`
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`DATASPEED INC.,
`Petitioner,
`
`v.
`
`SUCXESS, INC.,
`Patent Owner.
`
`_______________
`
`Case IPR2020-00147
`U.S. Patent No. 10,027,505
`____________
`
`
`
`
`PETITIONER’S REPLY
`
`
`
`TABLE OF CONTENTS
`
`
`
`I.
`II.
`
`B.
`
`C.
`
`INTRODUCTION ........................................................................................... 1
`PATENT OWNER’S RESPONSE THEORY FAILS TO FULLY
`CONSIDER MUNOZ, AND DIRECTLY CONTRADICTS MANY OF
`MUNOZ’S EXPRESS TEACHINGS ............................................................. 2
`A.
`Patent Owner’s Discussion of Various Convertible Cars Is
`Irrelevant to Munoz’s Teachings........................................................... 3
`Patent Owner Interprets Munoz in a Manner Contrary to
`Munoz’s Own Teachings ...................................................................... 5
`Patent Owner’s Own Admissions Confirm that Munoz Teaches
`Spoofing ................................................................................................ 7
`Patent Owner’s “Diagnostic Message” Theory is Not Supported
`by Munoz ............................................................................................... 8
`E. Munoz Teaches Gateway Functions Performed by the Roof
`Control Module ..................................................................................... 9
`III. THE CHALLENGED CLAIMS ARE UNPATENTABLE WHEN
`MUNOZ’S TEACHINGS ARE CONSIDERED IN FULL..........................10
`A. Munoz Teaches A Retrofit Device Architecture That
`Terminates The Original Data Connection, Interfaces With Two
`Separate Buses, and Routes All Communications Through The
`Retrofit Device ....................................................................................11
`Petitioner Interprets Munoz as a POSITA Would—Consistently
`with Munoz’s Own Teachings ............................................................14
`C. Munoz’s Claims Support Petitioner, Not Patent Owner .....................22
`D.
`Claims 14-16 Are Rendered Obvious by Munoz alone or in
`view of Negley, SAE and Bosch, further in view of Lobaza ..............22
`IV. PETITIONER’S COMBINATION BASED ON ALLEN ESTABLISHES
`THAT CLAIMS 6-12 ARE UNPATENTABLE ..........................................22
`
`D.
`
`B.
`
`- i -
`
`
`
`V.
`
`PETITIONER’S COMBINATION BASED ON LOBAZA ESTABLISHES
`THAT CLAIMS 10 AND 14-16 ARE UNPATENTABLE ..........................25
`VI. CONCLUSION ..............................................................................................28
`
`
`
`
`
`
`- ii -
`
`
`
`TABLE OF AUTHORITIES
`
`Cases
`ClassCo, Inc. v. Apple, Inc.,
`838 F.3d 1214 (Fed. Cir. 2016) .....................................................................25
`Graham v. John Deere Co.,
`383 U.S. 1 (1966) ............................................................................................. 4
`In re Heck,
`699 F.2d 1331 (Fed. Cir. 1983) .................................................................1, 22
`Merck & Co., Inc. v. Biocraft Labs., Inc.,
`874 F.2d 804 (Fed. Cir. 1989) ...................................................................1, 21
`Novartis Pharm. Corp. v. West-Ward Pharm. Int’l Ltd.,
`923 F.3d 1051 (Fed. Cir. 2019) .....................................................................25
`Uber Technologies, Inc. v. X One, Inc.,
`2020 WL 2123399 (Fed. Cir. May 5, 2020) ..................................................26
`
`
`
`
`
`
`- iii -
`
`
`
`PATENT OWNER’S LIST OF EXHIBITS
`
`
`Exhibit
`Number
`1001-1003
`
`Reserved
`
`Exhibit Description
`
`1004
`
`1005
`
`1006
`
`1007
`
`1008
`
`1009
`
`1010
`
`1011
`
`1012
`
`1013
`
`U.S. Patent No. 7,737,831 to Munoz (“Munoz”)
`
`Installation Manual For A Multimedia Interface 1280
`(“Dietz”)
`
`“Getting Control Through CAN,” Sensors, October 2000, Vol.
`17, #10 (“Negley”)
`
`Annotated Version of Munoz (Ex. 1004), Fig. 1
`
`Annotated Version of U.S. Patent No. 9,871,671 (Ex. 1001),
`Fig. 4
`
`SAE Technical Paper Series, 930005, “A Gateway For CAN
`Specification 2.0 Non-Passive Devices,” by Szydlowski
`(“SAE”)
`
`Robert Bosch GbmH, “CAN Specification, Version 2.0”
`(“Bosch”)
`
`Johansson, Vehicle Applications Of Controller Area Network,
`Handbook of Networked and Embedded Control Systems,
`2005, pages 741-765 (“Johansson”)
`
`Dietz Invoice dated October 21, 2005 to Perzan Auto Radio,
`Inc., 6409 Market Street, Upper Darby PA 19082 for Order
`No. 101505
`
`Archived Version of Ex. 1005 (“Dietz”), Archived on March
`16, 2005, Retrieved from Internet Archive
`(https://web.archive.org/web/20050316204956/http://www.tm-
`techmark.com/touareg/PDFfiles/1280anl.pdf)
`
`- iv -
`
`
`
`Exhibit
`Number
`1014
`
`1015
`
`1016
`
`1017
`
`1018
`
`1019
`
`1020
`
`1021
`
`1022
`
`Exhibit Description
`
`U.S. Patent No. 6,812,832 to Lobaza et al. (“Lobaza”)
`
`Taube, Comparison of CAN Gateway Module For Automotive
`And Industrial Control Apparatus, CAN In Automation 2005
`
`Annotated Version of Dietz’s Illustration
`
`Curriculum Vitae of Robert Leale
`
`U.S. Patent Application Publication No. 2007/0016342
`(“Allen”)
`
`Annotated Fig. 1 of Allen
`
`Deposition Transcript of Mahdi Shahbakhti, Ph.D.
`
`Reserved
`
`Expert Declaration of Mahdi Shahbakhti, Ph.D. in IPR2020-
`00116
`
`1023-1100
`
`Reserved
`
`1101
`
`1102
`
`1103
`
`
`U.S. Patent No. 10,027,505 (the ’505 patent, or “Nix”)
`
`Prosecution History of U.S. Patent No. 10,027,505
`
`Declaration of Robert Leale (“Leale”)
`
`- v -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`Petitioner Dataspeed, Inc. files this Reply to Patent Owner Sucxess LLC’s
`
`Response (“POR”) to Dataspeed’s Petition for inter partes review against U.S.
`
`Patent No. 10,027,505 (the “’505 Patent”). Accompanying this Reply is the
`
`Deposition Transcript of Patent Owner’s expert, Dr. Shahbakhti (Ex. 1020).
`
`Because Dr. Shahbakhti’s deposition covered both the ’505 Patent and U.S. Patent
`
`No. 9,871,671 from IPR2020-00116, Dr. Shahbakhti’s Declaration from IPR2020-
`
`00116 (Ex. 1022) is also submitted.
`
`I.
`
`INTRODUCTION
`It is axiomatic in an obviousness challenge that a reference should be
`
`considered for all it teaches. In re Heck, 699 F.2d 1331, 1332-33 (Fed. Cir. 1983);
`
`Merck & Co., Inc. v. Biocraft Labs., Inc., 874 F.2d 804, 807 (Fed. Cir. 1989).
`
`Ignoring this tenet, Patent Owner plucks Munoz’s Roof Control Module 100 out of
`
`the automobile disclosed in Munoz, and fabricates an alternative way to implement
`
`this retrofit module using a “diagnostic message” in other automobiles. In
`
`particular, while Munoz discloses the retrofit module installed in an automobile
`
`with roof controls located in the dashboard, Patent Owner presumes how the
`
`retrofit module could have been implemented in automobiles having roof controls
`
`that are directly connected to the roof’s electronics.
`
`But Patent Owner’s approach is legally erroneous, and fails to consider
`
`Munoz for everything it teaches. Determining how a retrofit device could have
`
`- 1 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`been commercially implemented in other vehicles is a different question than
`
`determining whether the ’505 Patent claims are obvious in view of Munoz,
`
`including the specific automobile disclosed in Munoz. The latter, not the former,
`
`question is before the Board in this proceeding. Evaluated correctly, the
`
`challenged claims of the ’505 Patent are obvious over Munoz, and also over Allen
`
`and Lobaza, as explained in the Petition.
`
`II. PATENT OWNER’S RESPONSE THEORY FAILS TO FULLY
`CONSIDER MUNOZ, AND DIRECTLY CONTRADICTS MANY OF
`MUNOZ’S EXPRESS TEACHINGS
`Patent Owner initially addresses “two critical elements” it believes are
`
`absent from the asserted prior art. POR, 2. First, Patent Owner says that “none of
`
`the prior art shows any first (original) message that is being spoofed.” Id. Second,
`
`Patent Owner claims that “the prior art does not teach a second (spoofed) message
`
`that is indistinguishable from a first message, mimics the first message, or has the
`
`same identifier as the first message.” Id., 3. Patent Owner expands these two
`
`points into three enumerated “differences” between Munoz and the ’505 Patent,
`
`addressed with respect to an annotated version of Munoz’s Fig. 1. POR, 33-34.
`
`Those alleged differences are based on Patent Owner’s self-serving presumption
`
`that “Munoz must be implemented as shown” below:
`
`- 2 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`
`
`POR, 33; Ex. 2028, ¶49. Patent Owner’s presumption is wrong and legally
`
`irrelevant to the question posed to the Board. Further, Patent Owner’s
`
`interpretation of Munoz’s implementation directly contradicts multiple express
`
`disclosures in Munoz itself.
`
`A.
`
`Patent Owner’s Discussion of Various Convertible Cars Is
`Irrelevant to Munoz’s Teachings
`Patent Owner attacks a strawman when it bases its Response on what Patent
`
`Owner believes would be a commercial implementation of Alex Munoz’s retrofit
`
`product into a VW Eos, rather than on Munoz’s actual disclosures. POR, 32; id.,
`
`35 (arguing that “Munoz demonstrated his invention in a VW Eos in which the
`
`roof buttons are part of the original roof electronics 110.”); see also Ex. 2028, ¶57
`
`- 3 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`(“[I]t is my opinion that Munoz’s invention had been demonstrated in a VW Eos.
`
`My further analysis is therefore based on that vehicle.”).
`
`Critically, in Munoz, the automobile’s original dashboard 105 includes
`
`“vehicle factory dashboard electronics and controls that are used to control Roof
`
`Control Electronics 110.” Munoz, 6:26-30. As a result, control signals to control
`
`Roof Control Electronics 110 are sent over Munoz’s CAN bus before the retrofit,
`
`and through Roof Control Module 100 and two separate CAN buses after the
`
`retrofit.
`
`In the automobile that Patent Owner evaluates, Patent Owner claims that the
`
`factory cabriolet top open/close buttons “are part of original electronics and
`
`actuators to operate factory installed roof 110.” POR, 33-34. But inserting
`
`Munoz’s device into a differently-configured automobile is a diversion from, and
`
`irrelevant to, the legal determination of obviousness based on Munoz’s teachings.
`
`Nothing in the Graham factors requires (or even permits) a POSITA to view the
`
`prior art technology solely through the lens of subsequent commercial
`
`implementations of that technology. See, e.g., POR, 30 (reciting the factors of
`
`obviousness according to Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966)).
`
`Yet this is exactly the legal error that Patent Owner invites here.
`
`Moreover, Patent Owner’s expert was unable to answer whether inventor
`
`Alex Munoz was aware of the VW Eos wiring configuration when Munoz’s patent
`
`- 4 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`application was filed with the USPTO. Ex. 1020, 91:14-92:2. There is no record
`
`evidence that would establish that the Munoz reference was intended to be
`
`identical in disclosure to any later-developed commercial implementation of that
`
`technology. As such, Patent Owner’s evaluation of the commercial
`
`implementation has no bearing on how a POSITA would have interpretated the
`
`Munoz reference.
`
`B.
`
`Patent Owner Interprets Munoz in a Manner Contrary to
`Munoz’s Own Teachings
`Based on retrofit installation in a VW Eos, Patent Owner incorrectly
`
`interprets Munoz in a manner that is inconsistent with many of Munoz’s
`
`disclosures:
`
`(1) Rather than having an “original data connection [that] will be
`
`terminated,” as expressly taught in Munoz’s Fig. 1, block 115, Patent Owner
`
`presumes without evidence that Munoz’s original data connection is maintained
`
`via an “Internal Connection” or passthrough in Munoz’s retrofit. POR, 34. There
`
`is no “Internal Connection” or passthrough disclosed in Munoz’s Roof Control
`
`Module 100 or device 200.
`
`(2) Rather than acknowledging Munoz’s express disclosure of “a first
`
`CAN-bus” and “a second CAN-bus,” see, e.g., Munoz, 6:37-40, Fig. 2, Dr.
`
`Shahbakhti asserts that Munoz teaches only a single CAN-bus, and dashboard 105
`
`- 5 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`and Roof Control Electronics 110 are connected via that single CAN even after the
`
`retrofit is installed. Ex. 2028, ¶84.
`
`(3) Rather than having the capability for “removing or altering data
`
`exchanged,” see, e.g., Munoz, Fig. 1, block 100, Patent Owner contends that
`
`Munoz has no ability to remove CAN-bus frames or alter CAN-bus frames. POR,
`
`18 (“A CAN bus does not provide any mechanism for ‘removing’ data.”); Ex.
`
`1020, 94:4-11.
`
`(4) Rather than having an original dashboard 105 with “vehicle factory
`
`dashboard electronics and controls that are used to control Roof Control
`
`Electronics 110,” see, e.g., Munoz, 6:28-30, Patent Owner claims that the factory
`
`cabriolet top open/close buttons “are part of original electronics and actuators to
`
`operate factory installed roof 110.” POR, 33-34.
`
`(5) Rather than having “all communication” “go through the roof control
`
`module [100],” see, e.g., Munoz, Fig. 1, block 115, including communications
`
`from the controls in dashboard 105 to the Roof Control Electronics 110, Patent
`
`Owner claims that there is no “first” message sent from dashboard 105 to control
`
`Roof Control Electronics 110. POR, 34.
`
`(6) Rather than acknowledging the “switch 120” between separate CAN
`
`buses as shown in Munoz, see, e.g., Munoz, 6:32-36, Fig. 1, Patent Owner’s
`
`expert claims to be confused about this disclosure and doubts whether switch 120
`
`- 6 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`actually exists. Ex. 2028, ¶80; Ex. 1020, 60:18-61:8 (“I truly believe that this is a
`
`virtual switch.”).
`
`Rather than crediting all of Munoz’s teachings, Patent Owner instead
`
`chooses to ignore these disclosures while developing its alternative theory about
`
`how Munoz’s technology was implemented in the VW Eos. This failure to
`
`consider Munoz for all it teaches confirms that Patent Owner’s theory cannot be
`
`correct.
`
`C.
`
`Patent Owner’s Own Admissions Confirm that Munoz Teaches
`Spoofing
`Patent Owner also argues that none of the prior art expressly uses the term
`
`“spoofing.” But neither do the challenged claims. More importantly, Dr.
`
`Shahbakhti admits that “[t]he only reason [he] can imagine why a POSITA would
`
`separate an existing CAN bus into two separate busses is to spoof a periodic CAN
`
`message … .” Ex. 2028, ¶91 (emphasis added). Separating the integrated CAN
`
`bus into two separate buses is exactly what Munoz discloses in Fig. 1, element
`
`115, and Fig. 2. See also Munoz, 6:37-40 (disclosing a first and a second CAN
`
`bus interfacing with Module 200). This evidence confirms that Munoz is
`
`separating the existing CAN bus into two separate buses precisely because Munoz
`
`is spoofing CAN messages.
`
`Finally, Patent Owner’s search for the term “spoofing” is a diversion.
`
`Patent Owner and its expert never allege that Patent Owner “invented” spoofing,
`
`- 7 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`Patent Owner characterizes CAN buses as “inherently insecure,” (POR, 11), and
`
`Dr. Shahbakhti even concedes that automotive manufacturers were aware of the
`
`dangers of spoofing for some time and tried to hide that concern from the public.
`
`Ex. 2028, ¶27.1
`
`D.
`
`Patent Owner’s “Diagnostic Message” Theory is Not Supported
`by Munoz
`Patent Owner’s “diagnostic message” theory is also wrong in the context of
`
`Munoz. Munoz does not disclose adding new messages to the CAN bus to
`
`perform the retrofit’s roof control module functions—it discloses altering or
`
`removing data. See Munoz, Fig. 1 (100). Patent Owner cannot fully explain this
`
`disclosure, whereas Petitioner’s interpretation fully credits this disclosure and
`
`explains that Munoz achieves additionally functionality by suppressing CAN bus
`
`messages indicating vehicle speed from the dashboard 105 to Roof Control
`
`Electronics 110, which may otherwise prohibit roof operation. Pet., 27-28;
`
`Munoz, 3:54-64. Moreover, Patent Owner cannot reconcile its “diagnostic
`
`message” theory with Munoz’s disclosure that the controls for the Roof Control
`
`Electronics 110 are in the dashboard 105.
`
`
`
`
`1 At deposition, Dr. Shahbakhti could not say how long automotive manufacturers
`were aware of spoofing. Ex. 1020, 81:22-82:17.
`
`- 8 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`E. Munoz Teaches Gateway Functions Performed by the Roof
`Control Module
`As argued in the Petition, a POSITA would understand that Munoz
`
`discloses the Roof Control Module acting as a gateway. Pet., 22-23; Ex. 1103,
`
`¶¶126-48, 163-64. Patent Owner fails to rebut that the Roof Control Module
`
`having the ability to “alter[]” and “remov[e]” data teaches the Roof Control
`
`Module acting as a gateway.
`
`To oppose Petitioner’s explanation of Munoz, Patent Owner relies upon
`
`Munoz’s Fig. 3 to argue that the Roof Control Module 100 does nothing when
`
`“off.” POR, 48. But Munoz does not support Patent Owner’s interpretation.
`
`With respect to Fig. 3, Munoz describes the initial step 300 as “the start of device
`
`operations.” Munoz, 6:43-44 (emphasis added). “Operation 305 represents the
`
`on/off switch that determines whether or not the device features are activated,”
`
`not whether the device is capable of serving as a gateway. Munoz, 6:44-46
`
`(emphasis added); see also id., 7:15-65 (describing Figs. 4-7). Per these
`
`teachings, the device is powered on, device operations have started, and the device
`
`can be checked for whether the additional functions are activated at operations
`
`300, 400, 500, 600, and 700. These disclosures confirm that the retrofit device is
`
`available to serve as a gateway even where the additional device features are not
`
`activated at steps 305, 405, etc.... This does not conflict with Petitioner’s
`
`understanding of Munoz.
`
`- 9 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`Moreover, Patent Owner all but admits that Munoz discloses a gateway.
`
`Addressing Munoz’s reference to “removing or altering data” in Fig. 1, box 100,
`
`Patent Owner concedes that “[a] CAN bus does not provide any mechanism for
`
`‘removing’ data.” POR, 18. This is exactly the point—for Munoz’s Roof Control
`
`Module 100 to perform the disclosed function of removing or altering data, it has
`
`more than just a passthrough, and also acts as a gateway. Patent Owner offers to
`
`no other credible explanation of how the Roof Control Module 100 performs this
`
`disclosed function, and it is improper to formulate a theory about Munoz’s
`
`structure and operation while specifically ignoring those disclosures that do not fit
`
`Patent Owner’s theory.
`
`As Dr. Shahbakhti conceded at deposition that “[i]f there are two different
`
`buses, it would be a legitimate reason to have a – a gateway between these two
`
`buses.” Ex. 1020, 85:11-13. This is exactly what Munoz discloses: two different
`
`buses, and a gateway interfacing with those two buses.
`
`III. THE CHALLENGED CLAIMS ARE UNPATENTABLE WHEN
`MUNOZ’S TEACHINGS ARE CONSIDERED IN FULL
`In the Board’s Decision on Institution, the Board determined that Petitioner
`
`had demonstrated a reasonable likelihood of success in establishing the
`
`unpatentability of claims 1-16 based on the teachings of Munoz, Negley, SAE,
`
`Bosch, Lobaza, and Allen. D.I., 15-20, 24, 25.
`
`Patent Owner’s Response raises no argument as to the motivation for
`
`- 10 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`combining these reference teachings.2 Patent Owner’s Response only challenges
`
`Petitioner’s limitation-by-limitation comparison, but fails to put any of this
`
`limitation-by-limitation analysis into dispute.
`
`A. Munoz Teaches A Retrofit Device Architecture That Terminates
`The Original Data Connection, Interfaces With Two Separate
`Buses, and Routes All Communications Through The Retrofit
`Device
`As explained in the Petition, Munoz’s Fig. 1 discloses that a vehicle has a
`
`factory-installed first apparatus 110 (Roof Control Electronics) programmed to
`
`communicate with a factory-installed second apparatus 105 (“original dashboard,
`
`internal sensors and electronics”) through vehicle data bus. Pet., 13-14 (“The
`
`original data connection [providing the ‘first message’] is shown as dotted line ‘C’
`
`in Ex. 1007, the annotated version of Munoz’s Fig. 1 shown below.”).
`
`
`2 Patent Owner has waived any argument it could have raised against a motivation
`to combine the asserted references. See Paper 11, 8 (“[A]ny arguments not raised
`in the response may be deemed waived.”).
`
`- 11 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`
`
`Id. During installation, the retrofit module 100 is connected to the 2nd factory-
`
`installed apparatus 105 via the original CAN bus, shown above as “A,” and is
`
`connected to the 1st factory-installed apparatus 110 by an added second bus
`
`designated “B” above. Ex. 1103, ¶¶139-45, 154. When open, switch 120
`
`terminates the connection between the 1st factory-installed apparatus 110 and the
`
`2nd factory-installed apparatus 105 (Munoz, 6:32-36), thereby electrically
`
`disconnecting the vehicle data bus between these two factory-installed apparatuses.
`
`Ex. 1103, ¶¶143, 154.
`
`- 12 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`Fig. 2 similarly illustrates that Munoz’s retrofit device 200 “is connected
`
`among a first and second vehicle CAN-bus.” Munoz, 5:40-42, 6:37-40, Fig. 2.
`
`
`
`Munoz also teaches that “original data connection will be terminated so all
`
`communication has to go through the roof control module,” (Fig. 1, box 115) and
`
`Roof Control Module 100 can “remov[e] or alter[] data … to allow additional
`
`operations normally not available to operate an automatic folding roof or sunroof.”
`
`Fig. 1, 100. Munoz’s teaching of terminating the original data connection is
`
`consistent with Fig. 1, including switch 120 separating two separate buses (Munoz,
`
`6:32-36), and Fig. 2, which shows the retrofit device 200 connected to two CAN
`
`buses via two interfaces.
`
`
`
`
`
`- 13 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`B.
`
`Petitioner Interprets Munoz as a POSITA Would—Consistently
`with Munoz’s Own Teachings
`As established by Petitioner, a POSITA would have understood that in
`
`Munoz, there is a “first (original) message that is being spoofed,” and “a second
`
`(spoofed) message that is indistinguishable from a first message, mimics the first
`
`message, or has the same identifier as the first message.,” Cf. POR, 2. Unlike
`
`Patent Owner’s interpretation, Petitioner’s interpretation does not conflict with
`
`Munoz’s disclosures:
`
`(1) A POSITA would credit Munoz’s express teaching that an “original
`
`data connection will be terminated” and a retrofit Device 200, including Roof
`
`Control Module 100, is inserted with separate interfaces for each of the two
`
`resulting CAN buses. Munoz, Fig. 1, block 115; Fig. 2.
`
`(2) A POSITA would credit Munoz’s express teaching of a retrofit
`
`connected to “a first CAN-bus” and “a second CAN-bus,” see, e.g., Munoz,
`
`6:37-40, Figs. 1-2. As shown in Figs. 1 and 2 of Munoz, the Device 200 (including
`
`Roof Control Module 100) connects to two CAN buses, shown as A and B in Ex.
`
`1007, where each CAN bus is connected to the Device 200 using separate
`
`interfaces.
`
`Though Patent Owner disputes this interpretation, Patent Owner’s expert
`
`conceded during deposition that Munoz expressly teaches two separate buses. Ex.
`
`1020, 85:14-22; see also Munoz, 6:37-40. Further, he conceded that the device
`
`- 14 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`200 shown in Fig. 2 includes the added retrofit Roof Control Module 100, as
`
`Munoz expressly discloses. Ex. 1020, 90:20-22 (“I expect the POSITA will think
`
`that [Roof Control Module] 100 will be part of the Vario plus control module
`
`[200].”), 91:1-5; see also Munoz, 6:30-31 (“100 illustrates that Roof Control
`
`Module, which is a portion of the device [200] devoted to roof or cabriolet top
`
`controls.”).
`
`Patent Owner also overlooks that Munoz shares common architecture with
`
`the ’505 Patent’s FIG. 7. FIG. 7 shows that BUS1 and BUS2 are wired to separate
`
`vehicle data bus interfaces 504, 700. Munoz describes this same arrangement,
`
`where the retrofit module 100 is disclosed as having “2 interfaces” and connected
`
`to “a first CAN-bus 210 and a second CAN-bus 205.” Munoz, Fig. 2, 6:37-40.
`
`(3) A POSITA would credit Munoz’s express teaching that the retrofit
`
`device 100 has the capability for “removing or altering data exchanged” between
`
`original CAN-bus nodes, see, e.g., Munoz, Fig. 1, block 100. By these
`
`disclosures, Munoz is describing aspects of a CAN-bus gateway internal to Roof
`
`Control Module 100 that connects Munoz’s two separate CAN buses. A CAN bus
`
`gateway permits removing CAN bus frames entirely or altering data within CAN
`
`bus frames. Pet., 22-23; Ex. 1103, ¶¶126-48, 163-64.
`
`As noted above, Munoz’s block 100 discloses that the retrofit Roof Control
`
`Module 100 can remove or alter data “to allow additional operations normally not
`
`- 15 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`available to operate an automatic folding roof or sunroof.” Munoz, Fig. 1 (100);
`
`see also id., 3:13-18; 3:62-64; 4:15-27; 5:14-20. Under Patent Owner’s theory,
`
`even after the Roof Control Module 100 is installed, original dashboard 105 and
`
`original electronics and actuators 110 are connected to a single, common bus
`
`(POR, 33) and Roof Control Module 100 is not a “gateway,” despite the
`
`undisputed fact that a gateway can connect separate buses. Ex. 1020, 17:6-18:3
`
`(discussing gateway advantages and functions).
`
`Further, Dr. Shahbakhti goes to great lengths in his Declaration to explain
`
`that he believes “altering” in Munoz is actually referring to the concept of
`
`“tampering.” Ex. 2028, ¶34. Even if Dr. Shahbakhti’s efforts to rewrite Munoz’s
`
`“altering” could be accepted, he never explains how Munoz’s Roof Control
`
`Module “remov[es]” data to allow additional operations normally not available to
`
`operate an automatic roof or sunroof without serving as a gateway. Id. The only
`
`explanation supported by the record evidence—including Munoz and Ex. 1103—is
`
`that the Roof Control Module 100 is a gateway, with separate interfaces connected
`
`to a first bus and a second bus.
`
`(4) A POSITA would credit Munoz’s disclosure of an original dashboard
`
`105 having “vehicle factory dashboard electronics and controls that are used to
`
`control Roof Control Electronics 110,” see, e.g., Munoz, 6:26-30. A POSITA
`
`- 16 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`would also understand the that the “controls that are used to control Roof Control
`
`Electronics 110” are exactly where Munoz says they are—in element 105.
`
`In contrast, Patent Owner’s strained theory assumes that the controls for
`
`Roof Control Electronics 110 are directly connected, or hard-wired, to element
`
`110, as shown below:
`
`
`
`POR, 33.
`
`
`
`
`
`This is wrong. Munoz expressly discloses that the controls for the Roof
`
`Control Electronics 110 are in the dashboard 105, not directly connected to Roof
`
`Control Electronics 110. Munoz, 6:26-30. Dr. Shahbakhti stated at deposition that
`
`he believed this particular disclosure is limited to the post-retrofit arrangement of
`
`roof controls based on his evaluation of the VW Eos. Ex. 1020, 39:1-40:22; Ex.
`
`2028, ¶57; see also POR, 35. But this is inconsistent with Munoz, which never
`
`states that the controls for the roof are changed from pre-retrofit to post-retrofit.
`
`Rather, Munoz’s “device does not rely upon new buttons, controls, or displays.”
`
`See, e.g., Munoz, 1:55-60; 3:10-12; 3:18-21; 3:34-36; 3:43-45; 3:49-50; 4:25-26;
`
`4:56-59; 5:21-26. Thus, Munoz’s express disclosure indicates that the controls are
`
`the same both before and after the retrofit, and are part of dashboard 105.
`
`- 17 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`
`
`Because Patent Owner is wrong about the location of the controls for the
`
`Roof Control Electronics 110, Patent Owner draws other conclusions that are
`
`inconsistent with Munoz. Patent Owner and Dr. Shahbakhti claim that there is no
`
`communication between the dashboard 105 and the Roof Control Electronics 110
`
`before the retrofit is installed. POR, 38 (“Munoz does not disclose any
`
`communication between the original dashboard 105 and the roof control
`
`electronics 110.”); see also Ex. 2028, ¶61.3 This cannot be correct, since “the
`
`vehicle factory dashboard electronics and controls that are used to control Roof
`
`Control Electronics 110” are located in dashboard 105. Munoz, 6:26-30. Patent
`
`Owner offers no explanation how the factory dashboard 105 can control Roof
`
`Control Electronics 110 without sending a message.
`
`Further, Patent Owner’s argument that Munoz fails to disclose or suggest a
`
`“first message” as claimed depends entirely upon Patent Owner’s unsupported
`
`allegation about where Munoz’s controls for the Roof Control Electronics are
`
`located. Under the proper interpretation of Munoz, a “first message” from the
`
`dashboard 105 is sent to control the Roof Control Electronics 110 to open or close
`
`the roof, and this same “first message” is sent to the Roof Control Module 100 via
`
`the first bus after Munoz’s retrofit is installed. Pet., 13-17, 19-20.
`
`
`3 Dr. Shahbakhti conceded at deposition, however, that the “original data
`connection” being terminated per Munoz’s block 115 in Fig. 1 “could include 105
`to 110.” Ex. 1020, 95:13-22.
`
`- 18 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`As explained in the Petition, a POSITA would have understood that when
`
`the aftermarket functionality is disabled, a first CAN message sent from the
`
`original dashboard 105 intended for the Roof Control Electronics 110 would have
`
`been received by the retrofit Roof Control Module 100 via bus “A”, which would
`
`have transmitted a second CAN message via bus “B”, indistinguishable from the
`
`first CAN message, to the Roof Control Electronics 110 with the proper
`
`information in the identifier field, and the identical command from the original
`
`dashboard 105. Pet., 13-17, 19-20; Ex. 1103, ¶¶132, 158. This is to cause the
`
`Roof Control Electronics 110 to recognize, accept, and act upon the second
`
`message. This would have allowed the Roof Control Electronics 110 to perform
`
`its original, pre-existing features as originally programmed despite the addition of
`
`Munoz’s device 100.
`
`To provide alternative functionality, the data within a message frame could
`
`be altered while keeping the same message identifier. In that case, the Roof
`
`Control Electronics 110 would recognize, accept, and act upon the second message
`
`since the altered frame would use an identical message identifier as an original first
`
`message.
`
`Notably, Patent Owner’s dispute with this argument is limited to whether
`
`there is a first message disclosed in Munoz. POR, 37-42. If the Board finds that
`
`there is a “first” message, as Munoz’s express disclosures indicates, Patent Owner
`
`- 19 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`has no argument to rebut that Munoz’s Roof Control Module 100 continues to
`
`receive that “first” message after the retrofit installation, and transmits an
`
`indistinguishable “second” message to the Roof Control Electronics 110 to
`
`accomplish the new aftermarket features.
`
`(5) A POSITA would credit Munoz’s disclosure that “all communication”
`
`“go[es] through the roof control module,” see, e.g., Munoz, Fig. 1, block 115.
`
`A POSITA would understand that dashboard 105, which originally
`
`communicated with Roof Control Electronics 110 over the original CAN-bus,
`
`would instead send its control communication through the Roof Control Module
`
`100 over a first CAN-bus A, and the Roof Control Module 100 would then decide
`
`whether to send an indistinguishable message, or altered message, over a second
`
`CAN-bus B, to Roof Control Electronics 110. Ex. 1007. Thus, Munoz discloses a
`
`“first (original) message that is being spoofed” and “a second (spoofed) message
`
`that is indistinguishable from a first message, mimics the first message, or has the
`
`same identifier as the first message,” contrary to the Response. POR, 2.
`
`(6) A POSITA would not ignore Munoz’s disclosure of “switch 120” see,
`
`e.g., Munoz, 6:32-36. A POSITA would understand that Munoz provides a switch
`
`120 that separates the original data connection when opened or, when closed,
`
`reconnects the separate buses to restore the original data connection should the
`
`retrofit fail or otherwise be in need of service. Ex. 2024, 50:11-54:6. This gives
`
`- 20 -
`
`
`
`IPR2020-00147 Petitioner’s Reply
`
`proper credit to Munoz’s disclosure that the data connection is terminated and “a
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
