United States Court of Appeals for the Federal Circuit ______________________

PALO ALTO NETWORKS, INC., Appellant

v.

CENTRIPETAL NETWORKS, LLC, FKA CENTRIPETAL NETWORKS, INC., Appellee ______________________

2023-1636 ______________________

Appeal from the United States Patent and Trademark Office, Patent Trial and Appeal Board in No. IPR2021- 01150. ______________________

Decided: December 16, 2024 ______________________

ANDREW T. RADSCH, Ropes & Gray LLP, East Palo Alto, CA, argued for appellant. Also represented by JAMES RICHARD BATCHELDER; DOUGLAS HALLWARD-DRIEMEIER, Washington, DC; BRIAN LEBOW, New York, NY.

DANIEL NOAH LERMAN, Kramer Levin Naftalis & Frankel LLP, Washington, DC, argued for appellee. Also represented by JASON A. SHAFFER; PAUL J. ANDRE, JAMES R. HANNAH, Redwood Shores, CA; JEFFREY PRICE, New York, NY; JOHN R. HUTCHINS, SCOTT M. KELLY, BRADLEY CHARLES WRIGHT, Banner & Witcoff, Ltd., Washington, DC. Case: 23-1636 Document: 50 Page: 2 Filed: 12/16/2024

2 PALO ALTO NETWORKS, INC. v. CENTRIPETAL NETWORKS, LLC

______________________

Before DYK, STOLL, and STARK, Circuit Judges. STOLL, Circuit Judge. Palo Alto Networks, Inc. (“PAN”) successfully petitioned for inter partes review (IPR) of claims 1–18 of Centripetal Networks, LLC’s (“Centripetal’s”) U.S. Patent No. 10,530,903 (the “’903 patent”), asserting unpatentability for obviousness based on three prior-art references, two of which are relevant here. PAN appeals the final written decision of the United States Patent and Trademark Office Patent Trial and Appeal Board (the “Board”), which concluded that PAN had not established by preponderant evidence that the claims would have been obvious over the relevant prior art combination. Because the Board erred by failing to explain its holding and reasoning regarding motivation to combine, we vacate and remand. BACKGROUND I The ’903 patent is titled “Correlating Packets In Communications Networks” and discloses a “computing system” that may: (1) “identify packets received by a network device from a host located in a first network,” (2) “generate log entries corresponding to the packets received by the network device,” (3) “identify packets transmitted by the network device to a host located in a second network,” (4) “generate log entries corresponding to the packets transmitted by the network device,” and (5) “correlate the packets transmitted by the network device with the packets received by the network device.” U.S. Patent No. 10,530,903 at Title, Abstract. These packets are “small segments that together make up a larger communication.” Appellant’s Br. 5. Case: 23-1636 Document: 50 Page: 3 Filed: 12/16/2024

PALO ALTO NETWORKS, INC. v. CENTRIPETAL NETWORKS, LLC 3

The network device may include a device that alters the packets in a way that obfuscates the association of the packets received from the host with the corresponding packets generated by the network device. ’903 patent col. 5 ll. 16–22. Correlating the packets transmitted by the network device with the packets received by the network device may enable the computing system to determine that the packets transmitted by the network device are associated with a distinct end-to-end communication. Id. col. 1 ll. 53–62. In other words, the packet correlation technique de-obfuscates the identity of an obfuscated host. The specification notes “there is a need for correlating packets in communications networks.” Id. col. 1 ll. 27–28. “While such obfuscation may be done without malice, it may also be performed with malicious