`
`
`
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`⸺⸺⸻⸺⸺⸺⸺
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`⸺⸺⸻⸺⸺⸺⸺
`
`DATASPEED INC.,
`
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`
`Patent Owner.
`
`⸺⸺⸻⸺⸺⸺⸺
`
`Case IPR2020-00116
`
`Patent 9,871,671
`
`⸺⸺⸻⸺⸺⸺⸺
`
`PATENT OWNER’S SUR-REPLY
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`EXHIBIT LIST
`
`Exhibit No. Description
`
`2001
`
`Declaration of Maxwell Goss in Support of Motion to Appear
`
`Pro Hac Vice on behalf of patent owner Sucxess LLC
`
`2002
`
`ISO 11898-1, Road vehicles – Controller area network (CAN) –
`
`Part 1: Data link layer and physical signalling, First edition 2003-
`
`12-01 (“ISO”)
`
`2003
`
`Denton, Tom. Advanced automotive fault diagnosis. Oxford
`
`Burlington, MA: Butterworth-Heinemann, 2006 (“Denton”)
`
`2004
`
`BAE Systems, Inc., Job posting “Vehicle Systems Architect,”
`
`retrieved from
`
`https://jobs.baesystems.com/global/en/job/56889BR on 02-Jan-
`
`2020
`
`2005
`
`Fiat Chrysler Automobiles, Job posting “Electrical Technician,”
`
`retrieved from https://careers.fcagroup.com/job/10316315/ on 02-
`
`Jan-2020
`
`2006
`
`Reserved
`
`2007
`
`Volkswagen Service Training. “Self-study Program 871603. The
`
`Eos 2006 Electrical System Design and Function”
`
` i
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`2008
`
`“VW Eos Convertible Hardtop Emergency Opening and Closing
`
`Using Autologic DrivePRO,” https://us.autologic.com/news/vw-
`
`eos-convertible-hardtop-emergency-opening-and-closing.
`
`2009
`
`Resume of Mahdi Shahbakhti , Ph.D.
`
`2010
`
`YouTube Video “VW Eos Convertible Hardtop Emergency
`
`Opening and Closing,” https://youtu.be/KhgrBsIDO_0.
`
`2011
`
`Currie, Roderick. “Developments in Car Hacking.” (2015).
`
`2012
`
`Bernd Elend, Tony Adamson. “Cyber security enhancing CAN
`
`transceivers.” (2017)
`
`2013
`
`YouTube Video “EOS ROOF OPENING WHILE DRIVING,”
`
`https://youtu.be/Fll2sWA-iwA
`
`2014
`
`Convertible Roof Wiring Diagram, 2007 Volkswagen Eos (1F7)
`
`V6-3.2L (BUB)
`
`2015
`
`Convertible Roof Wiring Diagram, 2007 Cadillac XLR V8-4.6L
`
`2016
`
`Convertible Roof Wiring Diagram, 2007 Lexus SC 430
`
`2017
`
`Convertible Roof Wiring Diagram, 2007 Mazda MX-5 Miata
`
`2018
`
`Convertible Roof Wiring Diagram, 2007 Saab 9-3
`
`2019
`
`Convertible Roof Wiring Diagram, 2007 Pontiac G6
`
`2020
`
`Convertible Roof Wiring Diagram, 2007 Mini Cooper S
`
`Convertible
`
` ii
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`2021
`
`Convertible Roof Wiring Diagram, 2007 Audi S4 Quattro
`
`Cabriolet
`
`2022
`
`Convertible Roof Wiring Diagram, 2007 Ford Mustang
`
`2023
`
`Convertible Roof Wiring Diagram, 2007 Porsche Boxster (987)
`
`2024
`
`Robert Leale, Deposition Transcript
`
`2025
`
`2007 Pontiac G6 Service Manual
`
`2026
`
`Annotated copy of Munoz Fig. 1
`
`2027
`
`YouTube Video “EOS ROOF MODULE SETUP MENU,”
`
`https://youtu.be/yQ9xqvHwe0o
`
`2028
`
`Declaration of Dr. Mahdi Shahbakhti
`
`2029
`
`U.S. Trademark Ser. No. 77-198,481, Reg. No. 3,388,116
`
`2030
`
`YouTube Video “Vario Plus Control Module Ultra features walk-
`
`through,” https://youtu.be/9PYK9j3FFx4
`
`2031
`
`Connector pinout of 2007 Audi A4 Cabriolet, Bose Amplifier,
`
`25-Pin and 32-pin.
`
`
`
`
`
` iii
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`TABLE OF CONTENTS
`
`I.
`
`Introduction ...................................................................................................... 1
`
`II. Munoz does not teach several claim elements. ................................................ 2
`
`A. Munoz does not disclose a first (original) message that is being spoofed. ... 2
`
`B. Munoz does not teach a second (spoofed) message. ..................................... 4
`
`C. Munoz does not teach splitting an existing CAN bus to establish “a second
`
`data bus.” ................................................................................................................ 5
`
`III. Patent Owner’s interpretation is consistent with Munoz’s disclosure. ............ 6
`
`A. A POSITA would have understood Munoz in view of convertible vehicles
`
`at the time. .............................................................................................................. 6
`
`B. Patent Owner’s understanding of convertible roof controls is consistent
`
`with Munoz and with the common practice of convertible vehicles at the time. .. 8
`
`C. Patent Owner does not rely on new buttons, controls or displays. ............... 9
`
`D. Patent Owner’s position reflects Munoz’s mention that an original data
`
`connection will be terminated. .............................................................................10
`
`E.
`
`“All communication” does not include non-existent messages. .................11
`
`F.
`
`Petitioner’s new theory based on Munoz’s Fig. 2 is misguided. ................11
`
`G. Petitioner’s understanding of switch 120 contradicts its own arguments. ..12
`
` iv
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`H. None of the prior art teaches spoofing. .......................................................13
`
`
`
`
`I.
`
`Petitioner now acknowledges that Munoz does not teach the second
`
`message. ...............................................................................................................15
`
`J.
`
`“Removing or altering” data does not lead to a gateway. ...........................15
`
`K. Petitioner’s theory is the ultimate hindsight exercise. ................................16
`
`IV. Conclusion ......................................................................................................17
`
`
`
`
`
`
`
` v
`
`
`
`
`
`
`
`
`Cases
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`TABLE OF AUTHORITIES
`
`Dynamic Drinkware, LLC v. Nat'l Graphics, Inc.,
`
`800 F.3d 1375 (Fed. Cir. 2015) ............................................................................. 1
`
`Knauf Insulation, Inc. v. Rockwool, Int’l A/S,
`
`788 Fed. App’x 728 (Fed. Cir. 2019) ................................................................1, 2
`
`Tech. Licensing Corp. v. Videotek, Inc.,
`
`545 F.3d 1327 (Fed.Cir.2008)..............................................................................11
`
`
`
` vi
`
`
`
`
`
`
`I.
`
`INTRODUCTION
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`Petitioner uses carefully crafted hindsight to read elements into Munoz that
`
`simply are not there. Petitioner cannot evade the fact that Munoz does not teach a
`
`first (original) message that is being spoofed, a second (spoofed) message, or the
`
`splitting of an existing CAN bus to establish a second data bus. While a reference
`
`should be considered for all it teaches, it may not be considered for more than it
`
`teaches. See, e.g., Knauf Insulation, Inc. v. Rockwool, Int’l A/S, 788 Fed. App’x
`
`728, 733 (Fed. Cir. 2019) (“Although a reference may be used for everything it
`
`teaches, e.g. using a polyhydroxy component, the Board did not identify any
`
`suggestion in Helbing to use a reducing sugar as the polyhydroxy component.”).
`
`Petitioner disagrees with Patent Owner’s analysis of how Munoz had been
`
`implemented. But Patent Owner was merely explaining why a POSITA would not
`
`have filled gaps in Munoz’s disclosure as understood by Petitioner. Thus,
`
`Petitioner cannot meet its burden to show obviousness. See Dynamic Drinkware,
`
`LLC v. Nat'l Graphics, Inc., 800 F.3d 1375, 1378 (Fed. Cir. 2015) (“In an inter
`
`partes review, the burden of persuasion is on the petitioner to prove
`
`‘unpatentability by a preponderance of the evidence,’ 35 U.S.C. § 316(e), and that
`
`burden never shifts to the patentee.”).
`
`Notably, Petitioner does not dispute that the Board should give no weight to
`
`the testimony of its expert, Mr. Leale. Without it, the Petition lacks evidentiary
`
` 1
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`support. In any event, Petitioner’s analysis is flawed, as shown herein. Mr. Leale’s
`
`
`
`
`lack of credibility and the clear record that Munoz himself implemented his
`
`invention differently than proposed by Petitioner shows that the claims of the’671
`
`Patent are not obvious.
`
`II. MUNOZ DOES NOT TEACH SEVERAL CLAIM ELEMENTS.
`
`A. Munoz does not disclose a first (original) message that is being
`spoofed.
`
`Petitioner’s Reply fails to identify any disclosure in Munoz of a first
`
`(original) message that is being spoofed. Instead, Petitioner uses Munoz’s broad
`
`reference to “all communication” to supposedly find a specific “first message.” But
`
`the words “all communication” cannot possibly be understood to describe an
`
`undisclosed specific message that opens a convertible roof. See, e.g., Knauf
`
`Insulation, 788 Fed. App’x at 733 (“It is not enough, even after KSR, to support a
`
`determination of obviousness that a reference includes a broad generic disclosure
`
`and a common utility to that in the claims and other prior art references—there
`
`must be some reason to select a species from the genus.”).
`
`Petitioner misleadingly refers to an “express disclosure” of a first message in
`
`Munoz. Reply, 21. A careful review of the reference will confirm that there is no
`
`express disclosure. Petitioner’s own expert agreed:
`
`Q
`
`So does Munoz anywhere specifically say there is
`
`a first message coming from 105?
`
` 2
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`A
`
`I don't believe he specifically said that.
`
`Ex. 2024, 58:8-10. Furthermore, Dr. Shahbakhti found that the reference does not
`
`disclose a first message, noting that “Munoz does not disclose any communication
`
`between the original dashboard 105 and the roof control electronics 110.” Ex.
`
`2028, ¶59.
`
`Petitioner’s assertion that Munoz would have used an undisclosed first
`
`message is based on a presumption that Munoz’s factory open/close buttons are
`
`wired to dashboard 105. There is no basis in fact for such a presumption. It was
`
`common practice at the time for factory open/close buttons to be wired directly
`
`into a roof control electronics.
`
`As shown in Patent Owner’s Response, such a practice is supported by
`
`detailed wiring diagrams of 10 different vehicles that would have shaped a
`
`POSITA’s understanding of Munoz. Contrary to what Petitioner claims, the
`
`relevance of these wiring diagrams is not simply that they show how a “retrofit
`
`device could have been commercially implemented in other vehicles.” Reply, 2.
`
`Rather, the wiring diagrams show that what Petitioner postulates—the wiring of
`
`the factory open/close buttons to the dashboard—contradicts the common practice
`
`of wiring convertible vehicles at the time.
`
` 3
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Patent Owner’s position is also directly supported by expert testimony. See
`
`
`
`
`Ex. 2028, ¶68. And even Petitioner’s expert admitted during cross-examination
`
`that he could not tell how Munoz’s factory open/close buttons are wired:
`
`Q
`
`How do you know that the factory cabriolet top
`
`open/close buttons are connected to the module
`
`105?
`
`A
`
`I do not.
`
`Ex. 2024, 61:6-8.
`
`B. Munoz does not teach a second (spoofed) message.
`
`The Reply fails to show any evidence of the second message required in the
`
`claims of the ’671 Patent. Patent Owner demonstrated that Munoz can be
`
`implemented with a diagnostic message that does not spoof any first message and
`
`does not read on the “second message” limitation. Trying to dismiss the diagnostic
`
`message, Petitioner now refers to Munoz’s disclosure of “removing or altering
`
`data” in Fig. 1, box 100. Reply, 8. Surprisingly though, Petitioner now agrees with
`
`Patent Owner that “removing or altering data” does not read on “transmitting a
`
`second message”:
`
`Munoz does not disclose adding new messages to the
`
`CAN bus to perform the retrofit’s roof control module
`
`functions—it discloses altering or removing data.
`
`Reply, 8.
`
` 4
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`“Removing or altering data” does not read on a second (spoofed) message
`
`
`
`
`that is “indistinguishable from a first message” as required by claim 1. “Removing
`
`or altering data” also does not read on “a second message which mimics the first
`
`message” as required by claim 6. Neither does “removing or altering data” read on
`
`“a second message having the same message identifier” as a first message as
`
`required by claim 10. See Ex. 2012, 2; Ex. 2028, ¶38.
`
`Petitioner’s position now appears to be that the “second message” element
`
`would inherently be met if a first message existed. See Reply, 21-22. But that is not
`
`the case. Even in a hypothetical vehicle in which a “roof open” command was sent
`
`over a CAN bus, it is the use of a diagnostic message that would get around a
`
`manufacturer lockout and allow opening the roof while driving. There would be no
`
`reason for a retrofit apparatus to send a second (spoofed) message to request what
`
`is locked out.
`
`Even if, arguendo, there was a first message, Petitioner still has failed to
`
`show that a second message spoofs the first message and is not, for example, a
`
`diagnostic message. Petitioner’s position is based on unfounded conjecture.
`
`C. Munoz does not teach splitting an existing CAN bus to establish
`“a second data bus.”
`
`With respect to the “second bus” limitation, Petitioner presents a new theory
`
`that Munoz’s Fig. 2 shows that the retrofit module 100 has two interfaces. Reply,
`
`17. Petitioner misreads Munoz. Figure 2 shows two CAN busses as part of the
`
` 5
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`(larger) device 200. But the Roof Control Electronics 100 shown in Figure 1 is
`
`
`
`
`only a portion of the device 200 and uses only one of the two CAN connections
`
`shown in Fig. 2. Dr. Shahbakhti explained this during his deposition:
`
`So what we see in figure 2, it's showing that there are
`
`buses [...] so the Vario plus control module will act
`
`properly. But these -- it doesn't mean what we seen [sic]
`
`in figure 1 is showing two different buses.
`
`Ex. 1020, 13-18. The device 200 would, for example, have to communicate on a
`
`chassis CAN bus to implement the shock absorber adjustment Munoz discusses.
`
`See Ex. 1004, 5:6-20. That leaves one CAN interface to interact with the
`
`convertible roof as illustrated in Fig. 1.
`
`III. PATENT OWNER’S INTERPRETATION IS CONSISTENT WITH
`MUNOZ’S DISCLOSURE.
`
`A. A POSITA would have understood Munoz in view of convertible
`vehicles at the time.
`
`Petitioner attempts to discredit Patent Owner’s analysis as irrelevant for
`
`considering a specific implementation in a VW EOS, suggesting that Patent Owner
`
`“plucks Munoz’s Roof Control Module 100 out of the automobile disclosed in
`
`Munoz.” Reply, 1. That is not the case. Whereas Petitioner tries to re-create in
`
`hindsight what is claimed in the ’671 Patent, Patent Owner shows the
`
`understanding of convertible vehicles that a POSITA would have had in 2007.
`
`Patent Owner does not change anything about Munoz’s disclosure. This can be
`
` 6
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`readily seen in the annotated Figure 1 shown below: Everything Munoz discloses
`
`
`
`
`in black remains, and gaps of Munoz’s disclosure have been filled as indicated in
`
`red.
`
`
`
`Response, 35; Ex. 2028, ¶51.
`
`Dr. Shahbakhti analyzed ten different convertible vehicles sold in 2007. In
`
`so doing, Dr. Shahbakhti established the common practice at the time that
`
`convertible vehicles included a hardwired connection from a roof control switch to
`
`a roof control electronics. See Ex. 2028, ¶50. The VW EOS was chosen as an
`
`example because Munoz himself demonstrated his invention in this vehicle. But
`
` 7
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Dr. Shahbakhti’s analysis applies to any of the analyzed vehicles. See Ex. 2028,
`
`
`
`
`¶80. Patent Owner’s Response established the knowledge a POSITA would have
`
`had with respect to convertible vehicles and used the specific example of Munoz’s
`
`own implementation to show how gaps in Munoz’s disclosure would be filled.
`
`B.
`
`Patent Owner’s understanding of convertible roof controls is
`consistent with Munoz and with the common practice of
`convertible vehicles at the time.
`
`Petitioner believes that “control signals to control Roof Control Electronics
`
`110 are sent over Munoz’s CAN bus before the retrofit, and through Roof Control
`
`Module 100 and two separate CAN buses after the retrofit.” Reply, 4. Petitioner
`
`refers to Munoz’s statement regarding “the operation of the roof control module in
`
`various embodiments of the invention” to imply that the same must have been true
`
`before the vehicle was retrofitted. That is invalid and has been rejected by Dr.
`
`Shahbakhti. See Ex. 2028, ¶65. Petitioner’s theory is based on Munoz’s alleged
`
`failure to state “that the controls for the roof are changed from pre-retrofit to post-
`
`retrofit.” Reply, 19. But Munoz does show the use of different controls pre- and
`
`post-retrofit. Munoz refers to “factory cabriolet top open/close buttons which
`
`require that said buttons be depressed for the duration the said cabriolet top is
`
`opened or closed [pre retrofit].” Ex. 1004, 8:37-38. In contrast, post-retrofit
`
`Munoz’s device is controlled only by a factory display:
`
` 8
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Another improvement made by the device over related
`
`
`
`
`art systems is the ability to operate using only the factory
`
`display. Messages that are required in order to operate
`
`and adjust the device's features and settings are displayed
`
`on the vehicle's factory display.
`
`Ex. 1004, 3:43-47. Munoz’s features are operated post-retrofit by interacting
`
`with a factory display, not by depressing roof control buttons as done pre-retrofit.
`
`Petitioner fails to account for the control using only a factory display.
`
`C.
`
`Patent Owner does not rely on new buttons, controls or displays.
`
`Petitioner highlights Munoz’s disclosure that his “device does not rely upon
`
`new buttons, controls, or displays.” Reply, 19. The use of existing steering wheel
`
`buttons is exactly what Dr. Shahbakhti shows, using a VW EOS as an example:
`
`
`
`Ex. 2028, ¶40. It is this interaction with the display that allows Munoz, post-
`
`retrofit, to control the roof. Petitioner, on the other hand, argues that Munoz adds a
`
`switch 120, which is plainly inconsistent with Munoz’s explicit disclosure.
`
` 9
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Patent Owner’s position reflects Munoz’s mention that an original
`data connection will be terminated.
`
`
`
`
`D.
`
`Munoz mentions that an “original data connection will be terminated.” Ex.
`
`1004, Fig. 1, block 115. Munoz does not provide any further details beyond those
`
`words in the drawing as to the nature of the termination.
`
`Patent Owner’s understanding of an internal connection in the roof control
`
`module 100 is consistent with Munoz’s wording: The original data connection
`
`refers to the wiring originally present in the vehicle, which has been permanently
`
`separated and no longer connects the original dashboard 105 to the roof control
`
`electronics 110.
`
`Petitioner points to another gap in Munoz’s disclosure that “[t]here is no
`
`disclosure of any ‘Internal Connection’ or ‘passthrough’ in Munoz’s Roof Control
`
`Module 100 or device 200.” Reply, 6. Even if that is correct, it is Petitioner’s
`
`burden to proof that there is no such internal connection. See Tech. Licensing
`
`Corp. v. Videotek, Inc., 545 F.3d 1327 (Fed.Cir.2008) ) (“[I]f the fact trier of the
`
`issue is left uncertain, the party with the burden loses.”). Petitioner fails to
`
`substantively contradict any of Patent Owner’s reasons “A” through “F” which
`
`explain why a POSITA would have understood Munoz to include an internal
`
`passthrough. See Response, 48-50.
`
` 10
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`“All communication” does not include non-existent messages.
`
`
`
`
`E.
`
`Petitioner argues that “all communication” includes an undisclosed message
`
`sent from dashboard 105 to roof control electronics 110 to read on the ’671 Patent.
`
`Reply, 22.
`
`Munoz Fig. 1 is oversimplified, in that it shows only two original
`
`components, the original vehicle dashboard electronics 105 and the original roof
`
`electronics 110 connected to the bus. Ex. 2028, ¶59. Petitioner’s Expert agreed:
`
`“From the diagram [Fig. 1], this diagram indicates that there's only two nodes on
`
`this bus; however, in reality, there are likely more.” Ex. 2024, 56:16-21. “All
`
`communication” includes messages from nodes that are present on the CAN bus
`
`and not shown in Fig. 1. The words “all communication” do not imply any
`
`message being sent from dashboard 105 to roof control electronics 110.
`
`F.
`
`Petitioner’s new theory based on Munoz’s Fig. 2 is misguided.
`
`Petitioner presents a new theory that Munoz’s Fig. 2 shows “a first CAN-
`
`bus” and “a second CAN-bus” of the roof control module 100. Petitioner fails to
`
`appreciate that Fig. 2 shows a larger device 200, of which the roof control module
`
`100 is only a portion. See Ex. 1004, 6:30-31. Munoz does not state that both CAN
`
`busses shown in Fig. 2 are part of the roof control module 100. A POSITA would
`
`recognize that Munoz’s features such as pneumatic shock absorber adjustments
`
` 11
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`require access to a chassis CAN bus separately from access to a body CAN bus for
`
`
`
`
`convertible roof control. Dr. Shahbakhti explained this during cross-examination:
`
`So what we see in figure 2, it's showing that there are
`
`buses [...] so the Vario plus control module will act
`
`properly. But these -- it doesn't mean what we seen [sic]
`
`in figure 1 is showing two different buses.
`
`Ex. 1020, 86:13-18.
`
`G.
`
`Petitioner’s understanding of switch 120 contradicts its own
`arguments.
`
`Petitioner disagrees with Patent Owner’s position that switch 120 is
`
`symbolic. Yet, Petitioner cannot credibly explain what purpose switch 120 serves
`
`or why Munoz would add a switch 120 in spite of the explicit statement that his
`
`“device further relies upon these [existing] controls, without the need for new
`
`buttons, knobs, or switches to be added to the vehicle.” Ex. 1004, 3:35-37.
`
`Petitioner’s expert provided a far-fetched explanation that the switch 120 was
`
`always open and proactively installed in a hidden location to be closed only if the
`
`retrofit device were to be removed from the vehicle at a later time. See Ex. 2024,
`
`51:5-55:10. Petitioner’s Expert acknowledged never to have installed a switch
`
`between two CAN buses himself when he installed retrofit devices. See Ex. 2024,
`
`56:11-15.
`
` 12
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`As Dr. Shahbakhti pointed out during cross examination, switch 120 is
`
`
`
`
`shown in Fig. 1 not being connected to any wire and floating in the air. See Ex.
`
`1020, 70:9-17.
`
`
`
`If Petitioner were correct and the switch 120 were real, then there would be
`
`no need for the roof control module 100 to include a gateway even if there were
`
`two separate busses. All that would need to be done is for switch 120 to be closed
`
`when the module 100 is off and the vehicle would return to the pre-retrofit state.
`
`Patent Owner’s understanding of Munoz is independent of the switch 120. A
`
`switch 120 wired in parallel to the internal pass-through in module 100 does not
`
`affect its operation. That is not true for Petitioner’s understanding. If switch 120 is
`
`closed, Petitioner’s gateway would receive and retransmit its own messages,
`
`thereby flooding the bus and ultimately rendering the vehicle inoperative.
`
`H. None of the prior art teaches spoofing.
`
`Petitioner criticizes Patent Owner’s Response as being too focused on the
`
`term “spoofing.” But spoofing is critical to the invention disclosed in the ’671
`
` 13
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`Patent—and Petitioner cannot show the concept of “spoofing” in the prior art
`
`
`
`
`references under any name.
`
`Petitioner mischaracterizes Patent Owner’s position as confirming that
`
`Munoz is performing spoofing. To the contrary, Patent Owner has emphasized that
`
`“Munoz does not teach spoofing of CAN messages, which would require a node to
`
`be using an identifier that it is not allowed to send.” Response, 34.
`
`Patent Owner’s argument related to the reasoning for separating an existing
`
`vehicle data bus into two busses is a response to show that even if, arguendo,
`
`spoofing were known, it would not lead to splitting an existing bus into two. Dr.
`
`Shahbakhti clarified that a POSITA was not familiar with spoofing in 2007 during
`
`his deposition:
`
`Q.
`
`Is it your position that a POSITA would not have
`
`known about spoofing in 2007?
`
`A.
`
`[...] So my expectation would be that the POSITA
`
`will not be familiar with doing a spoofing at that
`
`time.
`
`Q. Were you familiar with spoofing in 2007?
`
`A.
`
`I was -- I was not.
`
`Ex. 1020, 80:14-81:11.
`
` 14
`
`
`
`
`
`
`I.
`
`Case IPR2020-00116
`Patent 9,871,671
`Petitioner now acknowledges that Munoz does not teach the
`second message.
`
`
`
`
`Petitioner attempts, and fails, to discredit Patent Owner’s finding that a
`
`POSITA would have implemented Munoz with a diagnostic message. Petitioner
`
`instead proves its own theory wrong and confirms that Munoz does not read on the
`
`’671 Patent: “Munoz does not disclose adding new messages to the CAN bus to
`
`perform the retrofit’s roof control module functions—it discloses altering or
`
`removing data.” Reply, 8.
`
`Claim 1 of the ’671 Patent requires “transmitting a second message” which
`
`is “indistinguishable from a first message.” Claim 6 requires “a second message
`
`which mimics the first message.” Claim 10 requires sending “a second message
`
`having the same message identifier” as a first message. All independent claims
`
`require adding a new (second) message, which, surprisingly, Petitioner now says
`
`Munoz does not teach.
`
`J.
`
`“Removing or altering” data does not lead to a gateway.
`
`Petitioner argues that Munoz’s vague mention of “removing or altering” data
`
`would lead a POSITA to understand the roof control module 100 to include a
`
`gateway. That is not correct. Gateways are used by car manufacturers to connect
`
`separate busses that have been designed to be separate ab initio. Ex. 2028, ¶90.
`
`Their purpose is to add data to a bus that otherwise would not be present. For
`
`example, the convertible top control module of a VW EOS uses vehicle speed data
`
` 15
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`from the Engine Control Module (ECM) or ABS control module. See Ex. 2007, 38.
`
`
`
`
`It is the role of a gateway to receive vehicle speed from the ECM or ABS on a
`
`Powertrain CAN bus and add it to the Comfort System CAN bus so that the
`
`convertible top control module can receive it. A gateway does not remove any data
`
`that already exists on a bus. Elend and Adamson directly describe a denial of
`
`service attack by flooding the bus “which can be used to disable safety relevant
`
`functionality.” Ex. 2012, 2. That would include Munoz’s goal to defeat a speed-
`
`based lockout and might be considered “removing data,” but does not include a
`
`gateway.
`
`Dr. Shahbakhti explained that a POSITA would understand “altering” data
`
`to reflect a tampering attack as described by Elend and Adamson. See Ex. 2028,
`
`¶37. Such a tampering attack is not a function performed by a gateway.
`
`Petitioner’s understanding that Munoz includes a gateway is a hindsight
`
`reconstruction. Munoz does not mention or imply “gating” any messages.
`
`K.
`
`Petitioner’s theory is the ultimate hindsight exercise.
`
`Petitioner’s theory that Munoz teaches a gateway is rooted in the mistaken
`
`contention in a “CAN bus messages indicating vehicle speed from the dashboard
`
`105 to Roof Control Electronics 110, which may otherwise prohibit roof
`
`operation.” Reply, 9. Munoz does not mention such a vehicle speed message. Nor
`
`is there any reason to believe that such a message would exist. Vehicle speed is
`
` 16
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`determined by wheel speed sensors which are connected to an ABS system, not by
`
`
`
`
`a dashboard. What makes Petitioner’s theory even more bizarre is the notion that
`
`the dashboard supposedly sends a “roof open” message to the roof electronics,
`
`which the roof electronics ignores based on vehicle speed information also
`
`received from the dashboard. This is an ultimate exercise in hindsight and defies
`
`common sense. If the vehicle is too fast to open the roof, the dashboard would
`
`simply not send a roof open message.
`
`IV. CONCLUSION
`
`For all the reasons set out above, the Board should reject the Petitioner’s
`
`arguments and confirm the patentability of each challenged claim.
`
`Respectfully submitted,
`
`
`
`
`
`By: /Axel Nix/
`Bernd Axel Nix
`Registration No. 59184
`Counsel for Patent Owner
`Sucxess LLC
`
`
`
`Date: 22 December 2020
`
`
`
` 17
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`CERTIFICATE OF COMPLIANCE WITH 37 C.F.R. § 42.24
`
`
`This Patent Owner’s Sur-Reply contains 3431 words, excluding the portions
`
`allowed to be excluded by § 42.24(a)(1), as determined by the word-processing
`
`system used to prepare the paper.
`
`
`
`Date: December 22, 2020
`
`
`
`
`/Axel Nix/
`Bernd Axel Nix
`Registration No. 59184
`Counsel for Patent Owner
`Sucxess LLC
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case IPR2020-00116
`Patent 9,871,671
`
`CERTIFICATE OF SERVICE
`
`I hereby certify that a copy of this Patent Owner’s Sur-Reply was served on
`
`Petitioner's counsel of record via PTAB E2E and by electronic mail on December
`
`22, 2020 at the following addresses:
`
`Peter W. Gowdey - pgowdey@dbjg.com
`
`Wayne M. Helge - whelge@dbjg.com
`
`James T. Wilson - jwilson@dbjg.com
`
`with a copy sent to ESong@dbjg.com
`
`
`
`Date: December 22, 2020
`
`
`
`
`/Axel Nix/
`Bernd Axel Nix
`Registration No. 59184
`Counsel for Patent Owner
`Sucxess LLC
`
`
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
