UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`Patent Owner.
`
`____________
`
`Case IPR2020-00147
`Patent 10,027,505
`
`____________
`
`EXPERT DECLARATION OF MAHDI SHAHBAKHTI, PH.D.
`
`IN SUPPORT OF PATENT OWNER RESPONSE
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 1 of 95
`
`Petitioner's Exhibit 1021
`Page 1 of 95
`
`
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`Patent Owner.
`
`____________
`
`Case IPR2020-00147
`Patent 10,027,505
`
`____________
`
`EXPERT DECLARATION OF MAHDI SHAHBAKHTI, PH.D.
`
`IN SUPPORT OF PATENT OWNER RESPONSE
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 1 of 95
`
`Petitioner's Exhibit 1021
`Page 1 of 95
`
`
`
`TABLE OF CONTENTS
`
`Case IPR2020-00147
`Patent 10,027,505
`
`I.
`
`Introduction ...................................................................................................... 1
`
`II. Qualifications, publications, and prior testimony ............................................ 4
`
`III. Person having ordinary skill in the art .............................................................. 9
`
`IV. Claim construction ..........................................................................................10
`
`A.
`
`B.
`
`"data bus" .....................................................................................................10
`
` ....................................................................................................11
`
`V.
`
`Background: Hacking Vehicle Networks .......................................................12
`
`VI. The Munoz Reference ....................................................................................15
`
`VII. A person of ordinary skill in the art would have understood that Munoz does
`
`not disclose spoofing of CAN messages. .................................................................16
`
`VIII. Differences between Munoz and claimed invention; expert assumptions .....31
`
`A. Claim 1 [1.1]: Munoz does not teach a first message from the first
`
`apparatus 110 to the factory-installed second apparatus 105 ..............................38
`
`B. Munoz does not add a second data bus. ......................................................56
`
`C. Claim 1 [1.4]: Munoz does not teach transmitting a second message being
`
`indistinguishable from a first message. ................................................................63
`
` i
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 2 of 95
`
`Petitioner's Exhibit 1021
`Page 2 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`D. Claim 2: Munoz does not teach that the second message uses the identifier
`
`of the first message. .............................................................................................68
`
`E. Claim 3: Munoz does not teach receiving the first message in the retrofit
`
`device. ..................................................................................................................69
`
`F. Claim 4: Munoz does not teach that the retrofit apparatus re-transmits
`
`messages received on the vehicle data bus to the factory-installed first apparatus.
`
`70
`
`G. Claim 6 [6.1]: Munoz does not teach a factory-installed first apparatus
`
`including a first processor which is programmed to receive a first message on a
`
`vehicle data bus from a factory-installed second apparatus. ...............................71
`
`H. Claim 6 [6.2]: Munoz does not teach a retrofit apparatus connected to the
`
`vehicle data bus including a second processor programmed to transmit a second
`
`message that mimics the first message. ...............................................................71
`
`I.
`
`Claim 7: Munoz does not teach wherein the first message comprises a
`
`message identifier that has been assigned to the factory-installed second
`
`apparatus and wherein the second processor is programmed to transmit the
`
`second message with the same message identifier. .............................................72
`
`J.
`
`Claim 10 [10.1]: Munoz does not teach a factory-installed first apparatus
`
`including a first processor, programmed to receive a first message via a vehicle
`
` ii
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 3 of 95
`
`Petitioner's Exhibit 1021
`Page 3 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`data bus from a factory-installed second apparatus, the first message having a
`
`message identifier. ...............................................................................................73
`
`K. Claim 10 [10.2]: Munoz does not teach a retrofit apparatus, operatively
`
`connected to the vehicle data bus, including a second processor programmed to
`
`send a second message having the same message identifier. ..............................73
`
`L. Claim 11: Munoz does not teach that the second message originating from
`
`the retrofit apparatus is indistinguishable to the first apparatus from the first
`
`message which the first processor is programmed to receive from the second
`
`apparatus. .............................................................................................................73
`
`M. Dependent Claim 12: Munoz does not teach that the factory-installed first
`
`apparatus responds to the second message originating from the retrofit apparatus
`
`as if it were the first message which the first processor is programmed to receive
`
`from the factory-installed second apparatus. .......................................................74
`
`N. Dependent Claim 13: Munoz does not teach that the factory- installed first
`
`apparatus is electrically disconnected from the vehicle data bus. .......................74
`
`IX. Dietz does not teach the claimed inventionS..................................................75
`
`A. The Dietz reference is not enabling.............................................................75
`
`B. Dietz does not teach a vehicle having a factory-installed first apparatus
`
`including a processor, programmed to communicate with a factory-installed
`
` iii
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 4 of 95
`
`Petitioner's Exhibit 1021
`Page 4 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`second apparatus through a vehicle data bus with a first message having an
`
`identifier. ..............................................................................................................76
`
`C. Dietz does not to teach adding a second data bus to the vehicle. ....... Error!
`
`Bookmark not defined.
`
`D. Dietz does not to teach transmitting a second message from the retrofit
`
`apparatus to the factory-installed first apparatus through the second data bus, the
`
`second message being indistinguishable from the first message. ........................77
`
`E. Dietz does not teach that the second message uses the identifier of the first
`
`message. ...............................................................................................................78
`
`F. Dietz does not teach wherein the retrofit apparatus re-transmits messages
`
`received on the vehicle data bus to the factory-installed first apparatus through
`
`the second data bus. .............................................................................................78
`
`X. Allen does not emulate vehicle data bus signals ............................................79
`
`XI. Lobaza cannot be retrofitted ...........................................................................83
`
`XII. Conclusion ......................................................................................................90
`
` iv
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 5 of 95
`
`Petitioner's Exhibit 1021
`Page 5 of 95
`
`
`
`I.
`
`1.
`
`INTRODUCTION
`
`I have been retained by Patent Owner
`
`Case IPR2020-00147
`Patent 10,027,505
`
`at the request of Sucxess regarding my opinions as an independent expert
`
`regarding issues of validity of U.S. Patent No. 10,027,505
`
`505
`
`in the matter of Inter Partes Review, Petition IPR2020-00147
`
`2.
`
`I am being compensated for my services in connection with this Inter Partes
`
`Review proceeding. My compensation is not dependent upon the outcome of the
`
`present Inter Partes review proceeding.
`
`3.
`
`I have reviewed the Petition for Inter Partes Review of Patent No.
`
`10,027,505
`
`Declaration1. I have also reviewed the exhibits cited in those documents, including
`
`Negley2, SAE3, and Bosch4.
`
`4.
`
`I have also reviewed the exhibits cited in this declaration. This includes:
`
`1 2
`
` Bruce Negley, Getting Control Through CAN, The Journal of Applied
`Sensing Technology, Oct. 2000, vol. 17, no. 10, pages 16 33. Ex. 1006.
`3 Craig Szydlowski, A Gateway for CAN Specification 2.0 Non-Passive
`Devices, SAE Technical Paper Series, 930005, Society of Automotive
`Engineers, Inc. 1993, pages 29 37. Ex. 1009.
`4 Robert Bosch, CAN Specification Version 2.0, Bosch, Sept. 1991. Ex. 1010.
`
`1
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 6 of 95
`
`Petitioner's Exhibit 1021
`Page 6 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`https://www.sans.org/reading-room/whitepapers/ICS/paper/36607.
`
`.
`
`Bernd Elend
`
`https://www.can-
`
`cia.org/fileadmin/resources/documents/conferences/2017_elend.pdf.
`
`Ex. 2012
`
`.
`
`Service Training Self Study Program 871603 Eos Electrical
`
`System Design and Function, Volkswagen of America, Inc.
`
`Volkswagen Academy, May 2006 which I obtained from
`
`https://erwin.vw.com.
`
`.
`
`Using Autologic DriveP
`
`https://us.autologic.com/news/vw-eos-convertible-hardtop-
`
`emergency-opening-and-closing showing a publication date of Sept.
`
`17th, 2019. Ex. 2008.
`
`https://youtu.be/KhgrBsIDO_0. Ex. 2010.
`
`2
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 7 of 95
`
`Petitioner's Exhibit 1021
`Page 7 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
` at https://youtu.be/yQ9xqvHwe0o and
`
`described to be featuring the www.l-c-t.com EOS VARIO PLUS
`
`ROOF MODULE setup menu. (Ex. 2027).
`
`-
`
`https://youtu.be/9PYK9j3FFx4 having the following description:
`
`aftermarket gadget for your JETTA, GTI, RABBIT, GOLF, PASSAT,
`
`Touareg, Tiguan, A3, A4, A6, A5, Q7 has to offer? watch the video
`
`and find out! more infos at www.l-c-
`
` (Ex. 2030).
`
`-iwA
`
`-c-t.com eos roof module and
`
` (Ex. 2013).
`
`Wiring diagrams obtained from Alldata (http://my.alldata.com) or
`
`Alldatadiy (https://www.alldatadiy.com/) of the following vehicles:
`
`2007 Volkswagen Eos (Ex. 2014), 2007 Cadillac XLR (Ex. 2015),
`
`2007 Lexus SC 430 (Ex. 2016), 2007 Mazda MX-5 Miata (Ex. 2017),
`
`2007 Saab 9-3. (Ex. 2018), 2007 Pontiac G6 (Ex. 2019), 2007 Mini
`
`3
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 8 of 95
`
`Petitioner's Exhibit 1021
`Page 8 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Cooper S Convertible (Ex. 2020), 2007 Audi S4 Quattro Cabriolet
`
`(Ex. 2021), 2007 Ford Mustang (Ex. 2022), 2007 Porsche Boxster
`
`(987) (Ex. 2023).
`
`Connector pinout of 2007 Audi A4 Cabriolet, Bose Amplifier, 25-Pin
`
`and 32-pin obtained from Alldatadiy (https://www.alldatadiy.com/).
`
`(Ex. 2031).
`
`I have also reviewed the transcript of
`
` deposition, which I refer to as
`
`Leale
`
`II. QUALIFICATIONS, PUBLICATIONS, AND PRIOR TESTIMONY
`5.
`I am an Associate Professor of Mechanical Engineering at the University of
`
`Alberta and an Adjunct Associate Professor of Mechanical Engineering at
`
`Michigan Technological University. At these two universities, I serve as the
`
`Director of Energy Mechatronics Laboratory that conducts research in a
`
`multidisciplinary area of engineering that includes electrical and mechanical
`
`systems, telecommunications, and control engineering.
`
`6.
`
`Before joining Michigan Technological University in August of 2012, I
`
`spent two years as a post-doctoral scholar at the Mechanical Engineering
`
`Department at the University of California, Berkeley. My post-doctorate work
`
`focused on developing control systems for automotive applications, including
`
`powertrains and others.
`
`4
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 9 of 95
`
`Petitioner's Exhibit 1021
`Page 9 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`I earned a Ph.D. in Mechanical Engineering from the University of Alberta
`
`7.
`
`in 2009 and a Masters degree from KNT University of Technology in 2003. My
`
`research activities in the past 20 years have centered on propulsion systems, energy
`
`systems, and related control systems for automotive applications.
`
`8.
`
`I also have direct industry experience. From 2001 to 2004, I worked as a
`
`researcher in the automotive industry. During this time, I was involved in research
`
`and development work on powertrain management systems for gasoline and
`
`natural gas vehicles. In the past ten years, I have performed controls-related
`
`research sponsored by various automotive companies such as Ford Motor
`
`Company, Toyota Motor Corporation, General Motors Corporation, Hyundai,
`
`Cummins, Westport, IAV, Hitachi, and Denso.
`
`9.
`
`I have experience with automotive control systems including modeling,
`
`design, implementation, and utilizing vehicle networks including CAN. These
`
`include numerous projects in the past 20 years for vehicles including conventional,
`
`hybrid electric, electric, and connected and automated vehicles. Many of these
`
`projects included CAN communications and design of prototype (or aftermarket)
`
`systems for collecting required vehicle/powertrain data, implementing and testing
`
`designed real-time automotive controllers.
`
`10.
`
`I have taught graduate courses in the areas of model predictive controls, and
`
`vehicle propulsion systems; Led international workshops in the areas of controls
`
`5
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 10 of 95
`
`Petitioner's Exhibit 1021
`Page 10 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`and data systems including Methods of Easily verifiable Control Design ,
`
`(American Society of Mechanical Engineers) Dynamic Systems and Controls
`
`at American Control Conference, and ASME
`
`conferences.
`
`11.
`
`I have supervised/mentored 119 graduate and undergraduate students,
`
`including 28 PhD, 63 MS and 28 BS students in Mechanical Engineering and
`
`Electrical Engineering Departments in four academic institutions during 2010-
`
`2020. These mentorships have been in the area of modeling, experimental studies
`
`(including instrumentation, CAN setup), and control of automotive, HVAC, and
`
`energy systems.
`
`12. My current research activity at the University of Alberta and Michigan Tech
`
`University focuses on increasing efficiency of energy systems through utilization
`
`of advanced modeling, control, and network communication techniques, focusing
`
`on the transportation and building sectors.
`
`13.
`
`I am Associate editor (2017- ) for ASME Journal of Dynamic Systems,
`
`Measurement, and Controls and also Guest editor (2017- ), and Associate Editor
`
`(2014- 2020) for International Journal of Powertrains (Inderscience).
`
`14.
`
`National Science Foundation (NSF) review panels in the areas of controls and
`
`6
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 11 of 95
`
`Petitioner's Exhibit 1021
`Page 11 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`energy systems in the past seven years. I have also been reviewer for (i)
`
`international grant proposals from funding agencies from Croatia, France,
`
`Germany, Poland, and the Netherlands, (ii) US Academy of Engineering for the
`
`Research Program of the US DRIVE Partnership, (iii) 24 international journals
`
`mostly in the area of controls and energy systems, (iv) Springer International
`
`Publishing for books in the area of controls and automotive systems.
`
`15.
`
`I am an active member of ASME Dynamic Systems & Control Division
`
`(DSCD), serving as vice-chair of the Automotive Transportation Systems (ATS)
`
`technical committee (181 international members), the chair (2018-2020) of the
`
`Energy Systems (ES) technical committee (141 international members) and,
`
`chairing (30 sessions) and co-organizing sessions (> 60 sessions) in the areas of
`
`modeling, fault diagnosis, and control of automotive systems, and energy/HVAC
`
`systems in American Control Conference, SAE World Congress, and ASME
`
`Dynamic Systems Control Conferences.
`
`16.
`
`I have won the following awards for my work relating to modeling and
`
`control of automotive systems:
`
`Awarded over $2.1M grants/support as a Principle Investigator (PI) and
`
`over $6.6M as a co-PI from international, federal, provincial, and industry
`
`sources for conducting research in the areas of modeling, design, and
`
`7
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 12 of 95
`
`Petitioner's Exhibit 1021
`Page 12 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`implementation of novel control systems for automotive systems, HVAC
`
`and energy systems.
`
`Society of Automotive Engineers (SAE) International Ralph R. Teetor
`
`Best Paper Award, ASME Automotive and Transportation Systems
`
`Technical Committee ASME Dynamic Systems Control Conference,
`
`2015.
`
`Best Paper Award, ASME Automotive and Transportation Systems
`
`Technical Committee ASME Dynamic Systems Control Conference,
`
`2012.
`
`Best Presentation in the Session, American Control Conference (ACC),
`
`2012, 2015, 2016.
`
`Best Presentation Award, SAE Int. Powertrain, Fuels & Lubricants
`
`Conference, Baltimore, MD, USA, 2016.
`
`Canada National Sciences and Engineering Research Council (NSERC)
`
`Postdoctoral Fellowship (for research in the area of automotive controls),
`
`2010 - 2012.
`
`8
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 13 of 95
`
`Petitioner's Exhibit 1021
`Page 13 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Andrew Stewart Memorial Graduate Prize, University of Alberta, 2009.
`
`David Morris Graduate Scholarship in Automotive Engineering,
`
`University of Alberta, 2008.
`
`Lehigh Inland Cement Graduate Scholarship in Environmental Studies,
`
`University of Alberta, 2007.
`
`Winning Team (first prize) of a Total of 66 Research Teams from 26
`
`Canadian Universities, Canada Automotive21 High Qualified Personnel
`
`Competition, Windsor, Canada, June 11-13, 2007.
`
`Chevron Graduate Scholarship in Natural Gas Engineering, University of
`
`Alberta, 2005.
`
`17. My curriculum vitae has been submitted as Exhibit 2009 to this proceeding.
`
`My publications are found at
`
`https://sites.ualberta.ca/~mahdi/Shahbakhti_Publications.html. This includes 171
`
`peer-reviewed publications. These research publications have been recognized and
`
`cited over 2400 times from over 45 different countries (Source: Google Scholar).
`
`III. PERSON HAVING ORDINARY SKILL IN THE ART
`
`18.
`
`It is my understanding that when considering the claims of the 505 patent
`
`and the prior art, I am required to do so based on the perspective of one of ordinary
`
`skill in the art at the relevant effective filing date, which I understand is April 30,
`
`2007.
`
`9
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 14 of 95
`
`Petitioner's Exhibit 1021
`Page 14 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`I understand that the Board has provided guidance that a person of ordinary
`
`19.
`
`coursework or post-
`
`years of work experience in the design, operation, and functioning of CAN
`
`10, 7.
`
`20.
`
`I have adopted this proposed level of skill in the art in formulating my
`
`opinions. Given my background and experience listed in Section II above, I
`
`consider myself as having met this skill level.
`
`IV. CLAIM CONSTRUCTION
`A.
`"data bus"
`
`21.
`
`The Petition
`
`is used in IP-based networks and refers to a network in
`
`which packets sent between every pair of subnets pass through subnets of the same
`
`network.
`
`continuing,
`
`data bus as a
`
`Leale Tr. 17:2. In my opinion, referring to a vehicle
`
` network
`
`22. CAN was standardized by the International Standard Organization in in
`
`International Standard ISO 11898-
`
`es Controller area network
`
`10
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 15 of 95
`
`Petitioner's Exhibit 1021
`Page 15 of 95
`
`
`
`(CAN)
`
`ISO-11898 defines certain terms. In chapter 4,
`
`Case IPR2020-00147
`Patent 10,027,505
`. Ex. 2002
`-
`
`passive
`
`, the use of the
`
`505
`
`ISO 11898-1.
`
`a communication network, where all nodes are reached by passive links which
`
`allow transmission in both directions.
`
`B.
`
`23. Negley Figure 8 provides an overview of receiving CAN messages. The
`
`Petitioner understands
`
`messages, and the act of
`
`differentiate nodes.
`
`Consequently, all nodes on a CAN bus receive all
`
`24. A PHOSITA would understand a message to be received when it has passed
`
`the Message Filters/Masks block and is accepted
`
`Receive
`
`so that a microcontroller can now act on the received message.
`
`11
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 16 of 95
`
`Petitioner's Exhibit 1021
`Page 16 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`The 505
`
`1101
`
`11:43, 12:16). This indicates
`
`1101,
`
`programming. In case of a CAN bus, this includes setting appropriate message
`
`filters/
`
`patent a POSITA would
`
`505
`
`BACKGROUND: HACKING VEHICLE NETWORKS
`V.
`25. Currie describes the CAN bus architecture as follows:
`
`systems is the Controller Area Network bus, or CAN bus.
`The CAN bus is a single, centralized network bus on
`
`12
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 17 of 95
`
`Petitioner's Exhibit 1021
`Page 17 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
` The
`CAN bus carries everything from operator commands
`
`to readouts from sensors reporting engine temperature or
`tire pressure. The advent of the CAN bus brought about
`improvements in efficiency and a reduction in
`complexity while also reducing wiring costs.
`
`Currie, 6. I find that to be an accurate description.
`
`Development of the CAN bus protocol was begun in
`1983 by German company Robert Bosch GmbH. After
`three years of development, CAN bus technology hit the
`public market in 1986, first showing up in the BMW 850.
`
`Currie, 9.
`
`efficiently supports distributed r
`
`Bosch, 4. The characterization of CAN as being secure, however, is simply not
`
`correct with respect to spoofing. CAN is inherently insecure:
`
`The CAN bus is a 30-year old architecture that was
`developed for various valid reasons, but security
`certainly was not one of them. Automakers at the time
`could not possibly envision the risk of cars being hacked
`decades into the future, nor could the governing bodies
`that mandated the CAN and OBD standards. The CAN
`architecture was designed to be lightweight and robust,
`
`13
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 18 of 95
`
`Petitioner's Exhibit 1021
`Page 18 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`and those qualities it accomplishes very well. However,
`CAN contains numerous vulnerabilities that are inherent
`in its design.
`
`Currie, 10.
`
`26.
`
`Today, spoofing of CAN messages is a recognized technique to retrofit cars
`
`and is widely used.
`
`Spoofing a CAN identifier means that a compromised
`
`node attempts to use an identifier that it is not allowed to
`
`send, see Figure 1. This can be useful to pretend to be
`
`another node.
`
`Ex. 2012, 2.
`
`a message with
`
`the same identifier as another message . Leale Tr. 26:13-14. Spoofing of CAN
`
`messages would have worked in the first BMW with CAN in 1986. Notably
`
`though, none of references cited in the Petition explains spoofing or shows any
`
`example of spoofing. Neither Munoz nor Dietz nor any of Negley, SAE, or Bosch
`
`mention i) a message using an identifier that it is not allowed to use or ii) a
`
`message using the same identifier as another message. General familiarity with a
`
`14
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 19 of 95
`
`Petitioner's Exhibit 1021
`Page 19 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`CAN bus does not enable a POSITA to spoof CAN messages. Spoofing involves
`
`sending a message with the same identifier as another message. See Leale Tr.
`
`26:13-14. That is, a node uses an identifier that it is not allowed to send. See Ex.
`
`2012,2.
`
`27. While spoofing of CAN messages is an effective technique by which an
`
`owner can retrofit an existing vehicle, it can also be abused to attack vehicles of
`
`others. Car manufacturers have recognized this threat and actively attempted to
`
`conceal it:
`
`Manufacturers are floundering when it comes to locking
`
`yet others using litigation as a means to silence security
`researchers and keep vulnerabilities under wraps. In one
`recent case, Volkswagen engaged a team of European
`security researchers in a 2-year long legal battle to
`prevent the group from presenting its research paper on a
`
`keyless entry system (Cimpanu, 2015).
`
`Currie, 3-4.
`
`VI. THE MUNOZ REFERENCE
`
`28.
`
`In my opinion, the Munoz patent is not properly drafted and violates basic
`
`rules of technical writing.
`
`-
`
`as including
`
`15
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 20 of 95
`
`Petitioner's Exhibit 1021
`Page 20 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`but not limited to CAN-bus, LIN-bus, FlexRay, or other such automobile network
`
`Munoz, 6:22-25. This self-referencing and expanding a definition make
`
`it impossible to
`
`-
`
`-
`
`defined by Bosch or to another serial data bus. A LIN-bus is not a CAN-bus,
`
`neither is FlexRay a CAN-bus.
`
`29. Munoz routinely refers to the same element by different names and refers to
`
`different elements by the same or confusingly similar names. For example, Fig. 3
`
`signal
`
`we receive another lock/unlock message
`
`explained in the specificat
`
`the specification how data can
`
`without any further reference in
`
`entails.
`
`VII. A PERSON OF ORDINARY SKILL IN THE ART WOULD HAVE
`UNDERSTOOD THAT MUNOZ DOES NOT DISCLOSE SPOOFING
`OF CAN MESSAGES.
`
`30. Munoz discloses an aftermarket automobile device that is seamlessly
`
`integrable to factory automobile networks such as CAN-bus and its ECU systems
`
`and allows multiple convenience and performance enhancements to be controlled
`
`through factory controls and displayed on factory displays. Munoz, 3:7-12.
`
`16
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 21 of 95
`
`Petitioner's Exhibit 1021
`Page 21 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`31. Munoz discloses the operation of several high-level features. Those include
`
`a convertible top control mechanism (FIG. 3), a horn upon lock/unlock feature
`
`(FIG. 4), a vehicle's horn while reversing feature (FIG. 5), a module's emergency
`
`flasher mode (FIG. 6) and a blind spot assistant system (FIG. 7). While Munoz
`
`discloses these high-level features, Munoz fails to teach the lower level details how
`
`these features are implemented in a vehicle.
`
`32. Munoz mentions a feature for vehicles that only allow the cabriolet top to be
`
`opened or closed when the vehicle is moving slowly. In that case, his device
`
`increases the maximum speed of the vehicle at which the cabriolet top may be
`
`opened or closed . Munoz, 3:62-64. Compared to the features discussed above,
`
`Munoz provides even fewer details as to how
`
`is implemented. For example, there is no hardware schematic or flowchart to
`
`explain implementation of
`
`. The schematic in
`
`Fig.1 is a very basic illustration that fails to show critical elements of the claims.
`
`For example, Fig. 1 does not show the factory cabriolet top open/close button
`
`recited in claim 1 (Munoz, 8:37-38) and claim 15 (Munoz, 10:9-10). Neither does
`
`Fig. 1 show the remote keyless entry system recited in claim 1 (Munoz, 35-36) and
`
`claim 15 (Munoz, 10:6-7).
`
`17
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 22 of 95
`
`Petitioner's Exhibit 1021
`Page 22 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`In my opinion, a POSITA having studied Munoz and being familiar with the
`
`33.
`
`operation of a CAN bus as disclosed in Bosch, Negley and SAE would not have
`
`34. Munoz
`
`r
`
`, box 100. But
`
`Munoz does not explain how data can be removed. A CAN bus does not provide
`
`any mechanism
`
`. Nor would a POSITA expect that removing
`
`data from a CAN bus causes a convertible roof to open. Elend and Adamson
`
`describe a possible tampering attack on a CAN bus in paragraph 2.2 of their paper:
`
`Ex. 2012, 2.
`
`gives the attacker the power to
`
`tamper with the messages that are being sent on the bus.
`
` 2.
`
`with a message means altering the message. In my opinion, a POSITA would have
`
`en integrated and
`
`attempt which
`
`adjusts a message that another node is currently sending on the bus as described by
`
`18
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 23 of 95
`
`Petitioner's Exhibit 1021
`Page 23 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Elend and Adamsom. The tampering attempt
`
` Spoofing can be accomplished by retransmitting, from a
`
`retrofit device, the exact same message that a factory installed device sends.
`
`Spoofing a message does not require any removing or altering of data. See Ex.
`
`2012, 2. None of SAE, Bosch or Negley
`
`on a
`
`CAN bus.
`
`35. A POSITA would not
`
`505 patent.
`
`Munoz lacks disclosure of the lower level implementation of his features. This lack
`
`of disclosure does not lead a POSITA to the spoofing of normal mode CAN
`
`messages as described and claimed
`
`505 patent.
`
`36.
`
`reviewed additional material not considered in the petition. This includes a
`
`-
`
`https://youtu.be/9PYK9j3FFx4. Ex. 2030.
`
`19
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 24 of 95
`
`Petitioner's Exhibit 1021
`Page 24 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Volkswagen vehicle. I will refer to this video as "the Vario Plus video".
`
`37.
`
`The Vario Plus video shows clear correlations to the Munoz patent as
`
`illustrated below.
`
`Munoz
`
`the Vario Plus video
`
`20
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 25 of 95
`
`Petitioner's Exhibit 1021
`Page 25 of 95
`
`
`
`Fig. 2
`
`Video @ 0:46
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Fig. 3
`
`Video @ 1:11
`
`Video @ 1:12
`
`Video @ 3:00
`
`21
`
`illustrates the operation of the
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 26 of 95
`
`Petitioner's Exhibit 1021
`Page 26 of 95
`
`
`
`vehicle's horn while reversing
`
`-29).
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Fig. 5
`
`Video @3:03
`
`Fig. 5
`
`Video @3:06
`
`38. Given the apparent similarities between Munoz and the Vario Plus video it is
`
`my opinion that the two are related. My opinion is further supported by the fact
`
`that a trademark for the word
`
`was
`
`22
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 27 of 95
`
`Petitioner's Exhibit 1021
`Page 27 of 95
`
`
`
`No. 77-198,481, Reg. No. 3,388,116. (Ex. 2029).
`
`39.
`
`Case IPR2020-00147
`Patent 10,027,505
`
`-5-2007, Ser.
`
`ULE SETUP
`
`-c-t.com EOS VARIO PLUS ROOF
`
`23
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 28 of 95
`
`Petitioner's Exhibit 1021
`Page 28 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`The EOS roof module video also shows a clear correlation to Munoz as
`
`40.
`
`illustrated below:
`
`Munoz
`
`Fig. 1
`
`the EOS roof module video
`
`Video @0:19
`
`Fig. 3
`
`Video @0:21
`
`24
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 29 of 95
`
`Petitioner's Exhibit 1021
`Page 29 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`illustrates the operation of the
`
`Video @0:35
`
`25
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 30 of 95
`
`Petitioner's Exhibit 1021
`Page 30 of 95
`
`
`
`vehicle's horn while reversing
`
`-29).
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Fig. 5
`
`Fig. 5
`
`Video @ 0:42
`
`26
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 31 of 95
`
`Petitioner's Exhibit 1021
`Page 31 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Fig. 3
`
`Video @0:52
`
`Fig. 3
`
`Video @0:46
`
`27
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 32 of 95
`
`Petitioner's Exhibit 1021
`Page 32 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`In my opinion, the EOS roof module video shows
`
`control module 100 in operation.
`
`41.
`
`-
`
`-c-t.com eos roof module and
`
`Roof
`
`28
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 33 of 95
`
`Petitioner's Exhibit 1021
`Page 33 of 95
`
`
`
`Opening V
`
`Case IPR2020-00147
`Patent 10,027,505
`
`42.
`
`The Roof Opening Video shows a VW EOS convertible vehicle opening its
`
`convertible roof while driving:
`
`0.19: Roof closed
`
`0:31: Roof in
`
`0.39: Roof in open
`
`intermediate position
`
`position
`
`29
`
`Sucxess LLC Exhibit 2028
`Dataspeed Inc. v. Sucxess LLC IPR 2020-00147
`Page 34 of 95
`
`Petitioner's Exhibit 1021
`Page 34 of 95
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`In my opinion, the Vario Plus Video, the EOS roof module video and the
`
`43.
`
`Roof Opening Video, all of which were published by the same YouTube user,
`
`show examples
`
`44. Neither the Munoz patent, nor the videos provide sufficient details to enable
`
`a POSITA, in particular an inexperienced engineer or a technician without
`
`engineering degree, to practice what Munoz describes.
`
`45.
`
`To understand how Munoz may have been able to open the roof of a VW
`
`Eos while driving, I obtained and reviewed a VW Service Training document titled
`
`available online at https://erwin.vw.co
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
