+ All Categories
Home > Documents > Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a...

Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a...

Date post: 26-Jun-2020
Category:
Upload: others
View: 0 times
Download: 0 times
Share this document with a friend
73
[email protected] Paper No. 45 571-272-7822 Filed: December 10, 2018 UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________ SAMSUNG ELECTRONICS CO., LTD., Petitioner, v. HUAWEI TECHNOLOGIES CO., LTD. Patent Owner. ____________ Case IPR2017-01487 Patent 8,812,848 B2 ____________ Before TREVOR M. JEFFERSON, MICHELLE N. WORMMEESTER, and JOHN F. HORVATH, Administrative Patent Judges. HORVATH, Administrative Patent Judge. FINAL WRITTEN DECISION 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
Transcript
Page 1: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

[email protected] Paper No. 45 571-272-7822 Filed: December 10, 2018

UNITED STATES PATENT AND TRADEMARK OFFICE

____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________

SAMSUNG ELECTRONICS CO., LTD.,

Petitioner,

v.

HUAWEI TECHNOLOGIES CO., LTD. Patent Owner. ____________

Case IPR2017-01487 Patent 8,812,848 B2

____________

Before TREVOR M. JEFFERSON, MICHELLE N. WORMMEESTER, and JOHN F. HORVATH, Administrative Patent Judges. HORVATH, Administrative Patent Judge.

FINAL WRITTEN DECISION 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73

Page 2: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

2

I. INTRODUCTION

A. Background

Samsung Electronics Co., Ltd.1 (“Petitioner”) filed a Petition (Paper 2,

“Pet.”) to institute inter partes review of claims 1, 3–5, 7–9, 11–13, 15, and

16 (“the challenged claims”) of U.S. Patent No. 8,812,848 B2 (Ex. 1001,

“the ’848 patent”). Huawei Technologies Co., Ltd. (“Patent Owner”) filed a

Preliminary Response. Paper 11 (“Prelim. Resp.”). Upon consideration of

the Petition and Preliminary Response, we instituted review of all challenged

claims. Paper 17 (“Dec. Inst.”)

Patent Owner filed a Response to the Petition (Paper 26, “PO Resp.”),

and Petitioner filed a Reply to the Response (Paper 31, “Reply”). Patent

Owner filed a Sur-Reply to Petitioner’s Reply. Paper 38 (“PO Sur-Reply”).

We held an oral hearing on September 26, 2018, and the hearing transcript is

included in the record. Paper 44 (“Tr.”).

We have jurisdiction under 35 U.S.C. § 6(b). This is a Final Written

Decision under 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73. For the reasons

set forth below, we find Petitioner has shown by a preponderance of the

evidence that claims 1, 3–5, 7–9, 11–13, 15, and 16 of the ’848 patent are

unpatentable.

B. Related Matters

Petitioner and Patent Owner identify the following as a matter that

could affect, or be affected by, a decision in this proceeding: Huawei Tech.

Co., Ltd. v. Samsung Elecs. Co., Ltd., Case No. 3:16-cv-02787 (N.D. Cal.).

1 Samsung identifies Samsung Electronics America, Inc. and Samsung Research America as real parties-in-interest. Pet. 3.

Page 3: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by
Page 4: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by
Page 5: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by
Page 6: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

6

102). Id. at 4:58–63, 5:10–16. The MME selects an NAS security algorithm

that is supported by both the UE and MME, derives a root key (Kasme) from

the authentication vector-related key, and derives an NAS protection key

from the root key (step 103). Id. at 5:25–31. The NAS protection key can

be an integrity protection key (Knas-int) or a confidentiality protection key

(Knas-enc). Id. at 5:31–33. The MME then sends a TAU accept message

identifying the selected NAS security algorithm to the UE (step 104). Id. at

5:34–44. The UE receives the TAU accept message, identifies the NAS

security algorithm selected by the MME, derives the same root key (Kasme)

from a UE key that is related to the authentication vector-related key (IK,

CK), and derives an NAS protection key (Knas-int or Knas-enc) from the

root key and the selected NAS security algorithm (step 105). Id. at 5:47–58.

Of the challenged claims, claims 1 and 9 of the ’848 patent are

independent. Other challenged claims depend directly or indirectly from

claims 1 or 9. Claim 9 is representative of the challenged claims, and is

reproduced below.

9. A method for security capability negotiation during idle state mobility of a user equipment (UE), in a situation where the UE moves from a non-long term evolution (non-LTE) network to a long term evolution (LTE) network, the method comprising:

sending, by the UE, UE security capabilities supported by the UE to the LTE network for a non-access stratum (NAS) security algorithm selection use;

receiving, by the UE, a selected NAS security algorithm from the LTE network;

Page 7: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

7

generating, by the UE, a root key from an authentication vector-related key available at the UE; and

deriving, by the UE, according to the NAS security algorithm, a NAS protection key according to the generated root key.

Ex. 1001, 12:30–45. Claim 1 is similar in scope to claim 9, but recites a user

equipment (UE) comprising a transmitter, receiver, and processor for

performing the method recited in claim 9. Compare id. at 11:52–65 with id.

at 12:30–45.

B. Claim Construction

The claim construction standard applicable to this inter partes review

proceeding is the broadest reasonable interpretation in light of the patent

specification. See 37 C.F.R. § 42.100(b) (2016); Cuozzo Speed Techs., LLC

v. Lee, 136 S. Ct. 2131, 2144–46 (2016). Consistent with the rule of

broadest reasonable interpretation, claim terms are generally given their

plain and ordinary meaning, as would be understood by one of ordinary skill

in the art in the context of the entire patent disclosure. See In re Translogic

Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). Only those terms which

are in controversy need be construed and only to the extent necessary to

resolve the controversy. See Vivid Techs., Inc. v. Am. Sci. & Eng’g, Inc.,

200 F.3d 795, 803 (Fed. Cir. 1999).

Petitioner contends all claim terms have their plain and ordinary

meaning, and does not expressly construe any claim term. Pet. 26–27.

Patent Owner does not expressly construe any claim term, or request express

construction of any claim term. See PO Resp. i–ii. In our Institution

Decision, we did not expressly construe any claim term because the meaning

Page 8: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

8

of the claims was not in dispute. Dec. Inst. 6–7. We maintain that decision

here.

C. Level of Ordinary Skill in the Art

Petitioner, relying on the testimony of Dr. Williams, argues a person

of ordinary skill in the art would have had a master’s degree in electrical

engineering, computer science, or a related field, and at least two years of

experience working with cellular telephony systems. Pet. 26 (citing

Ex. 1014 ¶¶ 13–20). Patent Owner does not dispute Petitioner’s contention,

and accepts it as applicable in this proceeding. PO Resp. 10.

In our Institution Decision, we adopted Petitioner’s definition for the

level of ordinary skill in the art as reasonable. Dec. Inst. 7. We maintain

that decision here.

D. Public Accessibility of TR 33.821 and TS 23.401

Petitioner argues the 3GPP documents (TR 33.821 and TS 23.401) it

relies on to challenge the claims of the ’848 patent were stored, indexed, and

publicly accessible from the 3GPP website. See Pet. 27–35. Petitioner relies

on the testimony of Dr. Yaqub to demonstrate this public accessibility. Id.

(citing Ex. 1012 ¶¶ 26–56).

According to Dr. Yaqub, “3GPP was formed to coordinate and

facilitate the development of standards” for cellular communications.

Ex. 1012 ¶ 18. 3GPP’s goal “is to provide its members with an environment

to produce reports and specifications that define technologies covering

cellular telecommunications.” Id. ¶ 19. Network operators, handset

manufacturers, and device manufacturers have all “been involved in the

development of 3GPP standards.” Id. ¶¶ 18–19. 3GPP members contribute

technical specifications, technical reports, and feasibility studies at both

Page 9: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

9

Working Group and Technical Specification Group levels. Id. ¶¶ 20–21.

Working Groups “meet regularly and also have quarterly plenary meetings

where member companies’ contributions, draft specification[s], and other

discussion documents are presented for approval.” Id. ¶ 20.

3GPP specification development “is an ongoing, collaborative effort

involving hundreds of engineers from many companies,” and 3GPP catalogs

that effort using “a very structured process.” Id. ¶¶ 24, 26. 3GPP names

member contributed documents using a naming procedure based on a

structured numbering system, whereby the numbers by which documents are

named indicate the subject matter of the documents. Id. ¶ 28–29 (citing

Ex. 1022 §§ 4, 5A). Once named, documents are compressed and uploaded

to the 3GPP FTP server as zipped files having the same name, and receive a

date and time stamp indicating when the upload occurred. Id. ¶¶ 30, 33, 37.

Once uploaded, documents are indexed on the 3GPP FTP server by subject

matter (e.g., Working Group number), meeting number, and type. Id. ¶ 35.

Documents are also effectively indexed by date due to the sequential

naming/numbering system. Id. Documents uploaded to the 3GPP FTP

server are available indefinitely and without restriction, and any interested

member of the public can freely access, download, print, reproduce, and

disseminate them. Id. ¶¶ 32–33. “Making documents publicly available

encourages discussion and promotes collaboration among Working Group

members toward the establishment of industry standards for cellular

telecommunications.” Id. ¶ 31.

Dr. Yaqub further testifies that the functionality of the 3GPP FTP

server, as described above, was present in October 1999, as evidenced by a

printout from the Internet Archive’s “Wayback Machine,” which shows the

Page 10: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

10

October 1999 landing page of the 3GPP TSG RAN group. Id. ¶ 41 (citing

Ex. 1024). Dr. Yaqub testifies that this printout “refreshes and confirms

[his] recollection as to how 3GPP’s website looked and could be navigated

in 1999,” and shows how “meeting information, such as Working Group

documents, could be accessed by the public” at the time. Id. The printout of

the 3GPP TSG RAN landing page shows links to the landing pages of other

3GPP groups (e.g., TSG CN, TSG SA, TSG T). Ex. 1024, 1. It also shows

a link to documents generally available on the 3GPP FTP server, a link to

documents from the TSG RAN group, and links to documents from various

TSG RAN Working Groups (e.g., TSG RAN WG1–WG4). Id. For

example, the printout shows a link to documents from TSG RAN WG1

directed toward the 3GPP Radio Layer 1 Specification. Id.

Dr. Yaqub further testifies that because the documents stored on the

3GPP FTP server were available without restriction and fully searchable,

they were available “to users via conventional search engines, such as the

Google search engine.” Ex. 1012 ¶ 48. Regarding the specific 3GPP

documents Petitioner relies on in this proceeding, Dr. Yaqub testifies that

TR 33.821 was uploaded to the 3GPP FTP server on July 13, 2007 and

TS 23.401 was uploaded on August 13, 2007. Ex. 1012 ¶¶ 54, 56.

Dr. Yaqub further testifies that each of these documents could have been

located using reasonable diligence by navigating to the 3GPP FTP site and

clicking on the links corresponding to the desired subject matter, meeting

Page 11: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

11

number, or document number, or by performing a Google search using the

terms “3GPP” and keywords within the document.3 Id. ¶ 49.

Patent Owner argues Petitioner has failed to establish the public

accessibility of TR 33.821 and TS 23.401 prior to the priority date of the

’848 patent. PO Resp. 37–40. In particular, Patent Owner argues Petitioner

has failed to demonstrate these 3GPP documents were sufficiently indexed

on the 3GPP FTP server to allow an interested party to locate them prior to

the priority date of the ’848 patent. Id. at 39. Patent Owner further argues

Petitioner has failed to provide any evidence that the documents were

presented at a 3GPP working group meeting, or were physically or

electronically disseminated in any manner. Id. at 39–40. Patent Owner also

argues that “Petitioner only provides present day evidence showing that the

public can download TR 33.821 and TS 23.401 from the [3GPP] FTP server

that putatively indicates TR 33.821 and TS 23.401 were uploaded on July

13, 2007 and August 13, 2007, respectively.” Id. at 40.

Public accessibility is “the touchstone in determining whether a

reference constitutes a ‘printed publication.’” In re Hall, 781 F.2d 897,

898–99 (Fed. Cir. 1986). A reference is publicly accessible if it “has been

disseminated or otherwise made available to the extent that persons

3 Dr. Yaqub further testifies that in addition to having access via the 3GPP FTP site, 3GPP members typically received an email whenever documents contributed for a Working Group meeting were uploaded to the FTP server. Id. ¶ 36. Moreover, each Working Group kept “minutes” of their meetings, and uploaded these to the 3GPP FTP server. Id. ¶ 38. These minutes were organized by subject matter or topic, as described above, and included a table of contents so that all TDocs relating to a particular subject or topic presented or discussed at the meeting could be easily located. Id. ¶ 39.

Page 12: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

12

interested and ordinarily skilled in the subject matter or art, exercising

reasonable diligence, can locate it.” In re Wyer, 655 F.2d 221, 226 (CCPA

1981) (citations omitted). Public accessibility “is determined on a case-by-

case basis, and based on the ‘facts and circumstances surrounding the

reference's disclosure to members of the public.’” In re Lister, 583 F.3d

1307, 1311 (Fed. Cir. 2009) (quoting In re Klopfenstein, 380 F.3d 1345,

1350 (Fed. Cir. 2004)). The determination “is a legal conclusion based on

underlying factual determinations.” Kyocera Wireless Corp. v. Int’l Trade

Comm'n, 545 F.3d 1340, 1350 (Fed. Cir. 2008).

“[A] variety of factors may be useful in determining whether a

reference was publicly accessible.” Lister, 583 F.3d at 1312. Two such

factors are cataloging and indexing, although neither of these factors is “a

necessary condition for [a] reference to be publicly accessible.” Id.

Cataloging and indexing are most probative and relevant “in the context of

references stored in libraries.” Medtronic, Inc. v. Barry, 891 F.3d 1368,

1380 (Fed. Cir. 2018). However, such evidence is not needed to prove the

public accessibility of documents distributed at a meeting. Id. at 1381. To

prove the public accessibility of meeting-distributed documents, the most

relevant factors are “(1) ‘the length of time the [document] was exhibited,’

(2) ‘the expertise of the target audience’ (to determine how easily those who

viewed the material could retain the information), (3) ‘the existence (or lack

thereof) of reasonable expectations that the [document] would not be

copied,’ and (4) ‘the simplicity or ease with which the [document] could

have been copied.’” Id. at 1381–82 (quoting Klopfenstein, 380 F.3d at

1350).

Page 13: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

13

Upon consideration of Petitioner’s evidence and Patent Owner’s

arguments regarding the insufficiency of that evidence, we find Petitioner

has demonstrated by a preponderance of the evidence that TR 33.821 and

TS 23.401 were publicly available before the earliest effective priority date

of the ’848 patent, and are prior art under 35 U.S.C. § 102.

Dr. Yaqub has provided extensive unrebutted testimony regarding

3GPP’s routine business practices, including how (1) 3GPP’s technical

specifications, reports, and TDocs were created and uploaded to 3GPP’s

FTP server, (2) these documents were downloaded without restriction by

hundreds of engineers from many different member companies for

discussion at 3GPP working group and plenary meetings, (3) these engineers

(and other interested members of the public) had indefinite access to these

documents long after the meetings had ended, and (4) the 3GPP FTP server

indexed meeting documents based on meeting date and subject. See Ex.

1012 ¶¶ 20–21, 24, 30–33, 35.

Although Dr. Yaqub’s testimony is directed to 3GPP documents in

general, Dr. Yaqub’s description of 3GPP’s regular business practice

demonstrates the public accessibility of TR 33.821 and TS 23.401. See

Constant v. Advanced Micro-Devices, Inc., 848 F.2d 1560, 1568–69

(“Evidence of routine business practice can be sufficient to prove that a

reference was made accessible.”). TR 33.821 and TS 23.401, like all 3GPP

documents, were generated with intent to distribute them to interested

members of the telecommunications industry. They were uploaded to

3GPP’s FTP server without restriction or expectation of confidentiality, and

were indefinitely maintained there. They have been available for

downloading (copying) from the FTP server since being uploaded, and can

Page 14: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

14

be shared with others without restriction. Under such circumstances, the

documents are publicly accessible. See Klopfenstein, 380 F.3d at 1351

(finding publicly accessible a document that was easily copied and displayed

for an extended period of time to persons having ordinary skill in the art

without restrictions on copying). Indeed, Specifications for the related GSM

(Global System for Mobile) telecommunications standard were publicly

accessible because:

GSM specifications, though drafted within smaller technical subcommittees, were widely distributed before the critical date of the ’983 Patent. Versions of the standard were “publicly available and released as consistent sets.” Several U.S. companies took part in the ETSI work and had access to the GSM specifications through their European subsidiaries. The specifications themselves were visible to any member of the interested public without requesting them from an ETSI member. Further, ETSI did not impose restrictions on ETSI members to prevent them from disseminating information about the standard to non-members.

Kyocera, 545 F.3d at 1350–51 (internal citations omitted).

E. Patent Owner’s Motion to Exclude

Patent Owner filed a Motion to Exclude portions of TR 33.821

(Ex. 1004), TS 23.401 (Ex. 1005), and the Declaration of Raziq Yaqub,

Ph.D. (Ex. 1012), and the entirety of TS 23.401 (version 8.4.0) (Ex. 1028),

Patent Owner’s District Court Infringement Contentions (Ex. 1011), and the

Deposition Testimony of Johan Johansson (Ex. 1030). Paper 36, 2–6

(“Mot.”). Petitioner opposed the Motion (Paper 39, “Opp.”), and Patent

Owner replied (Paper 41, “Opp. Reply”). As the movant, Patent Owner

bears the burden of establishing it is entitled to the relief requested. See

37 C.F.R. § 42.20. The Board decides evidentiary issues based on the

Page 15: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

15

Federal Rules of Evidence. Id. § 42.62(a). For the reasons discussed below,

we deny Patent Owner’s motion to exclude.

1. Declaration of Raziq Yaqub, Ph.D.(Ex. 1012)

In paragraphs 54–56 of his declaration, Dr. Yaqub opines on the

authenticity, public availability, and publication dates of TR 33.821 and

TS 23.401. See Ex. 1012 (“Yaqub Decl.”) ¶¶ 54–56. Dr. Yaqub bases his

opinion, in part, on his ability to find these documents on the 3GPP FTP

server and listserv server, and the time stamps associated with these

documents on those servers. Id. His testimony includes screen shots of

portions of the 3GPP FTP server’s webpage listing these documents, and

URLs (universal resource locators) pointing to where these documents are

located on the 3GPP FTP server. Id.

On December 21, 2017, Patent Owner objected to Dr. Yaqub’s

declaration “to the extent it relies on documents that lack authentication or

contain hearsay.” Paper 19, 1. In particular, Patent Owner objected to

certain paragraphs of Dr. Yaqub’s declaration that “quote, discuss, or

otherwise rely on web pages that were not filed in this proceeding,” and that

“lack authentication and contain hearsay.” Id. On January 8, 2018,

Petitioner provided the webpages to Patent Owner in the form of

supplemental evidence. See Paper 20, 1; see also 37 C.F.R. § 42.64(b)(2).

On January 11, 2018, Patent Owner objected to the webpages as lacking

authentication and containing hearsay. Id. at 1.

Patent Owner moves to exclude paragraphs 54–56 of Dr. Yaqub’s

declaration “because they rely on unauthenticated webpages for the truth of

the matter asserted in those webpages.” Mot. 3–4. Patent Owner argues the

webpages lack authentication, and contain inadmissible hearsay that Dr.

Page 16: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

16

Yaqub relied on in determining when TR 33.821 and TS 23.401 (Exs. 1004–

1005) were publicly accessible on the 3GPP FTP server. Id. at 4–5.

Petitioner argues the objected to webpages are self-authenticating, and have

been authenticated by Dr. Yaqub’s testimony regarding their distinctive

characteristics. Opp. 3–5. Petitioner further argues the webpages “are

exempt from the rule against hearsay under Federal Rules of Evidence

803(6) and 807.” Id. at 6. Patent Owner responds that Dr. Yaqub is not

qualified to certify the authenticity of the webpages because his declaration

“is silent as to his role in the [3GPP] group’s recordkeeping or maintaining

the accuracy of the 3GPP webpages.” Opp. Reply 2.

Under Federal Rule of Evidence 803(6), records of a regularly

conducted activity are not hearsay provided the opposing party has not

established that the source of information or the method or circumstances of

their preparation indicate a lack of trustworthiness, and the party offering the

records establishes through the testimony of a qualified witness that the

records are (a) made at or near the time from information transmitted by

someone with knowledge, (b) kept in the course of a regularly conducted

business activity, and (c) made as a regular practice of that activity. Fed. R.

Evid. 803(6). Under Federal Rule of Evidence 902(11), such records are

self-authenticating provided (a) they are originals or copies that meet the

requirements of Rule 803(6)(a)–(c) as shown by certification of a qualified

person, (b) notice of intent to offer the records is given to the opposing party

before a hearing, and (c) the records and certifications are made available to

the opposing party so that the opposing party has a fair opportunity to

challenge them. Id. at 902(11).

We first note, “[b]ecause of the general trustworthiness of regularly

Page 17: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

17

kept records and the need for such evidence in many cases, the business

records exception [to the hearsay rule] has been construed generously in

favor of admissibility.” Conoco Inc. v. Dept. of Energy, 99 F.3d 387, 391

(Fed. Cir. 1996). Moreover, “the ‘custodian or other qualified witness’ who

must authenticate business records need not be the person who prepared or

maintained the records, or even an employee of the record-keeping entity, so

long as the witness understands the system used to prepare the records.” Id.

Finally, “documents that are standard records of the type regularly

maintained by firms in a particular industry may require less by way of

foundation testimony than less conventional documents proffered for

admission as business records.” Id. at 392; see also Gjokaj v. U.S. Steel

Corp., 700 F. App’x 494, 502 (6th Cir.) (finding a business record certified

by a qualified witness is self-authenticating under Federal Rule of Evidence

902(11)).

We find persuasive Dr. Yaqub’s testimony that the 3GPP webpages

he relied upon in his declaration are authentic, and their content, including

the publication dates of TR 33.821 and TS 23.401, are not hearsay. Dr.

Yaqub is a qualifying witness for the purposes of Rule 806(b) and 902(11).

See Conoco, 99 F.3d at 391; see also Gjokaj, 700 F. App’x at 502. From

1998 until 2010, Dr. Yaqub worked for various entities having an interest in

developing or understanding 3GPP technologies. Ex. 1012 ¶¶ 7–12. During

that time, he both participated in and contributed to 3GPP standards setting

organizations, was an active member in various 3GPP plenary level and

working group level meetings, and was Rapporteur of Technical Feasibility

Report TR 33.817. Id. ¶¶ 8, 11.

Dr. Yaqub testifies that 3GPP “produce[s] reports and specifications

Page 18: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

18

that define technologies covering cellular communications networks.” Id.

¶ 19. The specifications are “contribution-driven by 3GPP member

companies,” and produced via regularly and quarterly plenary meetings

“where member companies’ contributions, draft specification[s], and other

discussion documents are presented for approval.” Id. ¶ 20. Dr. Yaqub

further testifies that 3GPP follows “[a] well-established process . . . for

capturing accepted proposals and changes in Technical Specifications (TS)

and Technical Reports (TR).” Id. ¶ 24. This process includes a file naming

convention so that all of “the changes that are brought into the standard,

from the past, present, and in the future, are well documented and

controlled.” Id. ¶ 28 (quoting Ex. 1022, 5).

Dr. Yaqub further testifies that 3GPP documents are stored on 3GPP’s

FTP server in zip-compressed format, where the filename of the zip file is

the same as the name of the source document. Id. ¶ 29 (citing Ex. 1022

§ 5A). Member-contributed documents (“TDocs”) are assigned unique

document numbers, and “members upload these documents to 3GPP’s

public FTP server before, during, and after Working Group meetings.” Id.

¶ 30. The documents are uploaded “[s]oon after the end of the meeting—the

same day, or at worst within a few days.” Id. ¶ 37. The “TDocs are

publicly-available and unrestricted on the online FTP server,” and are

“openly published and no password is needed to access any information on

the 3GPP website.” Id. ¶ 30; see also Ex. 1022 § 7.6. Documents uploaded

to the 3GPP FTP server “receive a data and time stamp.” Ex. 1012 ¶ 33.

The documents are “retained on the public 3GPP server indefinitely, and the

date and time stamp can be relied upon to indicate when the upload

occurred.” Id. ¶¶ 33, 37.

Page 19: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

19

Based on the foregoing testimony, we find Dr. Yaqub “understands

the system used to prepare [3GPP] records,” and is a “qualified witness” or

“qualified person” as those terms are used in Federal Rules of Evidence

803(6) and 902(11). See Conoco, 99 F.3d at 391; see also Gjokaj, 700 F.

App’x at 502.

For the documents relevant to this proceeding (TR 33.821 and TS

23.401), Dr. Yaqub testifies that he “navigated to the relevant file” on the

3GPP FTP server, and “confirm[ed] that it had been correctly uploaded.”

Ex. 1012 ¶ 51. Dr. Yaqub provides the URLs he used to navigate to the

documents, and testifies that he recognizes the documents located by those

URLs as “true and correct” copies. Id. ¶¶ 54, 56. Dr. Yaqub provides

screen shots of the 3GPP FTP server’s directories that include the identically

named zip files containing the objected to documents. Id. As discussed

above, when Patent Owner objected to these screen shots, Petitioner served

complete printouts of the 3GPP FTP server’s directories from which Dr.

Yaqub took the screenshots. Opp. 5; see also Paper 19, 1; Paper 20, 1; Exs.

1031–1032.

Patent Owner provides no evidence that the 3GPP FTP server, the

webpages disclosing the contents of the FTP server’s directories, or the

methods or circumstances by which those webpages or their content were

prepared lack trustworthiness. See Mot. 3–5; Opp. Reply 1–4. By contrast,

Dr. Yaqub testifies that the contents of the 3GPP FTP server directories

(webpages) he relied upon were made and kept in the course of 3GPP’s

regularly conducted business activity, and were made at or near the times

indicated by their upload date and time stamps from information transmitted

by 3GPP contributing members. See Ex. 1012 ¶¶ 24, 28–30, 33, 37, 54–56.

Page 20: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

20

Dr. Yaqub’s declaration and the webpages (printouts of the 3GPP FTP

server directories) he relied upon were served on Patent Owner with notice

of intent to use them, and Patent Owner was provided with the opportunity

to challenge the webpages and their content, as well as Dr. Yaqub’s

testimony regarding how that content was created. See 37 C.F.R.

§ 42.51(b)(1)(ii).

Based on the evidence presented, as summarized above, we find Dr.

Yaqub’s testimony sufficient to authenticate the 3GPP FTP server’s

directories (webpages) and their content, such that they are admissible under

Federal Rule of Evidence 902(11) and not hearsay under Federal Rule of

Evidence 803(6). We, therefore, deny Patent Owner’s motion to exclude

paragraphs 54–56 of Dr. Yaqub’s declaration.

As discussed above, Petitioner also argues the 3GPP FTP server

directories (webpages) Dr. Yaqub relies upon can be authenticated under

Federal Rule of Evidence 901(b)(4), and their content is not hearsay under

Federal Rules of Evidence 807. Opp. 4–13. Patent Owner argues to the

contrary. Opp. Reply 2–3. Because we find Petitioner has shown the

webpages are self-authenticating business records and their contents are not

hearsay, we need not address these additional arguments. See Beloit Corp.

v. Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir. 1984) (finding an

administrative agency is at liberty to reach a decision based on a single

dispositive issue to “not only save the parties, the [agency], and [the

reviewing] court unnecessary cost and effort,” but to “greatly ease the

burden on [an agency] faced with a . . . proceeding involving numerous

complex issues and required by statute to reach its conclusion within rigid

time limits”).

Page 21: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

21

2. TR 33.821 and TS 23.401

Patent Owner moves to exclude as hearsay portions of TR 33.821

(Ex. 1004) and TS 23.401 (Ex. 1005) “[t]o the extent Petitioner relies on the

dates within [each of these Exhibits] for the purported truth of the matter

asserted to show the date of [their] public accessibility.” Mot. 2. Petitioner

argues the contents of these documents are “exempt from the rule against

hearsay under Federal Rules of Evidence 803(6) and 807.” Opp. 10–13.

Patent Owner argues “Dr. Yaqub’s role as a ‘participant in 3GPP’ is

insufficient to render him a qualified individual to support admission under

FRE 806(b),” and that “FRE 807 is an ‘exceptional’ remedy that Petitioner

has not justified in this case.” Opp. Reply 4.

For the reasons discussed in § II.E.1, supra, we find Dr. Yaqub is a

qualified witness who has authenticated the objected to documents, and

established their trustworthiness, so that their content is not hearsay under

Fed. R. Evid. 803(6). Patent Owner relies on Kolmes v. World Fibers Corp.,

107 F.3d 1354, 1542–43 (Fed. Cir. 1997), to argue that Dr. Yaqub is not a

qualified witness. We disagree. In Kolmes, a witness who “testified that he

had seen [certain] documents while attending a meeting,” but failed to

“testify concerning the record-keeping process related to them” was found

not to be a “qualified witness” under Federal Rule of Evidence 803(6). Id.

In the instant case, however, Dr. Yaqub has provided extensive testimony

regarding 3GPP’s record-development and record-keeping process,

including the fact that member-contributed documents uploaded to the 3GPP

FTP server are maintained indefinitely on that server as of their upload

dates. See Ex. 1012 ¶¶ 24, 28–30, 33, 37. Dr. Yaqub is, therefore, a

qualified witness. See Conoco, 99 F.3d at 391. Moreover, regarding the

Page 22: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

22

specifically objected to documents, Dr. Yaqub testifies that these documents

are “true and correct” copies of the documents uploaded to the 3GPP FTP

server as of their upload dates, and provides specific URLs to the 3GPP FTP

server by which they are downloadable. Id. ¶¶ 54, 56.

Accordingly, for the reasons discussed here and in § II.E.1 supra, we

find the objected to documents TR 33.821 (Ex. 1004) and TS 23.401

(Ex. 1005) are admissible business records under Federal Rule of Evidence

902(11), and their content is not hearsay under Federal Rule of Evidence

803(6). We, therefore, deny Patent Owner’s motion to exclude any portions

of Exhibits 1004 and 1005. Moreover, because we find these Exhibits are

admissible and not hearsay under Federal Rule of Evidence 803(6), we need

not address the parties’ additional arguments regarding whether these

documents are admissible and not hearsay under Federal Rule of Evidence

807. See Beloit, 742 F.2d at 1423.

3. Johansson Deposition Transcript (Ex. 1030)

Exhibit 1030 is a deposition transcript of Johan Johansson taken in the

related District Court proceeding. Mr. Johansson is a former Huawei

employee, and was Huawei’s 3GPP representative for Working Group 2.

Ex. 1030, 7:7–9, 54:18–55:7. Mr. Johansson testified that while he was

Huawei’s Working Group 2 representative, his practice was to download

TDocs for the Working Group 2 meetings he attended. Id. at 147, 9–13. He

further testified that he did not need to provide these TDocs to anyone else

because “[e]veryone that needed them would download them from the FTP

server at 3GPP,” and that because the FTP server was public, “the world had

access to these TDocs, everyone.” Id. at 147:19–22, 154:7–10.

Petitioner relies on Mr. Johansson’s testimony to corroborate Dr.

Page 23: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

23

Yaqub’s testimony that it was 3GPP’s regular business practice to make

3GPP documents available to and accessible by “at least members of the

3GPP working [groups] through the 3GPP FTP site.” Reply 21. Patent

Owner moves to exclude this testimony as irrelevant and causing unfair

prejudice. Mot. 6 (citing Fed. R. Evid 401–403). Patent Owner argues the

testimony is irrelevant because it “makes no mention of the 3GPP

specifications in this case—TR 33.821 and TS 23.401,” and does not

identify which documents were downloaded from the FTP server or when.

Id.; Opp. Reply 5. Petitioner argues the testimony is relevant because it

“directly contradicts Huawei’s arguments concerning the public availability”

of 3GPP documents. Opp. 14.

A document is relevant if it tends to make a fact of consequence in

determining an action more or less probable. Fed. R. Evid. 401. Relevant

evidence is generally admissible, but may be excluded if its probative value

is substantially outweighed by unfair prejudice. Id. at 402–403.

Mr. Johansson’s testimony is relevant because it makes more or less

probable Dr. Yaqub’s testimony regarding 3GPP’s business practice of

making TDocs available to Working Group members before Working Group

meetings. This is true, even though Mr. Johansson’s testimony does not

concern the specific TDocs at issue in this proceeding. As discussed in

§ II.D, supra, the public availability of documents can be established based

on evidence of regularly conducted business practices. See Constant, 848

F.2d at 1568–69 (“Evidence of routine business practice can be sufficient to

prove that a reference was made accessible.”). Patent Owner’s concerns

about unfair prejudice do not persuade us that we should exclude Mr.

Johansson’s testimony because, like a district court conducting a bench trial,

Page 24: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

24

we can assess the probative value of the testimony as it applies to this

proceeding.

Accordingly, for the reasons discussed above, we deny Patent

Owner’s motion to exclude the testimony of Mr. Johansson.

4. TS 23.401 v. 8.4.0 (Ex. 1028)

Exhibit 1028 is a newer version of TS 23.401 (Ex. 1005), released

December 2008, which is after the priority date of the ’848 patent.

Ex. 1028, 1. It discloses the UE’s “network capabilities indicate . . . the

supported NAS and AS security algorithms.” Id. at 55. Petitioner relies on

Exhibit 1028 to rebut Patent Owner’s argument that the TAU request a UE

sends to an MME in idle mode mobility between non-LTE and LTE

networks, which includes the UE’s Network Capability, does not include the

UE’s security capabilities. See Reply 19, n.5; see also Ex. 1005, 31–32

(showing a UE sends its “UE Network Capability” to an MME in a TAU

request).

Patent Owner argues that because Exhibit 1028 was dated after the

priority date of the ’848 patent, it “is irrelevant to showing how a Skilled

Artisan would understand ‘UE Network Capabilities’ as of the time at

issue—August 31, 2007 (’848 Patent’s effective filing date).” Mot. 5.

Petitioner counters that extrinsic evidence of the meaning of a term to a

person of ordinary skill in the art “need not antedate the critical date of the

patent at issue.” Opp. 13 (quoting Monsanto Tech. LLC v. E.I. DuPont de

Nemours & Co., 878 F.3d 1336, 1345 (Fed. Cir. 2018)). Petitioner further

argues that because Exhibit 1028 was submitted as “extrinsic evidence to

establish the understanding of a person of ordinary skill in the art,” it “is

relevant to demonstrate what . . . was meant by the term ‘UE network

Page 25: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

25

capabilities’ in the prior art version of TS 23.401 [i.e., Exhibit 1005].”

Opp. 13–14. Patent Owner replies that because Exhibit 1028 “postdates the

February 2008 3GPP meeting where Patent Owner’s contribution was

accepted by the 3GPP standard’s body. . . . it shows only that Patent

Owner’s contribution was adopted in a later standard, and is irrelevant.”

Opp. Reply 5 (citing Ex. 2010, 1).

As discussed below, we do not rely on Exhibit 1028 to elucidate the

meaning of the term “UE Network Capability” in TS 23.401 (Ex. 1005) to a

person of ordinary skill in the art. Accordingly, we dismiss Patent Owner’s

motion to exclude Exhibit 1028 as moot.

5. Infringement Contentions (Ex. 1011)

Exhibit 1011 is a copy of Patent Owner’s infringement contentions

submitted to the District Court in the related district court litigation. Patent

Owner moves to exclude the exhibit as irrelevant and causing unfair

prejudice. Mot. 3. Patent Owner argues the exhibit is irrelevant because

“[n]either the Petitioner, nor its expert Dr. Tim Williams . . . cites or relies

on these infringement contentions,” which purport to show that Samsung’s

accused devices “comply with different versions of the 3GPP standards,

dated later than the versions Petitioner contends are prior art.” Id. Petitioner

does not dispute Patent Owner’s contentions. Opp. 13.

We agree with Patent Owner that its infringement contentions in the

related district court litigation are not relevant to any issue in this

proceeding. Accordingly, Patent Owner’s motion to exclude Exhibit 1011 is

granted.

Page 26: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

26

F. Overview of Prior Art

1. TR 33.821

TR 33.821 is a 3GPP document describing the “rationale and

track[ing] of security decisions in Long Term Evolved (LTE)” networks.

Ex. 1004, 6. TR 33.821 explains that LTE security “separate[s] the security

between AS [Access Stratum] . . . and NAS [non-Access Stratum]

signalling,” and requires “the radio link and the core network . . . have

cryptographically separate keys.” Id. at 7. As a result, the “LTE system has

two layers of protection instead of one layer perimeter security like in

UTRAN [non-LTE].” Id. The first layer of security is RRC [Radio

Resource Control] security between the UE and eNB, and the second layer

of security is NAS security between the UE and a mobility management

entity (MME). Id. at 7, 41–42 (during initial attachment “Both UE-eNB and

UE-MME security needs to be established.”); see also id. at 42 (during idle

mode mobility “UE-MME security must be established. This could be done

by the passing of the NAS security context.”). The second or NAS security

layer protects the LTE network should the first or RRC security layer be

compromised. Id. at 4. As indicated above, the UE must establish NAS

security with the MME during both initial attachment to the LTE network

and idle mode mobility within the LTE network. Id. at 41–42.

TR 33.821 discloses that an Authentication and Key Agreement

(AKA) procedure authenticates a UE in both 3G and LTE networks. Id. at

31. In the 3G (UMTS) AKA procedure, the UE and 3G network agree on a

pair of security keys, a cipher key (CK) and an integrity key (IK). Id. at 31,

43. In the LTE AKA procedure, the UE and LTE network agree not only on

security keys (CK, IK), but also on NAS security keys (KNASint and

Page 27: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

27

KNASenc). Id. at 43, 51–53, 59. A diagram depicting where and how the

various security keys are generated in an LTE network is shown in Figure 12

of TR 33.821, which is reproduced below.

Figure 12 is a diagram showing the distribution and generation of security

keys in an LTE network. Id. at 53. K is a secret key that is permanently

stored in both an LTE network’s Authentication Center (AuC) and a UE’s

Universal Subscriber Identity Module (USIM). Id. at 51. During an AKA

run, the USIM and AuC independently derive cipher and integrity keys

CK/IK from secret key K, and respectively provide CK/IK to the UE and to

the LTE network’s Home Subscriber Server (HSS). Id. at 52. The UE and

HSS independently derive key Kasme from keys CK/IK, and the HSS

provides Kasme to the MME. Id. Lastly, the UE and MME independently

derive NAS security keys KNASint and KNASenc from Kasme using selected

integrity and security algorithms, respectively. Id.

Page 28: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

28

TR 33.821 discloses that the UE and MME must agree upon the

security algorithms used to derive NAS security keys KNASint and KNASenc

when the UE initially attaches to the network, undergoes idle to active

transition within the network, or undergoes idle mode mobility. Id. at 68

(“Here the UE and the target network entities have to agree on security

algorithms to use after a mobility event occurred.”). The network selects the

security algorithms based upon the capabilities of the UE, the capabilities of

the serving network entity, and the network’s restrictions. Id. TR 33.821

proposes having the MME select the NAS security algorithms based on the

UE’s security capability and that the most natural way for the MME to learn

of the UE’s security capability is for the UE to send it to the MME. Id. at

69.

Figure 17 of TR 33.821, reproduced below, discloses a procedure that

allows the MME to obtain the UE’s security capabilities and select an NAS

security algorithm during initial attachment.

Page 29: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

29

Figure 17 is a flow chart showing the flow of information between the UE,

eNB, and MME in an LTE network during initial attachment. Id. at 70. At

step 1, the UE sends an NAS message to the eNB that includes the UE’s

security capabilities (UE caps). Id. At step 2, the eNB forwards the

message to the MME. Id. At step 3, the UE and MME optionally perform

an AKA run to derive keys CK/IK. Id. at 33, 70. At step 4, the MME

Page 30: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

30

selects an NAS security algorithm, and sends it to the eNB in a Security

Mode Command (SMC) message. Id. at 70. At step 5, the eNB forwards

the SMC message to the UE. Id. at 71. At step 6, the UE begins NAS

encryption and sends an NAS complete message to the eNB, and at step 7

the eNB forwards this message to the MME. Id. Messages sent between the

UE and MME are now NAS encrypted. Id.

TR 33.821 further discloses that a UE undergoing idle mode mobility

within an LTE network “results in a location update procedure. The security

algorithm selection upon location updates shall be performed in the same

way as on initial attachment.” Id. at 75.

2. TS 23.401

TS 23.401 is a 3GPP specification that covers “roaming and non-

roaming scenarios and covers all aspects, including mobility between E-

UTRAN and pre-E-UTRAN 3GPP radio access technologies, policy control

and charging, and authentication.” Ex. 1005, 7. TS 23.401 discloses a

Tracking Area Update (TAU) procedure that allows a UE in a 3G network to

undergo idle mode transition to an LTE network. Id. at 30–33. The TAU

procedure executes when an idle state UE that is registered with a 3G-SGSN

registers with an MME in an LTE network as depicted in Figure 5.3.3.2-1,

reproduced below. Id. at 30–31.

Page 31: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

31

Figure 5.3.3.2-1 discloses a TAU update procedure executed when an

idle mode UE transitions from a 3G network to an LTE network. Id. at 31.

At step 1, the UE moves from a 3G network Ranging Area (RA) to an LTE

network Tracking Area (TA). Id. At steps 2a/2b, the UE sends, via an

eNodeB, a TAU request to an MME in the LTE network. Id. The TAU

request includes the UE’s old TAI (tracking area identifier), S-TMSI

Page 32: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

32

(temporary mobile subscriber identifier), UE Network Capability, selected

network, and an active flag. Id. At step 3, the MME uses the information in

the TAU request to identify the 3G-SGSN to which the UE was connected,

and sends a Context Request message to the SGSN to retrieve the UE’s

context. Id. At step 4, the SGSN sends a Context Response to the MME,

and the MME “shall ignore the UE Network Capability contained in the . . .

SGSN Context Response only when it has previously received an UE

Network Capability in the Tracking Area Update.” Id. At step 5, the UE

and MME execute authentication functions, security functions, and

ciphering procedures. Id. The remaining steps in Figure 5.3.3.2-1 involve

messages sent between the MME and various elements of the 3G and LTE

networks to ensure the UE’s context is transmitted to the LTE network,

which subsequently controls messaging to and from the UE. Id.

3. Shaheen

Shaheen is a patent directed to a system and method for implementing

a Routing Area Update (“RAU”) procedure in an LTE network. Ex. 1006,

Abstract. The RAU procedure involves signaling between various LTE

network elements, including an MME and a Wireless Transmit/Receive Unit

(WRTU) such as a UE. Id. ¶¶ 9, 33, Fig. 9. The WRTU includes a

transceiver (transmitter/receiver) for sending and receiving data to and from

the MME in the LTE network, and a processor for implementing the

disclosed procedure. Id. ¶¶ 40–42.

G. Obviousness of Claims 1, 3–5, 7–9, 11–13, 15, and 16 over TR 33.821 and TS 23.401

Petitioner argues claims 1, 3–5, 7–9, 11–13, 15, and 16 are

unpatentable as obvious over TR 33.821 and TS 23.401. Pet. 36–63.

Page 33: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

33

1. Mapping of TR 33.821 and TS 23.401 to the Claims

a. Claims 1 and 9

Claim 1 recites a UE that includes a transmitter configured to send the

UE’s security capabilities to an LTE network for NAS security algorithm

selection when the UE moves in idle state from a non-LTE network to the

LTE network. Ex. 1001, 11:52–58. Petitioner relies on the combined

teachings of TR 33.821 and TS 23.401 to teach this limitation. See Pet. 37–

43, 58–63.

Petitioner argues TR 33.821 teaches a UE having an LTE radio that

sends radio signals to and receives radio signals from an eNodeB in an LTE

network. Pet. 37–39 (citing Ex. 1004, 18 (Fig. 3)). Relying on the

testimony of Dr. Williams, Petitioner argues a person of ordinary skill in the

art would have known that an LTE radio includes a transmitter. Id. at 39

(citing Ex. 1014 ¶¶ 93–94). Petitioner argues TR 33.821 also teaches the UE

transmitter sends an initial access message that includes the UE’s security

capabilities to an MME in an LTE network, and the MME selects an NAS

security algorithm based on the UE’s and MME’s security capabilities. Id.

at 39–41 (citing Ex. 1004, 69–70, Figs. 10, 17; Ex. 1014 ¶¶ 95–97). Lastly,

Petitioner argues TR 33.821 teaches “the same procedure used for initial

access/attach should be used during idle state mobility” within the LTE

network. Id. at 41–42 (quoting Ex. 1004, 75 (“Idle mode mobility results in

a location update procedure. The security algorithm selection upon location

updates shall be performed in the same way as on initial attachment.”)).

Petitioner acknowledges that TR 33.821 does not teach a non-LTE to

LTE idle mode mobility procedure. Id. at 42. However, Petitioner argues

TS 23.401 teaches such a procedure, and during that procedure a UE sends a

Page 34: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

34

TAU request to an MME, and the UE and MME perform an AKA run to

generate security keys. Id. at 42–43 (citing Ex. 1005, 30–32, Fig. 5.3.3.2-1;

Ex. 1014 ¶¶ 87, 99–101). Petitioner argues a person of ordinary skill in the

art would have been motivated to modify this non-LTE to LTE idle mode

procedure such that the UE includes its NAS security capabilities in the

TAU request for several reasons. See Pet. 58–63.

Relying on the testimony of Dr. Williams, Petitioner argues

TR 33.821 and TS 23.401 were part of the LTE development process, and a

person implementing LTE network security would have considered the

teachings from both references “to understand the overall network

architecture and how security procedures are implemented in different

elements of the architecture.” Id. at 58–59 (citing Ex. 1014 ¶¶ 133, 135). In

particular, TS 23.401 discloses LTE “network architecture, including major

network elements . . . and information flows among the network elements

and UEs within the network,” and TR 33.821 discloses LTE “security and

authentication procedures between networks and user equipment.” Id.

(citing Ex. 1004, 6; Ex. 1005, 23–47).

Petitioner argues TR 33.821 “demonstrates all of the security

negotiation procedures claimed in the ’848 Patent were known in the context

of initial attachment and idle mode mobility.” Id. at 59–60 (citing Ex. 1014

¶ 136). Petitioner further argues TS 23.401 teaches a UE sends its network

capabilities to an MME in a TAU request during idle mode mobility

between non-LTE and LTE networks. Id. at 60–61 (quoting Ex. 1005, 31

(“The UE initiates a TAU procedure by sending a Tracking Area Update

Request (old TAI, old S-TMSI, UE Network Capability, Selected Network,

active flag) message to the eNodeB.”)). Moreover, TS 23.401 teaches the

Page 35: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

35

LTE network needs to authenticate and establish security with the UE via an

AKA run. Id. at 62 (citing Ex. 1005, 31; Ex. 1014 ¶ 140). Therefore,

Petitioner argues, a person skilled in the art “would have looked to known

security negotiation and key derivation procedures in order to implement the

AKA procedure, which would have led him or her to TR 33.821.” Id. (citing

Ex. 1014 ¶ 140).

Petitioner argues a person of ordinary skill in the art would have

found it obvious to modify the non-LTE to LTE idle mode mobility TAU

procedure taught by TS 23.401 to include the UE security capabilities taught

by TR 33.821 because the UE needed to authenticate itself to and establish

security with the LTE network. Id. at 59–60 (citing Ex. 1014 ¶¶ 136–137).

Petitioner argues this modification would have been a simple substitution of

one known element for another to obtain predictable results because once the

MME obtained the UE’s security capabilities it would select an NAS

security algorithm, provide the selection to the UE, and the UE and MME

would proceed to derive security keys as taught by TR 33.821. Id. at 60–61

(citing Ex. 1014 ¶¶ 137–139). Petitioner argues the results of the

modification would have been predictable because the TS 23.401 TAU

request is a type of NAS message like the NAS message used to send UE

security capabilities to an MME on initial attachment as taught by

TR 33.821. Id. at 60–61 (citing Ex. 1014 ¶ 138).

Patent Owner disputes that it would have been obvious to combine the

teachings of TR 33.821 and TS 23.401 in the manner proposed by Petitioner.

See PO Resp. 21–33. In particular, Patent Owner argues Petitioner fails to

identify a reason to make the proposed combination, has relied on improper

hindsight, has improperly relied upon the initial attach procedure disclosed

Page 36: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

36

in TR 33.821 rather than the idle mode mobility procedure, and has failed to

show the proposed combination would have been a simple and

straightforward substitution. Id. We summarize Patent Owner’s arguments

in more detail below, and explain why we find Petitioner’s arguments to be

persuasive.

First, Patent Owner argues that Petitioner’s rationale for combining

the teachings of TR 33.831 and TS 23.401 are too “generic, not specific,”

and lack an “objective reason to combine specific elements in the way they

are claimed in the ’848 Patent.” Id. at 29–30. We do not find this argument

persuasive because it only considers the starting point of Petitioner’s

analysis for why a person skilled in the art would have combined the

teachings of TR 33.831 and TS 23.401, namely, because they are in the same

field of endeavor and were drafted as part of the LTE standards development

process. Id. As discussed above, Petitioner further argues that a person

ordinarily skilled in the art would have combined these references because

TS 23.401 teaches that when a UE undergoes non-LTE to LTE idle mode

mobility, the UE needs to authenticate itself and establish security with the

LTE network via an AKA run. Pet. 62 (citing Ex. 1005, 31; Ex. 1014

¶ 140). Thus, he or she “would have looked to known security negotiation

and key derivation procedures in order to implement the AKA procedure.”

Id. at 62 (citing Ex. 1014 ¶ 140). This would have led to consideration of

the security negotiation and key derivation procedures disclosed in TR

33.821, including having the UE send its security capabilities to an MME as

taught in the TR 33.821 initial access procedure. Id. Therefore, a person

ordinarily skilled in the art would have modified the TS 23.401 idle mode

Page 37: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

37

mobility TAU request to include transmitting the UE security capabilities to

the MME as taught by TR 33.821. Id. at 59–60 (citing Ex. 1014 ¶ 137).

Patent Owner argues the AKA run disclosed in the TS 23.401 idle

mode mobility TAU procedure would not have motivated a person skilled in

the art to combine the teachings of TS 23.401 and TR 33.801 because

“[n]either TR 33.821 nor TS 23.401 suggest that the UE security capabilities

are required for or used in this AKA procedure.” PO Resp. 32. Rather,

relying on the testimony of Dr. Mandayam, Patent Owner argues “[t]he

AKA procedure is instead for KASME deduction.” Id. (citing Ex. 2003 ¶ 43).

Dr. Mandayam’s testimony is based on two disclosures relating to Figure 13

of TR 33.821, which describes a TAU Request procedure for idle mode

mobility between LTE networks. See Ex. 2003 ¶¶ 39–43; Ex. 1004, 61

(Fig. 13). First, step 6 of Figure 13 shows that during an AKA run the UE

and MME agree on key KASME. Ex. 1004, 61. Second, TR 33.821 describes

a step 7 in which the MME derives new NAS keys from KASME and the NAS

security algorithm selected by the MME. Id. We are not persuaded by this

argument for the reasons that follow.

Initially, we note that Petitioner’s argument is based on the TS 23.401

non-LTE to LTE idle mode mobility TAU Request AKA run, not on the

TR 33.821 LTE to LTE idle mode TAU Request AKA run on which Patent

Owner’s argument depends. See Pet. 62 (citing Ex. 1005, 31) (“TS 23.401

recognizes that authentication and security must be established when the UE

moves in idle mode from a non-LTE network to an LTE network. . . . the UE

and MME engage in an AKA procedure following the TAU Request.”)

(internal citations omitted). TS 23.401 teaches a TAU Request is followed

by an authentication procedure (step 5) involving authentication functions,

Page 38: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

38

security functions, and ciphering procedures. Ex. 1005, 31–32. Moreover,

Figure 13 of TR 33.821 discloses the TR 33.821 TAU Request procedure

concludes with an AKA run, and does not disclose step 7 as a separate step

from that AKA run. See Ex. 1004, 61. Elsewhere, TR 33.821 discloses

NAS keys are derived by an MME during an AKA run. See id. at 59

(disclosing an MME already has “NAS protection [keys] as well as other

higher layer keys” during idle to active transitions, and that “[t]hese higher

layer keys may have been established in the MME as a result of an AKA

run.”); see also id. at 42 (disclosing UE-MME security must be established

during a fresh AKA run). Accordingly, we are not persuaded that neither

TR 33.821 nor TS 23.401 suggests that the UE security capabilities are

required for or used in the TS 23.401 AKA run that occurs when a UE

connects to an LTE network from a non-LTE network.

Second, Patent Owner argues Petitioner’s reason for combining the

teachings of TR 33.821 and TS 23.401, i.e., “to enhance security during idle

mode mobility from a non-LTE network to an LTE network,” is hindsight-

based because it is “the reasoning of the 848 Patent itself.” PO Resp. 33

(quoting Pet. 62). We disagree. Petitioner correctly notes that TR 33.821 is

a 3GPP report that “elaborates on security and authentication procedures

between networks and user equipment.” Pet. 59 (citing Ex. 1004, 6); see

also Ex. 1004, 6 (describing the scope of TR 33.821 as a discussion of the

“rationale and track[ing] of security decisions in Long Term Evolved (LTE)

RAN and 3GPP System Architecture Evolution (SAE).”). Petitioner also

correctly notes that TS 23.401 “recognizes that authentication and security

must be established when the UE moves in idle mode from a non-LTE

network to an LTE network,” and does so by “engag[ing] in an AKA

Page 39: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

39

procedure following the TAU Request.” Pet. 62 (citing Ex. 1005, 31;

Ex. 1014 ¶ 140); see also Ex. 1004, 31–32 (describing authentication step 5

of the TS 23.401 TAU procedure as involving authentication functions,

security functions, and ciphering procedures); see also Ex. 1005, 41–42

(disclosing a UE must establish NAS security upon idle mode mobility and

during an AKA run). Therefore, Petitioner argues, “a person of ordinary

skill in the art at the time of the invention would have found express

motivation to combine TR 33.821 and TS 23.401 in order to enhance

security during idle mode mobility from a non-LTE network to an LTE

network.” Id. (citing Ex. 1014 ¶ 140).

Notably, as discussed above, Petitioner’s rationale for combining the

teachings of TR 33.821 and TS 23.401 relies solely on disclosures obtained

from those references, and does not rely on any disclosure obtained from the

’848 patent. As such, we determine that Petitioner’s rationale is not

hindsight-based. See In re McLaughlin, 443 F.2d 1392, 1395 (CCPA 1971)

(finding an obviousness determination is not based on hindsight when “it

takes into account only knowledge which was within the level of ordinary

skill at the time the claimed invention was made and does not include

knowledge gleaned only from applicant’s disclosure”). This is true even if

Petitioner’s rationale also motivated the inventor of the ’848 patent. Indeed,

the fact that the inventor made the claimed invention for the same reason

motivated by the prior art is evidence that the invention was obvious, not

that the Petitioner relied on hindsight-bias.

Third, Patent Owner argues Petitioner’s reason to combine the

teachings of TR 33.821 and TS 23.401 is hindsight-based because it “ignores

the teaching in TR 33.821 for handling security during an idle state network

Page 40: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

40

transition,” and instead focuses on “the initial attach procedure . . . that does

not involve a UE transition between two networks.” PO Resp. 23. Patent

Owner argues TR 33.821 teaches different security procedures for idle mode

mobility and initial attachment in LTE networks. Id. at 21–23, 27. In idle

mode mobility, TR 33.821 teaches a UE sends a TAU request to a new

MME, and the new MME receives the UE’s security capabilities from a

previous MME via context request/response messages. Id. at 21–22, 27

(citing Ex. 1004, 61, Fig. 13; Ex. 2003 ¶¶ 42, 52). By contrast, in initial

attachment, TR 33.821 teaches a new MME receives the UE’s security

capabilities directly from the UE because “there is no old SGSN or MME

that the new MME can contact to get the UE’s security capabilities.” Id. at

22–23 (citing Ex. 1004, 70, Fig. 17; Ex. 2003 ¶ 50). Patent Owner further

argues that TS 23.401 also teaches using a TAU request procedure in idle

mode mobility, albeit between non-LTE and LTE networks, in which the

MME in the LTE network receives information from the SGSN in the non-

LTE network via context request/response messages. Id. at 22, 27 (citing

Ex. 1005, 31–32; Ex. 2003 ¶ 52). Therefore, Patent Owner argues, a person

skilled in the art would have combined the teachings of TR 33.801 and

TS 23.401 such that “the new MME obtains the UE’s security capabilities

from the old network [i.e., old SGSN] through the exchange of ‘context

request’ and ‘context response’ messages.” Id. at 27, 34 (citing Ex. 2003

¶¶ 52, 61, 73).

Patent Owner’s argument highlights the fundamental dispute between

the parties regarding how a person of ordinary skill in the art would have

combined the teachings of TR 33.821 and TS 23.401. That dispute revolves

around whether an MME receiving a TS 23.401 TAU Request from a UE

Page 41: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

41

undergoing non-LTE to LTE idle mode mobility should get the UE’s

security capabilities from the UE itself or from an SGSN in the non-LTE

network. Petitioner argues the MME should get the UE’s security

capabilities from the UE itself. See Pet. 43, 60–61. Patent Owner argues the

MME should get the UE’s security capabilities from an SGSN in the non-

LTE network. See PO Resp. 27, 32. To resolve this fundamental dispute,

we must determine “whether the teachings of the prior art, taken as a whole,

would have made obvious the claimed invention.” In re Gorman, 933 F.2d

982, 986, (Fed. Cir. 1991). For the reasons that follow, we find the prior art

as a whole suggests a UE undergoing non-LTE to LTE idle mode mobility

would send its security capabilities to an MME in the TS 23.401 TAU

Request as Petitioner contends.

TR 33.821 teaches that a UE must establish AS security between itself

and an eNodeB, and NAS security between itself and an MME, when the UE

first connects to an LTE network. Ex. 1004, 41–42. To establish NAS

security, the UE sends “all UE[] security capabilities” to the MME in an

initial NAS request message. Id. at 70 (steps 1, 3) (emphasis added).

TR 33.821 further teaches that during idle mode mobility between LTE

networks, the UE does not send its security capabilities to the MME because

the MME can obtain them from the MME to which the UE was previously

attached. Id. at 61.

The teachings of TS 23.401 are similar. In particular, TS 23.401

teaches that when a UE first registers or connects to an LTE network,

whether via initial attachment or non-LTE to LTE idle mode mobility, the

UE must send to an MME the information the MME needs to connect the

UE to the network. For example, TS 23.401 teaches a UE sends its UE

Page 42: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

42

Network Capability to an MME in an LTE network attachment procedure.

See Ex. 1005, 24 (disclosing “[a] UE needs to register with the network. . . .

This registration is described as Network Attachment.”); see also id. at 25

(disclosing a UE Attach Request sent to an MME includes the UE’s S-

TMSI, old TAI, UE Network Capability, PDN Address Allocation, and

Selected Network). TS 23.401 also teaches that during non-LTE to LTE idle

mode mobility, a UE (which has not yet connected to the LTE network)

sends an MME its UE Network Capability in a TAU Request. Id. at 31

(disclosing the non-LTE to LTE TAU Request includes the UE’s S-TMSI,

old TAI, UE Network Capability, Selected Network, and an active flag). By

contrast, when the UE simply moves among MMEs within an LTE network,

TS 23.401 teaches the UE’s TAU request does not include the UE Network

Capability. Id. at 28 (disclosing the TAU request for mobility within LTE

networks includes the UE’s S-TMSI, old TAI, Selected Network, and an

active flag, but does not include the UE Network Capability).

Considering the teachings of TS 23.401 and TR 33.821 as a whole, we

agree with Petitioner’s argument and evidence that a person ordinarily

skilled in the art would have used “the TAU Request message in TS 23.401

to transport the UE security capabilities to the MME,” and would have done

so “to initiate the security negotiation and key derivation procedures

disclosed in TR 33.821.” Pet. 60–61 (citing Ex. 1014 ¶¶ 137–138).

TR 33.821 teaches that when a UE first connects to an LTE network, the UE

must establish NAS security with an MME in the LTE network. See Ex.

1004, 41–42, 71. TR 33.821 further teaches that to establish NAS security,

the MME needs the UE’s security capabilities, and gets them from the UE

itself. See Ex. 1004, 69 (“[I]n SAE/LTE MME has to obtain knowledge of

Page 43: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

43

(at least NAS part) of UEs capabilities. . . . [I]t seems most natural to assume

that UE sends its capabilities to MME”). TS 23.401 teaches that when a UE

first connects to an LTE network (in which case the LTE network does not

have the UE’s context) it must perform authentication, which involves

“AKA authentication and establishment of a NAS level security association

with the UE.” Ex. 1005, 24–26 (step 5); see also id. at 30–32 (step 5).

TS 23.401 also teaches the UE sends its UE Network Capability to an MME

when if first attaches to an LTE network, including during idle mode

transitions from a non-LTE network. Ex. 1005, 25, 31.

For the reasons discussed above, we disagree with Patent Owner’s

contention that an MME would get a UE’s security capabilities from a

previous SGSN in non-LTE to LTE idle mode mobility when the UE

executes the TS 23.401 TAU Request. Although TR 33.821 does teach an

MME gets a UE’s security capabilities from a previous MME in LTE to

LTE idle mode mobility, the MME is able to do that because the LTE

network already has the UE’s security context. The previous MME obtained

that security context either itself, or from an even earlier MME, during an

initial attachment procedure in which the previous (or earlier) MME directly

received the UE’s security capabilities. See Ex. 1004, 41–42, 70. However,

when a UE transitions from a non-LTE network to an LTE network that LTE

initial attachment procedure has not taken place, and the LTE network does

not have the UE’s security context. TS 23.401 teaches that a UE first

connecting to an LTE network in non-LTE to LTE idle mode mobility

executes an authentication function. Ex. 1005, 31–32 (step 5). That

authentication function, which is mandatory when the LTE network does not

have the UE’s security context, involves “AKA authentication and

Page 44: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

44

establishment of a NAS level of security association with the UE). Id. at

25–26 (step 5). TR 33.821 teaches an AKA run with an LTE network

establishes NAS protection and other higher layer security keys. See

Ex. 1004, 59 (disclosing NAS and other “higher layer keys may have been

established in the MME as a result of an AKA run”).

For the same reasons, we are not persuaded by Patent Owner’s

additional argument that although the TS 23.401 TAU request includes the

UE’s Network capabilities, “[t]he term UE Network capability does not

imply that the TAU request includes the UE’s security capabilities.” PO

Resp. 22 (citing Ex. 1005, 31; Ex. 2003 ¶ 54) (emphasis added). We first

note that Dr. Mandayam, Patent Owner’s expert, did not state the term UE

Network capabilities does not imply UE security capabilities. Rather, he

stated “a TAU request including network capabilities does not necessarily

mean that the TAU request can or should also include security capabilities.”

Ex. 2003 ¶ 54 (emphasis added). However, as explained above, TR 33.821

teaches that a UE must negotiate and establish NAS security with an LTE

network upon initial attachment. See Ex. 1004, 41–42, 70. Thus, when a

UE transitions in idle mode from a non-LTE network to an LTE network, the

UE must establish NAS security with the LTE network. TR 33.831 teaches

the most natural way for the UE to do this is to send its security capabilities

to an MME in the LTE network. Id. at 69–70. Moreover, as Petitioner

contends, TS 23.401 suggests doing exactly this by sending its UE Network

capabilities to an MME in the LTE network. Ex. 1005, 31; see also Pet. at

60 (“[A] person of ordinary skill in the art would have implemented this

combination by using the TAU Request message in TS 23.401 to transport

the UE security capabilities to the MME.”) (emphasis added); id. at 61

Page 45: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

45

(“[T]he TAU Request message disclosed in TS 23.401 . . . would have been

readily capable of carrying the UE security capabilities to the MME in order

to initiate the security negotiation and key derivation procedures disclosed in

TR 33.821.”); id. (“[T]he TAU request message is specifically intended to

transmit UE capabilities to the MME, so there would be no unexpected

changes in its operation.”).

Patent Owner also argues Petitioner’s proposed combination of

TR 33.821 and TS 23.401 is flawed because Petitioner mischaracterizes the

teaching in TR 33.821 that the “security algorithm selection upon location

updates shall be performed in the same way as on initial attachment.” Id. at

25 (citing Pet. 41–42); see also Ex. 1004, 75. Patent Owner argues this

simply means what it says—that the MME should select the security

algorithm based on the UE’s security capabilities—not that the MME should

obtain the UE’s security capabilities from the UE as it does during initial

attachment. Id. at 25 (citing Ex. 2003 ¶ 70).

We do not find this argument persuasive because it does not address

the combination proposed by Petitioner, which is to modify the TS 23.401

TAU Request in view of the teachings of TR 33.821. See Pet. 43, 59–60

(citing Ex. 1014 ¶¶ 137–138). In the context of LTE to LTE idle mode

mobility, we agree that performing security algorithm selection upon

location updates in the same was as on initial attachment simply means the

new MME selects a UE’s security algorithm because it already knows the

UE’s security capabilities. This is because TR 33.821 teaches, in the context

of LTE to LTE idle mode mobility, the new MME obtains the UE’s security

capabilities from a previous MME in a context response message. Id. at 61.

Page 46: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

46

TR 33.821, however, does not address how a UE should establish

NAS security with an MME when the UE connects to the LTE network from

a non-LTE network, e.g., during non-LTE to LTE idle mode mobility.

TS 23.401 discloses a non-LTE to LTE idle mode mobility TAU Request

procedure, and teaches the UE sends the MME its UE Network Capability in

a tracking area update (TAU) request, i.e., a location update. See Ex. 1005,

31–32. The UE must establish NAS security with an LTE network that does

not already have its security context via the LTE initial attachment

procedure when it moves in idle mode from a non-LTE network to an LTE

network. Thus, in this context, the TR 33.821 teaching that “security

algorithm selection upon location updates shall be performed in the same

way on initial attachment” has a different meaning. In particular, it means

the UE should follow the TR 33.821 “algorithm selection at initial

attachment” procedure, because although the UE is undergoing idle mode

mobility, it is also undergoing initial attachment to the LTE network.

Ex. 1004, 69–71.

Patent Owner further argues Petitioner has failed to show that

modifying the TS 23.401 TAU procedure to transmit the UE’s security

capabilities to the MME would have been a simple and straightforward

substitution because it could lead to the transmission of redundant or

incompatible security capability information. PO Resp. 30–31 (citing Ex.

1004, 61; Ex. 2003 ¶ 81). Patent Owner’s argument is again based on the

TR 33.821 LTE to LTE idle mode mobility TAU Request procedure in

which a previous MME sends a new MME the UE’s security capabilities in

a context response step after the TAU request. Id. at 31 (citing Ex. 1004,

61). However, as discussed above, Petitioner does not propose using or

Page 47: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

47

modifying the TR 33.821 TAU Request procedure, which is only applicable

to idle mode mobility within LTE networks. See Ex. 1004, 60–61. Rather,

Petitioner proposes modifying the TS 23.401 TAU procedure, which is

applicable for idle mode mobility between non-LTE and LTE networks, such

that the UE sends a TAU request to the MME that includes not only the

UE’s network capabilities (as taught by TS 23.401), but also the UE’s

security capabilities (as taught by TR 33.821). See Pet. 42–43, 59–61.

Moreover, TS 23.401 teaches “[t]he MME shall ignore the UE Network

Capability contained in the 3G-SGSN Context of SGSN Context Response

. . . when it has previously received an UE Network Capability in the

Tracking Area Update Request.” Id. (emphasis added). Thus, even if the

MME receives the UE’s security capabilities in a context response message

from the non-LTE network’s SGSN, the MME would not have incompatible

security information because it would ignore the information provided in the

SGSN’s context response. Accordingly, for these reasons, we do not find

this argument persuasive.

For the reasons discussed above, we find Petitioner has demonstrated

by a preponderance of the evidence that it would have been obvious to

combine TR 33.821 and TS 23.401 to provide a UE having a transmitter

configured to send UE security capabilities to the MME for NAS security

algorithm selection during non-LTE to LTE idle mode mobility as required

by claim 1.

Claim 1 further requires the UE to include a receiver that is

configured to receive a selected NAS security algorithm from the LTE

network. Ex. 1001, 11:59–60. Petitioner argues the combination of TR

Page 48: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

48

33.821 and TS 23.401 teaches this limitation. See Pet. 43–45, 58–63. Patent

Owner does not dispute Petitioner’s contentions. See generally PO Resp.

Petitioner demonstrates how TR 33.821 teaches a UE has an LTE

radio that sends radio signals to and receives radio signals from an eNodeB

in an LTE network. Pet. 43 (citing Ex. 1004, 18 (Fig. 3)). Petitioner further

demonstrates, via the unrebutted testimony of Dr. Williams, that a person of

ordinary skill in the art would have known that an LTE radio includes a

receiver. Id. at 43–44 (citing Ex. 1014 ¶¶ 93–94, 103). Petitioner further

demonstrates how TR 33.821 teaches the UE receiver is configured to

receive a selected NAS security algorithm from the LTE network by

receiving a Security Command Message (SMC) from the MME containing a

selected NAS security algorithm. Id. at 44–45 (citing 1004, 69, Fig. 17;

Ex. 1014 ¶¶ 93–94, 104–105). Accordingly, Petitioner has demonstrated

how the combination of TR 33.821 and TS 23.401 teaches the UE receiver

limitation.

Claim 1 further requires the UE to include a processor configured to

generate a root key from an authentication vector-related key available at the

UE. Ex. 1001, 11:61–62. Petitioner argues the combination of TR 33.821

and TS 23.401 teaches this limitation. See Pet. 45–50, 58–63. Patent Owner

does not dispute Petitioner’s contentions. See generally PO Resp.

Petitioner, via the unrebutted testimony of Dr. Williams, demonstrates

how TR 33.821 discloses a UE having a processor because a person skilled

in the art would have understood that a processor is “an inherent and

necessarily present feature of UEs as disclosed in LTE technical reports and

specifications.” Pet. 45–46 (citing Ex. 1014 ¶¶ 93–94, 106). Moreover,

Petitioner demonstrates how TR 33.821 discloses the UE’s processor

Page 49: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

49

generates a root key from an authentication vector-related key by generating

root key Kasme from authentication vector-related keys CK and IK during

an AKA run. Pet. 46–48 (citing Ex. 1004, 47, 52–53, 70, Figs. 10, 12, 17;

Ex. 1014 ¶¶ 107–110).4 Accordingly, Petitioner has demonstrated how the

combination of TR 33.821 and TS 23.401 teaches a UE having a processor

configured to generate a root key from an authentication vector-related key

available at the UE as required by claim 1.

Lastly, claim 1 requires the UE processor to derive an NAS protection

key for communicating with the LTE network from the root key and the

selected NAS security algorithm. Ex. 1001, 11:62–65. Petitioner argues the

combination of TR 33.821 and TS 23.401 teaches this limitation. See Pet.

45–50, 58–63. Patent Owner does not dispute Petitioner’s contentions. See

generally PO Resp.

Petitioner demonstrates how TR 33.821 discloses this limitation by

generating NAS protection key KNASenc from root key Kasme based on a

particular encryption algorithm, and by generating NAS protection key

KNASint from root key Kasme based on a particular integrity algorithm,

during an AKA run. Pet. 48–50 (citing Ex. 1004, 33, 47, 52–53, Figs. 10,

12; Ex. 1014 ¶¶ 111–113).5 Accordingly, Petitioner has demonstrated how

the combination of TR 33.821 and TS 23.401 teaches a UE having a

processor configured to generate an NAS protection key for communicating

4 The ’848 patent identifies Kasme as a root key, and CK and IK as authentication vector-related keys. See Ex. 1001, 5:11–16, 5:25–33. 5 The ’848 patent identifies Knas-enc and Knas-int as NAS protection keys and Kasme as a root key. See Ex. 1001, 5:25–33.

Page 50: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

50

with the LTE network from a generated root key according to the selected

NAS security algorithm as required by claim 1.

For the reasons discussed above, having considered the evidence and

arguments presented by Petitioner and Patent Owner, Petitioner has

demonstrated by a preponderance of the evidence that the combination of

TR 33.821 and TS 23.401 teaches or suggests all the limitations of claim 1.

Claim 9 is a method claim that recites a method for security capability

negotiation performed by a UE undergoing idle mode mobility from a non-

LTE to LTE network by performing the functions recited in claim 1.

Compare Ex. 1001, 12:30–45 with id. at 11:52–65. Petitioner maps the

limitations of claim 9 to the corresponding functional limitations of claim 1,

and provides the same analysis described above with respect to claim 1 to

demonstrate how the combination of TR 33.821 and TS 23.401 teaches all

the limitations of claim 9. See Pet. 55–56. Accordingly, for the reasons

discussed above with respect to claim 1, Petitioner has demonstrated how

the combination of TR 33.821 and TS 23.401 teaches all the limitations of

claim 9.

b. Claims 3 and 11

Claim 3 depends from claim 1, and requires the authentication vector-

related key for generating the root key to include an integrity key (IK) and

an encryption key (CK) when the UE moves from a 3G network to an LTE

network. Ex. 1001, 12:3–7, Cert. of Corr., 1. Claim 11 depends from claim

9, and requires the same limitation. Compare id. at 12:3–7, with id. at

12:50–53; see also id., Cert. of Corr., 1. Petitioner relies on the combination

of TR 33.821 and TS 23.401 to teach this limitation. See Pet. 50–51, 56–65.

Patent Owner does not dispute Petitioner’s contentions. See generally PO

Page 51: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

51

Resp.

Petitioner demonstrates how TS 23.401 teaches a UE undergoing idle

mode mobility between 3G and LTE networks sends a TAU request to an

MME, and the UE and MME subsequently perform an AKA run. Pet. 50

(citing Ex. 1005, 30–31); see also id. at 42–43 (citing Ex. 1005, 30–32, Fig.

5.3.3.2-1). Petitioner further demonstrates how TR 33.821 teaches the UE

and MME generate root key Kasme from authentication vector-related keys

CK and IK during an AKA run.6 Id. at 50 (quoting Ex. 1004, 33); see also

id. at 46–48 (citing Ex. 1004, 47, 52–53, 70, Figs. 10, 12, 17). Accordingly,

Petitioner has demonstrated how the combination of TR 33.821 and TS

23.401 teaches this limitation, identically recited in claims 3 and 11.

c. Claims 4 and 12

Claim 4 depends from claim 1, and requires the UE transmitter to

send the UE security capabilities through a TAU request. Ex. 1001, 12:8–

10. Claim 12 depends from claim 9, and requires the UE to perform the

same function. Compare id. at 12:8–10 with id. at 12:54–56. Petitioner

argues the combination of TR 33.821 and TS 23.401 teaches this limitation.

See Pet. 51–52, 57–65.

For the reasons explained in § II.G.1.a, supra, Petitioner demonstrates

TR 33.821 teaches a UE having a transmitter configured to send UE security

capabilities to an MME in an LTE network. See Pet. 51 (citing Ex. 1004,

69, Ex. 1014 ¶¶ 115–116). Petitioner further demonstrates TS 23.401

teaches a UE sends UE information to the MME in a TAU request message

6 The ’848 patent identifies CK as an encryption key and IK as an integrity key. Ex. 1001, 5:13–15.

Page 52: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

52

during non-LTE and LTE idle mode mobility. Id. at 51–52 (citing Ex. 1005

31, Fig. 5.3.3.2-1).

Patent Owner argues, “Petitioner fails to provide any explanation of

how the cited disclosure of TR 33.821 and TS 23.401 would be combined to

meet the requirements of claims 4 and 12.” PO Resp. 35. Patent Owner

further argues Petitioner has failed to “provide any rationale for why a

Skilled Artisan would have been motivated to combine TR 33.821 and

TS 23.401 in the specific manner required by these claims.” Id.

We disagree. Petitioner provides a limitation-by-limitation analysis

that maps the teachings of TR 33.821 and TS 23.401 to each of the

limitations of the challenged claims in §§ X.A.1–12 of the Petition. See Pet.

37–58. Petitioner then provides a reason to combine the teachings of

TR 33.821 and TS 23.401 in § X.A.13 of the Petition, and that reason to

combine is applicable to all of the challenged claims. See id. at 58–63.

This is evident by considering how Petitioner maps the teachings of

TR 33.821 and TS 23.401 to claim 1. In that mapping, Petitioner argues as

follows. TR 33.821 teaches a UE having a transmitter that sends UE

security capabilities to an MME in an LTE network during an initial access

procedure to establish security. Id. at 39–42. TS 23.401 teaches a UE that

sends UE Network Capability information to an MME in a TAU Request

message sent during non-LTE to LTE idle mode mobility. Id. at 42–43.

These teachings “could have been combined in a straightforward manner by

following the security procedures of TR 33.821 during idle mode mobility

from a non-LTE network to an LTE network as disclosed in TS 23.401.” Id.

at 60. Moreover, “a person of ordinary skill in the art would have

Page 53: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

53

implemented this combination by using the TAU Request message in TS

23.401 to transport the UE security capabilities to the MME.” Id.

For the reasons discussed in § II.G.1.a, supra, we find Petitioner’s

analysis of claim 1 demonstrates the combination of TR 33.821 and

TS 23.401 teaches a UE transmitter configured to send UE security

capabilities to an LTE network through a TAU Request message, and

articulates why an ordinarily skilled artisan would have combined the

references to provide such UE transmitter. Thus, Petitioner’s analysis of

claim 1 also demonstrates the combination of TR 33.821 and TS 23.401

teaches the limitation required by claim 4, which simply requires the UE to

transmit its security capabilities to the LTE network in a TAU message.

Indeed, Petitioner’s brief analysis of claim 4 begins with “[a]s explained

above,” followed by a condensed version of the argument that maps the

teachings of TR 33.821 and TS 23.401 to claim 1. See Pet. 51–52.

Accordingly, for the reasons discussed above, we find Petitioner’s

analysis of claim 4 is sufficient to demonstrate that it would have been

obvious to combine TR 33.821 and TS 23.401 to provide this limitation,

similarly recited in claims 4 and 12.

d. Claims 5 and 13

Claim 5 depends from claim 1, and requires the UE receiver to receive

the selected NAS security algorithm through an NAS security mode

command message. Ex. 1001, 12:11–13. Claim 13 depends from claim 9,

and requires the UE to perform the same function. Compare id. at 12:11–13

with, id. at 12:57–60. Petitioner argues the combination of TR 33.821 and

TS 23.401 teaches this limitation. See Pet. 52–53, 57–65. Patent Owner

does not dispute Petitioner’s contentions. See generally PO Resp.

Page 54: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

54

Petitioner demonstrates how TR 33.821 teaches that when an MME

selects an NAS security algorithm based on the UE’s security capabilities, it

sends the selected NAS security algorithm to the UE (via eNodeB) in a

security mode command (SMC) message. Pet. 52–53 (citing Ex. 1004, 69–

70, Fig. 17; Ex. 1014 ¶ 117); see also Ex. 1004, 7 (defining SMC as a

Security Mode Command). Accordingly, Petitioner has demonstrated the

combination of TR 33.821 and TS 23.401 teaches this limitation, similarly

recited in claims 5 and 13.

e. Claims 7 and 15

Claim 7 depends from claim 1, and further requires the UE receiver to

receive the UE security capability information from the LTE network. Ex.

1001, 12:17–19. Claim 15 depends from claim 9, and requires the UE to

perform the same function. Compare id. at 12:3–7 with id. at 12:65–67.

Petitioner argues the combination of TR 33.821 and TS 23.401 teaches this

limitation. See Pet. 53–54, 57–65. Patent Owner does not dispute

Petitioner’s contentions. See generally PO Resp.

Petitioner demonstrates how TR 33.821 teaches an MME sends the

UE’s security capabilities (UE caps) to the UE (via eNodeB) in the same

SMC message the MME sends the UE to indicate the MME’s selection of an

NAS security algorithm. Pet. 53–54 (citing Ex. 1004, 69–70, Fig. 17; Ex.

1014 ¶¶ 118–119). In particular, Petitioner demonstrates how steps 4 and 5

of Figure 17 of TR 33.821 teach “the MME provides the ‘UE caps’ to the

eNodeB in a NAS SMC,” and the “eNodeB provides the NAS SMC

(including the ‘UE caps’) to the UE. Id. at 53. Accordingly, Petitioner has

demonstrated the combination of TR 33.821 and TS 23.401 teaches this

limitation, similarly recited in claims 7 and 15.

Page 55: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

55

f. Claims 8 and 16

Claim 8 depends from claim 7, and requires the processor to compare

whether the UE security capability information received from the LTE

network is consistent with the security capability information stored in the

UE, and to determine the security capability negotiation fails if the two are

inconsistent. Ex. 1001, 12:20–27. Claim 16 depends from claim 9, and

requires the UE to perform the same function. Compare id. at 12:20–27 with

id. at 13:1–9. Petitioner argues the combination of TR 33.821 and

TS 23.401 teaches this limitation. See Pet. 54–55, 58–65. Patent Owner

does not dispute Petitioner’s contentions. See generally PO Resp.

As discussed above, Petitioner demonstrates how TR 33.821 teaches

an MME sends the UE’s security capabilities (UE caps) to the UE (via

eNodeB) in the same SMC message the MME sends to the UE to indicate

the MME’s NAS security algorithm selection. Pet. 54 –55 (citing Ex. 1004,

69–70, Fig. 17; Ex. 1014 ¶¶ 118–119). Petitioner further demonstrates,

through the unrebutted testimony of Dr. Williams, that the UE “compare[s]

the information maintained at the UE with the information received from the

network . . . [to] ensure that an attacker has not interfered with the security

algorithm selection process.” Id. at 55 (quoting Ex. 1014 ¶ 121); see also id.

(quoting Ex. 1004, 68 (“The capabilities the UE sends to the network shall

be repeated in an integrity protected message to UE such that ‘bidding down

attacks’ against the UE’s capabilities can be detected by UE.”)).

Accordingly, Petitioner has demonstrated the combination of TR 33.821 and

TS 23.401 teaches this limitation, similarly recited in claims 8 and 16.

Page 56: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

56

2. Secondary Considerations of Non-obviousness

Patent Owner argues that, notwithstanding Petitioner’s arguments and

evidence to the contrary, the challenged claims of the ’848 patent are

patentable due to secondary considerations of non-obviousness. PO Resp.

18–21. In particular, Patent Owner argues, “[w]hen the solution of the 848

Patent was presented to the Skilled Artisans at 3GPP, they did not respond

as if it was an obvious solution. Instead, they expressed considerable

skepticism.” Id. at 18.

Patent Owner argues that in October 2007, the inventor of the ’848

patent (Mr. He) presented two documents at a 3GPP working group

meeting—S3-070684 (Ex. 2006) and S3-070685 (Ex. 2007). Id. at 19.

Patent Owner characterizes these documents as presenting Mr. He’s “novel

solution for security negotiation between a UE and an MME when the UE is

in idle state and has moved from a non-LTE network to an LTE network.”

Id. Patent Owner argues the attendees of the working group meeting were

persons of ordinary skill in the art and “did not immediately see the benefits

of Mr. He’s proposals” because they “required Mr. He to submit ‘more

rationale on why this procedure is necessary.’” Id. at 19–20 (quoting Ex.

2008, 19).

Patent Owner argues Mr. He resubmitted his proposals7 at a 3GPP

working group meeting in December 2007, including S3a071040, which

Patent Owner characterizes as “an updated submission regarding security

negotiation between a UE and an MME when the UE is in idle state and has

7 Mr. He resubmitted S3-070684 (Ex. 2006) as S3a071039 (Ex. 2012). Compare Ex. 2006 with Ex. 2012. Mr. He resubmitted S3-07065 (Ex. 2007) as S3a071040 (Ex. 2013). Compare Ex. 2007 with Ex. 2013.

Page 57: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

57

moved from a non-LTE network to an LTE network.” Id. at 20 (citing Ex.

2013, 2). Patent Owner argues the working group “questioned whether the

UE capabilities should be transmitted in step 1 (the TAU request [from the

UE]) when they could be sent in step 3 (the context response from the old

network element).” 8 Id. at 20 (citing Ex. 2009, 11).

Patent Owner argues Mr. He “then submitted discussion document

S3-080123 (Ex. 2004) for consideration” to 3GPP at a working group

meeting in February 2008. Id. Patent Owner argues Mr. He explained in

S3-080123 that “his solution of carrying the UE’s security capabilities in the

TAU request is more efficient than carrying this information in the context

response,” which would “[i]ntroduce unnecessary roundtrips between the

Rel-8 SGSN and the UE during idle mode mobility from Rel-8

UTRAN/GERAN [non-LTE] to EUTRAN [LTE].” Id. at 20 (quoting Ex.

2004, 1). Moreover, including the UE’s security capabilities in the context

response would require updating “the Pre-rel-8 SGSNs during idle mode

mobility from Rel-8 UTRAN/GERAN [non-LTE] to EUTRAN [LTE],

which seems infeasible from [an] operator’s point of view.” Id. at 21

(quoting Ex. 2004, 1). Patent Owner argues “[w]ith this further explanation

of the previously unknown and unexpected efficiency advantages of Mr.

8 We note the working group directed its comments to Sa071039 rather than to S3a071040 as Patent Owner contends. See Ex. 1009, 11. Sa071039 is the resubmission of S3-070684. Compare Ex. 1012 with Ex. 2006. Sa071039 proposes modifying an LTE to LTE idle mode procedure rather than a non-LTE to LTE idle mode procedure. See Ex. 2012, 2 (showing modification of an idle mode procedure between old and new MMEs, i.e., an LTE to LTE idle mode procedure).

Page 58: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

58

He’s solution” the working group approved and adopted Mr. He’s proposals

into the TR 33.821 standard. Id. at 21 (citing Ex. 2010, 30).

Industry skepticism and unexpected results are objective indicia of

secondary considerations of non-obviousness. See In re Rouffet, 149 F.3d

1350, 1355 (Fed. Cir. 1998) (internal citations omitted). Such “objective

indicia of non-obviousness play an important role as a guard against the

statutorily proscribed hindsight reasoning in the obviousness analysis.”

WBIP, LLC v. Kohler Co., 829 F.3d 1317, 1328 (Fed. Cir. 2016). Patent

Owner bears the burden of producing evidence of secondary considerations

of non-obviousness. See Pfizer, Inc. v. Apotex, Inc., 480 F.3d 1348, 1360

(Fed. Cir. 2007); see also Winner Int’l Royalty Corp. v. Wang, 202 F.3d

1340, 1350 (Fed. Cir. 2000). Nonetheless, Petitioner retains the burden of

proving the unpatentability of the challenged claims. See 35 U.S.C.

§ 316(e).

As discussed above, Patent Owner characterizes Mr. He’s various

proposals to the 3GPP working group, and in particular his proposal in S3-

070684, as describing a “novel solution for security negotiation between a

UE and an MME when the UE is in idle state and has moved from a non-

LTE network to an LTE network.” PO Resp. 19. We disagree with this

characterization of Mr. He’s proposals, and find Patent Owner’s evidence of

secondary considerations to be weak evidence of non-obviousness.

Mr. He’s first proposal to 3GPP in S3-070685 was to “add a new

section” to TR 33.821 § 7.4.11 because “[i]n 3GPP TS 23.401 v1.1.1 section

5.3.3.2.1, [a] TAU procedure from UTRAN to E-UTRAN is introduced. But

there is no such . . . corresponding security part in TR 33.821.” Ex. 2007, 1.

The version of TS 23.401 cited by Mr. He (i.e., v1.1.1) is a later version of

Page 59: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

59

TS 23.401 (Ex. 1004) that differs from TS 23.401 only by the addition of

editorial but not technical changes. See Ex. 1004, 1 (TS 23.401 v1.1.0); see

also Ex. 1022 § 4 (indicating the second digit of a 3GPP document’s version

number is “[i]ncremented every time a technical change is introduced into

the specification,” and the last digit is “[i]ncremented every time a purely

editorial change is introduced”) (emphases added); see also Ex. 1012 ¶ 28.

Section 5.3.3.2.1 of TS 23.401 describes a TAU Request procedure in which

a UE sends its UE Network Capability to an MME when the UE moves in

idle mode from a non-LTE network to the LTE network. See Ex. 1005, 30–

31. Thus, Mr. He’s proposal in S3-070685 was simply to add a new section

to TR 33.821 that described the non-LTE to LTE idle mode mobility

procedure already described in TS 23.401 v1.1.0. See Ex. 2007, 1. Mr. He

did not propose this non-LTE to LTE idle mode mobility procedure in S3-

070685, he simply proposed adding its description to TR 33.821, a

document that discusses 3GPP’s “design choices and rationale[s] for why

proposed security mechanisms are accepted or rejected to record the history

of the final security solution.” Ex. 1004, 6.

Mr. He’s second proposal to 3GPP similarly demonstrates that he did

not propose a non-LTE to LTE idle mode security procedure. Rather, in S3-

070684, Mr. He proposed updating the “TAU procedure in TR 33.821

section 7.4.11.3.” Ex. 2006, 1. The updated procedure is shown on page 2

of his proposal, and describes a UE sending its security capabilities to an

MME when the UE undergoes idle mode mobility from an old MME to a

new MME, i.e., when it undergoes LTE to LTE idle mode mobility. Id. at 2.

Mr. He suggests this change is needed for the LTE to LTE idle mode

mobility procedure described in TR 33.821 § 7.4.11.3 to “[k]eep the uniform

Page 60: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

60

behaviour [sic] in both idle mobility scenarios: within E-UTRAN [LTE to

LTE] and from UTRAN/GERAN to E-UTRAN [non-LTE to LTE].” Id. at

1. That is, Mr. He proposes changing the LTE to LTE idle mode mobility

procedure described in TR 33.821 so that it would be consistent with the

non-LTE to LTE idle mode mobility procedure already described in TS

23.401 v1.1.1. See Ex. 2006, 1–2.

The 3GPP working group considered Mr. He’s S3-070684 and S3-

070685 proposals, and requested he revise them to provide “more rationale

on why [these] procedure[s] [are] necessary.” Ex. 2008, 19. To whatever

extent these requests from the working group can be considered skepticism

of Mr. He’s proposals, as Patent Owner contends, that skepticism is entitled

to little or no weight in our obviousness analysis because Mr. He’s proposals

have little to no nexus to the invention claimed in the ’848 patent. See

Wyers v. Master Lock Co., 616 F.3d 1231, 1246 (Fed. Cir. 2010) (“For

objective [evidence of secondary considerations] to be accorded substantial

weight, its proponent must establish a nexus between the evidence and the

merits of the claimed invention.”) (internal citation omitted).

As discussed above, Mr. He’s proposal in S3-070685 pertains to

modifying an LTE to LTE idle mode mobility procedure, rather than to a

non-LTE to LTE idle mode mobility procedure as claimed in the ’848 patent.

See Ex. 2006, 1–2 (showing the modified procedure is for mobility between

new and old MMEs, i.e., LTE to LTE mobility). It, therefore, lacks any

nexus to the invention claimed in the ’848 patent. Mr. He’s proposal in S3-

070685 pertains to adding a new section to TR 33.821 to document an

existing non-LTE to LTE idle mode mobility procedure described in

TS 23.401 v1.1.1. See Ex. 2007, 1. The record does not indicate that Mr. He

Page 61: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

61

proposed the non-LTE to LTE idle mode mobility procedure described in

TS 23.401 v1.1.1. At best, it indicates he proposed adding its description to

TR 33.821, which again, documents the reasons 3GPP adopted various

security mode procedures. See Ex. 2007, 1; see also Ex. 1004, 6. Given this

uncertainty and lack of evidence, the nexus of Mr. He’s S3-070685 proposal

to the invention claimed in the ’848 patent is weak at best.9 Moreover, the

3GPP working group’s request to explain the need for a procedure change is

weak evidence of skepticism that the procedure change would not work.

After receiving the 3GPP meeting group’s recommendation, Mr. He

submitted revised proposals S3a071039 (Ex. 2012) and S3a071040 (Ex.

2013). S3a071039 is a revised version of S3-070684 (Ex. 2006), and again

proposes modifying TR 33.801 § 7.4.11.3 to indicate an MME receives a

UE’s security capabilities from the UE in LTE to LTE idle mode mobility.

See Ex. 2012, 1, 2 (showing modification of an idle mode mobility

procedure between new and old MMEs, i.e., LTE to LTE mobility); see also

n.7, supra. Thus, S3a071039 lacks nexus to the invention claimed in the

’848 patent, which pertains to a non-LTE to LTE idle mode mobility

procedure. S3a071040 is a revised version of S3-070685 (Ex. 2007), and

again proposes adding a new section to TR 33.801 to document the non-LTE

to LTE idle mode mobility procedure already described in TS 23.401 (albeit

in even newer version v1.4.1). See Ex. 2013, 1–2; see also n.7, supra.

9 The invention claimed in the ’848 patent is to a non-LTE to LTE idle mode mobility procedure. Mr. He’s S3-070685 proposal is not to add a new non-LTE to LTE idle mode mobility procedure, but to add the description of a procedure already described in TS 23.401 v1.1.1 to TR 33.821 to document the reasons for 3GPP’s security decisions. See Ex. 2007, 1; see also Ex. 1004, 6.

Page 62: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

62

Thus, for the reasons discussed above with respect to S3-070685,

S3a071040 has weak nexus at best to the invention claimed in the ’848

patent.

The 3GPP working group considered Mr. He’s proposals in

S3a071039 and S3a071040, and commented only on the proposal in

S3a071039, which pertains to modifying an LTE to LTE idle mode mobility

procedure. See Ex. 2009, 11; see also Ex. 2012, 2 (showing the modified

procedure is for idle mode mobility between old and new MMEs, i.e., LTE

to LTE mobility). Specifically, the 3GPP working group suggested

modifying the Editor’s note in step 3 of the procedure described in

S3a071039 “to clarify that if the security capabilities are needed in step 3

then possibly they are not needed in step 1,” and to “extend the Editor’s note

to state that this procedure should be harmonised [sic] with the procedure in

S3a071040.” Ex. 2009, 11.

To whatever extent these suggestions show skepticism about Mr. He’s

proposals, they are weak evidence of skepticism. As noted above, the

suggestion to clarify editorial remarks in S3a071039 lacks any nexus to the

invention claimed in the ’848 patent because S3a071039 pertains to

modifying an LTE to LTE idle mode mobility procedure. See Ex. 2012, 1–2.

The suggestion to harmonize the editorial comments in S3a071039 and

S3a071040 is only weak evidence of skepticism for two reasons. First, it is

a suggestion to change an editor’s comment, not the proposed procedure.

Second, the editor’s comment does not question whether the non-LTE to

LTE idle mode mobility procedure described in TS 23.401 v.1.4.1 would

work. This can be seen from the description of step 3 of the TS 23.401

v1.4.1 non-LTE to LTE idle mode mobility procedure Mr. He proposes

Page 63: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

63

adding to TR 33.801, and the editor’s comment regarding step 3, which is as

follows:

3. The old SGSN sends back a context response to the new MME including at least the IMSI, IK, CK to the new MME. Editor’s Notes: It is FFS [for further study] whether the UE’s security capabilities should be carried in this step.

Ex. 2013, 2. Nothing in the editor’s comment indicates skepticism that

sending the UE’s security capabilities to the MME in step 1 would not work,

i.e., that it would fail to provide the MME with the UE security information

the MME needs to negotiate NAS security with the UE. Rather, the

skepticism is whether the SGSN should provide the UE’s security

capabilities to the MME in a context response message given that the MME

has already received the UE’s security information from the UE in step 1.

Id.

In response to the 3GPP working group’s suggestions, Mr. He

submitted new proposal S3-080123 to the working group at the February

2008 meeting. See Ex. 2004, 1. In S3-080123, Mr. He proposes modifying

TR 33.821 v0.6.0 by deleting the Editor’s note to steps 3 in TR 33.821

§§ 7.4.12.3 and 7.4.12.4. Id. The proposed modification to section 7.4.12.3

pertains to LTE to LTE idle mode mobility within EUTRAN, incorporates

Mr. He’s proposal S3a071039, and simply proposes deleting the Editor’s

notes for step 3. Id. at 2, n.1. The proposed modification to section 7.4.12.4

pertains to non-LTE to LTE idle mode mobility between UTRAN and E-

UTRAN, incorporates Mr. He’s proposal S3a071040, and simply proposes

Page 64: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

64

deleting the Editor’s notes for step 3. Id. at 4, n.2.10 Upon deleting the

editor’s notes as requested, the 3GPP working group accepted Mr. He’s

proposal without comment. See Ex. 2010, 30.

As discussed above, much of Patent Owner’s secondary

considerations evidence either lacks nexus to the invention claimed in the

’848 patent (e.g., Exs. 2006, 2012) or has weak nexus at best to the claimed

invention (e.g., Exs. 2004, 2007, 2013). Moreover, to the extent such

evidence does have nexus to the claimed invention, it is weak evidence of

industry skepticism because the 3GPP working group’s comments were

simply requests for more information for why changes were needed, or to

delete comments made by an editor of the proposed changes. None of the

3GPP working group’s comments expressed skepticism that the proposed

changes would not work to provide the MME with the UE security

capability information the MME needs to negotiate NAS security.

Moreover, the record shows that most proposals did not receive

approval when first submitted at 3GPP meetings. Rather, the norm was for

the proposals to be discussed and tabled for further discussion at future

meetings as happened with Mr. He’s proposals. For example, the record

shows that 234 proposals were made at the October 2007 3GPP working

group meeting, including Mr. He’s S3-070684 and S3-070685 proposals.

See Ex. 2008, 36–57 (showing a submitted document range of S3-070673 to

S3-070906). Of these, 98 (40%) were discussed and noted at the meeting

(including Mr. He’s two proposals); 75 (31%) were approved; 45 (18%)

10 Footnote 2 indicates the section is from S31071040, which appears to be a typo. Compare Ex. 2013, 2 with Ex. 2004, 4.

Page 65: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

65

were replaced with other proposals; 6 (3%) were withdrawn; 5 (2%) were

new versions of 3GPP standards documents; 2 (1%) were rejected, 1 was

postponed, 1 was taken offline, and 1 was not discussed. Id. Moreover, the

record shows that when proposals were approved, such as when Mr. He’s

S3-080123 proposal was approved, no information was provided to indicate

whether the approved proposals were new or re-submitted proposals. See

Ex. 2010, 30, 49 (showing approval of S3-080123 without comment on its

status as a re-submitted proposal). Thus, there is no evidence to indicate

what percentage of the 45 (18%) proposals approved at the October 2007

meeting, when Mr. He first submitted proposals S3-070684 and S3-070685,

were first proposals or re-submitted proposals that were approved after

receiving additional information requested by the 3GPP working group.

Accordingly, the evidence that Mr. He’s proposals were not approved

at the October 2007 3GPP meeting when they were first presented, but were

instead approved after Mr. He provided additional requested information, is

weak evidence that the 3GPP working group was skeptical of Mr. He’s

proposals. To the contrary, that appears to have been the normal way

submitted proposals were considered and treated by the 3GPP working

group.

In additional to arguing industry skepticism, Patent Owner argues that

Mr. He’s proposals produced the surprising result of “unknown and

unexpected efficienc[ies].” PO Resp. 21. This too is weak evidence of

secondary considerations of non-obviousness. Exhibit 2010 are the minutes

from the February 2008 working group meeting at which Mr. He’s S3-

080123 proposal was approved. See Ex. 2010, 30. As discussed above, the

working group provided no commentary regarding the merits of the proposal

Page 66: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

66

or its ability to achieve “unknown or unexpected efficiency advantages.”

Id. The working group simply indicated, without comment, that the

proposal was “Approved.” Ex. 2010, 30, 49.

Exhibit 2003 is Dr. Mandayam’s declaration. See Ex. 2003, i. Dr.

Mandayam summarizes the contents of S3-080123 in paragraph 93 of his

declaration, including Mr. He’s reasons for deleting the editor’s notes for

step 3 in the non-LTE to LTE idle mode mobility procedure described in

TR 33.821 v0.6.0 § 7.4.12.4. Id. ¶ 93. Dr. Mandayam then states in

paragraph 94 of his declaration that the 3GPP working group accepted Mr.

He’s proposal. Id. ¶ 94. We see no evidence here of unexpected results.

Unexpected results “must be established by factual evidence. ‘Mere

argument or conclusory statements . . . does not suffice.’” In re Geisler, 116

F.3d 1465, 1470, 43 (Fed. Cir. 1997) (quoting In re De Blauwe, 736 F.2d

699, 705 (Fed. Cir. 1984)).

Finally, we note that in S3-080123, Mr. He indicates that section

7.4.12.4 had already been added to TR 33.821 v0.6.0 when he proposes

deleting the editor’s note to step 3. See Ex. 2004, 1 (“In TR 33.821 v060,

section 7.4.12.4 . . . there is an Editor’s notes in step 3 . . . .”). The record

does not show when section 7.4.12.4 was added to TR 33.821, which is the

proposal Mr. He made in S3-070685 and S3a071040. See Ex. 2007, 1;

Ex. 2013, 1. Moreover, as discussed above, the record does not show that

Mr. He proposed the non-LTE to LTE idle mode security procedure added to

TR 33.821 v0.6.0 §7.4.12.4. Rather, Mr. He proposed adding a description

of that procedure, which was already described in TS 23.401 v1.1.1 or in

TS 23.401 v1.4.1, to a new section of TR 33.821. Id. The record does not

indicate that the security solution described in TS 23.401 v1.1.1 (or v1.4.1)

Page 67: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

67

produced unexpected results, or that adding its description to a new section

of TR 33.821 produced unexpected results.

For all of the reasons discussed above, we find Patent Owner’s

evidence of industry skepticism or unexpected results lacks nexus to the

invention claimed in the ’848 patent (Exs. 2006 and 2012) or has a weak

nexus that provides weak evidence of industry skepticism or unexpected

results, such as unexpected efficiencies (Exs. 3004, 2007, and 2013).

3. Conclusions Regarding Obviousness

We have reviewed the Petition, Patent Owner Response, Petitioner

Reply and Patent Owner Sur-Reply. We have considered all of the

arguments made by Petitioner and Patent Owner, as well as all of the

evidence for and against obviousness, including evidence of secondary

considerations of non-obviousness in the form of industry skepticism and

unexpected results. We have weighed and assessed the entirety of this

evidence as a whole.

For the reasons discussed in §§ II.G.1.a–f, supra, Petitioner has shown

by a preponderance of the evidence that the combination of TR 33.821 and

TS 23.401 teaches each of the limitations of claims 1, 3–5, 7–9, 11–13, 15

and 16. Further, Petitioner has persuasively explained why a person skilled

in the art would have modified the non-LTE to LTE security procedure

taught in TS 23.401 to send the UE security capabilities to an MME based

on the teachings of TR 33.821. See § II.G.1.a, supra. In particular, a person

of ordinary skill in the art would have found it obvious to modify the non-

LTE to LTE idle mode mobility procedure taught by TS 23.401 to include

the UE security capabilities taught by TR 33.821 because the UE needed to

authenticate itself to and establish security with the LTE network. See Pet.

Page 68: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

68

59–60 (citing Ex. 1014 ¶¶ 136–137). In short, Petitioner has made a strong

showing that claims 1, 3–5, 7–9, 11–13, 15 and 16 of the ’848 patent would

have been obvious over the combination of TR 33.821 and TS 23.401.

The only contravening evidence that claims 1, 3–5, 7–9, 11–13, 15

and 16 of the ’848 patent would not have been obvious is the evidence of

industry skepticism and unexpected results introduced by Patent Owner. For

the reasons discussed in § II.G.3, supra, this evidence has lacks or has only

weak nexus to the invention claimed in the ’848 patent, and does not

sufficiently demonstrate industry skepticism of or unexpected results arising

from the invention claimed in the ’848 patent. It is therefore insufficient to

overcome Petitioner’s “strong . . . case of obviousness.” Wyers, 616 F.3d at

1246.

Accordingly, for the reasons discussed in §§ II.G.1.a–f and II.G.2,

supra, Petitioner has demonstrated by a preponderance of the evidence that

claims 1, 3–5, 7–9, 11–13, 15 and 16 of the ’848 patent are unpatentable

over the combination of TR 33.821 and TS 23.401.

H. Obviousness of claims 1, 3–5, 7, and 8 over TR 33.821, TS 23.401, and Shaheen

Petitioner argues that to the extent the combination of TR 33.821 and

TS 23.401 does not disclose a UE comprising a transmitter, receiver, and

processor, “it would have been obvious to a person of ordinary skill in the

art to modify the UE to include these elements in light of Shaheen.” Pet.

63–64 (citing Ex. 1014 ¶¶ 142–146).

Petitioner argues Shaheen discloses a system and method for

implementing a Routing Area Update (RAU) procedure between a UE and

an LTE network in which the UE “includes a transceiver for sending and

Page 69: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

69

receiving data to and from the LTE network, and a processor for

implementing the disclosed procedure.” Id. at 64 (citing Ex. 1006 ¶¶ 9, 23,

40–42; Ex. 1014 ¶¶ 93–94). Relying on the testimony of Dr. Williams,

Petitioner argues, “[a] person of ordinary skill in the art would have

understood that the transceiver includes both a transmitter for sending data

to the LTE network, and a receiver for receiving data from the network.” Id.

(citing Ex. 1014 ¶¶ 93–94).

For the purposes of the analysis that includes Shaheen, Petitioner

argues the combination of TR 33.821 and TS 23.401 teaches each of the

elements of claims 1, 3–5, 7, and 8, except the transmitter, receiver and

processor elements needed to carry out the functions recited in these claims.

Id. at 63 (citing Pet. 36–63). Petitioner further argues that LTE

specifications “like TR 33.821 and TS 23.401 establish that the UE must

have a means for transmitting data to the network, means for receiving data

from the network, and means for processing the data in order to implement

specific procedures.” Id. at 64–65 (citing Ex. 1014 ¶¶ 93–94). Petitioner

argues the “transmitter, receiver, and processor as disclosed in Shaheen

would have been the most logical and commonsense elements for

performing these functions.” Id. at 65. Therefore, Petitioner argues,

“[m]odifying the UE disclosed in TR 33.821 to include the transmitter,

receiver, and processor disclosed in Shaheen would have been a

straightforward combination of known prior art elements that would yield

predicable results,” and the combination of TR 33.821, TS 23.401, and

Shaheen “would include each element of claims 1, 3–5, 7, and 8.” Id. at 64–

65.

Page 70: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

70

Patent Owner does not contest Petitioner’s rationale for modifying the

UE disclosed in TR 33.821 to include Shaheen’s transceiver and processor.

PO Resp. 37. Rather, Patent Owner argues that “[t]he combination set forth

by Petitioner in Ground 2 [obviousness over TR 33.821, TS 23.401, and

Shaheen] does not provide any further reasons to combine TR 33.821 and

TS 23.401, or any further reasons to modify them.” Id. Therefore, “all of

the deficiencies regarding Ground 1 [obviousness over TR 33.821 and TS

23.401] identified above apply equally to Ground 2.” Id.

As discussed in §§ II.G.1–3, supra, Petitioner has demonstrated how

the combination of TR 33.821 and TS 23.401 teaches all of the limitations of

claims 1, 3–5, 7, and 8, including the transmitter, receiver, and processor

limitations. Petitioner has further provided sufficient reason to combine the

teachings of TR 33.821 and TS 23.401. Here, Petitioner demonstrates that

Shaheen discloses a UE that includes a transmitter for sending information

to an LTE network, a receiver for receiving information from the LTE

network, and processor for processing the received information to perform

an RAU procedure. See Ex. 1006, ¶¶ 9, 33, 40–42, Fig. 9. Petitioner further

demonstrates why a person ordinarily skilled in the art would have modified

the UE disclosed in the combination of TR 33.821 and TS 23.401 to include

Shaheen’s transmitter, receiver, and processor to execute LTE procedures,

such as the non-LTE to LTE idle mode mobility procedure taught by the

combination of TR 33.821 and TS 23.401, in the event TR 33.821 and TS

23.401 lack these elements.

Accordingly, for the reasons discussed herein and in § II.G.1–3,

supra, Petitioner has demonstrated by a preponderance of the evidence that

Page 71: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

71

claims 1, 3–5, 7, and 8 are unpatentable as obvious over the combination of

TR 33.821, TS 23.401, and Shaheen.

III. CONCLUSION

We have reviewed the Petition, Patent Owner’s Response, Petitioner’s

Reply, and Patent Owner’s Sur-Reply. We have considered all of the

evidence and arguments presented by Petitioner and Patent Owner, including

Patent Owner’s evidence of secondary considerations of non-obviousness,

and have weighed and assessed the entirety of this evidence as a whole. We

find, on this record, Petitioner has demonstrated by a preponderance of the

evidence that claims 1, 3–5, 7–9, 11–13, 15, and 16 are unpatentable over

TR 33.821 and TS 23.401, and that claims 1, 3–5, 7, and 8 are unpatentable

over TR 33.821, TS 23.401, and Shaheen.

IV. ORDER

It is hereby:

ORDERED that claims 1, 3–5, 7–9, 11–13, 15, and 16 of the ’848

patent are unpatentable under 35 U.S.C. § 103(a) as obvious over TR 33.821

and TS 23.401;

FURTHER ORDERED that claims 1, 3–5, 7, and 8 of the ’848 patent

are unpatentable under 35 U.S.C. § 103(a) as obvious over TR 33.821, TS

23.401, and Shaheen;

FURTHER ORDERED that Patent Owner’s Motion to Exclude is

granted with respect to Exhibit 1011, denied with respect to Exhibits 1004,

Page 72: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

72

1005, 1012, and 1030, and dismissed as moot with respect to Exhibit 1028;

and

FURTHER ORDERED that this Decision is final, and a party to this

proceeding seeking judicial review of the Decision must comply with the

notice and service requirements of 37 C.F.R. § 90.2.

Page 73: Administrative Patent Judges Administrative Patent Judge 35 … · 2020-06-18 · Claim 9 is a method claim that recites a method for security capability negotiation performed by

IPR2017-01487 Patent 8,812,848 B2

73

For PETITIONER:

Kevin P.B. Johnson Marissa Ducca Deepa Acharya Jared Newton Brian Mack [email protected] [email protected] [email protected] [email protected] [email protected]

For PATENT OWNER:

Jeffrey P. Kushan Joseph A. Micallef [email protected] [email protected]


Recommended