Okta, Inc. v. Biogy, Inc.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
OKTA, INC.,
Plaintiff,
v.
BIOGY, INC.,
Defendant.
Case No. 25-cv-03329-AMO
ORDER DENYING MOTION TO
DISMISS
Re: Dkt. No. 32
Plaintiff Okta, Inc. (“Okta”) brings this action seeking a declaration of patent non-
infringement. Defendant Biogy, Inc.’s (“Biogy”) motion to dismiss was heard before this Court
on November 6, 2025. Having read the papers filed by the parties and carefully considered their
arguments therein and those made at the hearing, as well as the relevant legal authority, the Court
hereby DENIES Biogy’s motion for the following reasons.
I. BACKGROUND
Biogy is the owner of United States Patent No. 7,669,236 (“the ’236 Patent”), entitled
“Determining Whether to Grant Access to a Passcode Protected System.” First Am. Compl. (Dkt.
No. 29, “FAC”), Ex. A. The ’236 Patent issued on February 23, 2010, and generally relates to a
method of issuing passcodes that are only valid for a limited time. Such passcodes are sometimes
referred to as Time-Based One-Time Passcodes, which is often abbreviated as “TOTP” or
“TOTPs.” Such systems are commonly used as one form of multi-factor or two-factor
authentication.
After the application that matured into the ’236 Patent was filed, an industry trade group
promulgated a standard relating to the issuance of a particular type of TOTP passcodes. The
standard Internet Engineering Task Force RFC 6238 (the “RFC 6238 Standard”) sets forth a
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 1 of 9

2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
specific method to generate TOTP codes. See Berten Decl., Ex. 1. Biogy asserts that passcodes
issued in compliance with the RFC 6238 Standard infringe at least claims 5, 12, 14, and 24 of the
’236 Patent. Biogy does not assert that all TOTP passcodes infringe the ’236 Patent; it has only
asserted that passcodes issued to users in conformance with the RFC 6238 Standard infringe the
patent. See, e.g., Berten Decl. ¶ 6; Dkt. No. 29-2 at 2 (“To the extent Albertson’s use of two-
factor authentication is using one-time passcodes that comply with the TOTP standard, that use
infringes the ’236 Patent.”); see also Berten Decl., Ex. 2 (Complaint in Albertson’s Action) ¶ 16
(“The specific solution[s] claimed in the claims of the ’236 Patent do not claim the entire field of
‘multi-factor authentication’ or ‘two factor authentication.’ For example, there are other methods
for multifactor authentication that do not involve sending temporary one-time passcodes that are
created using a passcode generator that perturbs.”).
On April 24, 2024, counsel for Biogy sent to Okta’s customer Albertsons Companies, Inc.
(“Albertson’s”) a “Notice of Infringement Letter” regarding the ’236 Patent and Albertson’s
suspected use of the RFC 6238 Standard for TOTPs. Compl. ¶ 20; see also id., Ex. B (Dkt. No.
29-2). The letter included a claim chart mapping the ’236 Patent to the TOTP RFC 6238 Standard
and cited an example of an Albertson’s temporary one-time passcode. Compl., Ex. C (Dkt. No.
29-3). Albertson’s never responded to the letter. Berten Decl. ¶ 13. After Albertson’s ignored
Biogy’s letter for nearly six months, on October 17, 2024, Biogy filed an action for infringement
of the ’236 Patent against Albertson’s Companies, Biogy, Inc. v. Albertsons Companies, Inc. et al.,
No. 2:24-cv-00838 (E.D. Tex.) (the “Albertson’s Action”). Berten Decl. ¶ 14; see also FAC ¶ 12.
Okta brings this action for declaratory relief of non-infringement based at least in part on
Biogy’s letter-writing campaign to enforce the ’236 Patent against its customers. See generally
FAC. Microsoft Corporation (“Microsoft”) brings a similar action seeking a declaration of non-
infringement of the ’236 Patent. See Microsoft Corporation v. Biogy, Inc., N.D. Cal. Case No.
3:25-cv-4957. The Court related the two cases and heard Biogy’s identical motions to dismiss in a
single hearing. See Dkt. Nos. 34, 50. The Court issues its order in the Microsoft action this same
day.
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 2 of 9

3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
II. DISCUSSION
Biogy moves to dismiss the declaratory relief action for lack of subject matter
jurisdiction – Biogy asserts that Okta lacks Article III standing. The Court sets forth the legal
standard for assessing a motion under Federal Rule of Civil Procedure 12(b)(1) before turning to
the parties’ arguments.
A. Legal Standard
The law of the Federal Circuit governs “review as to whether an actual controversy exists
under the Declaratory Judgment Act when the underlying merits of an action involve patent
infringement and/or validity.” Microchip Tech. Inc. v. Chamberlain Grp., Inc., 441 F.3d 936, 940
(Fed. Cir. 2006). However, for the standards to assess legal issues that are not patent specific,
such as the standards applicable for analyzing Rule 12(b)(1) motions, the district court still relies
on the law of the regional circuit – here, the Ninth Circuit. Mitek Sys., Inc. v. United Servs. Auto.
Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”).
Motions to dismiss pursuant to Federal Rule of Procedure 12(b)(1) challenge a court’s
subject matter jurisdiction and may be facial or factual. A facial attack presumes the truth of the
plaintiff’s allegations but asserts that they “are insufficient on their face to invoke federal
jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Facial attacks
are reviewed akin to Rule 12(b)(6) motions in that all allegations of the complaint are taken as
true, and all reasonable inferences are drawn in favor of the plaintiff. Love v. United States, 915
F.2d 1242, 1245 (9th Cir. 1990). A factual attack “contests the truth of the plaintiff’s factual
allegations, usually by introducing evidence outside the pleadings.” Leite v. Crane Co., 749 F.3d
1117, 1121 (9th Cir. 2014) (quoting Safe Air for Everyone, 373 F.3d at 1039). In resolving a
factual challenge, once the defendant contests the truth of the plaintiff’s factual allegations, the
plaintiff has the burden to support its allegations with competent proof. Friends of the Earth v.
Sanderson Farms, Inc., 992 F.3d 939, 944 (9th Cir. 2021) (quoting Leite, 749 F.3d at 1121). In
resolving such a challenge, when the “jurisdictional issues are ‘intertwined with an element of the
merits of the plaintiff’s claim,’ the court must treat the motion like a motion for summary
judgment and ‘leave the resolution of material factual disputes to the trier of fact.’ ” Bowen v.
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 3 of 9

4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
Energizer Holdings, Inc., 118 F.4th 1134, 1143 (9th Cir. 2024) (quoting Leite, 749 F.3d at 1122).
But when allegations relating to standing are “separable from the merits of the case,” the court is
free to “resolv[e] factual disputes if necessary.” Jones v. L.A. Cent. Plaza LLC, 74 F.4th 1053,
1057 n.2 (9th Cir. 2023).
B. Patent Infringement
Under the Declaratory Judgment Act, courts only have jurisdiction over matters that
present an “actual controversy.” 28 U.S.C. § 2201(a). “[T]he phrase ‘case of actual controversy’
in the Act refers to the types of ‘Cases’ and ‘Controversies’ that are justiciable under Article III of
the Constitution.” MedImmune v. Genentech, Inc., 549 U.S. 118, 127 (2007) (citation omitted).
An Article III controversy may exist where a party seeks a declaration that its product does not
infringe a patent. See, e.g., Danisco U.S. Inc. v. Novozymes A/S, 744 F.3d 1325, 1330 (Fed. Cir.
2014). It is the plaintiff’s burden to show an actual controversy existed at the time the declaratory
action was filed. AIDS Healthcare Found., Inc. v. Gilead Scis., Inc., 890 F.3d 986, 990 (Fed. Cir.
2018). “[L]ater events may not create jurisdiction where none existed at the time of filing.” GAF
Building Materials Corp. v. Elk Corp. of Dallas, 90 F.3d 479, 483 (Fed. Cir. 1996).
A “case of actual controversy” is one that is “substantial . . . between parties having
adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory
judgment.” Allied Min. Prods., Inc. v. Osmi, Inc., 870 F.3d 1337, 1139 (Fed. Cir. 2017) (quoting
MedImmune, 549 U.S. at 127). The dispute must be “definite and concrete,” not based on “a
hypothetical state of facts.” Id. at 1339, 1341. Courts must determine whether “the facts alleged,
under all the circumstances, show that there is a substantial controversy, between parties having
adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory
judgment.” MedImmune, 549 U.S. at 127. The Federal Circuit has explained that “jurisdiction
generally will not arise merely on the basis that a party learns of the existence of a patent owned
by another or even perceives such a patent to pose a risk of infringement, without some
affirmative act by the patentee.” Prasco, LLC v. Medicis Pharm. Corp., 537 F.3d 1329, 1339
(Fed. Cir. 2008) (citation omitted). In essence, a controversy exists where a patentee’s actions
“can be reasonably inferred as demonstrating intent to enforce a patent.” UCP Int’l Co. Ltd. v.
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 4 of 9

5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
Balsam Brands Inc., 787 F. App’x 691, 700 (Fed. Cir. 2019). Specifically, declaratory judgment
jurisdiction requires “both (1) an affirmative act by the patentee related to the enforcement of his
patent rights” directed at the plaintiff and “(2) meaningful preparation to conduct potentially
infringing activity.” Finisar Corp. v. Capella Photonics, Inc., No. 20-cv-07629-EMC, 2021 WL
810227, at *4 (N.D. Cal. Mar. 3, 2021).
Given that declaratory judgment jurisdiction requires “some affirmative act by the
patentee” to enforce its patents against the plaintiff, a plaintiff’s “fear of a future infringement suit
is insufficient to confer jurisdiction.” Allied Min., 870 F.3d at 1139. There is no bright-line rule
that any particular conduct is either necessary or sufficient for a showing of an affirmative act.
Proofpoint, Inc. v. InNova Pat. Licensing, LLC, 2011 WL 4915847, at *3 (N.D. Cal. Oct. 17,
2011). For example, while “[a]n affirmative act requires more than a communication from a
patent owner to another party,” Finisar, 2021 WL 810227 at *4, “direct communication between a
patentee and a declaratory plaintiff is not necessary to confer standing,” Arris Grp., Inc. v. Brit.
Telecomms. PLC, 639 F.3d 1368, 1378 (Fed. Cir. 2011); see also UCP Int’l, 787 F. App’x at 700
(“[J]urisdiction does not turn on whether the patentee specifically communicated with the
declaratory judgment plaintiff.”).
Through two opinions invoked in the papers here, the Federal Circuit somewhat recently
considered a district court’s exercise of jurisdiction over an action in which a plaintiff sought a
declaratory judgment establishing its non-infringement of the defendant’s patent. See Mitek Sys.,
Inc. v. United Servs. Auto. Ass’n, 34 F.4th 1334, 1343 (Fed. Cir. 2022) (“Mitek I”); Mitek Sys., Inc.
v. United Servs. Auto. Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”). In Mitek I, the
Federal Circuit reversed and remanded the lower court’s determination that the plaintiff lacked
standing to pursue such declaratory relief on the basis that the lower court failed to fully assess the
existence of a dispute between the parties, the scope of the plaintiff’s indemnification obligations
to its customers arising from the potentially infringing product, and a declination of jurisdiction.
Mitek I, 34 F.4th at 1341-48. In Mitek II, after the district court permitted jurisdictional discovery
and conducted a more exacting analysis of the plaintiff’s purported basis for standing, the Federal
Circuit affirmed dismissal for lack of jurisdiction. Mitek II, 139 F.4th at 1348-53. Notably, the
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 5 of 9

6
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
court stated that a determination of whether the declaratory judgment plaintiff “reasonably might
be liable for infringement requires ‘look[ing] to the elements of the potential cause of action’ and
considering both the patent claims at issue and the alleged facts concerning Mitek and its
customers in light of those elements.” Id. at 1343 (citing Microsoft Corp. v. DataTern, Inc., 755
F.3d 899, 903-05 (Fed. Cir. 2014)). Further, the Mitek II court identified that district courts are
required to consider whether there exist allegations by the patentee establishing a “reasonable
potential” that infringement claims could be brought against the plaintiff, including under each of
the separate types of infringement. Mitek II, 139 F.4th at 1343.1 Finally, the Mitek II court
considered and affirmed the district court’s determination that, even if a live controversy existed, it
would decline to exercise jurisdiction over the declaratory judgment action as a matter of
discretion. Id. at 1355-57.
A party who “makes, uses, offers to sell, or sells” a patented invention “without authority”
directly infringes a patent. 35 U.S.C. § 271(a). To state a claim for direct infringement, a plaintiff
must plead facts that give the alleged infringer fair notice of the claim and the accused
misconduct. Disc Disease Sols. Inc. v. VGH Sols., Inc., 888 F.3d 1256, 1260 (Fed. Cir. 2018).
Here, Biogy’s alleged infringement “claim charts” included in “Notice of Infringement”
letters sent to Okta’s customers explicitly accuse them of infringing by using TOTPs. Okta FAC
¶¶ 20-28; cf. SanDisk Corp. v. STMicroelectronics, Inc., 480 F.3d 1372, 1381-83 (Fed. Cir. 2007)
(holding there is a “substantial controversy” warranting declaratory judgement jurisdiction where
a patentee “assert[ed] rights” through written accusations of infringement). Biogy’s motion to
dismiss does not dispute or acknowledge Biogy’s identification of Okta’s source code as alleged
evidence of infringement in Biogy’s claim charts. Further, Biogy alleges that Okta’s products use
RFC 6238 to generate one-time passcodes, and Biogy also alleges that all such uses of RFC 6238
infringe the ’236 Patent. FAC ¶¶ 29-30. Indeed, even the exhibits Biogy cites in its motions to
1 At the hearing, counsel for both sides confirmed that the Court need not address each of the
potential theories of patent infringement in making this assessment – if Plaintiffs establish
standing to pursue direct patent infringement, for example, the Court need not also address
standing to pursue theories of indirect infringement. The Court thus only considers direct
infringement here.
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 6 of 9

7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
dismiss establish that Biogy has charged infringement in this form. Compare, e.g., FAC ¶ 35 with
Dkt. No. 32-5 at 6-8 (supporting the allegation that Biogy’s counsel alleged that use of “the
algorithm standardized at RFC 6238 infringe[s] the patent” and that “[a]mong the algorithms Okta
uses to supply codes are those based on the FRC-6238 [sic] standard”). Biogy’s motion concedes
that Okta’s complaint “allege[s] that Biogy asserts that” the one-time passcodes issued by Okta
comply with the standard that Biogy accuses of infringement. Mot. at 7. Plaintiffs thus properly
allege that Biogy accuses them of directly infringing the ’236 patent. Biogy’s letter writing
campaign alleging patent infringement establishes Okta’s standing to proceed in this declaratory
relief action.
C. Defense and Indemnity Obligations
Declaratory judgment plaintiffs may establish that a live case or controversy exists where
indemnity agreements create a “reasonable potential” for their indemnification liability. See Mitek
II, 139 F.4th at 1345-47 (citing Mitek I, 34 F.4th at 1346) (focusing on whether there was “a
‘reasonable potential’ of [the declaratory judgment plaintiff’s] indemnification liability, with that
potential giving [the declaratory judgment plaintiff] the required concrete stake in litigating the
underlying customers’ freedom from infringement liability to [the patent holder]”).
Here, Okta alleges in the FAC that “[m]ultiple Okta customers have made indemnity
requests to Okta, requesting that Okta defend and indemnify these customers against Biogy’s
infringement allegations.” FAC ¶ 32. “Biogy’s infringement allegations against Okta’s customers
are effectively accusations that Okta itself infringes the ’236 patent, both directly (through use of
the Okta Accused Products.” FAC ¶ 36. In its opposition brief, Okta identifies Parker Hannifin
Corporation (“Parker”) as a customer that received a Biogy letter and seeks indemnification. See
Dkt. No. 43 at 9. Okta provides the letter that Biogy sent to Parker and the “Master Subscription
Agreement” between Okta and Parker containing the “Okta Indemnification Obligation” at § 9.1
of that agreement. See Brenckman Decl. ¶¶ 2-4, Exs. A-B; see also FAC at ¶¶ 25-26. As laid out
in the Master Subscription Agreement, “Okta will defend Customer from any and all claims,
demands, suits or proceedings brought against Customer by a third party alleging that the Service,
as provided by Okta to Customer under this Agreement infringe[s] any patent . . . . Okta will
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 7 of 9

8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
indemnify Customer . . . in connection with an Infringement Claim.” Brenckman Decl., Ex. B
(“Master Subscription Agreement”) § 9.1 (“Okta Indemnification Obligation”). This includes
allegations that an Okta Product “infringe[s] any patent” – the very accusations that Biogy has
leveled against Parker due to Parker’s use of an Okta product, which Biogy identifies in its claim
chart. See Brenckman Decl. ¶ 2, Ex. A (“Notice of Apparent Infringement of U.S. Patent Number
7,669,236” with accompanying “claim chart”). Okta therefore shows a “reasonable potential of
indemnification liability” based on Biogy’s allegations against Okta to its customers. See Mitek II,
139 F.4th at 1353. This is sufficient to establish Okta’s standing to bring this declaratory relief
action.
D. Discretionary Declination of Jurisdiction Over Declaratory Action
“Given the Declaratory Judgment Act’s use of the word ‘may,’ 28 U.S.C. § 2201(a), the
Supreme Court has stated that a district court has ‘unique and substantial discretion in deciding
whether to declare the rights of litigants.’ ” Mitek I, 34 F.4th at 1347 (quoting Wilton v. Seven
Falls Co., 515 U.S. 277, 286 (1995)). “[A]s long as a district court acts in accordance with the
purposes of the Declaratory Judgment Act and the principles of sound judicial administration, [it]
has broad discretion to refuse to entertain a declaratory judgment action.” Mitek I, 34 F.4th at
1347 (citation and internal quotation marks omitted). However, “[t]here must be well-founded
reasons for declining to entertain a declaratory judgment action.” Mitek I, 34 F.4th at 1347
(quoting Capo, Inc. v. Dioptics Medical Products, 387 F.3d 1352, 1355 (Fed. Cir. 2004)). For
example, “[w]hile the existence of another adequate remedy does not necessarily bar a declaratory
judgment, district courts may refuse declaratory relief where an alternative remedy is better or
more effective.” Mitek I, 34 F.4th at 1347 (quoting Ford Motor Co. v. United States, 811 F.3d
1371, 1379-80 (Fed. Cir. 2016)).
Here, Biogy avers that the Court should follow the course set by the district court in
Mitek II and dismiss Okta’s declaratory relief case to instead permit Okta to intervene in the next
litigation, if any, brought by Biogy against an Okta customer. See Dkt. No. 12 at 18; see also
Mitek II, 139 F.4th at 1355 (affirming the district court’s determination that “the ‘best’ way for
Mitek to defend its software would be ‘to intervene, either as of right or permissively, in the next
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 8 of 9

9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
litigation, if any, brought by USAA against a Mitek customer which asserts the [patents-in-suit].’ ”
(citation omitted)). Okta distinguishes the facts here from those in Mitek, noting that Biogy’s
claims of infringement challenge its products as they currently stand, unlike the charges of
infringement based on a customer’s customization of a software product in Mitek. See Dkt. No. 43
at 21-22. Indeed, in Mitek, to assess whether the accused products potentially infringed, a factual
analysis of the products’ customization for an end user was necessary, requiring at least one of the
plaintiff’s customers to be involved in the case – the district court and the Federal Circuit
determined that the dispute would prove better suited for adjudication if the declaratory judgment
plaintiff waited for the patentee to bring an enforcement action against one of the customers.
Mitek II, 139 F.4th at 1347. Given this distinction and the claims of direct infringement Biogy has
lobbed against Okta’s TOTP products as distributed (not as customized), this case is already ripe
for adjudication. The Court does not decline jurisdiction as a matter of discretion.
III. CONCLUSION
For the foregoing reasons, the Court finds that Okta has standing to pursue this action
seeking a declaration of patent non-infringement. The Court therefore DENIES Biogy’s motion
to dismiss.
IT IS SO ORDERED.
Dated: February 23, 2026
ARACELI MARTÍNEZ-OLGUÍN
United States District Judge
Case 3:25-cv-03329-AMO Document 71 Filed 02/23/26 Page 9 of 9