UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`Patent Owner.
`
`____________
`
`Case IPR2020-00116
`Patent 9,871,671
`
`____________
`
`EXPERT DECLARATION OF MAHDI SHAHBAKHTI, PH.D.
`
`IN SUPPORT OF PATENT OWNER RESPONSE
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 1 of 93
`
`
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`Patent Owner.
`
`____________
`
`Case IPR2020-00116
`Patent 9,871,671
`
`____________
`
`EXPERT DECLARATION OF MAHDI SHAHBAKHTI, PH.D.
`
`IN SUPPORT OF PATENT OWNER RESPONSE
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 1 of 93
`
`
`
`TABLE OF CONTENTS
`
`Case IPR2020-00116
`Patent 9,871,671
`
`I.
`
`Introduction ...................................................................................................... 1
`
`II. Qualifications, publications, and prior testimony ............................................ 4
`
`III. Person having ordinary skill in the art .............................................................. 9
`
`IV. Claim construction ..........................................................................................10
`
`A.
`
`B.
`
`C.
`
`"data bus" .....................................................................................................10
`
` .........................................................................11
`
` ....................................................................................................13
`
`V.
`
`Background: Hacking Vehicle Networks .......................................................15
`
`VI. The Munoz Reference ....................................................................................18
`
`VII. A person of ordinary skill in the art would have understood that Munoz does
`
`not disclose spoofing of CAN messages. .................................................................19
`
`VIII. Differences between Munoz and claimed invention; expert assumptions .....33
`
`A. Claim 1 [1.1]: Munoz does not teach a first message from the first
`
`apparatus 110 to the factory-installed second apparatus 105 ..............................40
`
`B. Claim 1 [1.3]: Munoz does not add a second data bus. ..............................58
`
`C. Claim 1 [1.4]: Munoz does not teach connecting a retrofit apparatus to the
`
`vehicle bus and the second data bus. ...................................................................65
`
` i
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 2 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`D. Claim 1 [1.5]: Munoz does not teach connecting the factory-installed first
`
`apparatus to the second data bus. .........................................................................65
`
`E. Claim 1 [1.6]: Munoz does not teach transmitting a second message being
`
`indistinguishable from a first message. ................................................................65
`
`F. Claim 2: Munoz does not teach that the second message uses the identifier
`
`of the first message. .............................................................................................71
`
`G. Claim 3: Munoz does not teach receiving the first message in the retrofit
`
`device. ..................................................................................................................71
`
`H. Claim 4: Munoz does not teach that the retrofit apparatus re-transmits
`
`messages received on the vehicle data bus to the factory-installed first apparatus
`
`through the second data bus. ................................................................................72
`
`I.
`
`Claim 5: Munoz does not teach a vehicle that has been retrofitted according
`
` .........................................................................73
`
`J.
`
`Claim 6 [6.1]: Munoz does not teach a factory-installed first apparatus
`
`including a first processor which is programmed to receive a first message on a
`
`vehicle data bus from a factory-installed second apparatus. ...............................73
`
`K. Claim 6 [6.2]: Munoz does not teach a retrofit apparatus connected to the
`
`vehicle data bus including a second processor programmed to transmit a second
`
`message that mimics the first message through a second data bus. ....................73
`
` ii
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 3 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`L. Claim 7: Munoz does not teach wherein the first message comprises a
`
`message identifier that has been assigned to the factory-installed second
`
`apparatus and wherein the second processor is programmed to transmit the
`
`second message with the same message identifier. .............................................74
`
`M. Claim 10 [10.1]: Munoz does not teach a factory-installed first apparatus
`
`including a first processor, programmed to receive a first message via a vehicle
`
`data bus from a factory-installed second apparatus, the first message having a
`
`message identifier. ...............................................................................................75
`
`N. Claim 10 [10.2]: Munoz does not teach a retrofit apparatus, operatively
`
`connected to the vehicle data bus, including a second processor programmed to
`
`send a second message having the same message identifier. ..............................75
`
`O. Claim 10 [10.3]: Munoz does not teach that the factory-installed first
`
`apparatus communicates with the retrofit apparatus through a second data bus. 76
`
`P. Claim 11: Munoz does not teach that the second message originating from
`
`the retrofit apparatus is indistinguishable to the first apparatus from the first
`
`message which the first processor is programmed to receive from the second
`
`apparatus. .............................................................................................................76
`
`Q. Dependent Claim 12: Munoz does not teach that the factory-installed first
`
`apparatus responds to the second message originating from the retrofit apparatus
`
` iii
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 4 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`as if it were the first message which the first processor is programmed to receive
`
`from the factory-installed second apparatus. .......................................................76
`
`R. Dependent Claim 13: Munoz does not teach that the factory- installed first
`
`apparatus is electrically disconnected from the vehicle data bus. .......................77
`
`S. Dependent Claim 14: Munoz does not teach wherein the retrofit apparatus
`
`is a gateway through which the factory-installed first apparatus transmits and/or
`
`receives messages from the vehicle data bus. ......................................................77
`
`T. Claim 15: Munoz does not teach wherein the retrofit apparatus selectively
`
`suppresses forwarding messages received from the factory-installed first
`
`apparatus to the vehicle data bus. ........................................................................79
`
`U. Claim 19: Munoz does not to teach wherein the second data bus is added to
`
`the vehicle during a retrofit. .................................................................................80
`
`IX. Dietz does not teach the claimed inventionS..................................................80
`
`A. The Dietz reference is not enabling.............................................................80
`
`B. Dietz does not teach a vehicle having a factory-installed first apparatus
`
`including a processor, programmed to communicate with a factory-installed
`
`second apparatus through a vehicle data bus with a first message having an
`
`identifier. ..............................................................................................................81
`
`C. Dietz does not to teach adding a second data bus to the vehicle. ...............83
`
` iv
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 5 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`D. Dietz does not to teach transmitting a second message from the retrofit
`
`apparatus to the factory-installed first apparatus through the second data bus, the
`
`second message being indistinguishable from the first message. ........................85
`
`E. Dietz does not teach that the second message uses the identifier of the first
`
`message. ...............................................................................................................85
`
`F. Dietz does not teach wherein the retrofit apparatus re-transmits messages
`
`received on the vehicle data bus to the factory-installed first apparatus through
`
`the second data bus. .............................................................................................86
`
`X.
`
`Conclusion ......................................................................................................87
`
` v
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 6 of 93
`
`
`
`I.
`
`1.
`
`INTRODUCTION
`
`I have been retained by Patent Owner
`
`Case IPR2020-00116
`Patent 9,871,671
`
`n
`
`at the request of Sucxess regarding my opinions as an independent expert
`
`regarding issues of validity of U.S. Patent No. 9,871,671
`
`in the matter of Inter Partes Review, Petition IPR2020-
`
`2.
`
`I am being compensated for my services in connection with this Inter Partes
`
`Review proceeding. My compensation is not dependent upon the outcome of the
`
`present Inter Partes review proceeding.
`
`3.
`
`I have reviewed the Petition for Inter Partes Review of Patent No. 9,871,671
`
`filed by
`
`1. I have
`
`also reviewed the exhibits cited in those documents, including Negley2, SAE3, and
`
`Bosch4.
`
`4.
`
`I have also reviewed the exhibits cited in this declaration. This includes:
`
`1 Ex.
`2 Bruce Negley, Getting Control Through CAN, The Journal of Applied
`Sensing Technology, Oct. 2000, vol. 17, no. 10, pages 16 33. Ex. 1006.
`3 Craig Szydlowski, A Gateway for CAN Specification 2.0 Non-Passive
`Devices, SAE Technical Paper Series, 930005, Society of Automotive
`Engineers, Inc. 1993, pages 29 37. Ex. 1009.
`4 Robert Bosch, CAN Specification Version 2.0, Bosch, Sept. 1991. Ex. 1010.
`
`1
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 7 of 93
`
`
`
`Currie, Roderick
`
`https://www.sans.org/reading-room/whitepapers/ICS/paper/36607.
`
`Case IPR2020-00116
`Patent 9,871,671
`
`.
`
`https://www.can-
`
`cia.org/fileadmin/resources/documents/conferences/2017_elend.pdf.
`
`Ex. 2012
`
`.
`
`Service Training Self Study Program 871603 Eos Electrical
`
`System Design and Function, Volkswagen of America, Inc.
`
`Volkswagen Academy, May 2006 which I obtained from
`
`https://erwin.vw.com.
`
`.
`
`https://us.autologic.com/news/vw-eos-convertible-hardtop-
`
`emergency-opening-and-closing showing a publication date of Sept.
`
`17th, 2019. Ex. 2008.
`
`https://youtu.be/KhgrBsIDO_0. Ex. 2010.
`
`2
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 8 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`hed
`
` at https://youtu.be/yQ9xqvHwe0o and
`
`described to be featuring the www.l-c-t.com EOS VARIO PLUS
`
`ROOF MODULE setup menu. (Ex. 2027).
`
`-
`
`https://youtu.be/9PYK9j3FFx4 having the following description:
`
`aftermarket gadget for your JETTA, GTI, RABBIT, GOLF, PASSAT,
`
`Touareg, Tiguan, A3, A4, A6, A5, Q7 has to offer? watch the video
`
`and find out! more infos at www.l-c-
`
`(Ex. 2030).
`
`-iwA
`
`-c-t.com eos roof module and
`
`opening
`
` (Ex. 2013).
`
`Wiring diagrams obtained from Alldata (http://my.alldata.com) or
`
`Alldatadiy (https://www.alldatadiy.com/) of the following vehicles:
`
`2007 Volkswagen Eos (Ex. 2014), 2007 Cadillac XLR (Ex. 2015),
`
`2007 Lexus SC 430 (Ex. 2016), 2007 Mazda MX-5 Miata (Ex. 2017),
`
`2007 Saab 9-3. (Ex. 2018), 2007 Pontiac G6 (Ex. 2019), 2007 Mini
`
`3
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 9 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Cooper S Convertible (Ex. 2020), 2007 Audi S4 Quattro Cabriolet
`
`(Ex. 2021), 2007 Ford Mustang (Ex. 2022), 2007 Porsche Boxster
`
`(987) (Ex. 2023).
`
`Connector pinout of 2007 Audi A4 Cabriolet, Bose Amplifier, 25-Pin
`
`and 32-pin obtained from Alldatadiy (https://www.alldatadiy.com/).
`
`(Ex. 2031).
`
`I have also reviewed the transcript of
`
` deposition, which I refer to as
`
`Leale
`
`II. QUALIFICATIONS, PUBLICATIONS, AND PRIOR TESTIMONY
`5.
`I am an Associate Professor of Mechanical Engineering at the University of
`
`Alberta and an Adjunct Associate Professor of Mechanical Engineering at
`
`Michigan Technological University. At these two universities, I serve as the
`
`Director of Energy Mechatronics Laboratory that conducts research in a
`
`multidisciplinary area of engineering that includes electrical and mechanical
`
`systems, telecommunications, and control engineering.
`
`6.
`
`Before joining Michigan Technological University in August of 2012, I
`
`spent two years as a post-doctoral scholar at the Mechanical Engineering
`
`Department at the University of California, Berkeley. My post-doctorate work
`
`focused on developing control systems for automotive applications, including
`
`powertrains and others.
`
`4
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 10 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`I earned a Ph.D. in Mechanical Engineering from the University of Alberta
`
`7.
`
`in 2009 and a Masters degree from KNT University of Technology in 2003. My
`
`research activities in the past 20 years have centered on propulsion systems, energy
`
`systems, and related control systems for automotive applications.
`
`8.
`
`I also have direct industry experience. From 2001 to 2004, I worked as a
`
`researcher in the automotive industry. During this time, I was involved in research
`
`and development work on powertrain management systems for gasoline and
`
`natural gas vehicles. In the past ten years, I have performed controls-related
`
`research sponsored by various automotive companies such as Ford Motor
`
`Company, Toyota Motor Corporation, General Motors Corporation, Hyundai,
`
`Cummins, Westport, IAV, Hitachi, and Denso.
`
`9.
`
`I have experience with automotive control systems including modeling,
`
`design, implementation, and utilizing vehicle networks including CAN. These
`
`include numerous projects in the past 20 years for vehicles including conventional,
`
`hybrid electric, electric, and connected and automated vehicles. Many of these
`
`projects included CAN communications and design of prototype (or aftermarket)
`
`systems for collecting required vehicle/powertrain data, implementing and testing
`
`designed real-time automotive controllers.
`
`10.
`
`I have taught graduate courses in the areas of model predictive controls, and
`
`vehicle propulsion systems; Led international workshops in the areas of controls
`
`5
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 11 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`and data systems including Methods of Easily verifiable Control Design ,
`
`(American Society of Mechanical Engineers) Dynamic Systems and Controls
`
`at American Control Conference, and ASME
`
`conferences.
`
`11.
`
`I have supervised/mentored 119 graduate and undergraduate students,
`
`including 28 PhD, 63 MS and 28 BS students in Mechanical Engineering and
`
`Electrical Engineering Departments in four academic institutions during 2010-
`
`2020. These mentorships have been in the area of modeling, experimental studies
`
`(including instrumentation, CAN setup), and control of automotive, HVAC, and
`
`energy systems.
`
`12. My current research activity at the University of Alberta and Michigan Tech
`
`University focuses on increasing efficiency of energy systems through utilization
`
`of advanced modeling, control, and network communication techniques, focusing
`
`on the transportation and building sectors.
`
`13.
`
`I am Associate editor (2017- ) for ASME Journal of Dynamic Systems,
`
`Measurement, and Controls and also Guest editor (2017- ), and Associate Editor
`
`(2014- 2020) for International Journal of Powertrains (Inderscience).
`
`14.
`
`National Science Foundation (NSF) review panels in the areas of controls and
`
`6
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 12 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`energy systems in the past seven years. I have also been reviewer for (i)
`
`international grant proposals from funding agencies from Croatia, France,
`
`Germany, Poland, and the Netherlands, (ii) US Academy of Engineering for the
`
`Research Program of the US DRIVE Partnership, (iii) 24 international journals
`
`mostly in the area of controls and energy systems, (iv) Springer International
`
`Publishing for books in the area of controls and automotive systems.
`
`15.
`
`I am an active member of ASME Dynamic Systems & Control Division
`
`(DSCD), serving as vice-chair of the Automotive Transportation Systems (ATS)
`
`technical committee (181 international members), the chair (2018-2020) of the
`
`Energy Systems (ES) technical committee (141 international members) and,
`
`chairing (30 sessions) and co-organizing sessions (> 60 sessions) in the areas of
`
`modeling, fault diagnosis, and control of automotive systems, and energy/HVAC
`
`systems in American Control Conference, SAE World Congress, and ASME
`
`Dynamic Systems Control Conferences.
`
`16.
`
`I have won the following awards for my work relating to modeling and
`
`control of automotive systems:
`
`Awarded over $2.1M grants/support as a Principle Investigator (PI) and
`
`over $6.6M as a co-PI from international, federal, provincial, and industry
`
`sources for conducting research in the areas of modeling, design, and
`
`7
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 13 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`implementation of novel control systems for automotive systems, HVAC
`
`and energy systems.
`
`Society of Automotive Engineers (SAE) International Ralph R. Teetor
`
`Educational Award, 2016. This inter
`
`Best Paper Award, ASME Automotive and Transportation Systems
`
`Technical Committee ASME Dynamic Systems Control Conference,
`
`2015.
`
`Best Paper Award, ASME Automotive and Transportation Systems
`
`Technical Committee ASME Dynamic Systems Control Conference,
`
`2012.
`
`Best Presentation in the Session, American Control Conference (ACC),
`
`2012, 2015, 2016.
`
`Best Presentation Award, SAE Int. Powertrain, Fuels & Lubricants
`
`Conference, Baltimore, MD, USA, 2016.
`
`Canada National Sciences and Engineering Research Council (NSERC)
`
`Postdoctoral Fellowship (for research in the area of automotive controls),
`
`2010 - 2012.
`
`8
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 14 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Andrew Stewart Memorial Graduate Prize, University of Alberta, 2009.
`
`David Morris Graduate Scholarship in Automotive Engineering,
`
`University of Alberta, 2008.
`
`Lehigh Inland Cement Graduate Scholarship in Environmental Studies,
`
`University of Alberta, 2007.
`
`Winning Team (first prize) of a Total of 66 Research Teams from 26
`
`Canadian Universities, Canada Automotive21 High Qualified Personnel
`
`Competition, Windsor, Canada, June 11-13, 2007.
`
`Chevron Graduate Scholarship in Natural Gas Engineering, University of
`
`Alberta, 2005.
`
`17. My curriculum vitae has been submitted as Exhibit 2009 to this proceeding.
`
`My publications are found at
`
`https://sites.ualberta.ca/~mahdi/Shahbakhti_Publications.html. This includes 171
`
`peer-reviewed publications. These research publications have been recognized and
`
`cited over 2400 times from over 45 different countries (Source: Google Scholar).
`
`III. PERSON HAVING ORDINARY SKILL IN THE ART
`
`18.
`
`and the prior art, I am required to do so based on the perspective of one of ordinary
`
`skill in the art at the relevant effective filing date, which I understand is April 30,
`
`2007.
`
`9
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 15 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`I understand that the Board has provided guidance that a person of ordinary
`
`19.
`
`skill in th
`
`coursework or post-
`
`years of work experience in the design, operation, and functioning of CAN
`
`20.
`
`I have adopted this proposed level of skill in the art in formulating my
`
`opinions. Given my background and experience listed in Section II above, I
`
`consider myself as having met this skill level.
`
`IV. CLAIM CONSTRUCTION
`A.
`"data bus"
`
`21.
`
`The Petition
`
`is used in IP-based networks and refers to a network in
`
`which packets sent between every pair of subnets pass through subnets of the same
`
`network.
`
`continuing,
`
`data bus as a
`
`of the word
`
`Leale Tr. 17:2. In my opinion, referring to a vehicle
`
` network
`
`22. CAN was standardized by the International Standard Organization in in
`
`International Standard ISO 11898-
`
` Controller area network
`
`10
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 16 of 93
`
`
`
`(CAN)
`
`ISO-11898 defines certain terms. In chapter 4,
`
`Case IPR2020-00116
`Patent 9,871,671
`-
`
`. Ex. 2002
`
`, the use of the
`
`ISO 11898-1.
`
`a communication network, where all nodes are reached by passive links which
`
`allow transmission in both directions.
`
`B.
`
`23.
`
`The Petition understands a
`
`channel
`
`In my opinion,
`
`broadly mean
`
`. An added
`
`communication channel could for example be wireless. A POSITA would not
`
`consider a wireless channel to be a second data bus.
`
`24.
`
`The Petition states that a POSITA would understand FIG. 4 and FIG. 7 [of
`
`the 671 patent] as disclosing a vehicle data bus 212, and a separate, or second,
`
`data bus connecting the emergency call apparatus 214 and telecommunication
`
`apparatus 200. In my opinion, FIG. 4 and FIG. 7 taken together disclose a second
`
`vehicle data bus. FIG. 4 alone does not teach a second bus.
`
`11
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 17 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`Only by disclosing the internal wiring of the emergency call (retrofit)
`
`apparatus in FIG. 7 and its associated description in the specification does the 671
`
`patent enable the reader to recognize that there is a separate, or second, data bus.
`
`The second data bus is present only because FIG. 7 shows that BUS1 and BUS2
`
`are wired to separate vehicle data bus interfaces 504, 700.
`
`12
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 18 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`FIG. 6 shows a configuration in which BUS1 and BUS2 are connected
`
`together through a switch 606.
`
`In the configuration of FIG. 6, a second data bus is present only while the
`
`switch 606 is open. While the switch 606 is closed, the terminals 600 and 602 are
`
`wired together and there is no second data bus, yet all data bus communication
`
`goes through the retrofit module 610.
`
`25. Given the d
`
`understand a
`
`-1, I believe a PHOSITA would
`
`which is electrically isolated from an existing first communication network . This
`
`electrically isolated second communication network does add a new
`
`communication channel.
`
`C.
`
`26. Negley Figure 8 provides an overview of receiving CAN messages. The
`
`Petitioner understands
`
`13
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 19 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Consequently, all nodes on a CAN bus receive all
`
`messages, and the act of
`
`differentiate nodes.
`
`27. A PHOSITA would understand a message to be received when it has passed
`
`the Message Filters/Masks block and is accepted
`
`Receive
`
`so that a microcontroller can now act on the received message.
`
`The
`
`11:47, 12:12, 12:25, 12:30). This indicates
`
`or programming. In case of a CAN bus, this includes setting appropriate message
`
`filters/
`
`14
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 20 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`patent a POSITA would
`
`BACKGROUND: HACKING VEHICLE NETWORKS
`V.
`28. Currie describes the CAN bus architecture as follows:
`
`systems is the Controller Area Network bus, or CAN bus.
`The CAN bus is a single, centralized network bus on
` The
`CAN bus carries everything from operator commands
`
`to readouts from sensors reporting engine temperature or
`tire pressure. The advent of the CAN bus brought about
`improvements in efficiency and a reduction in
`complexity while also reducing wiring costs.
`
`Currie, 6. I find that to be an accurate description.
`
`Development of the CAN bus protocol was begun in
`1983 by German company Robert Bosch GmbH. After
`three years of development, CAN bus technology hit the
`public market in 1986, first showing up in the BMW 850.
`
`Currie, 9. Bosch introduced CAN a
`
`efficiently supports distributed r
`
`Bosch, 4. The characterization of CAN as being secure, however, is simply not
`
`correct with respect to spoofing. CAN is inherently insecure:
`
`15
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 21 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`The CAN bus is a 30-year old architecture that was
`developed for various valid reasons, but security
`certainly was not one of them. Automakers at the time
`could not possibly envision the risk of cars being hacked
`decades into the future, nor could the governing bodies
`that mandated the CAN and OBD standards. The CAN
`architecture was designed to be lightweight and robust,
`and those qualities it accomplishes very well. However,
`CAN contains numerous vulnerabilities that are inherent
`in its design.
`
`Currie, 10.
`
`29.
`
`Today, spoofing of CAN messages is a recognized technique to retrofit cars
`
`and is widely used.
`
`Spoofing a CAN identifier means that a compromised
`
`node attempts to use an identifier that it is not allowed to
`
`send, see Figure 1. This can be useful to pretend to be
`
`another node.
`
`Ex. 2012, 2.
`
`a message with
`
`the same identifier as another message . Leale Tr. 26:13-14. Spoofing of CAN
`16
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 22 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`messages would have worked in the first BMW with CAN in 1986. Notably
`
`though, none of references cited in the Petition explains spoofing or shows any
`
`example of spoofing. Neither Munoz nor Dietz nor any of Negley, SAE, or Bosch
`
`mention i) a message using an identifier that it is not allowed to use or ii) a
`
`message using the same identifier as another message. General familiarity with a
`
`CAN bus does not enable a POSITA to spoof CAN messages. Spoofing involves
`
`sending a message with the same identifier as another message. See Leale Tr.
`
`26:13-14. That is, a node uses an identifier that it is not allowed to send. See Ex.
`
`2012,2.
`
`30. While spoofing of CAN messages is an effective technique by which an
`
`owner can retrofit an existing vehicle, it can also be abused to attack vehicles of
`
`others. Car manufacturers have recognized this threat and actively attempted to
`
`conceal it:
`
`Manufacturers are floundering when it comes to locking
`
`yet others using litigation as a means to silence security
`researchers and keep vulnerabilities under wraps. In one
`recent case, Volkswagen engaged a team of European
`security researchers in a 2-year long legal battle to
`prevent the group from presenting its research paper on a
`
`17
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 23 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`vulnerability they ha
`keyless entry system (Cimpanu, 2015).
`
`Currie, 3-4.
`
`VI. THE MUNOZ REFERENCE
`
`31.
`
`In my opinion, the Munoz patent is not properly drafted and violates basic
`
`rules of technical writing.
`
`-
`
`as including
`
`but not limited to CAN-bus, LIN-bus, FlexRay, or other such automobile network
`
`Munoz, 6:22-25. This self-referencing and expanding a definition make
`
`-
`
`-
`
`defined by Bosch or to another serial data bus. A LIN-bus is not a CAN-bus,
`
`neither is FlexRay a CAN-bus.
`
`32. Munoz routinely refers to the same element by different names and refers to
`
`different elements by the same or confusingly similar names. For example, Fig. 3
`
`in step 30
`
`signal
`
`we receive another lock/unlock message
`
`t any further explanation in the specification how data can
`
`entails.
`
`18
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 24 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`VII. A PERSON OF ORDINARY SKILL IN THE ART WOULD HAVE
`UNDERSTOOD THAT MUNOZ DOES NOT DISCLOSE SPOOFING
`OF CAN MESSAGES.
`
`33. Munoz discloses an aftermarket automobile device that is seamlessly
`
`integrable to factory automobile networks such as CAN-bus and its ECU systems
`
`and allows multiple convenience and performance enhancements to be controlled
`
`through factory controls and displayed on factory displays. Munoz, 3:7-12.
`
`34. Munoz discloses the operation of several high-level features. Those include
`
`a convertible top control mechanism (FIG. 3), a horn upon lock/unlock feature
`
`(FIG. 4), a vehicle's horn while reversing feature (FIG. 5), a module's emergency
`
`flasher mode (FIG. 6) and a blind spot assistant system (FIG. 7). While Munoz
`
`discloses these high-level features, Munoz fails to teach the lower level details how
`
`these features are implemented in a vehicle.
`
`35. Munoz mentions a feature for vehicles that only allow the cabriolet top to be
`
`opened or closed when the vehicle is moving slowly. In that case, his device
`
`increases the maximum speed of the vehicle at which the cabriolet top may be
`
`opened or closed . Munoz, 3:62-64. Compared to the features discussed above,
`
`Munoz provides even fewer details as to how
`
`is implemented. For example, there is no hardware schematic or flowchart to
`
`explain implementation of
`
`. The schematic in
`
`Fig.1 is a very basic illustration that fails to show critical elements of the claims.
`
`19
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 25 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`For example, Fig. 1 does not show the factory cabriolet top open/close button
`
`recited in claim 1 (Munoz, 8:37-38) and claim 15 (Munoz, 10:9-10). Neither does
`
`Fig. 1 show the remote keyless entry system recited in claim 1 (Munoz, 35-36) and
`
`claim 15 (Munoz, 10:6-7).
`
`36.
`
`In my opinion, a POSITA having studied Munoz and being familiar with the
`
`operation of a CAN bus as disclosed in Bosch, Negley and SAE would not have
`
`37. Munoz
`
`or
`
`, box 100. But
`
`Munoz does not explain how data can be removed. A CAN bus does not provide
`
`any mechanism
`
`. Nor would a POSITA expect that removing
`
`data from a CAN bus causes a convertible roof to open. Elend and Adamson
`
`describe a possible tampering attack on a CAN bus in paragraph 2.2 of their paper:
`
`Ex. 2012, 2.
`
`tamper with the messages that are being sent on the bus.
`
`20
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 26 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`with a message means altering the message. In my opinion, a POSITA would have
`
`to be some sort of tampering attempt which
`
`adjusts a message that another node is currently sending on the bus as described by
`
`Elend and Adamsom. The tampering attempt
`
`Spoofing can be accomplished by retransmitting, from a
`
`retrofit device, the exact same message that a factory installed device sends.
`
`Spoofing a message does not require any removing or altering of data. See Ex.
`
`2012, 2. None of SAE, Bosch or Negley
`
`on a
`
`CAN bus.
`
`38. A POSITA would not
`
`general knowledge of a CAN bus to arr
`
`Munoz lacks disclosure of the lower level implementation of his features. This lack
`
`of disclosure does not lead a POSITA to the spoofing of normal mode CAN
`
`messages as described and claimed
`
`39.
`
`In
`
`reviewed additional material not considered in the petition. This includes a
`
`-
`
`https://youtu.be/9PYK9j3FFx4. Ex. 2030.
`
`21
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 27 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Volkswagen vehicle. I will refer to this video as "the Vario Plus video".
`
`40.
`
`The Vario Plus video shows clear correlations to the Munoz patent as
`
`illustrated below.
`
`Munoz
`
`the Vario Plus video
`
`22
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 28 of 93
`
`
`
`Fig. 2
`
`Video @ 0:46
`
`Case IPR2020-00116
`Patent 9,871,671
`
`Fig. 3
`
`Video @ 1:11
`
`Video @ 1:12
`
`Video @ 3:00
`
`23
`
`illustrates the operation of the
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 29 of 93
`
`
`
`vehicle's horn while reversing
`
`-29).
`
`Case IPR2020-00116
`Patent 9,871,671
`
`Fig. 5
`
`Video @3:03
`
`Fig. 5
`
`Video @3:06
`
`41. Given the apparent similarities between Munoz and the Vario Plus video it is
`
`my opinion that the two are related. My opinion is further supported by the fact
`
`that a trademark for the word
`
`was
`
`24
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 30 of 93
`
`
`
`regi
`
`No. 77-198,481, Reg. No. 3,388,116. (Ex. 2029).
`
`42.
`
`Case IPR2020-00116
`Patent 9,871,671
`
`-5-2007, Ser.
`
`SETUP
`
`-c-t.com EOS VARIO PLUS ROOF
`
`25
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00116
`Page 31 of 93
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`The EOS roof module video also shows a clear correlation to Munoz as
`
`43.
`
`illustrated below:
`
`Munoz
`
`Fig. 1
`
`the EOS roof module video
`
`Video @0:19
`
`Fig. 3
`
`Video @0:21
`
`26
`
`Sucxess LLC Exhibit 2028
`Dataspe
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
