`571-272-7822
`
`
`Paper No. 8
`Entered: July 28, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`NOKIA SOLUTIONS AND NETWORKS US LLC, and
`NOKIA SOLUTIONS AND NETWORKS OY,
`Petitioner,
`
`v.
`
`HUAWEI TECHNOLOGIES CO. LTD.,
`Patent Owner.
`____________
`
`Case IPR2017-00660
`Patent 9,241,261 B2
`____________
`
`
`Before JENNIFER MEYER CHAGNON,
`MICHELLE N. WORMMEESTER, and CHRISTA P. ZADO,
`Administrative Patent Judges.
`
`CHAGNON, Administrative Patent Judge.
`
`
`
`
`DECISION
`Institution of Inter Partes Review
`37 C.F.R. § 42.108
`
`
`
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`I.
`
`INTRODUCTION
`Nokia Solutions and Networks US LLC, and Nokia Solutions and
`Networks Oy (collectively, “Petitioner”)1 filed a Petition for inter partes
`review of claims 1–5, 7–13, 15–21, 23, and 24 (“the challenged claims”) of
`U.S. Patent No. 9,241,261 B2 (Ex. 1001, “the ’261 patent”). Paper 1
`(“Pet.”). Petitioner relies on the Declarations of David Lyon, Ph.D.
`(Ex. 1003) and Balazs Bertenyi (Ex. 1004) to support its positions. Huawei
`Technologies Co. Ltd. (“Patent Owner”) filed a Preliminary Response.
`Paper 7 (“Prelim. Resp.”).
`We have authority to determine whether to institute inter partes
`review. See 35 U.S.C. § 314(b); 37 C.F.R. § 42.4(a). Upon consideration of
`the Petition and the Preliminary Response, and for the reasons explained
`below, we determine that the information presented shows a reasonable
`likelihood that Petitioner would prevail with respect to all of the challenged
`claims. See 35 U.S.C. § 314(a). Accordingly, we institute trial as to
`claims 1–5, 7–13, 15–21, 23, and 24 of the ’261 patent.
`
`A. Related Proceedings
`The parties indicate that the ’261 patent is the subject of the following
`ongoing district court proceeding: Huawei Techs. Co. v. T-Mobile US, Inc.,
`Case No. 2:16-cv-00057 (E.D. Tex.). Pet. 1; Paper 6, 2.
`
`B. The ’261 Patent
`The ’261 patent is titled “Method, System and Device for Negotiating
`Security Capability When Terminal Moves,” and was filed as
`
`1 Petitioner identifies T-Mobile USA, Inc. and T-Mobile US, Inc. as
`additional real parties-in-interest. Pet. 1.
`
`
`
`2
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`U.S. application No. 14/303,146 on June 12, 2014. Ex. 1001, at [21], [22],
`[54]. The ’261 patent claims priority, via a chain of continuation
`applications, to application PCT/CN2008/072165, filed on August 27, 2008.
`Id. at [63]. The ’261 patent also claims priority to two Chinese applications:
`CN 2007 1 0145703, filed August 31, 2007, and CN 2007 1 0151700, filed
`September 26, 2007. Id. at [30].
`The ’261 patent “relates to the field of wireless communication
`technology, and more particularly to a method and a system for negotiating a
`security capability when a terminal moves, a mobility management entity
`(MME), and a user equipment (UE).” Id. at 1:18–22. Specifically, the ’261
`patent describes a method and system by which “a UE in an idle state can
`negotiate a security capability” “when moving from a 2G/3G network to an
`LTE network.” Id. at 2:14–20.
`Figure 1 of the ’261 patent is reproduced below.
`
`
`
`
`
`3
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`Figure 1, reproduced above, is a flow chart of a method for
`negotiating a security capability when a terminal moves, according to an
`embodiment of the ’261 patent. Id. at 4:3–5. According to the method
`illustrated in Figure 1, a UE sends a Tracking Area Update (TAU) request to
`an MME, at step 100. Id. at 4:47. The TAU request includes, among other
`things, the “security capability information supported by the UE,” which
`“includes an [non-access stratum (NAS)] security algorithm (an NAS
`integrity protection algorithm and/or an NAS confidentiality protection
`algorithm).” Id. at 4:54–64. At steps 101 and 102, “the MME acquires an
`NAS security algorithm supported by the UE, and sends a mobility
`management context request message to an SGSN. After receiving the
`message, the SGSN sends a mobility management context response message
`carrying an authentication vector-related key to the MME.” Id. at 4:65–5:3.
`At step 103, “the MME selects a new NAS security algorithm,
`according to the NAS security algorithm supported by the UE and an NAS
`security algorithm supported by the MME as well as an NAS security
`algorithm allowed by the system.” Id. at 5:32–36. At step 104, “the MME
`generates a TAU accept message carrying the selected NAS security
`algorithm.” Id. at 5:41–42. At step 105, “the UE receives the TAU accept
`message carrying the NAS security algorithm selected by the MME, and
`acquires the negotiated NAS security algorithm.” Id. at 5:54–56. The UE
`then “derives a root key . . . according to a current authentication vector-
`related key . . . , and derives an NAS protection key according to the root
`key.” Id. at 5:57–63.
`
`
`
`4
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`C. Illustrative Claims
`Of the challenged claims, claims 1, 9, and 17 are independent.
`Claims 2–5, 7 and 8 depend from claim 1; claims 10–13, 15, and 16 depend
`from claim 9; claims 18–21, 23 and 24 depend from claim 17. Independent
`claims 1, 9, and 17 of the ’261 patent are reproduced below, and are
`illustrative of the challenged claims. For convenience of the discussion, the
`claims are annotated with Petitioner’s labeling of the claim elements.
`1. [1 Pre] A method of security negotiation for idle state
`mobility from a first network to a long term evolution (LTE)
`network using a mobility management entity (MME), the
`method comprising:
`[1A] transmitting an authentication vector-related key
`from a service general packet radio service (GPRS) support
`node (SGSN) in the first network to the MME;
`[1B] receiving security capabilities of a user equipment
`(UE) including non-access stratum (NAS) security capabilities
`of the UE from the UE;
`[1C] selecting a NAS security algorithm supported by the
`NAS security capabilities of the UE;
`[1D] sending a message that indicates the selected NAS
`security algorithm to the UE; and
`[1E] deriving a NAS protection key with the selected
`NAS security algorithm from the authentication vector-related
`key.
`Ex. 1001, 11:54–12:2.
`9. [9 Pre] A communications system comprising:
`[9A] an acquisition module that receives from a user
`equipment (UE) security capabilities of the UE including non-
`access stratum (NAS) security capabilities of the UE;
`[9B] a service general packet radio service (GPRS)
`support node (SGSN) in a first network that sends an
`authentication vector-related key to the acquisition module;
`
`
`
`5
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`[9C] a selection module that selects a NAS security
`algorithm supported by the NAS security capabilities of the UE
`and [9D] sends a message that indicates the selected NAS
`security algorithm to the UE; and
`[9E] a key derivation module that derives a NAS
`protection key with the selected NAS security algorithm from
`the
`authentication
`vector-related
`key, wherein
`the
`communications system provides security negotiation for idle
`state mobility from the first network to a long term evolution
`(LTE) network;
`[9F] wherein the acquisition module, the selection
`module and the key derivation module are included in a
`mobility management entity (MME).
`Id. at 12:28–47.
`17. [17 Pre] A communications system that provides
`security negotiation for idle state mobility from a first network
`to a long term evolution (LTE) network comprising:
`[17A] a mobility management entity (MME) that receives
`security capabilities of a user equipment (UE) including non-
`access stratum (NAS) security capabilities of a UE from the
`UE; and
`[17B] a service general packet radio service (GPRS)
`support node (SGSN) in the first network that sends an
`authentication vector-related key to the MME,
`[17C] wherein the MME is in the LTE network
`
`and
`
`[17D] selects a NAS security algorithm
`supported by the NAS security capabilities of the
`UE,
`
`[17E] sends a message that indicates the
`selected NAS security algorithm to the UE, and
`[17F] derives a NAS protection key with the
`selected NAS security algorithm
`from
`the
`authentication vector-related key.
`
`Id. at 13:6–23.
`
`
`
`6
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`D. The Applied References
`Petitioner relies on the following references in the asserted grounds.
`Pet. 2.
`
`3GPP, Technical Specification Group Services and System Aspects;
`GPRS enhancements for E-UTRAN access (Release 8) (3GPP TS 23.401
`V1.1.0), (July 2007) (Ex. 1005, “TS 23.401”);
`
`3GPP, Technical Specification Group Services and System Aspects;
`Rationale and track of security decisions in Long Term Evolved (LTE) RAN /
`3GPP System Architecture Evolution (SAE) (Release 8) (3GPP TR 33.821
`V0.4.0), (July 2007) (Ex. 1006, “TR 33.821”);
`
`3GPP, Technical Specification Group Services and System Aspects;
`General Packet Radio Service (GPRS); Service description; Stage 2
`(Release 7) (3GPP TS 23.060 V7.4.0), (Mar. 2007) (Ex. 1007, “TS 23.060”);
`
`U.S. Patent No. 8,462,742 B2, issued June 11, 2013, to Song et al.
`(Ex. 1008, “Song”).
`
`E. The Asserted Grounds
`Petitioner challenges claims 1–5, 7–13, 15–21, 23, and 24 as having
`been obvious under 35 U.S.C. § 103(a) in view of the following three
`combinations of references: TS 23.401 and TR 33.821; TS 23.060 and
`TR 33.821; and Song and TR 33.821. Pet. 2, 17–73.
`
`II. ANALYSIS
`A. Claim Construction
`In an inter partes review, claim terms in an unexpired patent are given
`their broadest reasonable construction in light of the specification of the
`
`
`
`7
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`patent in which they appear. See 37 C.F.R. § 42.100(b); Cuozzo Speed
`Techs. LLC v. Lee, 136 S. Ct. 2131, 2144–46 (2016) (upholding the use of
`the broadest reasonable interpretation standard). Under the broadest
`reasonable construction standard, claim terms generally are given their
`ordinary and customary meaning, as would be understood by one of ordinary
`skill in the art in the context of the entire disclosure. See In re Translogic
`Tech., Inc., 504 F.3d 1249, 1257 (Fed. Cir. 2007). The claims, however,
`“‘should always be read in light of the specification and teachings in the
`underlying patent,’” and “[e]ven under the broadest reasonable
`interpretation, the Board’s construction ‘cannot be divorced from the
`specification and the record evidence.’” Microsoft Corp. v. Proxyconn, Inc.,
`789 F.3d 1292, 1298 (Fed. Cir. 2015) (citations omitted). Further, any
`special definition for a claim term must be set forth in the specification with
`reasonable clarity, deliberateness, and precision. See In re Paulsen, 30 F.3d
`1475, 1480 (Fed. Cir. 1994). In the absence of such a definition, however,
`limitations are not to be read from the specification into the claims. In re
`Van Geuns, 988 F.2d 1181, 1184 (Fed. Cir. 1993).
`The parties propose constructions for several claim terms. See
`Pet. 10–15; Prelim. Resp. 5–9. For purposes of this Decision, we address
`Petitioner’s arguments regarding certain limitations of claim 9—namely, the
`recited “acquisition module,” “selection module,” and “key derivation
`module.” Pet. 12–15. These “modules” are part of the “communications
`system” recited in claim 9. In the co-pending district court proceeding,
`Petitioner has argued that these limitations are means-plus-function
`limitations that lack sufficient corresponding structure. See Pet. 14;
`Ex. 1019, 41–47 (the parties’ Joint Claim Construction and Prehearing
`
`
`
`8
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`Statement in the co-pending district court proceeding). For purposes of this
`inter partes review Petition, Petitioner asserts that “the broadest reasonable
`interpretation of each of these limitations is any software or hardware
`capable of performing the claimed function.” Pet. 14.
`Patent Owner does not address the construction of the “module”
`limitations of claim 9 and related dependent claims. At this stage of the
`proceeding, we have not reached a final decision with regard to whether
`such limitations are means-plus-function limitations under 35 U.S.C. § 112,
`¶ 6, which requires identification of sufficient structure, material, or acts in
`the specification. See In re Donaldson Co., 16 F.3d 1189, 1193 (Fed. Cir.
`1994) (en banc). We, however, are able to analyze Petitioner’s asserted
`prior art grounds without making such a determination at this stage of the
`proceeding. For purposes of this Decision on Institution, we construe these
`terms to mean software or hardware for performing the steps recited in the
`claims.
`We direct the parties, in their subsequent briefing in this proceeding,
`to address specifically whether or not the “module” limitations of claim 9
`invoke 35 U.S.C. § 112, ¶ 6. If so, the parties are directed to identify the
`corresponding structure from the Specification. If not, the parties are
`directed to explain their reasoning and address the construction of the terms
`under the broadest reasonable interpretation.
`Upon review of the parties’ contentions and supporting evidence, we
`determine no issue in this Decision requires express construction of any
`other claim terms. See, e.g., Wellman, Inc. v. Eastman Chem. Co., 642 F.3d
`1355, 1361 (Fed. Cir. 2011) (“[C]laim terms need only be construed ‘to the
`extent necessary to resolve the controversy.’”) (quoting Vivid Techs., Inc. v.
`
`
`
`9
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`Am. Sci. & Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999)). Accordingly,
`for purposes of this Decision, we do not provide any express claim
`construction beyond that discussed above.
`
`B. Principles of Law
`A claim is unpatentable under 35 U.S.C. § 103(a) if the differences
`between the subject matter sought to be patented and the prior art are such
`that the subject matter as a whole would have been obvious at the time the
`invention was made to a person having ordinary skill in the art to which said
`subject matter pertains. See KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 406
`(2007). The question of obviousness is resolved on the basis of underlying
`factual determinations including: (1) the scope and content of the prior art;
`(2) any differences between the claimed subject matter and the prior art2;
`(3) the level of ordinary skill in the art; and (4) objective evidence of
`nonobviousness.3 Graham v. John Deere Co., 383 U.S. 1, 17–18 (1966).
`In that regard, an obviousness analysis “need not seek out precise
`teachings directed to the specific subject matter of the challenged claim, for
`a court can take account of the inferences and creative steps that a person of
`ordinary skill in the art would employ.” KSR, 550 U.S. at 418; accord In re
`Translogic Tech., Inc., 504 F.3d 1249, 1259 (Fed. Cir. 2007). A prima facie
`case of obviousness is established when the prior art, itself, would appear to
`
`
`2 Patent Owner argues that Petitioner does not appropriately address this
`Graham factor. Prelim. Resp. 23–34. At this stage of the proceeding, we
`determine that Petitioner has sufficiently addressed the Graham factors, and
`do not find Patent Owner’s argument persuasive.
`3 At this stage of the proceeding, the parties have not directed our attention
`to any objective evidence of non-obviousness.
`
`
`
`10
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`have suggested the claimed subject matter to a person of ordinary skill in the
`art. See In re Rinehart, 531 F.2d 1048, 1051 (CCPA 1976).
`We analyze the asserted grounds of unpatentability in accordance with
`these principles.
`
`C. Level of Ordinary Skill in the Art
`Petitioner asserts that a person of ordinary skill in the art “would have
`had a Bachelor’s degree in electrical engineering, computer science, or
`computer engineering with at least 2–3 years of experience in the
`telecommunications industry, including experience with operating and/or
`implementing [Third Generation Partnership Project (3GPP)] networks.
`Additional education might substitute for some of the experience, and
`substantial experience might substitute for some of the educational
`background.” Pet. 18 (citing Ex. 1003 ¶ 20). Patent Owner does not address
`the level of ordinary skill in the art in its Preliminary Response. For
`purposes of this Decision, we adopt Petitioner’s proposal regarding the level
`of ordinary skill in the art. The level of ordinary skill in the art further is
`reflected by the prior art of record. See Okajima v. Bourdeau, 261 F.3d
`1350, 1355 (Fed. Cir. 2001); In re GPAC Inc., 57 F.3d 1573, 1579 (Fed. Cir.
`1995); In re Oelrich, 579 F.2d 86, 91 (CCPA 1978).
`
`D. Whether TR 33.821 Qualifies as Prior Art
`Patent Owner argues in its Preliminary Response that Petitioner has
`failed to show that TR 33.821 qualifies as a printed publication. See Prelim.
`Resp. 9–23. Because each of Petitioner’s asserted grounds relies, in part, on
`TR 33.821 (see Pet. 2), we first address this issue. For the reasons discussed
`
`
`
`11
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`below, we determine that Petitioner has made at least a threshold showing
`that this asserted reference qualifies as a printed publication.4
`To establish that TR 33.821 qualifies as a printed publication,
`Petitioner relies on the testimony of Mr. Bertenyi (Ex. 1004). See Pet. 15–
`17. Mr. Bertenyi details his experience with the 3GPP, including his work
`as chairman for 3GPP’s SA-2 Working Group, as well as for the overall
`TSG-SA plenary group. Ex. 1004 ¶¶ 3, 9–12. Mr. Bertenyi also testifies
`that “[b]ased on [his] experience [with 3GPP], [he] can speak with authority
`as to how the 3GPP standards are developed across the working groups and
`how 3GPP documents are drafted, distributed, stored and made available to
`the public without restriction.” Id. ¶ 3.
`Mr. Bertenyi testifies that there are “over a hundred
`telecommunications industry participants” in 3GPP. Id. ¶ 2. According to
`Mr. Bertenyi:
`In the ordinary course of 3GPP’s regularly-conducted
`business activities and pursuant to its standard business
`practices, 3GPP published all proposals, technical reports,
`technical specifications and other documents related to the
`development of cellular telecommunications standards to the
`3GPP’s publicly-available, unrestricted, online ftp server:
`http://www.3gpp.org/ftp/. Draft proposals, technical reports,
`technical specifications, change requests, and other documents
`(“Tdocs”) were assigned a document number (“Tdoc number”)
`and uploaded to 3GPP’s public ftp server before, during, and
`after meetings. Making the documents publicly available
`encouraged discussion and promoted establishment of industry
`standards for cellular telecommunications.
`
`4 Although Patent Owner has not challenged whether TS 23.401 and
`TS 23.060 qualify as printed publications, we note that we also are
`persuaded that Petitioner has made at least a threshold showing with respect
`to these asserted references. See Pet. 15–17; Ex. 1004 ¶¶ 29, 31.
`
`
`
`12
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`Id. ¶ 20. Documents uploaded to the ftp server received a date and time
`stamp, indicating when the upload occurred. Id. ¶ 21. Mr. Bertenyi also
`provides a detailed explanation regarding the naming conventions used by
`3GPP with respect to proposals, technical reports, technical specifications,
`and other related documents (e.g., Tdocs). Id. ¶¶ 13–19 (citing Ex. 1050
`(3GPP TR 21.900 v6.0.0) (describing the procedures for naming and
`changing 3GPP documents)). Mr. Bertenyi testifies specifically that “the
`format for the filename of a TR document on the 3GPP server at least
`includes aabbb_xyz, which provides information regarding the contents . . .
`of the document.” Id. ¶ 15 (citing Ex. 1050, 21) (emphasis added); see also
`id. ¶ 16 (providing the same testimony with respect to TS documents on the
`3GPP server). Mr. Bertenyi then identified TR 33.821 as a document that
`was published and made available on the ftp server. Id. ¶ 30.
`Patent Owner argues that “regardless of whether some 3GPP
`documents were publicly available, neither Petitioner nor Mr. Bertenyi show
`that the specific TR 33.821 document relied upon was publicly accessible
`prior to August 31, 2007.” Prelim. Resp. 9–10.
`We look to the underlying facts to make a legal determination as to
`whether a reference is a printed publication. Suffolk Techs., LLC v. AOL
`Inc., 752 F.3d 1358, 1364 (Fed. Cir. 2014). The determination of whether a
`given reference qualifies as a prior art “printed publication” involves a case-
`by-case inquiry into the facts and circumstances surrounding its disclosure to
`members of the public. In re Klopfenstein, 380 F.3d 1345, 1350 (Fed. Cir.
`2004). The key inquiry is whether the reference was made “sufficiently
`accessible to the public interested in the art” before the critical date. In re
`
`
`
`13
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`Cronyn, 890 F.2d 1158, 1160 (Fed. Cir. 1989); In re Wyer, 655 F.2d 221,
`226 (CCPA 1981).
`According to the Federal Circuit, “[b]ecause there are many ways in
`which a reference may be disseminated to the interested public, ‘public
`accessibility’ has been called the touchstone in determining whether a
`reference constitutes a ‘printed publication’” under 35 U.S.C. § 102.
`Kyocera Wireless Corp. v. Int’l Trade Comm’n, 545 F.3d 1340, 1350 (Fed.
`Cir. 2008) (quoting In re Hall, 781 F.2d 897, 898–99 (Fed. Cir. 1986)).
`A reference is publicly accessible “upon a satisfactory showing that such
`document has been disseminated or otherwise made available to the extent
`that persons interested and ordinarily skilled in the subject matter or art
`exercising reasonable diligence, can locate it.” SRI Int’l, Inc. v. Internet
`Security Sys., Inc., 511 F.3d 1186, 1194 (Fed. Cir. 2008).
`At this stage of the proceeding, we credit Mr. Bertenyi’s testimony
`and are persuaded that this is sufficient to show that “persons interested and
`ordinarily skilled in the subject matter or art exercising reasonable diligence,
`[could have] locate[d]” TR 33.821. See Bruckelmyer v. Ground Heaters,
`Inc., 445 F.3d 1374, 1378 (Fed. Cir. 2006).
`
`E. Asserted Obviousness in View of TS 23.401 and TR 33.821
`Petitioner asserts that claims 1–5, 7–13, 15–21, 23, and 24 are
`unpatentable under 35 U.S.C. § 103(a) as obvious in view of TS 23.401 and
`TR 33.821. Pet. 18–37. In addition to the arguments that TR 33.821 does
`not qualify as prior art, and that Petitioner does not appropriately address the
`Graham factors (both discussed above), Patent Owner argues that the cited
`combination does not disclose all elements of the independent claims
`
`
`
`14
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`(Prelim. Resp. 34–52), and that Petitioner has not provided sufficient reasons
`to combine the references (id. at 67–68).
`We have reviewed the parties’ contentions and supporting evidence.
`Given the evidence on this record, and for the reasons explained below, we
`determine that the information presented shows a reasonable likelihood that
`Petitioner would prevail on this asserted ground.
`
`1. Summary of TS 23.401 (Ex. 1005)
`TS 23.401 is a Technical Specification produced by a working group
`of 3GPP. Ex. 1005, Forward. TS 23.401 addresses enhancements to the
`existing General Packet Radio Service (GPRS) network to support access to
`the E-UTRAN5 network, and “covers both roaming and non-roaming
`scenarios and . . . all aspects, including mobility between E-UTRAN and
`pre-E-UTRAN 3GPP radio access technologies, policy control and charging,
`and authentication.” Id. § 1; Pet. 19.
`
`
`5 E-UTRAN stands for Evolved Universal Terrestrial Radio Access Network
`and is another term used to describe 4G or LTE networks. See Pet. 19
`(citing Ex. 1003 ¶ 99).
`
`
`
`15
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`Sections 5.3.3.2.1 and 5.3.3.3.1 of TS 23.401 address the TAU update
`procedure for an idle state UE transitioning from a pre-E-UTRAN network
`(e.g., 2G or 3G) to an E-UTRAN network. Figure 5.3.3.2-1 is reproduced
`below.
`
`
`Figure 5.3.3.2-1, reproduced above, shows a 3G-to-LTE TAU update
`procedure. Ex. 1005 § 5.3.3.2.1. Figure 5.3.3.3-1 illustrates a similar
`procedure for a 2G-to-LTE transition. Id. § 5.3.3.3.1. As seen in Figure
`5.3.3.2-1, a UE sends a TAU Request to the MME (via the eNodeB) at steps
`2a/2b. Id. § 5.3.3.2.1. The MME sends a Context Request to the SGSN
`(step 3), and receives a Context Response back from the SGSN (step 4). Id.
`Authentication and security functions may be executed at step 5. Id.
`
`
`
`16
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`2. Summary of TR 33.821 (Ex. 1006)
`TR 33.821 is a Technical Report produced by a working group of
`3GPP. Ex. 1006, Forward. TR 33.821 “addresses security aspects of the
`new LTE/SAE network, including how security is handled during mobility
`events to/from the new LTE network and legacy 2G/3G networks.” Pet. 19
`(citing Ex. 1003 ¶ 99); see Ex. 1006 § 1. As described in TR 33.821, an
`LTE system has two layers of security, rather than the single layer used in
`pre-LTE systems, one of these two layers being NAS signaling security.
`Ex. 1006 § 4.
`Figure 13 of TR 33.821 is reproduced below.
`
`
`Figure 13, reproduced above, illustrates a procedure for key handling during
`idle mode mobility. Id. § 7.4.11.3. In relevant part, Figure 13 and the
`corresponding discussion describe that the MME Context Response includes
`specific keys, as well as the NAS algorithms and the UE’s security
`capabilities. Id.
`
`3. Analysis
`We first address Petitioner’s reasons to combine the references and
`then turn to particular disclosures of the references upon which Petitioner
`relies to teach each element of the independent claims. We use the element
`
`
`
`17
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`numbering provided by Petitioner (see supra Section I.C.). Where Patent
`Owner has presented arguments in its Preliminary Response, we also address
`them below.
`
`a. Reasons to Combine
`Petitioner asserts that a person of ordinary skill in the art would have
`combined the teachings of TS 23.401 and TR 33.821 because “they are both
`concerned with cellular technology and more particularly they both address
`mobility issues between radio access networks and the implications of the
`addition of the 4G/LTE network to existing infrastructure.” Pet. 18–19
`(citing Ex. 1003 ¶ 99). Petitioner further explains that the “documents
`provide views of the same subject matter from the different perspectives of
`the working groups which authored the documents” and that a person of
`ordinary skill in the art “would know that in order to implement the security
`negotiation in 4G/LTE networks in the architecture proposed in TS 23.401,
`they would need to look at both the architecture and security
`documentation.” Id. at 19–20 (citing Ex. 1003 ¶ 99); see also Ex. 1003 ¶ 98
`(“A person of ordinary skill in the art would have been familiar with the
`working groups and would have known that many 3GPP documents must
`necessarily be read together in order to implement the design features
`contained therein.”). Finally, Petitioner asserts that TR 33.821 explicitly
`directs the reader to TS 23.401 when considering idle mode mobility.
`Pet. 20 (citing Ex. 1006 § 7.4.11.3); see also Ex. 1003 ¶ 100 (“[T]he
`documents themselves direct those of ordinary skill to evaluate both
`documents in conjunction with one another.”). Thus, according to
`Petitioner, “a person of ordinary skill in the art would have been motivated
`
`
`
`18
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`to combine the teachings of TS 23.401 and TR 33.821 to fully describe a
`known solution to a known problem.” Pet. 20; Ex. 1003 ¶ 102.
`Patent Owner argues that “a ‘Petitioner’s observation that both
`references . . . are from the same field of endeavor falls short of an adequate
`rationale.’” Prelim. Resp. 67 (citing Spectrum Brands, Inc. v. ASSA ABLOY
`AB, Case IPR2015-01563, slip op. at 19 (PTAB Jan. 15 2016) (Paper 7)).
`While we agree with Patent Owner that such an assertion alone may be
`insufficient rationale, as noted above, Petitioner provides more than a simple
`assertion that the references are from the same field, and provides additional
`reasons a person of ordinary skill in the art would have combined the
`references.
`Patent Owner further argues that a person of ordinary skill in the art
`“seeking to support key handling during idle mode mobility between a
`2G/3G network and an LTE network, for example, would have found no
`solution in TR 33.821.” Id. at 68. Based on the record now before us,
`however we credit Dr. Lyon’s testimony in this regard and are persuaded
`that “a person of ordinary skill in the art would have been motivated to
`combine the teachings of TS 23.401 and TR 33.821 to fully describe a
`known solution to a known problem.” Ex. 1003 ¶ 102; see also Estee
`Lauder Inc. v. L’Oreal, S.A., 129 F.3d 588, 595 (Fed. Cir. 1997)
`(“[A]rguments of counsel cannot take the place of evidence lacking in the
`record.”) (internal citations and quotation marks omitted).
`
`
`
`19
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`Based on the record now before us, we are persuaded that Petitioner
`has articulated sufficient reasoning6 why it would have been obvious to
`combine these references in the proposed manner.
`
`b. Claim Elements 1 Pre, 9 Pre, 17 Pre – Preambles
`Claim 1 recites a “method of security negotiation for idle state
`mobility from a first network to a long term evolution (LTE) network using
`a mobility management entity (MME).”7 As discussed above, each of
`TS 23.401 and TR 33.821 teaches a method and communications system for
`security negotiation for idle state mobility from a first network to an LTE
`network. See Pet. 20–21 (citing Ex. 1003 ¶¶ 103, 133, 161; Ex. 1005
`§§ 5.3.3.2, 5.3.3.3.1; Ex. 1006 §§ 7.4.10, 7.4.11).
`Patent Owner, at this stage of the proceeding, has not presented
`specific arguments regarding this claim limitation. On the record now
`before us, we are persuaded that Petitioner has shown a reasonable
`likelihood of demonstrating that the asserted combination teaches or
`suggests this limitation of the claims.
`
`
`6 Petitioner also argues that “the inter-dependent nature of these documents
`was recognized by applicant, as both TS 23.401 and TR 33.821 were cited
`on the face of the patent.” Pet. 20. We agree with Patent Owner that “the
`fact that the applicant cited the TS 23.401 and TR 33.821 references to the
`examiner is in no way an admission or recognition that these references are
`‘interdependent’” (Prelim. Resp. 68), and we do not find this portion of
`Petitioner’s argument persuasive.
`7 Petitioner addresses independent claims 1, 9, and 17 together. See, e.g.,
`Pet. 20–21. For convenience we reproduce only the language of
`independent claim 1. Claims 9 and 17 recite similar limitations.
`
`
`
`20
`
`
`
`IPR2017-00660
`Patent 9,241,261 B2
`
`
`c. Claim Elements 1A, 9B, 17B – Authentication
`Vector-Related Key
`Claim 1 recites “transmitting an authentication vector-related key
`from a service general packet radio service (GPRS) support node (SGSN) in
`the first network to the MME.” Regarding this claim feature, Petitioner
`points to Step 4 in Figures 5.3.3.2-1 and 5.3.3.3-1 of TS 23.401, each of
`which discloses transmitting a context response from an SGSN to an MME.
`Pet. 21–23 (citing Ex. 1003 ¶¶ 104, 137, 165; Ex. 1005 §§ 5.3.3.2.1,
`5.3.3.3.1). According to Petitioner, a person of ordinary skill in the art
`“would have known that a context response contains authentication
`vector-related keys Kc or CK and IK.” Id. at 23–24 (citing Ex. 1003
`¶¶ 104–105, 137–138, 165–166; Ex. 1005 §§ 5.3.3.2, 5.3.3.3.1). As further
`support, Petitioner points to TR 33.821, which discloses transferring
`authentication vectors from 2G/3G SGSN to MME (id. at 24 (citing
`Ex. 1006 § 7.4.3.2)), and to Figure 13 of TR 33.821, which specifically
`“discloses transmitting a context response to an MME that contains
`encryption and integrity keys that are the 4G version of the 3G keys, CK, IK,
`which are authentication vector-related keys that are contained in
`authentication vectors” (id. (citing Ex. 1003 ¶¶ 106–107, 138–139, 166–167;
`Ex. 1006 § 7.4.11.3)).
`Patent Owner asserts that “Petitioner is incorrect in