice from the computing device's operating system that a new program is being loaded onto the computing device;	The GravityZone Platform's pre-execution Application Control layer allegedly receives notice from the OS when a new program loads, evaluating each new process at start Compl. Ex. A, p. 4	¶31	col. 6:45-50
a validation module coupled to the pre-execution monitor operable for determining whether the program is valid;	The Application Control module allegedly serves as the validation module. It validates new programs against an approved-list and can use integrity-sensitive identifiers like file hash and digital certificate thumbprint to determine validity Compl. Ex. A, pp. 6-7	¶31	col. 9:4-33
a detection module coupled to the pre-execution monitor operable for intercepting a trigger from the computing device's operating system;	The GravityZone Platform's on-execution detection components, including the Process Introspection (PI) component, allegedly intercept triggers from the OS, such as those for process creation and module loading Compl. Ex. A, p. 10	¶31	col. 7:1-11
and an execution module coupled to the detection module and operable for monitoring, at the operating system kernel of the computing device, the program in response to the trigger intercepted by the detection module.	The GravityZone Platform allegedly monitors programs at the OS kernel level via its Advanced Threat Control (ATC) and PI components, which grade suspicious behaviors in response to intercepted triggers Compl. Ex. A, pp. 13-14 A diagram in the complaint illustrates this kernel-level interception of process operations Compl. Ex. A, p. 12	¶31	col. 4:1-18

• Identified Points of Contention:
  • Scope Questions: A primary question will be whether Bitdefender's distributed architecture, composed of multiple distinct security modules (e.g., Application Control, HyperDetect, Process Inspector), can be collectively mapped onto the more monolithic structure of a single "pre-execution module", "validation module", "detection module", and "execution module" as recited in Claim 1.
  • Technical Questions: The infringement theory relies on the allegation that Bitdefender's "validation module" performs an integrity check similar to the checksumming described in the patent '137 Patent, col. 9:15-33 A key factual question will be whether the accused Application Control feature, when using hash or certificate validation, performs a function equivalent to the claimed validity determination, or if it merely performs a simpler allow/deny list check.

8,327,441 Infringement Allegations

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
receiving, by the attestation server remote from the computing platform: (1) a runtime execution context indicating attributes of the application at runtime, and (2) a security context providing security information about the application,	The complaint alleges that the remote GravityZone Cloud backend acts as the attestation server, receiving runtime telemetry (execution context) and security analytics (security context) from the endpoint BEST agent Compl. Ex. B, pp. 2-4	¶41	col. 4:1-10
wherein the attributes comprise one or more executable file binaries of the application and loaded components of the application; and	The received runtime context allegedly includes executable file binaries and loaded components, which are identified via telemetry streams covering process creation, file manipulation, and module loading Compl. Ex. B, pp. 5-6	¶41	col. 4:11-17
generating, by the attestation server, a report indicating security risks associated with the application based on the received runtime execution context and the received security context, as an attestation result;	The GravityZone backend's correlation engine and Incident Advisor allegedly generate a security risk report (an "Incident") based on the received telemetry, which quantifies risk via a Severity Score and serves as the attestation result Compl. Ex. B, pp. 17-18	¶41	col. 2:12-21
sending, by the attestation server, the attestation result associated with the application.	The GravityZone Cloud allegedly sends the generated incident report (the "attestation result") to administrators and other systems through the GravityZone console, reports, and outbound SIEM feeds Compl. Ex. B, pp. 20-23	¶41	col. 2:45-51

• Identified Points of Contention:
  • Scope Questions: The case may turn on whether Bitdefender's EDR/XDR security analytics platform, which collects telemetry and generates security incidents, can be properly characterized as an "attestation server" that generates an "attestation result" as claimed. The defense may argue that "attestation" implies a formal vouching process distinct from general security incident reporting.
  • Technical Questions: What evidence does the complaint provide that the accused system's generated "incident" is based on both the "runtime execution context" and the "security context" as separate inputs, as required by the claim? The analysis will need to determine if Bitdefender's system distinguishes between raw telemetry and higher-level security analytics in a manner that maps to the claim's two-part "context" structure.

V. Key Claim Terms for Construction

U.S. Patent No. 7,673,137

• The Term: "validation module"
• Context and Importance: This term is critical because it defines the core of the patent's first-phase security check. The infringement allegation hinges on equating Bitdefender's "Application Control" feature with this module. The court's construction will determine if a simple allow/deny list function meets the claim, or if a more robust integrity check (like the patent's checksum example) is required.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The claim language states the module is "operable for determining whether the program is valid," which is a broad functional description '137 Patent, col. 12:21-22 Practitioners could argue this does not limit the method of determining validity to any specific technique.
  • Evidence for a Narrower Interpretation: The specification's only detailed embodiment of validation is a checksum comparison '137 Patent, FIG. 5 '137 Patent, col. 9:4-33 The patent also states the protector system validates "that the software program has not been altered" '137 Patent, abstract This could support an argument that "valid" requires an integrity check, not just an identity check.

U.S. Patent No. 8,327,441

• The Term: "attestation server"
• Context and Importance: This term is the central component of the claimed invention. The complaint alleges Bitdefender's GravityZone cloud backend is an "attestation server". The viability of this infringement theory depends entirely on whether the functions of a security analytics and incident correlation platform fall within the patent's definition of this term.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The patent describes the server's function broadly as generating a "report indicating security risks" based on received contexts '441 Patent, claim 1 Practitioners may argue that any remote server performing this function qualifies, regardless of its commercial name or primary purpose.
  • Evidence for a Narrower Interpretation: The specification repeatedly uses the term "attestation," which implies a formal process of bearing witness to or certifying a state of affairs. The patent also describes an "attestation broker" component '441 Patent, FIG. 2 that issues "application artifacts" and "application statements" '441 Patent, col. 2:12-28, suggesting a more structured and formal process than simply generating a security alert.

VI. Other Allegations

• Indirect Infringement: The complaint alleges that Bitdefender induces infringement by providing "instructions, documentation, and other information to customers and end-users urging them to use the Accused Instrumentality in an infringing manner" Compl. ¶29 Compl. ¶39 Compl. ¶49 Compl. ¶59 Compl. ¶69 It also alleges contributory infringement, stating the accused components are material to the inventions, are not staple articles of commerce, and have no substantial non-infringing uses Compl. ¶30 Compl. ¶40 Compl. ¶50 Compl. ¶60 Compl. ¶70
• Willful Infringement: The complaint seeks a finding of willfulness Compl. Prayer for Relief, ¶b The factual allegations for knowledge are based on the date Bitdefender is served with the complaint, which may support a claim for post-suit willful infringement Compl. ¶29 Compl. ¶39 Compl. ¶49 Compl. ¶59 Compl. ¶69

VII. Analyst's Conclusion: Key Questions for the Case

• A core issue will be one of definitional scope: can the term "attestation server" from the '441 patent, described in the context of formally issuing artifacts and statements to vouch for an application's state, be construed to cover a commercial EDR/XDR platform that correlates telemetry to generate security incidents and risk scores?
• A second key question will be one of structural and functional mapping: does Bitdefender's distributed, multi-layered security architecture meet the limitations of the more sequential, modular system claimed in the '137 patent, particularly with respect to the "pre-execution module" and "validation module" elements?
• A central evidentiary question will be one of technical equivalence: does the functionality of the accused GravityZone platform, as revealed through discovery, align with the specific technical operations required by the claims? For instance, for the '517 patent, does the platform's logic identify a multi-part "action sequence" and generate a "behavior score" based on that sequence, or does it operate on a different technical principle?