`
`
`
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`⸺⸺⸻⸺⸺⸺⸺
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`⸺⸺⸻⸺⸺⸺⸺
`
`DATASPEED INC.,
`
`Petitioner,
`
`v.
`
`SUCXESS LLC,
`
`Patent Owner.
`
`⸺⸺⸻⸺⸺⸺⸺
`
`Case IPR2020-00147
`
`Patent 10,027,505
`
`⸺⸺⸻⸺⸺⸺⸺
`
`PATENT OWNER’S RESPONSE TO
`
`PETITION FOR INTER PARTES REVIEW
`
`
`
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`EXHIBIT LIST
`
`Exhibit No. Description
`
`2001
`
`Declaration of Maxwell Goss in Support of Motion to Appear Pro
`
`Hac Vice on behalf of patent owner Sucxess LLC
`
`2002
`
`ISO 11898-1, Road vehicles – Controller area network (CAN) –
`
`Part 1: Data link layer and physical signalling, First edition 2003-
`
`12-01 ("ISO")
`
`2003
`
`Denton, Tom. Advanced automotive fault diagnosis. Oxford
`
`Burlington, MA: Butterworth-Heinemann, 2006 ("Denton")
`
`2004
`
`BAE Systems, Inc., Job posting "Vehicle Systems Architect",
`
`retrieved from https://jobs.baesystems.com/global/en/job/56889BR
`
`on 02-Jan-2020
`
`2005
`
`Fiat Chrysler Automobiles, Job posting "Electrical Technician",
`
`retrieved from https://careers.fcagroup.com/job/10316315/ on 02-
`
`2006
`
`2007
`
`Jan-2020
`
`reserved
`
`Volkswagen Service Training. “Self-study Program 871603. The
`
`Eos 2006 Electrical System Design and Function”
`
`2008
`
`“VW Eos Convertible Hardtop Emergency Opening and Closing
`
`Using Autologic DrivePRO”, https://us.autologic.com/news/vw-
`
`eos-convertible-hardtop-emergency-opening-and-closing.
`
` i
`
`
`
`
`
`
`2009
`
`2010
`
`2011
`
`2012
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Resume of Mahdi Shahbakhti , Ph.D.
`
`YouTube Video “VW Eos Convertible Hardtop Emergency
`
`Opening and Closing”, https://youtu.be/KhgrBsIDO_0.
`
`Currie, Roderick. “Developments in Car Hacking.” (2015).
`
`Bernd Elend, Tony Adamson. “Cyber security enhancing CAN
`
`transceivers.” (2017)
`
`2013
`
`YouTube Video “EOS ROOF OPENING WHILE DRIVING”,
`
`https://youtu.be/Fll2sWA-iwA
`
`2014
`
`Convertible Roof Wiring Diagram, 2007 Volkswagen Eos (1F7)
`
`V6-3.2L (BUB)
`
`2015
`
`2016
`
`2017
`
`2018
`
`2019
`
`2020
`
`Convertible Roof Wiring Diagram, 2007 Cadillac XLR V8-4.6L
`
`Convertible Roof Wiring Diagram, 2007 Lexus SC 430
`
`Convertible Roof Wiring Diagram, 2007 Mazda MX-5 Miata
`
`Convertible Roof Wiring Diagram, 2007 Saab 9-3
`
`Convertible Roof Wiring Diagram, 2007 Pontiac G6
`
`Convertible Roof Wiring Diagram, 2007 Mini Cooper S
`
`Convertible
`
`2021
`
`Convertible Roof Wiring Diagram, 2007 Audi S4 Quattro
`
`Cabriolet
`
` ii
`
`
`
`
`
`
`2022
`
`2023
`
`2024
`
`2025
`
`2026
`
`2027
`
`2028
`
`2029
`
`2030
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Convertible Roof Wiring Diagram, 2007 Ford Mustang
`
`Convertible Roof Wiring Diagram, 2007 Porsche Boxster (987)
`
`Robert Leale, Deposition Transcript
`
`2007 Pontiac G6 Service Manual
`
`Annotated copy of Munoz Fig. 1
`
`YouTube Video “EOS ROOF MODULE SETUP MENU”,
`
`https://youtu.be/yQ9xqvHwe0o
`
`Declaration of Dr. Mahdi Shahbakhti
`
`U.S. Trademark Ser. No. 77-198,481, Reg. No. 3,388,116
`
`YouTube Video “Vario Plus Control Module Ultra features walk-
`
`through”, https://youtu.be/9PYK9j3FFx4
`
`2031
`
`Connector pinout of 2007 Audi A4 Cabriolet, Bose Amplifier, 25-
`
`Pin and 32-pin.
`
`2032
`
`YouTube Video “Motown00 Car Hacking 0x05 Robert Leale”,
`
`https://youtu.be/cb9xD-Jy5zA, Excerpt 30:45-34:08.
`
`
`
`
`
` iii
`
`
`
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`TABLE OF CONTENTS
`
`I.
`
`Introduction ...................................................................................................... 1
`
`II.
`
`The ’505 Patent ................................................................................................. 4
`
`III. Claim construction ............................................................................................ 6
`
`A.
`
`“data bus” ...................................................................................................... 6
`
`B.
`
`“responds” ..................................................................................................... 7
`
`C.
`
`“receives” ...................................................................................................... 7
`
`IV. Person having ordinary skill in the art .............................................................. 9
`
`V. Background: Hacking Vehicle Networks .......................................................10
`
`VI. Mr. Leale has a conflict of interest. ................................................................12
`
`VII. The Munoz reference ......................................................................................16
`
`VIII. Ground 1: The Claims are not obvious over Munoz alone or in combination
`
`with Negley, SAE, and Bosch. .................................................................................29
`
`A.
`
`Independent Claim 1 ...................................................................................37
`
`1.
`
`[1.1] Munoz does not teach providing a vehicle having a factory-installed
`
`first apparatus including a processor, programmed to communicate with a
`
`factory-installed second apparatus through a vehicle data bus with a first
`
`message having an identifier. ...........................................................................37
`
` iv
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`[1.4] Munoz does not teach transmitting a second message from the
`
`
`
`
`2.
`
`retrofit apparatus to the factory-installed first apparatus, the second message
`
`being indistinguishable from the first message. ..............................................42
`
`B. Dependent Claim 2: Munoz fails to teach that the second message uses the
`
`identifier of the first message. ..............................................................................47
`
`C. Dependent Claim 3: Munoz fails to teach receiving the first message in the
`
`retrofit device. ......................................................................................................47
`
`D. Dependent Claim 4: Munoz fails to teach that the retrofit apparatus re-
`
`transmits messages received on the vehicle data bus to the factory-installed first
`
`apparatus. .............................................................................................................47
`
`E. Dependent Claim 5: Munoz fails to teach the vehicle that has been
`
`retrofitted according to the method of claim 1. ...................................................48
`
`F.
`
`Independent Claim 6 ...................................................................................49
`
`1.
`
`[6.1] Munoz fails to teach a factory-installed first apparatus including a
`
`first processor which is programmed to receive a first message on a vehicle
`
`data bus from a factory-installed second apparatus. ........................................49
`
`2.
`
`[6.2] Munoz fails to teach a retrofit apparatus connected to the vehicle
`
`data bus including a second processor programmed to transmit a second
`
`message that mimics the first message. ...........................................................50
`
` v
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`G. Dependent Claim 7: Munoz fails to teach wherein the first message
`
`
`
`
`comprises a message identifier that has been assigned to the factory-installed
`
`second apparatus and wherein the second processor is programmed to transmit
`
`the second message with the same message identifier. .......................................50
`
`H.
`
`Independent Claim 10 .................................................................................51
`
`1.
`
`[10.1] Munoz fails to teach a factory-installed first apparatus including a
`
`first processor, programmed to receive a first message via a vehicle data bus
`
`from a factory-installed second apparatus, the first message having a message
`
`identifier. ..........................................................................................................51
`
`2.
`
`[10.2] Munoz fails to teach a retrofit apparatus, operatively connected to
`
`the vehicle data bus, including a second processor programmed to send a
`
`second message having the same message identifier. .....................................52
`
`I. Dependent Claim 11: Munoz fails to teach wherein the second message
`
`originating from the retrofit apparatus is indistinguishable to the first apparatus
`
`from the first message which the first processor is programmed to receive from
`
`the second apparatus. ...........................................................................................52
`
`J. Dependent Claim 12: Munoz fails to teach wherein the factory-installed
`
`first apparatus responds to the second message originating from the retrofit
`
` vi
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`apparatus as if it were the first message which the first processor is programmed
`
`
`
`
`to receive from the factory-installed second apparatus. ......................................52
`
`K. Dependent Claim 13: Munoz fails to teach wherein the factory- installed
`
`first apparatus is electrically disconnected from the vehicle data bus. ................53
`
`IX. Ground 2: Claims 14-16 Are not obvious over Munoz in combination with
`
`Negley, SAE, Bosch, and Lobaza. ...........................................................................53
`
`X. Ground 3: Claims 1-13 are not obvious over Dietz in combination with
`
`Negley, SAE, and Bosch. .........................................................................................53
`
`A.
`
`Independent Claim 1 ...................................................................................55
`
`1.
`
`[1.1] Dietz does not teach a vehicle having a factory-installed first
`
`apparatus including a processor, programmed to communicate with a factory-
`
`installed second apparatus through a vehicle data bus with a first message
`
`having an identifier. .........................................................................................55
`
`2.
`
`[1.4] Dietz fails to teach transmitting a second message from the retrofit
`
`apparatus to the factory-installed first apparatus, the second message being
`
`indistinguishable from the first message. ........................................................57
`
`B. Dependent Claim 2: Dietz fails to teach that the second message uses the
`
`identifier of the first message. ..............................................................................57
`
` vii
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`C. Dependent Claim 4: Dietz fails to teach that the retrofit apparatus re-
`
`
`
`
`transmits messages received on the vehicle data bus to the factory-installed first
`
`apparatus. .............................................................................................................58
`
`D.
`
`Independent Claim 6: Dietz fails to teach a retrofit apparatus connected to
`
`the vehicle data bus including a second processor programmed to transmit a
`
`second message that mimics the first message through a second data bus. ........60
`
`E. Dependent Claim 7: Dietz fails to teach that the first message comprises a
`
`message identifier that has been assigned to the factory-installed second
`
`apparatus and that the second processor is programmed to transmit the second
`
`message with the same message identifier. .........................................................61
`
`F.
`
`Independent Claim 10: Dietz fails to teach a vehicle, comprising a factory-
`
`installed first apparatus including a first processor, programmed to receive a first
`
`message via a vehicle data bus from a factory-installed second apparatus, the
`
`first message having a message identifier, and a retrofit apparatus, operatively
`
`connected to the vehicle data bus, including a second processor programmed to
`
`send a second message having the same message identifier. ..............................61
`
`G. Dependent Claim 11: Dietz fails to teach that the second message
`
`originating from the retrofit apparatus is indistinguishable to the first apparatus
`
`from the first message received from the second apparatus. ...............................62
`
` viii
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`H. Dependent Claim 13: Dietz fails to teach that the factory-installed first
`
`
`
`
`apparatus is electrically disconnected from the vehicle data bus. .......................62
`
`I. Dependent Claim 14: Dietz fails to teach a gateway through which the
`
`factory-installed first apparatus transmits and/or receives messages from the
`
`vehicle data bus. ...................................................................................................62
`
`J. Dependent Claim 15: Dietz fails to teach that a retrofit apparatus
`
`selectively suppresses forwarding messages received from the factory-installed
`
`first apparatus to the vehicle data bus. .................................................................63
`
`XI. Ground 4: Claims 1-13 are not obvious over Dietz in view of Allen, Negley,
`
`SAE and Bosch. .......................................................................................................63
`
`XII. Ground 5: Claims 14-16 are not obvious over Dietz in combination with
`
`Negley, SAE, Bosch, and Lobaza. ...........................................................................68
`
`XIII. Ground 6: Claims 14-16 are not obvious over Dietz in combination with
`
`Allen, Negley, SAE, Bosch, and Lobaza. ................................................................68
`
`XIV. Ground 7: Claims 6-12 are not obvious over Allen in view of Negley, SAE,
`
`and Bosch. ................................................................................................................69
`
`A.
`
`Independent claim 6: Allen does not teach a second message that is
`
`indistinguishable from a first message. ................................................................69
`
` ix
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`B. Dependent claim 7: Allen does not teach a second message that uses the
`
`
`
`
`identifier of a first message. .................................................................................71
`
`C.
`
`Independent claim 10: Allen does not teach a second processor
`
`programmed to send a second message having the same message identifier. .....71
`
`XV. Ground 8: Claims 10 and 14-16 are not obvious over Lobaza in view of
`
`Allen, Negley, SAE, and Bosch. ..............................................................................72
`
`A.
`
`Independent Claim 10. ................................................................................76
`
`XVI. Conclusion ......................................................................................................79
`
`
`
`
`
`
`
` x
`
`
`
`
`
`
`
`
`Cases
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`TABLE OF AUTHORITIES
`
`Graham v. John Deere Co.,
`
`383 U.S. 1, 17– 18 (1966) ....................................................................................30
`
`KSR Int’l Co. v. Teleflex Inc.,
`
`550 U.S. 398, 406 (2007) .....................................................................................30
`
`Medichem, S.A. v. Rolabo, S.L.,
`
`437 F.3d 1157, 1164 (Fed. Cir. 2006) .................................................................30
`
`Par Pharm., Inc. v. TWi Pharms., Inc.,
`
`773 F.3d 1186, 1194 (Fed. Cir. 2014) .................................................................30
`
`Statutes
`
`35 U.S.C. § 103(a) ...................................................................................................30
`
`Rules
`
`37 C.F.R. § 42.100 ..................................................................................................... 6
`
`Federal Rules of Evidence, Rule 608 .......................................................................15
`
`Federal Rules of Evidence, Rule 611 .......................................................................15
`
` xi
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Patent Trial and Appeal Board Consolidated Trial Practice Guide, November 2019
`
`
`
`
` ....................................................................................................................... 14, 16
`
`
`
` xii
`
`
`
`
`
`
`I.
`
`INTRODUCTION
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`Patent owner Sucxess LLC (“Patent Owner”) submits this Response to the
`
`Petition filed by petitioner Dataspeed Inc. (“Petitioner”) seeking inter partes
`
`review of claims 1-16 of U.S. Patent 10,027,505 (Ex. 1101, “the ’505 Patent”).
`
`The ’505 Patent discloses a unique method, apparatus, and system for
`
`retrofitting vehicles equipped with a Controller Area Network (CAN) bus. To
`
`make a vehicle perform an action not originally enabled by its manufacturer, the
`
`patent teaches adding a retrofit apparatus that sends a spoofed, or mimicked, CAN
`
`bus message to a factory-installed apparatus. This provides an effective and
`
`economical means to modify a production vehicle, for example for research and
`
`development companies to enter and operate in the autonomous vehicle space.
`
`In its Institution Decision (Paper 10) the Board found that Petitioner had
`
`demonstrated a reasonable likelihood that it would succeed in showing that claims
`
`1-16 are obvious over Munoz (Ex. 1004) alone or in view of Negley (Ex. 1006),
`
`SAE (Ex. 1009), and Bosch (Ex. 1010) and that claims 14-16 are obvious in further
`
`view of Lobaza (Ex. 1014). The Board also found that Petitioner had established a
`
`reasonable likelihood that claims 1-16 are obvious over Dietz in view of Allen (Ex.
`
`1018), Negley, SAE, Bosch and Lobaza. The Board further found that Petitioner
`
`had a reasonable likelihood that claim 6-12 are obvious over Allen, Negley, SAE
`
`and Bosch and that claims 10 and 14-16 are obvious over Lobaza, Allen, Negley,
`
` 1
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`SAE and Bosch. The Board found that Petitioner had not demonstrated a likelihood
`
`
`
`
`of success that claims 1-13 are rendered obvious by Dietz (Ex. 1005) in view of
`
`Negley, SAE, and Bosch.
`
`This Response presents new insights beyond those presented in Patent
`
`Owner’s Preliminary Response. As shown herein, and as supported by the
`
`Declaration of Dr. Mahdi Shahbakhti (Ex. 2028,) the invention disclosed in the
`
`’505 patent would not have been obvious to a person of ordinary skill in the art,
`
`(“POSITA”).
`
`Even though the CAN bus had been introduced more than 20 years before
`
`the ’505 Patent’s priority date, Petitioner cannot show a single document that
`
`describes spoofing of CAN messages. Instead, Petitioner contends that a POSITA
`
`would have somehow recognized the use of spoofed messages in prior art
`
`references that make no express reference to spoofing. That in itself is curious,
`
`given that a POSITA could not have been familiar with spoofed messages at the
`
`time. But Petitioner also gets it wrong. This Response will show that Petitioner
`
`recognizes spoofed messages that could not possibly have existed. The prior art
`
`fails to teach two critical elements of the ’505 Patent’s claims:
`
`First, none of the prior art shows any first (original) message that is being
`
`spoofed.
`
` 2
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Second, the prior art does not teach a second (spoofed) message that is
`
`
`
`
`indistinguishable from a first message, mimics the first message, or has the same
`
`identifier as the first message. Of course, a second message cannot meet these
`
`limitations if there is no first message.
`
`A thread running throughout the Petition, and throughout the Declaration of
`
`Robert Leale (Ex. 1103), is the reliance on conclusory assertions and
`
`unsubstantiated, gap-filling speculations about what “would have” been present in
`
`the prior art. Petitioner fails its burden to show that Claims 1-16 are unpatentable.
`
`Additionally, Petitioner’s conclusions are in critical parts plain wrong from a
`
`technical perspective. Contrary to Mr. Leale’s assertion that an “open roof while
`
`driving” feature would have led a POSITA to recognize all elements of claims 1-13
`
`in Munoz, such a feature cannot even be implemented as claimed in the ’505
`
`Patent.
`
`In any event, the testimony of Petitioner’s expert should be disregarded. Mr.
`
`Leale admitted in his deposition that he installs retrofit apparatuses and spoofs
`
`CAN messages in automobiles as part of his business. This of course infringes the
`
`patent claims and gives rise to a personal interest in getting the patents invalidated.
`
`When Patent Owner tried to pursue the matter further, Petitioner’s counsel claimed
`
`on the record, in Mr. Leale’s presence, that Patent Owner was asking about his
`
`activities as part of a “pre-litigation investigation,” and then admittedly conferred
`
` 3
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`with Mr. Leale off the record regarding his testimony. In view of Mr. Leale’s bias
`
`
`
`
`and Petitioner’s violations of PTAB practice rules, the Board should give no
`
`weight to his testimony.
`
`For all the reasons set forth above and throughout this Response, Patent
`
`Owner respectfully requests that the Board issue a final written decision in favor of
`
`Patent Owner finding that Petitioner has not shown that Claims 1-16 of the ’505
`
`Patent are unpatentable.
`
`II. THE ’505 PATENT
`
`The ’505 Patent concerns a novel method, apparatus, and system for
`
`retrofitting a vehicle. Claim 10 is illustrative:
`
`10. [10.p] A vehicle, comprising:
`
`[10.1] a factory-installed first apparatus including a first
`
`processor, programmed to receive a first message
`
`via a vehicle data bus from a factory-installed
`
`second apparatus, the first message having a
`
`message identifier; and
`
`[10.2] a retrofit apparatus, operatively connected to the
`
`vehicle data bus, including a second processor
`
`programmed to send a second message having the
`
`same message identifier.
`
`Ex. 1101, 12:14-22, identification elements in bracket added.
`
` 4
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`The ’505 Patent teaches a retrofit apparatus (exemplified as an emergency
`
`
`
`
`call apparatus) and its use in hacking a vehicle by sending spoofed messages.
`
`Many modern vehicles include a factory-installed first apparatus (e.g., a navigation
`
`system) that is connected to a second factory-installed apparatus (e.g., a
`
`telecommunication apparatus) via a vehicle data bus. To make the vehicle perform
`
`an action not originally enabled by its manufacturer, the ’505 Patent teaches adding
`
`a retrofit apparatus to the vehicle. See Ex. 1101, 2:48-53. The retrofit apparatus
`
`sends a spoofed (“mimicked”) message to the first apparatus. See Ex. 1101, 9:59-
`
`10:7.
`
`The ’505 Patent provides detailed instructions on how this spoofing is
`
`accomplished. It illustrates the structure of a vehicle network message (see Ex.
`
`1101, 10:30-35) and specifically discloses using the same message identifier for
`
`the spoofed message as has been assigned to the factory-installed first apparatus
`
`(see Ex. 1101, 9:63-64). Against the recognized standards of the time, the
`
`invention disclosed by the ’505 Patent does so while accepting possible message
`
`collisions, i.e., interference that occurs when two nodes on a data bus start
`
`transmitting at the same time. See Ex. 1101, 10:21-24; Ex. 2002, 31.
`
`The ’505 Patent shows block diagrams to teach the internal structure of a
`
`retrofit apparatus that can split an existing data bus into two separate busses and
`
`send spoofed messages. See Ex. 1101, Figs 6,7. The block diagrams are explained
`
` 5
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`in the specification. See Ex. 1101, 8:25-9:13. The ’505 Patent enables hacking pre-
`
`
`
`
`existing vehicles by providing detailed instructions not found in the prior art.
`
`III. CLAIM CONSTRUCTION
`
`The Petition was filed after November 13, 2018, the date of the Office’s
`
`adoption of the Phillips claim construction standard for IPRs. The claims therefore
`
`must be construed “in accordance with the ordinary and customary meaning of
`
`such claim as understood by one of ordinary skill in the art and the prosecution
`
`history pertaining to the patent.” 37 C.F.R. § 42.100(b).
`
`Petitioner proposes constructions of three claim terms. Pet., 6-12. Patent
`
`Owner proposes a different construction of three claim terms.
`
`A.
`
`“data bus”
`
`Petitioner proposes claim construction for the “data bus” based on expert
`
`testimony as “a contiguous network providing a communication channel for two or
`
`more modules”. Pet., 6. Petitioner’s proposed construction does not serve any
`
`discernable purpose. Petitioner defines the data bus as “a contiguous network”, but
`
`never uses the term “contiguous” again. Mr. Leale understands “contiguous” to
`
`simply mean “continuing, without break”. Ex. 2024, 17:2. But referring to a
`
`vehicle data bus as a “contiguous network” is confusing as that term has a specific
`
`meaning in other network technologies. See Ex. 2028, ¶21.
`
` 6
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Patent Owner submits that “bus” should be construed as defined in the
`
`
`
`
`applicable ISO-Standard 11898 as a “topology of a communication network, where
`
`all nodes are reached by passive links which allow transmission in both
`
`directions.” See Ex. 2002, 2; Ex. 2028, ¶¶21-22.
`
`B.
`
`“responds”
`
`Patent Owner does not recognize any disagreement with Petitioner as to
`
`what constitutes “responds” that would require clarification by the Board.
`
`C.
`
`“receives”
`
`Petitioner construes “receiving” messages too broadly. Negley’s Figure 8
`
`provides an overview of receiving CAN messages. See Ex. 1006, 11. Petitioner
`
`construes a message to be received when it arrives in the “Receive Assembly
`
`Registers” block. Consequently, all nodes on a bus receive all messages, and
`
`“receiving a message” becomes meaningless to differentiate nodes. See Ex. 2028,
`
`¶23. Patent Owner construes a message to be received when it has passed the
`
`Message Filters/Masks block and is accepted in the “Receive Register” block so
`
`that a microcontroller can act on it.
`
` 7
`
`
`
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`
`
`The ’505 Patent repeatedly refers to apparatuses being “configured to
`
`receive” (Ex. 1101, 1:51, 2:25, 9:40, 9:53, 9:56) or “programmed to receive” (Ex.
`
`1101, 11:43, 12:16). This indicates that “receiving” requires configuration or
`
`programming. In case of a CAN bus this includes setting appropriate message filter
`
`masks in the “Message Filters/Masks” block between the “Receive Assembly
`
`Registers” and “Receive Register” block. See Ex. 2028, ¶24.
`
`“Receive” should be construed as “accept”. This indicates, in the case of
`
`CAN, an acceptance of a message in a device’s receive register. Ex. 2028, ¶24. In
`
`his deposition, Mr. Leale agreed that one could refer to “receiving a CAN
`
`message” when it arrives in the receive register. Ex. 2024, 25:23-26:5.
`
` 8
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`This construction is consistent with Negley’s statement that “[e]ach node
`
`
`
`
`will most likely maintain different transmit buffer information and different filters
`
`that determine which messages to receive.” Ex. 1006, 15. It is consistent also with
`
`Munoz who claims a “device configured to receive input signals only from factory
`
`buttons, switches, and knobs.” Munoz, Claim 1, 8:22-23 and Claim 15, 9:59-60. If
`
`Petitioner’s construction of “receives” were applied, Munoz’s device, once
`
`connected to a bus, would “receive” all CAN messages and no longer fall within
`
`the scope of his claims.
`
`IV. PERSON HAVING ORDINARY SKILL IN THE ART
`
`Patent Owner acknowledges the Board’s preliminary ruling that a person of
`
`ordinary skill in the art would “have a bachelor’s degree in engineering with
`
`relevant coursework or post-secondary education (Bachelor’s or associate degree)
`
`and four years of work experience in the design, operation, and functioning of
`
`CAN systems.” Paper 10, 7. Patent Owner had previously maintained that a
`
`significantly higher level of experience would be appropriate. Here, Patent Owner
`
`has embraced the Board’s guidance and changed perspective to consider the prior
`
`art from the viewpoint of an entry-level engineer or experienced technician in
`
`2007. Patent Owner has taken a hands-on approach, identifying for example
`
`practical challenges a POSITA would have had to confront when asked to practice
`
`Munoz’s invention and modify an existing convertible so that its roof could be
`
` 9
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`opened while driving. The conclusions in this Response reflect this shift in
`
`
`
`
`perspective.
`
`V. BACKGROUND: HACKING VEHICLE NETWORKS
`
`It has become standard for modern vehicles to handle data traffic through a
`
`Controller Area Network bus, or CAN bus. One authority explains:
`
`At the heart of any modern vehicle’s interconnected
`
`systems is the Controller Area Network bus, or CAN bus.
`
`The CAN bus is a single, centralized network bus on
`
`which all of a vehicle’s data traffic is broadcast. The
`
`CAN bus carries everything from operator commands
`
`such as “roll down the windows” or “apply the brakes”,
`
`to readouts from sensors reporting engine temperature or
`
`tire pressure. The advent of the CAN bus brought about
`
`improvements in efficiency and a reduction in
`
`complexity while also reducing wiring costs.
`
`Ex. 2011, 5. CAN bus technology was first developed in the early 1980s:
`
`Development of the CAN bus protocol was begun in
`
`1983 by German company Robert Bosch GmbH. After
`
`three years of development, CAN bus technology hit the
`
`public market in 1986, first showing up in the BMW 850.
`
`Id., 9, citations omitted. At the time, Bosch touted CAN as “a serial
`
`communications protocol which efficiently supports distributed realtime control
`
`with a very high level of security.” Ex. 1010, 4, emphasis added. The
`
` 10
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`characterization of CAN as being secure, however, is not correct. It is now
`
`
`
`
`understood that CAN is inherently insecure:
`
`The CAN bus is a 30-year old architecture that was
`
`developed for various valid reasons, but security
`
`certainly was not one of them. Automakers at the time
`
`could not possibly envision the risk of cars being hacked
`
`decades into the future, nor could the governing bodies
`
`that mandated the CAN and OBD standards. The CAN
`
`architecture was designed to be lightweight and robust,
`
`and those qualities it accomplishes very well. However,
`
`CAN contains numerous vulnerabilities that are inherent
`
`in its design.
`
`Ex. 2011, 9. Though Bosch did not contemplate it at the time, spoofing of CAN
`
`messages has in more recent years become a standard technique for retrofitting
`
`cars. See Ex. 2028, ¶26. As one observer wrote in 2017:
`
`Spoofing a CAN identifier means that a compromised
`
`node attempts to use an identifier that it is not allowed to
`
`send, see Figure 1. This can be useful to pretend to be
`
`another node.
`
`Ex. 2012, 2, emphasis added.
`
`
`
` 11
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`Spoofing involves sending a message with the same identifier as another
`
`
`
`
`message. See Ex. 2024, 26:13-14. That is, a node uses an identifier that it is not
`
`allowed to send. See Ex. 2012, 2. Remarkably given its claim of obviousness,
`
`Petitioner is unable to present a single document that describes spoofing of CAN
`
`messages in over two decades from the first introduction of CAN until the April
`
`30th, 2007 priority date of the ’671 Patent. None of the cited references teach a
`
`CAN node using an identifier that it is not allowed to use. General familiarity with
`
`a CAN bus does not enable a POSITA to spoof CAN messages. See Ex. 2028, ¶26.
`
`VI. MR. LEALE HAS A CONFLICT OF INTEREST.
`
`The Board should discount Mr. Leale’s declaration because he has an
`
`interest in the outcome of this proceeding. During cross examination, Mr. Leale
`
`admitted that he himself installs retrofit devices and spoofs messages:
`
`Q. Okay. You were just discussing with respect to
`
`Allen -- where's Allen? -- that you have a lot of
`
`experience in hacking the door systems of cars; is
`
`that fair?
`
`A.
`
`The lock and unlock, so closure systems, yes.
`
`Q. And is that something you're -- is that something
`
`you’re doing as part of your business?
`
`A.
`
`I've been doing it for -- before I started my
`
`business.
`
`Q. Are you still doing it?
`
` 12
`
`
`
`
`
`
`
`
`
`Case IPR2020-00147
`Patent 10,027,505
`
`A.
`
`I am still, yes.
`
`Q. Are you installing retrofit apparatuses as part of
`
`that activity?
`
`A. Yes.
`
`Q. And are you spoofing CAN messages?
`
`A. Yes.
`
`Ex. 2024, 107:6-20. In other words, Mr. Leale appears to be infringing claims 1, 6,
`
`9, 10, and possibly other claims of the’505 Patent.
`
`Though this testimony is enough to show that Mr. Leale is a likely infringer,
`
`Petitioner’s attorney prevented Pa
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
