2024-1170, 2024-1274

Appeals from the United States Patent and Trademark Office, Patent Trial and Appeal Board in Nos. IPR202200646, IPR2023-00259.

Decided: December 9, 2025

KARIM ZEDDAM OUSSAYEF, Desmarais LLP, New York, NY, argued for appellant. Also represented by TAEG SANG CHO, YUNG-HOON HA; ADAM STEINMETZ, Washington, DC.

SHAWN DANIEL BLACKBURN, Susman Godfrey LLP, Houston, TX, argued for cross-appellants. Also represented by MENG XI; IAN B. CROSBY, STEVEN M. SEIGEL, Seattle, WA.

Before TARANTO, CHEN, and STOLL, Circuit Judges .

Page 2CHEN, Circuit Judge.

International Business Machines Corporation (IBM) appeals from a Patent Trial and Appeal Board (Board) decision holding claims 1–4, 12–16, and 18–19 in U.S. Patent No. 7,631,346 (’346 patent) unpatentable. See Ebates Performance Mktg., Inc. v. Int'l Bus. Machs. Corp. , No. IPR2022-00646, 2023 WL 7358027, at *1 (P.T.A.B. Oct. 11, 2023) ( Decision ). Zillow Group, Inc. and Zillow, Inc. (collectively, Zillow) cross-appeal the Board’s decision holding claims 5–11, 17, and 20 not unpatentable. Id. We affirm both the appeal and cross-appeal.

IBM’s ’346 patent relates to systems and methods for single sign-on (SSO) operations. See '346 patent at Abstract; id. at claim 1 . SSO allows a user to create (and, subsequently, log into) several accounts using only a single set of login credentials. See Appellant's Opening Br. 3; Cross-Appellant’s Opening & Resp. Br. 7.

Consider a hypothetical example, taken from IBM's principal brief, to better understand the claimed invention. See Appellant’s Opening Br. 3. A user might first log into a social media website using her user identification and password. Now, imagine that same user wishes to access discounts for medication on the website of a third-party healthcare provider, but cannot, because the healthcare provider only allows authenticated users (i.e., users with an account on the healthcare provider website) to access such discounts. SSO allows the healthcare provider to honor the user’s authentication at the social media website, without requiring the user to separately authenticate with the healthcare provider; it saves the user from having to create separate authentication credentials for every website.

Page 3The ’346 patent uses the terms “first system,” “second system,” “protected resources,” and “fourth system,” when describing the claimed invention. E.g. , '346 patent at claims 1, 14. “First system” refers to the entity performing the initial authentication (e.g., the social media site in the above example). Appellant's Opening Br. 5; see '346 patent at claim 1. 'Second system' corresponds to the entity which the user desires to access (e.g., the healthcare provider in the above example). Appellant's Opening Br. 6; see ’346 patent at claim 1. “Protected resources” refers to the access-restricted content managed by the second system. See '346 patent col.⁶ ll. 26-30. Finally, the 'fourth system' refers to the user's computer itself. Decision , 2023 WL 7358027, at *19.

Claim 1, representative for IBM’s appeal, recites: 1. A method for managing user authentication within a distributed data processing system, wherein a first system and a second system interact within a federated computing environment and support single-sign-on operations in order to provide access to protected resources , at least one of the first system and the second system comprising a processor, the method comprising[:]

triggering a single-sign-on operation on behalf of the user in order to obtain access to a protected resource that is hosted by the second system, wherein the second system requires a user account for the user to complete the single-sign-on operation prior to providing access to the protected resource;

receiving from the first system at the second system an identifier associated with the user ; and

creating a user account for the user at the second system based at least in part on the received identifier associated with the user

Page 4after triggering the single-sign-on operation but before generating at the second system a response for accessing the protected resource, wherein the created user account supports single-sign-on operations between the first system and the second system on behalf of the user.

’346 patent at claim 1 (emphases added). In plain English: where a platform (the “second system”) contains access-restricted content (“protected resources”), use a unique identifier (already stored within the “first system”) to create an account on the platform.

Claim 5, representative for Zillow's cross-appeal, recites:

5. The method of claim 1 further comprising:

in response to a determination at the second

system that the second system does not have

sufficient user attribute information to com-

plete creation of a user account for the user

at the second system, sending a request

message from the second system

system to the first to retrieve user attribute infor- mation; and

receiving at the second system from the

first system a response message that con-

tains user attribute information that is em-

ployed by the second system to complete

creation of a user account for the user at the second system.

’346 patent at claim 5 (emphases added).

Page 5These appeals turn on a single prior art reference, Sunada.¹ Sunada discloses a 'Network Apparatus and Authentication Server.” J.A. 1914. Much like the ’346 patent, Sunada's server allows a user to create an account on a third-party website by using information already stored elsewhere. See id .

Ebates Performance Marketing, Inc., doing business as Rakuten Rewards (Rakuten), petitioned for inter partes review of the ’346 patent. See J.A. 108. It raised a single anticipation challenge under § 102 and three obviousness challenges under § 103.

Sunada features prominently in Rakuten’s § 102 and § 103 challenges.² See id. at 136-78. Relevant to IBM's appeal, each of Rakuten’s obviousness theories alleged that Sunada “discloses” “protected resources,” see id. at 142-43, 164, and that Sunada “discloses” “receiving . . . an identifier associated with the user,” see id. at 147, 165. Sunada also played a role in Rakuten's obviousness theory for claims 5-11, 17, and 20, the claims at issue in Zillow'sPage 6 cross-appeal. See, e.g. , J.A. 168–69 (contending “Sunada in view of OASIS discloses' the first limitation of claim 5 3 ).

The Board granted institution. See J.A. 290. It, however, sided with IBM’s construction of “protected resource,” defining the phrase as:

[A]n application, an object, a document, a page, a

file, executable code, or other computational re-

source, communication-type resource, etc., identi-

fied by a Uniform Resource Locator (URL), or more

generally, a Uniform Resource Identifier (URI) ,

that can only be accessed by an authenticated and/or authorized user.

J.A. 304 (emphasis added); see id. at 305.

The Board’s findings on three claim limitations are relevant.

In light of the Board's construction of 'protected resources” to require URLs or URIs, Rakuten told the Board at the oral hearing that it was no longer pursuing its Sunada-based anticipation challenge. At the same time, Rakuten made clear that it believed that “Sunada discloses Page 7URLs in the context of web applications being accessed by users.” Decision , 2023 WL 7358027, at *7. Given Rakuten's concession as to the anticipation ground, the Board determined that Rakuten had not proven that Sunada anticipates claims 1, 3, 12, 14-15, and 18. Id.

As to Rakuten’s obviousness challenges, it contended that Sunada discloses the “protected resources” limitation because a skilled artisan would understand that Sunada’s 'web applications' use URLs. Id. at *13. The Board agreed, finding that Sunada's reference to 'web applications” “strongly suggests that web pages are among the services that it provides.' Id. And, in turn, it reasoned that a skilled artisan would understand Sunada's web pages to use URLs, as that usage was 'admittedly conventional'⁴ in Internet communications for web pages. See id. (“Sunada’s services are provided by web applications, which suggests that Sunada’s services are identified by URLs or URIs.”).

Upon IBM's request, the Board construed 'identifier associated with the user.' And the Board once again adopted IBM’s preferred construction, defining the phrase to mean “information that uniquely identifies the user.' Id. at *6 (emphasis added).

But the Board ultimately agreed with Rakuten that Sunada taught such an identifier. Among other findings, the Board read Sunada as teaching a system that receives a User ID, and that Sunada’s User ID uniquely identifies its users. Id. at *14–17.

The Board disagreed with Rakuten as to claims 5–9, 11, 17, and 20. In the Board’s view, though Sunada might have disclosed sending a request message to a first system during account creation, it did so in a different circumstance than the one recited in the claim: whereas the claims require such a transmission when an on-going useraccount-creation process on the second system (e.g., the healthcare website in the above example) has insufficient information, Sunada requests information when no such account exists in the first place. Id. at *30–31. The Board also concluded that neither OASIS nor Dutcher, the other prior art references in Rakuten’s combinations, cured that deficiency. Id. at *30–32.

In all, among the three grounds, the Board held claims 1–4, 12–16, and 18–19 unpatentable. See id. at *33. And it also found that Sunada in view of OASIS did not render claims 5–9, 11, 17, and 20 unpatentable, and that Sunada in view of OASIS and Dutcher did not render claim 10 unpatentable. Id.

IBM appeals with respect to all claims found unpatentable, contending (1) the Board’s analysis of “protected resources' relied on a theory of patentability not raised in Rakuten’s petition and (2) the Board’s findings on “identifier associated with the user' lack substantial evidence. Zillow (who joined the inter partes review alongside Rakuten after institution, see J.A. 2) cross-appeals with respect to all claims the Board held not unpatentable, arguing the Board's findings lack substantial evidence. We have jurisdiction under 28 U.S.C. § 1295(a)(4) and 35 U.S.C. § 141(c).

“We review the Board’s judgments concerning what arguments are fairly presented in a petition and other pleadings for abuse of discretion.” Netflix, Inc. v. DivX, LLC , 84Page 9 F.4th 1371, 1376 (Fed. Cir. 2023); see Corephotonics, Ltd. v. Apple Inc. , 84 F.4th 990, 1002 (Fed. Cir. 2023) (“It is for the Board to determine what grounds are being articulated in a petition and what arguments and evidence are being referred to in the responses and any replies.”).

We review the Board’s obviousness determinations de novo and its factual findings underlying those determinations for substantial evidence. In re Hodges , 882 F.3d 1107, 1116 (Fed. Cir. 2018). What a prior art reference discloses is a question of fact. Mettler-Toledo, Inc. v. B-Tek Scales, LLC , 671 F.3d 1291, 1297 (Fed. Cir. 2012).

We start with IBM’s appeal, before then turning to Zillow’s cross-appeal.

The “petitioner’s contentions . . . define the scope of the litigation all the way from institution through to conclusion.” SAS Inst., Inc. v. Iancu , 584 U.S. 357, 367 (2018). Consistent with this principle, we have found error where the Board deems a claim unpatentable on a ground absent from the petition. See, e.g. , Koninklijke Philips N.V. v. Google LLC , 948 F.3d 1330, 1337 (Fed. Cir. 2020) (determining the Board erred by relying on a combination of references not raised in the petition). IBM asks us to find such error here, contending the Board relied on an obviousness theory for the “protected resources” limitation never advanced in Rakuten’s petition. See Appellant’s Opening Br. 24–37.

Zillow disagrees with IBM’s characterization of Rakuten’s petition and the Board’s final written decision. See Cross-Appellant’s Opening & Resp. Br. 46–58. But it also asserts we are barred, under 35 U.S.C. § 314(d), from even considering IBM’s petition-based argument. See id. at 42-46. That is so, Zillow argues, because IBM's Page 10challenge is “closely tied” to the Board’s institution decision, such that § 314(d)’s bar on reviewability applies. See 35 U.S.C. § 314(d) ('The determination by the Director whether to institute an inter partes review under this section shall be final and nonappealable.”).

Zillow misunderstands § 314(d). While § 314(d) does bar us from reviewing a challenge “closely related to [the Board’s] decision whether to institute inter partes review,” Thryv, Inc. v. Click-To-Call Techs., LP , 590 U.S. 45, 48 (2020), it does not prevent us from examining whether the inter partes review “proceeds in accordance with the law’s demands,” SAS Inst. , 584 U.S. at 371. IBM does not seek to “undo” institution—rather, it simply asks to ensure the Board’s final written decision stayed within the confines of Rakuten’s petition.

Moreover, we routinely examine whether the Board’s final written decision departed from the petition. In Koninklijke , for example, we examined whether the Board instituted review under a theory of obviousness not raised by the petitioner. See 948 F.3d at 1337. So too in Sirona Dental Systems GmbH v. Institut Straumann AG , where we analyzed whether the Board’s unpatentability determination “deviate[d] from the grounds alleged in the petition.” 892 F.3d 1349, 1356 (Fed. Cir. 2018); see also, e.g. , VLSI Tech. LLC v. Intel Corp. , 53 F.4th 646, 653–54 (Fed. Cir. 2022); In re Magnum Oil Tools Int’l , Ltd., 829 F.3d 1364, 1381 (Fed. Cir. 2016).

Lone Star Silicon Innovations LLC v. Iancu , 809 F. App'x 773, 774 (Fed. Cir. 2020), the only case Zillow relies upon for its position, does not urge a different outcome. For one, non-precedential decisions are not binding. Trading Techs. Int’l, Inc. v. IBG LLC , 921 F.3d 1084, 1095 (Fed. Cir. 2019). Notwithstanding, Lone Star itself cites Koninklijke , and, in particular, Koninklijke 's holding that the Board erred by instituting review on a ground not presented. See Lone Star , 809 F. App'x at 777 (citing Koninklijke , 948 F.3d at 1337).

Page 11Section 314(d) accordingly does not bar us from reviewing IBM’s challenge. We thus turn to IBM’s arguments.

IBM first argues that the Board’s analysis of the “protected resources' limitation impermissibly strayed from the theory presented in Rakuten’s petition. Rakuten’s petition states that 'Sunada discloses all preamble limitations except potentially a FCE.'⁵ J.A. 142. And because the Board looked at what Sunada “suggests” or “strongly suggests,” as opposed to what Sunada “discloses,” IBM contends that the Board invoked an obviousness-like theory for this limitation—a theory different from what Rakuten raised in the petition. See Decision , 2023 WL 7358027, at *13.

We disagree with IBM’s reading of the Board’s decision. The Board found that Sunada teaches “protected resources,' as construed to use URLs or URIs, because it expressly discloses an access-controlled “web application.” Id. (citing J.A. 1918 ¶ 18); see J.A. 1918 ¶ 18 (“service by the web application”). Although Sunada never expressly mentions that its web applications are associated with “URLs” or “URIs,” the Board found that a skilled artisan would view such web applications as “provid[ing] [user] access . . . using admittedly conventional URLs or URIs.' Decision , 2023 WL 7358027, at *13. Under this understanding of Sunada's 'web application,' the Board found that Sunada taught 'protected resources' as construed. This line of inquiry by the Board-determining that a skilled artisan would understand a prior art reference’s express teaching to disclose a particular claim limitation-comports with a § 102 anticipation analysis and does not require turning to § 103 to modify a reference to Page 12satisfy a particular claim limitation. See Sage Prods., LLC v. Stewart , 133 F.4th 1376, 1385 (Fed. Cir. 2025); see also Acoustic Tech., Inc. v. Itron Networked Sols. , Inc. , 949 F.3d 1366, 1373 (Fed. Cir. 2020) ('In an anticipation analysis . . . . [e]xpert testimony may shed light on what a skilled artisan would reasonably understand or infer from a prior art reference.' (citation omitted)); Wasica Fin. GmbH v. Cont’l Auto. Sys., Inc. , 853 F.3d 1272, 1284 (Fed. Cir. 2017) (“Anticipation is an inquiry viewed from the perspective of one skilled in the art.”).

True, in making that observation about “web applications,” the Board used the terms “suggests” and “strongly suggests.” See Decision , 2023 WL 7358027, at *13 (“As we explained in the Institution Decision, Sunada’s services are provided by web applications, which suggests that Sunada’s services are identified by URLs or URIs.” (citing J.A. 1918 ¶ 18)); id. (“We find that Sunada, by specifically referring to its applications as ‘web applications,’ strongly suggests that web pages are among the services it provides.”). And such terminology often arises in the context of a § 103 obviousness inquiry. See Adasa Inc. v. Avery Dennison Corp. , 55 F.4th 900, 910 (Fed. Cir. 2022) (“And ‘[e]ven if a reference’s teachings are insufficient to find anticipation, that same reference’s teachings may be used to find obviousness’ where it suggests some reason to modify the prior art to obtain the claimed limitations.” (alteration in original) (emphasis added) (citation omitted)). But, by using these terms, the Board in this instance merely explained why, in its view, the better reading of Sunada’s express disclosure of 'web application' aligns with the claimed 'protected resources,' as construed. In other words, the Board read Sunada’s teachings to indicate (or strongly indicate) to a skilled artisan that its web application services are identified by URLs or URIs. Critically, the Board never proposed to modify Sunada’s “web application” to contain URLs. We thus reject IBM’s argument that the Board relied on an obviousness-based theory for Page 13the “protected resources” limitation; the Board’s analysis instead tracked the petition's anticipation-based theory.⁶

B. “an identifier associated with the user”

IBM’s appeal also raises a merits-based substantial evidence challenge. The claimed method requires “ receiving from the first system at the second system an identifier associated with the user .” ’346 patent at claim 1 (emphases added). According to the Board, Sunada disclosed this limitation because it (1) taught a first system creating a “User ID” that uniquely identifies the user, and (2) taught a second system receiving that User ID. See Decision , 2023 WL 7358027, at *14–17.

Page 14IBM concedes that Sunada’s “User ID” uniquely identifies the user, but it argues that Sunada does not teach the second system receiving a User ID. Sunada, however, expressly teaches transmitting 'information regarding the user” to the second system. J.A. 1917–18 ¶¶ 15, 19. The Board reasonably found that Sunada's 'information regarding the user” includes its User IDs, and we see no reason to think otherwise.

Nothing in Sunada, for example, expressly teaches that its disclosure of “information regarding the user” cannot include a User ID. See generally J.A. 1915–21. Moreover, as the Board noted, Sunada contemplates treating passwords as part of 'information regarding the user[].' See id. at 1918 ¶ 21. In the context of Sunada’s disclosure, it was reasonable for the Board to make a similar inference about Sunada's User ID, a closely related piece of information about the user. See Quake v. Lo , 928 F.3d 1365, 1373 (Fed. Cir. 2019) (“A finding is supported by substantial evidence if a reasonable mind might accept the evidence to support the finding.' (quoting Redline Detection, LLC v. Star Envirotech, Inc. , 811 F.3d 435, 449 (Fed. Cir. 2015))).

We now turn to Zillow's Cross-Appeal.⁷

Zillow fixates on a purported inconsistency within the Board's findings. See Cross-Appellant's Opening & Response Br. 37–42. One the one hand, the Board found claim 14 unpatentable in light of Sunada. Yet for claim 5, which looks very similar to claim 14, the Board said the opposite. Zillow believes those two findings cannot both stand.

Zillow almost has a point—the language of claim 5 is identical to claim 14 except for a single difference. The relevant limitation of claim 5 recites:

in response to a determination at the second system that the second system does not have sufficient user attribute information to complete creation of a user account for the user at the second system, sending a request message from the second system to the first system to retrieve user attribute information

’346 patent at claim 5 (emphasis added). As for claim 14:

in response to a determination at the second system that the second system does not have sufficient user attribute information to complete creation of a user account for the user at the second system,

notice of appeal, any other party may file a notice of appeal within 14 days after the date when the first notice was filed, or within the time otherwise prescribed by this Rule 4(a), whichever period ends later.”). We accordingly asked the parties to address this timeliness issue.

In response, Zillow explained that the Director granted a retroactive extension after finding excusable neglect. See ECF No. 81; 37 C.F.R. § 90.3(c)(ii). IBM did not oppose Zillow’s request to the Director, nor does it on appeal.

Page 16sending a request message to a fourth system to re- trieve user attribute information

’346 patent at claim 14 (emphasis added). Whereas method claim 5 requires sending a request to a first system (i.e., the entity that stores the original authentication information) once it becomes apparent the second system has insufficient information to complete an account, method claim 14 requires sending a request to a fourth system (i.e., the user’s computer) in such a circumstance.

That distinction makes all the difference as to Sunada. In Sunada, when it becomes evident the second system cannot complete account creation without additional user information, Sunada teaches requesting such information only from the user herself , i.e., the fourth system. See J.A. 1921 FIG. 3 Step 37 (“Is information necessary for creating user account here?”); id. at Step 38 (“[If not] Ask [the] user to enter missing information.”). As the Board found, such a teaching discloses the relevant limitation of claim 14. But nowhere does Sunada disclose alternatively pinging the first system to gap-fill any missing information needed for account creation, as claim 5 demands. The Board’s opposing conclusions on patentability for the two claims thus make good sense. Moreover, substantial evidence supports the Board's finding that neither Sunada nor OASIS discloses sending a request from the second system to the first system “in response to a determination at the second system that the second system does not have sufficient user attribute information to complete creation of a user account.”

We have considered the parties remaining arguments but find them unpersuasive.

No costs.