`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`
`Petitioner,
`
`v.
`
`SUCXESS, INC.,
`
`Patent Owner.
`
`_______________
`
`Case IPR2020-00116
`U.S. Patent No. 9,871,671
`____________
`
`
`
`
`PETITIONER’S REPLY
`
`
`
`TABLE OF CONTENTS
`
`
`
`I.
`II.
`
`B.
`
`C.
`
`INTRODUCTION ........................................................................................... 1
`PATENT OWNER’S RESPONSE THEORY FAILS TO FULLY
`CONSIDER MUNOZ, AND DIRECTLY CONTRADICTS MANY OF
`MUNOZ’S EXPRESS TEACHINGS ............................................................. 2
`A.
`Patent Owner’s Discussion of Various Convertible Cars Is
`Irrelevant to Munoz’s Teachings........................................................... 4
`Patent Owner Interprets Munoz in a Manner Contrary to
`Munoz’s Own Teachings ...................................................................... 5
`Patent Owner’s Own Statements Confirm that Munoz Teaches
`Spoofing ................................................................................................ 7
`Patent Owner’s “Diagnostic Message” Theory is Not Supported
`by Munoz ............................................................................................... 8
`E. Munoz Teaches Gateway Functions Performed by Roof Control
`Module, and Taube is Consistent with Munoz...................................... 9
`III. THE CHALLENGED CLAIMS ARE UNPATENTABLE WHEN THE
`PRIOR ART TEACHINGS ARE CONSIDERED IN FULL, AS
`REQUIRED UNDER THE LAW .................................................................11
`A. Munoz Teaches A Retrofit Device Architecture That
`Terminates The Original Data Connection, Interfaces With Two
`Separate Buses, and Routes All Communications Through The
`Retrofit Device ....................................................................................12
`Petitioner Interprets Munoz as a POSITA Would—Consistently
`with Munoz’s Own Teachings ............................................................15
`C. Munoz’s Figs. 3-7 Do Not Refute Petitioner’s Interpretation of
`Munoz ..................................................................................................24
`D. Munoz’s Claims Support Petitioner, Not Patent Owner .....................25
`
`D.
`
`B.
`
`- i -
`
`
`
`E.
`
`Claims 16-18 Are Rendered Obvious by Munoz alone or in
`view of Negley, SAE and Bosch, further in view of Lobaza ..............25
`IV. CONCLUSION ..............................................................................................25
`
`
`
`
`
`
`- ii -
`
`
`
`TABLE OF AUTHORITIES
`
`Cases
`Graham v. John Deere Co.,
`383 U.S. 1 (1966) ............................................................................................. 5
`In re Heck,
`699 F.2d 1331 (Fed. Cir. 1983) .................................................................1, 25
`Merck & Co., Inc. v. Biocraft Labs., Inc.,
`874 F.2d 804 (Fed. Cir. 1989) ......................................................................... 1
`Ormco Corp. v. Align Technology, Inc.,
`463 F.3d 1299 (Fed. Cir. 2006) .....................................................................10
`Polaris Indus., Inc. v. Arctic Cat, Inc.,
`882 F.3d 1056 (Fed. Cir. 2018) ....................................................................... 9
`
`
`
`
`
`
`- iii -
`
`
`
`Exhibit
`Number
`1001
`
`1002
`
`1003
`
`1004
`
`1005
`
`1006
`
`1007
`
`1008
`
`1009
`
`1010
`
`1011
`
`1012
`
`1013
`
`PATENT OWNER’S LIST OF EXHIBITS
`
`
`Exhibit Description
`
`U.S. Patent No. 9,871,671 (the ’671 patent, or “Nix”)
`
`Prosecution History of U.S. Patent No. 9,871,671
`
`Declaration of Robert Leale (“Leale”)
`
`U.S. Patent No. 7,737,831 to Munoz (“Munoz”)
`
`Installation Manual For A Multimedia Interface 1280
`(“Dietz”)
`
`“Getting Control Through CAN,” Sensors, October 2000, Vol.
`17, #10 (“Negley”)
`
`Annotated Version of Munoz (Ex. 1004), Fig. 1
`
`Annotated Version of U.S. Patent No. 9,871,671 (Ex. 1001),
`Fig. 4
`
`SAE Technical Paper Series, 930005, “A Gateway For CAN
`Specification 2.0 Non-Passive Devices,” by Szydlowski
`(“SAE”)
`
`Robert Bosch GbmH, “CAN Specification, Version 2.0”
`(“Bosch”)
`
`Johansson, Vehicle Applications Of Controller Area Network,
`Handbook of Networked and Embedded Control Systems,
`2005, pages 741-765 (“Johansson”)
`
`Dietz Invoice dated October 21, 2005 to Perzan Auto Radio,
`Inc., 6409 Market Street, Upper Darby PA 19082 for Order
`No. 101505
`
`Archived Version of Ex. 1005 (“Dietz”), Archived on March
`16, 2005, Retrieved from Internet Archive
`
`- iv -
`
`
`
`Exhibit
`Number
`
`1014
`
`1015
`
`1016
`
`1017
`
`Exhibit Description
`
`(https://web.archive.org/web/20050316204956/http://www.tm-
`techmark.com/touareg/PDFfiles/1280anl.pdf)
`
`U.S. Patent No. 6,812,832 to Lobaza et al. (“Lobaza”)
`
`Taube, Comparison of CAN Gateway Module For Automotive
`And Industrial Control Apparatus, CAN In Automation 2005
`
`Annotated Version of Dietz’s Illustration
`
`Curriculum Vitae of Robert Leale
`
`1018-1019
`
`Reserved
`
`1020
`
`1021
`
`1022
`
`
`Deposition Transcript of Mahdi Shahbakhti, Ph.D.
`
`Expert Declaration of Mahdi Shahbakhti, Ph.D. in IPR2020-
`00147
`
`Reserved
`
`- v -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Petitioner Dataspeed, Inc. (“Dataspeed” or “Petitioner”) files this Reply to
`
`Patent Owner Sucxess LLC’s Response (“POR”) to Dataspeed’s Petition for inter
`
`partes review against U.S. Patent No. 9,871,671 (the “’671 Patent”).
`
`Accompanying the Reply is the Deposition Transcript of Patent Owner’s expert,
`
`Dr. Shahbakhti (Ex. 1020). Additionally, to ensure a complete record, and because
`
`Dr. Shahbakhti’s deposition covered both the ’671 Patent and U.S. Patent No.
`
`10,027,505 from IPR2020-00147, Petitioner is also submitting Dr. Shahbakhti’s
`
`Declaration from IPR2020-00147 (Ex. 1021).
`
`I.
`
`INTRODUCTION
`It is axiomatic in an obviousness challenge that a reference should be
`
`considered for all it teaches. In re Heck, 699 F.2d 1331, 1332-33 (Fed. Cir. 1983);
`
`Merck & Co., Inc. v. Biocraft Labs., Inc., 874 F.2d 804, 807 (Fed. Cir. 1989).
`
`Ignoring this tenet, Patent Owner plucks Munoz’s Roof Control Module 100 out of
`
`the automobile disclosed in Munoz, and fabricates an alternative way to implement
`
`this module using a “diagnostic message” in various other automobiles. In
`
`particular, while Munoz discloses the retrofit device installed in an automobile
`
`with roof controls located in the dashboard, Patent Owner bases its Response on
`
`how a retrofit device could have been implemented in automobiles having roof
`
`controls that are directly connected to Roof Control Electronics.
`
`- 1 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`But Patent Owner’s approach is legally erroneous, and fails to consider
`
`Munoz for everything it teaches. Determining how a retrofit device could have
`
`been commercially implemented in other vehicles is a different question than
`
`determining whether the ’671 Patent claims are obvious in view of Munoz,
`
`including the specific automobile disclosed in Munoz. In other words, the proper
`
`question is whether the ’671 Patent claims are obvious over Munoz’s teachings,
`
`not over any of Alex Munoz’s subsequent commercial implementations dealing
`
`with different vehicles and their particular control configurations.
`
`Evaluated correctly, the challenged claims of the ’671 Patent are obvious
`
`over Munoz, either alone or in combination with the other asserted prior art.
`
`II. PATENT OWNER’S RESPONSE THEORY FAILS TO FULLY
`CONSIDER MUNOZ, AND DIRECTLY CONTRADICTS MANY OF
`MUNOZ’S EXPRESS TEACHINGS
`Patent Owner initially addresses what it refers to as “three critical elements”
`
`allegedly absent from the asserted prior art. First, Patent Owner says that “none of
`
`the prior art shows any first (original) message that is being spoofed.” POR, 2.
`
`Second, Patent Owner claims that “the prior art does not teach a second (spoofed)
`
`message that is indistinguishable from the first message, mimics the first message,
`
`or has the same identifier as the first message.” Id. Third, Patent Owner argues
`
`that “neither Munoz or Dietz, alone or in combination with Negley, SAE, and
`
`- 2 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Bosch (the ‘Cited References’), teaches splitting an existing CAN bus to establish
`
`‘a second data bus.’” Id.
`
`Patent Owner expands these three points into seven enumerated “differences
`
`between Munoz and the ’671 Patent” addressed with respect to an annotated
`
`version of Munoz’s Fig. 1. POR, 33-34. Those alleged differences are based on
`
`Patent Owner’s self-serving presumption that “Munoz must have been
`
`implemented as shown” below.
`
`
`
`POR, 35; Ex. 2028, ¶51. Patent Owner’s presumption is wrong and legally
`
`irrelevant to the question posed to the Board. Further, Patent Owner’s
`
`interpretation of Munoz’s implementation directly contradicts multiple express
`
`disclosures in Munoz itself.
`
`- 3 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`A. Patent Owner’s Discussion of Various Convertible Cars Is
`Irrelevant to Munoz’s Teachings
`Patent Owner’s Response is non-responsive to the Petition when it bases its
`
`arguments on what Patent Owner believes would be a commercial implementation
`
`of Alex Munoz’s retrofit product into a VW Eos, rather than Munoz itself. POR,
`
`35; id., 38 (arguing that “Munoz demonstrated his invention in a VW Eos in which
`
`the roof buttons are part of the original roof electronics 110.”); see also Ex. 2028,
`
`¶60 (“[I]t is my opinion that Munoz’s invention had been demonstrated in a VW
`
`Eos. My further analysis is therefore based on that vehicle.”).
`
`Critically, in Munoz, the “vehicle factory dashboard electronics and controls
`
`that are used to control Roof Control Electronics 110” are located in the
`
`automobile’s original dashboard 105. Munoz, 6:26-31. As a result, control signals
`
`to control Roof Control Electronics 110 are sent over Munoz’s CAN bus before the
`
`retrofit, and through Roof Control Module 100 and two separate CAN buses after
`
`the retrofit. But in the automobile that Patent Owner evaluates, Patent Owner
`
`claims that the factory cabriolet top open/close buttons “are part of original
`
`electronics and actuators to operate factory installed roof 110.” POR, 36.
`
`Inserting Munoz’s device into a differently-configured automobile is a
`
`diversion from, and irrelevant to, the legal determination of obviousness based on
`
`Munoz’s teachings. Nothing in the Graham factors requires (or even permits) a
`
`POSITA to seek out later-developed commercial implementations of disclosed
`
`- 4 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`technology, and then view the prior art patent solely through the lens of those
`
`subsequent commercial implementations. See, e.g., POR, 32 (reciting the factors
`
`of obviousness according to Graham v. John Deere Co., 383 U.S. 1, 17-18
`
`(1966)). Yet this is exactly the legal error that Patent Owner invites here.
`
`Moreover, Patent Owner’s expert was unable to answer a simple question
`
`related to Munoz’s disclosure: whether inventor Alex Munoz was aware of the
`
`VW Eos wiring configuration when Munoz’s patent application was filed with the
`
`USPTO. Ex. 1020, 91:14-92:2. There is no record evidence that would establish
`
`that the Munoz reference was intended to be identical in disclosure to any later-
`
`developed commercial implementation of that technology. As such, Patent
`
`Owner’s evaluation of the commercial implementation has no bearing on how a
`
`POSITA would have interpretated the Munoz reference.
`
`B.
`
`Patent Owner Interprets Munoz in a Manner Contrary to
`Munoz’s Own Teachings
`Based on what Patent Owner contends is a commercial implementation of
`
`Munoz’s technology, Patent Owner repeatedly and incorrectly interprets Munoz in
`
`a manner that is inconsistent with many of Munoz’s express disclosures:
`
`(1) Rather than having an “original data connection [that] will be
`
`terminated,” as expressly taught in Munoz’s Fig. 1, block 115, Patent Owner
`
`presumes without evidence that Munoz’s original data connection is maintained
`
`via an “Internal Connection” or “passthrough” in Munoz’s retrofit. POR, 35-36.
`
`- 5 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`There is no disclosure of any “Internal Connection” or “passthrough” in Munoz’s
`
`Roof Control Module 100 or device 200.
`
`(2) Rather than acknowledging Munoz’s express disclosure of “a first
`
`CAN-bus” and “a second CAN-bus,” see, e.g., Munoz, 6:37-40, Fig. 2, Patent
`
`Owner makes the incorrect assertion that Munoz teaches only a single CAN-bus,
`
`and dashboard 105 and Roof Control Electronics 110 are connected via that single
`
`CAN even after the retrofit is installed. POR, 35-36; Ex. 2028, ¶83.
`
`(3) Rather than having the capability for “removing or altering data
`
`exchanged,” see, e.g., Munoz, Fig. 1, block 100, Patent Owner contends that
`
`Munoz has no ability to remove CAN-bus frames or alter CAN-bus frames,
`
`contrary to Munoz’s express teaching. POR, 20 (“A CAN bus does not provide
`
`any mechanism for ‘removing’ data.”); Ex. 1020, 94:4-11.
`
`(4) Rather than having an original dashboard 105 with “vehicle factory
`
`dashboard electronics and controls that are used to control Roof Control
`
`Electronics 110,” see, e.g., Munoz, 6:28-30, Patent Owner claims that the factory
`
`cabriolet top open/close buttons “are part of original electronics and actuators to
`
`operate factory installed roof 110.” POR, 36.
`
`(5) Rather than having “all communication” “go through the roof control
`
`module [100],” see, e.g., Munoz, Fig. 1, block 115, including communications
`
`from the controls in dashboard 105 to the Roof Control Electronics 110, Patent
`
`- 6 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Owner claims that there is no first message sent from dashboard 105 to control
`
`Roof Control Electronics 110. POR, 36.
`
`(6) Rather than having a “switch 120” between separate CAN buses as
`
`shown in Munoz, see, e.g., Munoz, 6:32-36, Fig. 1, Patent Owner’s expert claims
`
`to be confused about this disclosure and doubts whether switch 120 actually exists.
`
`Ex. 2028, ¶84; Ex. 1020, 60:18-61:8 (“I truly believe that this is a virtual switch.”).
`
`Rather than crediting all of Munoz’s teachings, Patent Owner instead
`
`chooses to ignore these disclosures while developing its alternative theory about
`
`how Munoz’s technology was implemented in the VW Eos. This failure to
`
`consider Munoz for all it teaches confirms that Patent Owner’s theory is baseless
`
`and cannot be correct.
`
`C. Patent Owner’s Own Statements Confirm that Munoz Teaches
`Spoofing
`Patent Owner also argues that none of the references asserted by Petitioner
`
`expressly use the term “spoofing.” But neither do the challenged claims. Further,
`
`Patent Owner’s own statements confirm that Munoz is performing spoofing.
`
`Among the most telling statements in the Response is Patent Owner’s admission
`
`that “separating an existing vehicle bus into two buses would only be necessary if
`
`there was a need to spoof a periodic message.” POR, 39; see also id., 49 (“The
`
`only reason why a POSITA might consider separating an existing CAN bus into
`
`two separate buses is to spoof a periodic message … .”) (emphasis added).
`
`- 7 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`But separating the integrated CAN bus into two separate buses is exactly
`
`what Munoz discloses in Fig. 1, element 115, and Fig. 2. See also Munoz, 6:37-
`
`40 (disclosing a first and a second CAN bus interfacing with Module 200). And it
`
`is clear from Munoz and Patent Owner’s admissions (POR, 39, 49) that Munoz is
`
`separating the existing CAN bus into two separate buses precisely because Munoz
`
`is spoofing CAN messages.
`
`Finally, Patent Owner’s search for the term “spoofing” is a diversion.
`
`Patent Owner and its expert never go so far as to allege that Patent Owner
`
`“invented” spoofing, Patent Owner characterizes CAN buses as “inherently
`
`insecure,” (POR, 13), and Dr. Shahbakhti even concedes that automotive
`
`manufacturers were aware of the dangers of spoofing for some time and tried to
`
`hide that concern from the public. Ex. 2028, ¶30.1
`
`D. Patent Owner’s “Diagnostic Message” Theory is Not Supported
`by Munoz
`Patent Owner’s “diagnostic message” theory is also wrong in the context of
`
`Munoz. Munoz does not disclose adding new messages to the CAN bus to
`
`perform the retrofit’s roof control module functions—it discloses altering or
`
`removing data. See Munoz, Fig. 1 (100). Patent Owner cannot explain this
`
`
`1 At deposition, Dr. Shahbakhti could not say how long automotive manufacturers
`were aware of the dangers of spoofing, i.e. whether this awareness first existed
`before or after the ’671 Patent’s earliest effective filing date. Ex. 1020, 81:22-
`82:17.
`
`- 8 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`disclosure, whereas Petitioner’s interpretation of Munoz fully credits this
`
`disclosure and explains that Munoz achieves additionally functionality by
`
`suppressing CAN bus messages indicating vehicle speed from the dashboard 105
`
`to Roof Control Electronics 110, which may otherwise prohibit roof operation.
`
`Pet., 39-40; Munoz, 3:54-64. Moreover, Patent Owner cannot reconcile its
`
`“diagnostic message” theory with Munoz’s disclosure that the controls for the
`
`Roof Control Electronics 110 are in the dashboard 105.
`
`E. Munoz Teaches Gateway Functions Performed by Roof Control
`Module, and Taube is Consistent with Munoz
`Patent Owner argues that Taube teaches away from using a Gateway in
`
`Munoz. POR, 63; Ex. 2028, ¶121. This is factually and legally wrong. As
`
`argued in the Petition, a POSITA would understand that Munoz discloses the Roof
`
`Control Module acting as a gateway. Pet., 39-40; Ex. 1003, ¶¶74-85, 134-38,
`
`195-96. Patent Owner fails to rebut that Munoz’s disclosure—that the Roof
`
`Control Module has the ability to “alter[]” and “remov[e]” data—teaches the Roof
`
`Control Module acting as a gateway.
`
`Instead, Patent Owner argues that somehow a POSITA would have read
`
`Taube and therefore concluded that gateways are to be avoided in Munoz’s
`
`system. POR, 63. This is not a proper application of the law on teaching away as
`
`instructed by the Federal Circuit. See Polaris Indus., Inc. v. Arctic Cat, Inc., 882
`
`F.3d 1056, 1069 (Fed. Cir. 2018). First, Taube compares different types of
`
`- 9 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`gateways, including their respective advantages. Ex. 1015, 1, 4, 5, 7. Nowhere
`
`does Taube teach away from the use of gateways to perform gateway functions.
`
`Even Dr. Shahbakhti in deposition acknowledged that gateways are “useful” and
`
`can serve to interface between two networks, just as shown in Munoz’s Fig. 1 and
`
`Fig. 2. See Ex. 1020, 16:14-18 (“gateways are useful devices and it should be
`
`used whenever the needs is appropriate and the amount of efforts will make
`
`sense.”), 18:8-18.
`
`Second, even if there were some separate record evidence that discourages
`
`use of gateways, that evidence would only be relevant to a proposed modification
`
`to add a gateway to Munoz. Ormco Corp. v. Align Technology, Inc., 463 F.3d
`
`1299 (Fed. Cir. 2006) (explaining that teaching away may negate a motivation to
`
`modify a reference). Here, Munoz already discloses using a gateway that
`
`interfaces with separate CAN buses and is not being modified to add a gateway.
`
`Indeed, Patent Owner all but admits that Munoz discloses a gateway.
`
`Addressing Munoz’s reference to “removing or altering data” in Fig. 1, box 100,
`
`Patent Owner complains that “Munoz does not explain how data can be removed
`
`or altered,” and concedes that “[a] CAN bus does not provide any mechanism for
`
`‘removing’ data.” POR, 20. This is exactly the point—Munoz discloses that the
`
`Roof Control Module 100 can remove (or alter) data, and even Patent Owner
`
`admits that a CAN bus alone has no mechanism for removing data. For Munoz’s
`
`- 10 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Roof Control Module 100 to perform the disclosed function of removing or
`
`altering data, it has more than just a passthrough, and is also acting as a gateway.
`
`Patent Owner offers to no other credible explanation of how the Roof Control
`
`Module 100 performs this disclosed function, and it is improper to formulate a
`
`theory about Munoz’s structure and operation while specifically ignoring those
`
`disclosures that do not fit Patent Owner’s theory.
`
`As Dr. Shahbakhti conceded at deposition that “[i]f there are two different
`
`buses, it would be a legitimate reason to have a – a gateway between these two
`
`buses.” Ex. 1020, 85:11-13. Munoz discloses two different buses, and a gateway
`
`interfacing with those two buses. There is no legitimate dispute on this point, and
`
`even Taube supports Petitioner’s interpretation of Munoz.
`
`III. THE CHALLENGED CLAIMS ARE UNPATENTABLE WHEN THE
`PRIOR ART TEACHINGS ARE CONSIDERED IN FULL, AS
`REQUIRED UNDER THE LAW
`In the Petition, Petitioner contended “that Munoz alone or in combination
`
`with Negley, SAE, and Bosch teaches the limitations of claims 1-15 and 19.” D.I.,
`
`13 (citing to Pet., 18-41). The Board determined that Petitioner had demonstrated
`
`a reasonable likelihood of success in establishing the unpatentability of claims 1-15
`
`and 19 based on Petitioner’s “sufficient rationale for combining the teachings of
`
`Munoz, Negley, SAE, and Bosch,” (D.I., 14) and limitation-by-limitation analysis
`
`comparing each of the claims against the asserted prior art. D.I., 20-24.
`
`- 11 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Patent Owner’s Response raises no argument as to the motivation for
`
`combining these reference teachings.2 Patent Owner only advances an argument
`
`against Petitioner’s limitation-by-limitation comparison in an unsuccessful attempt
`
`to discredit Petitioner’s challenges. But the Response fails to put any of this
`
`limitation-by-limitation analysis into dispute.
`
`A. Munoz Teaches A Retrofit Device Architecture That Terminates
`The Original Data Connection, Interfaces With Two Separate
`Buses, and Routes All Communications Through The Retrofit
`Device
`As explained in the Petition, Munoz’s Fig. 1 discloses that a vehicle has a
`
`factory-installed first apparatus 110 (Roof Control Electronics) programmed to
`
`communicate with a factory-installed second apparatus 105 (“original dashboard,
`
`internal sensors and electronics”) through vehicle data bus. Pet., 18-19 (“The
`
`original data connection is shown as dotted line ‘C’ in Ex. 1007, the annotated
`
`version of Munoz’s Fig. 1 shown below.”).
`
`
`2 Patent Owner has waived any argument it could have raised against a motivation
`to combine the asserted references. See Paper 13, 8 (“[A]ny arguments not raised
`in the response may be deemed waived.”).
`
`- 12 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`
`
`Id. During installation, the retrofit module 100 is connected to the 2nd factory-
`
`installed apparatus 105 for sending a “first message” via the original CAN bus,
`
`shown above at “A,” and is connected to the 1st factory-installed apparatus 110 by
`
`an added second bus designated “B” above, for providing the “second message.”
`
`Ex. 1003 (hereinafter “Leale”), ¶¶139-45, 154. When open, switch 120 terminates
`
`the connection between the 1st factory-installed apparatus 110 and the 2nd factory-
`
`installed apparatus 105 (Munoz, 6:32-36), thereby teaching the step of electrically
`
`disconnecting the vehicle data bus between a factory-installed first apparatus and a
`
`factory-installed second apparatus. Leale, ¶¶143, 154.
`
`Fig. 2 of Munoz similarly provides a diagram illustrating that Munoz’s
`
`retrofit device 200 “is connected among a first and second vehicle CAN-bus.”
`
`- 13 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Munoz, 5:40-42, 6:37-40.
`
`
`
`Munoz also teaches that because the “original data connection will be
`
`terminated so all communication has to go through the roof control module,” (Fig.
`
`1, box 115) as a part of adding the Roof Control module 100 and its new retrofit
`
`functions, Roof Control Module 100 can “remov[e] or alter[] data … to allow
`
`additional operations normally not available to operate an automatic folding roof or
`
`sunroof.” Fig. 1, 100. Munoz’s teaching of terminating the original data
`
`connection is consistent with Fig. 1, which shows a switch 120 separating the
`
`original data connection between dashboard 105 and Roof Control Electronics 110
`
`(Munoz, 6:32-36), and Fig. 2 of Munoz, which shows the retrofit device 200
`
`connected to two CAN buses via two interfaces.
`
`
`
`- 14 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`B.
`
`Petitioner Interprets Munoz as a POSITA Would—Consistently
`with Munoz’s Own Teachings
`As established by Petitioner, a POSITA would have understood that in
`
`Munoz, there is a “first (original) message that is being spoofed,” POR, 2, “a
`
`second (spoofed) message that is indistinguishable from the first message and
`
`mimics the first message, or has the same identifier as the first message,” Id., and
`
`“an existing CAN bus [is split] to establish ‘a second data bus.’” Id. Unlike Patent
`
`Owner’s interpretation, Petitioner’s understandings do not conflict with the express
`
`teachings of Munoz:
`
`(1) A POSITA would credit Munoz’s express teaching that an “original
`
`data connection will be terminated” and a retrofit Device 200, including Roof
`
`Control Module 100, is inserted with separate interfaces for each of the two
`
`resulting CAN buses. Munoz, Fig. 1, block 115; Fig. 2. Accordingly, Munoz
`
`discloses “splitting an existing CAN bus” contrary to the Response. Cf. POR, 2.
`
`(2) A POSITA would credit Munoz’s express teaching of a retrofit
`
`connected to “a first CAN-bus” and “a second CAN-bus,” see, e.g., Munoz,
`
`6:37-40, Figs. 1-2. As shown in Figs. 1 and 2 of Munoz, the Device 200 (including
`
`Roof Control Module 100) connects to two CAN buses, shown at A and B in Ex.
`
`1007, where each CAN bus is connected to the Device 200 using a respective
`
`interface. Accordingly, Munoz splits an existing CAN bus “to establish ‘a second
`
`data bus,” contrary to the Response. Cf. POR, 2.
`
`- 15 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Confirming this correct interpretation, Patent Owner’s expert conceded
`
`during deposition that Munoz expressly teaches two separate buses. Ex. 1020,
`
`85:14-22; see also Munoz, 6:37-40. Further, he conceded that the device 200
`
`shown in Fig. 2 includes the added retrofit Roof Control Module 100, as Munoz
`
`expressly discloses. Ex. 1020, 90:20-22 (“I expect the POSITA will think that
`
`[Roof Control Module] 100 will be part of the Vario plus control module [200].”),
`
`91:1-5 (“Q. Okay. So you understood that roof control module 100 was part of the
`
`Vario plus control module 200 shown in figure 2, which is connected to two
`
`separate buses, correct? A. Yeah, that is my understanding.”); see also Munoz,
`
`6:30-31 (“100 illustrates that Roof Control Module, which is a portion of the
`
`device [200] devoted to roof or cabriolet top controls.”).
`
`During his deposition, Patent Owner’s expert questioned whether the
`
`separate buses of Munoz’s Fig. 2 might reflect some other buses not expressly
`
`disclosed in Munoz. Ex. 1020, 86:5-12. But this cannot be reconciled with
`
`Munoz’s block 200, which states that the Control Module device “is connected to
`
`the integrated CAN-Network through 2 interfaces.” Munoz, Fig. 2 (200)
`
`(emphasis added). Munoz confirms that there is an integrated CAN network, and a
`
`retrofit Device 200 that includes two interfaces to the two resulting CAN buses.
`
`Patent Owner also overlooks that Munoz shares common architecture with
`
`the ’671 Patent. While discussing the ’671 Patent’s FIG. 7, Patent Owner argues
`
`- 16 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`that “[t]he second data bus is present only because FIG. 7 shows that BUS1 and
`
`BUS2 are wired to separate vehicle data bus interfaces 504, 700.” POR, 8
`
`(emphasis added). Munoz describes this same arrangement, where the retrofit
`
`module 100 is disclosed as having “2 interfaces” and connected to “a first CAN-
`
`bus 210 and a second CAN-bus 205.” Munoz, Fig. 2, 6:37-40.
`
`(3) A POSITA would credit Munoz’s express teaching that the retrofit
`
`device 100 has the capability for “removing or altering data exchanged” between
`
`original CAN-bus nodes, see, e.g., Munoz, Fig. 1, block 100. These disclosures
`
`confirm that Munoz is describing aspects of a CAN-bus gateway internal to Roof
`
`Control Module 100 that connects Munoz’s two separate CAN-buses. A CAN-bus
`
`gateway permits removing CAN-bus frames entirely or altering data within CAN-
`
`bus frames. Pet., 39-40; Ex. 1003, ¶¶134-38, 144, 196, 198-99.
`
`As noted above, Munoz’s block 100 discloses that the retrofit Roof Control
`
`Module 100 can remove or alter data “to allow additional operations normally not
`
`available to operate an automatic folding roof or sunroof.” Munoz, Fig. 1 (100);
`
`see also id., 3:13-18; 3:62-64; 4:15-27; 5:14-20. Under Patent Owner’s theory,
`
`even after this retrofit Roof Control Module 100 is installed, original dashboard
`
`105 and original electronics and actuators 110 are connected to a single, common
`
`bus (POR, 33) and Roof Control Module 100 is not a “gateway,” despite the
`
`undisputed fact that a gateway can connect separate buses as disclosed by Munoz.
`
`- 17 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`Ex. 1020, 17:6-18:3 (discussing Taube’s disclosure of gateway advantages and
`
`functions).
`
`Dr. Shahbakhti goes to great lengths in his Declaration to explain that he
`
`believes “altering” in Munoz is actually referring to the concept of “tampering.”
`
`Ex. 2028, ¶37. Even if Dr. Shahbakhti’s efforts to rewrite Munoz’s “altering”
`
`could be accepted, he never even attempts to explain how Munoz’s Roof Control
`
`Module “remov[es]” data to allow additional operations normally not available to
`
`operate an automatic roof or sunroof. Id. The only explanation supported by the
`
`record evidence—including Munoz and Ex. 1003—is that the Roof Control
`
`Module 100 is a gateway, with separate interfaces connected to a first bus and a
`
`second bus. Patent Owner offers no credible alternative explanation.
`
`(4) A POSITA would credit Munoz’s disclosure of an original dashboard
`
`105 having “vehicle factory dashboard electronics and controls that are used to
`
`control Roof Control Electronics 110,” see, e.g., Munoz, 6:26-30. A POSITA
`
`would also understand the that the “controls that are used to control Roof Control
`
`Electronics 110” are exactly where Munoz says they are—in element 105.
`
`In contrast, Patent Owner’s strained theory assumes that the controls for
`
`Roof Control Electronics 110 are directly connected, or hard-wired, to element
`
`110, as shown below:
`
`- 18 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`
`
`POR, 35.
`
`
`
`
`
`Patent Owner’s interpretation is wrong. Munoz expressly discloses that the
`
`controls for the Roof Control Electronics 110 are in the dashboard 105, not directly
`
`connected to Roof Control Electronics 110. Munoz, 6:26-30. In an attempt to
`
`manufacture ambiguity in Munoz’s disclosure, Dr. Shahbakhti stated at deposition
`
`that he believed this particular disclosure about dashboard 105 is limited to the
`
`post-retrofit arrangement of roof controls, and this is based on his evaluation of the
`
`VW Eos. Ex. 1020, 39:1-40:22; Ex. 2028, ¶65; see also POR, 40. But Munoz
`
`never states that the controls for the roof are changed from pre-retrofit to post-
`
`retrofit. Rather, Munoz specifically states throughout his specification that “the
`
`device does not rely upon new buttons, controls, or displays.” See, e.g., Munoz,
`
`1:55-60; 3:10-12; 3:18-21; 3:34-36; 3:43-45; 3:49-50; 4:25-26; 4:56-59; 5:21-26.
`
`Thus, Munoz’s express disclosure indicates that the controls are the same both
`
`before and after the retrofit, and are part of dashboard 105.
`
`
`
`Because Patent Owner is wrong about the location of the controls for the
`
`Roof Control Electronics 110, Patent Owner draws other conclusions that are
`
`inconsistent with Munoz. Patent Owner and Dr. Shahbakhti even make the
`
`- 19 -
`
`
`
`IPR2020-00116 Petitioner’s Reply
`
`extraordinary claim that there is no communication between the dashboard 105 and
`
`the Roof Control Electronics 110 before the retrofit is installed. POR, 41 (“Munoz
`
`does not disclose any communication between the original dashboard 105 and the
`
`roof control electronics 110.”); see also Ex. 2028, ¶65.3 Patent Owner offers no
`
`explanation how the factory dashboard 105 can control Roof Control Electronics
`
`110 without sending a message.
`
`Further, Patent Owner’s argument that Munoz fails to disclose o