IPR2020-00337
`U.S. Patent No. 6,771,646
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`____________
`
`JUNIPER NETWORKS, INC. and PALO ALTO NETWORKS, INC.,
`
`Petitioner,
`
`v.
`
`PACKET INTELLIGENCE LLC,
`
`Patent Owner.
`
`____________
`
`Case IPR2020-00337
`
`U.S. Patent No. 6,771,646
`
`____________
`
`
`
`PETITIONER’S REPLY TO PATENT OWNER’S RESPONSE
`
`
`
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`
`TABLE OF CONTENTS
`
`I.
`
`II.
`
`INTRODUCTION ......................................................................................... 1
`
`PO’S ATTEMPT TO NARROW THE MEANING OF
`“CONVERSATIONAL FLOW” CONTRADICTS THE
`SPECIFICATION AND EXCLUDES EMBODIMENTS. ........................ 2
`
`B.
`
`III. RIDDLE DISCLOSES CONVERSATIONAL FLOWS (ALL
`GROUNDS). ................................................................................................... 8
`A.
`PO Does Not Dispute that Riddle Discloses Conversational
`Flows Under the Board’s Construction. ..............................................10
`Even under PO’s Incorrect Construction, Riddle Discloses
`Conversational Flows. .........................................................................11
`1.
`Riddle classifies activities based on a particular client. ...........11
`2.
`Riddle aggregates inbound and outbound components of
`a conversational flow. ...............................................................13
`Riddle distinguishes between different activities of the
`same type. ..................................................................................13
`
`3.
`
`IV. THE PRIOR ART DISCLOSES THE STATE-BASED
`LIMITATIONS (ALL GROUNDS). ..........................................................14
`
`V.
`
`THE RIDDLE-FERDINAND COMBINATION RENDERS
`OBVIOUS THE FLOW-ENTRY DATABASE LIMITATIONS
`(ALL GROUNDS). ......................................................................................18
`
`VI. YU IS PRIOR ART, TEACHES CONVERSATIONAL FLOWS,
`AND A POSITA WOULD HAVE BEEN MOTIVATED TO
`MODIFY RIDDLE’S TEACHINGS IN VIEW OF YU (GROUND
`2). ...................................................................................................................19
`A. Yu is Prior Art. ....................................................................................19
`B.
`Yu’s “Conversational Flow” ...............................................................21
`C. Motivation to Modify Riddle’s Teachings in View of Yu ..................23
`
`VII. RFC1945’S HTTP REFERRERS RENDER OBVIOUS THE
`“CONVERSATIONAL FLOW” LIMITATIONS (GROUND 3). .........25
`
`i
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`VIII. THE PRIOR ART RENDERS OBVIOUS DEPENDENT CLAIM
`3’S “ASSOCIATIVE CACHE” (GROUNDS 1-3). ..................................27
`A.
`“Associative Caches” Were Well Known ...........................................27
`B. Motivation to Modify Riddle’s Teachings in View of Wakeman ......28
`
`IX. CONCLUSION ............................................................................................30
`
`
`
`* * * *
`
`USE OF EMPHASIS IN QUOTATIONS
`
`All emphases in quotations and exhibit citations have been added, unless
`
`otherwise indicated.
`
`
`
`APPLICABLE STATUTES
`
`References to 35 U.S.C. §§102 and 103 are to the pre-AIA versions applicable
`
`to the ’646 Patent.
`
`ii
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`
`I.
`
`INTRODUCTION
`
`Patent Owner doesn’t dispute that the art of record teaches a “conversational
`
`flow” as construed by the Board. Rather than address the trial grounds under the
`
`Board’s construction, PO again argues—as it did in its POPR and Rehearing Re-
`
`quest—that a “conversational flow” must be further limited to define only those
`
`flows of a particular client. The Board has already rejected PO’s argument twice,
`
`and the POR offers no new evidence or arguments warranting a different outcome.
`
`Indeed, the Board’s rejection of PO’s position remains sound. The specifica-
`
`tion contains no language that limits conversational flows to activity by a particular
`
`client. The specification instead broadly discloses multiple examples of a “conver-
`
`sational flow” that aren’t client-specific. And PO’s argument, if accepted, would
`
`exclude these embodiments from the scope of “conversational flow” based upon
`
`only unsupported attorney argument. Despite the extensive litigation history of
`
`these patents, this marks the first proceeding in which PO has asserted this narrow,
`
`embodiment-excluding construction of “conversational flow.”
`
`But even applying PO’s incorrect construction, Riddle and Yu nevertheless
`
`teach “conversational flow.” And PO’s remaining arguments attack the prior art
`
`references individually rather than in combination and as bodily incorporated com-
`
`binations nowhere presented in the petition. Neither approach provides a basis to
`
`1
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`contradict the Board’s prior reasoning. Thus, all challenged claims are unpatenta-
`
`ble.
`
`II.
`
`PO’S ATTEMPT TO NARROW THE MEANING OF “CONVERSA-
`TIONAL FLOW” CONTRADICTS THE SPECIFICATION AND EX-
`CLUDES EMBODIMENTS.
`
`The term “conversational flow” appears in every challenged claim. The
`
`Board adopted a construction that mirrors definitional language in the related ’099
`
`Patent—“the sequence of packets that are exchanged in any direction as a result of
`
`an activity.”1 PO doesn’t address the trial grounds under that construction. Thus,
`
`when applying its prior construction, the Board should find that the prior art ren-
`
`ders obvious every challenged claim.
`
`Rather than address the Board’s construction, PO argues again that a “con-
`
`versational flow” is limited to a single instance of an activity by a “particular user
`
`or client device.”2 But PO premises its argument on the unsupported position that
`
`“activity” (as used in the Board’s construction of “conversational flow”) is limited
`
`to one “involv[ing] an application and a particular client device.”3 The Board al-
`
`ready rejected this same argument multiple times, and should do so again.4 Indeed,
`
`
`1 ID, 27-29. The ’646 incorporates-by-reference the ’099’s application. ’646, 1:16-
`
`18.
`
`2 POR, 3, 10-11, 24-26.
`
`3 Id., 38.
`
`4 ID, 28-29; R’hrg Dec., 3-6.
`
`2
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`PO offers no new evidence or argument that would warrant a change of the
`
`Board’s construction. To be sure, Ms. Quigley never addresses PO’s proposal that
`
`“conversational flow” requires activity involving an application and a particular
`
`client device.5
`
`The definitional language of “conversational flow” doesn’t contain any re-
`
`quirement for identifying flows based on a particular user or client.6 Likewise, the
`
`language that follows imposes no such requirement, supplying only examples:
`
`“[F]or instance, the running of an application on a server as requested by a cli-
`
`ent….some conversational flows involve more than one connection, and some even
`
`involve more than one exchange of packets between a client and server….”7
`
`To the contrary, the related ‘099 Patent states that a “conversational flow”
`
`may “involve more than one connection,” and encompasses connections that aren’t
`
`limited to a single user/client.8 Indeed, certain disclosed embodiments describe that
`
`different clients may be part of the same conversational flow when they relate to
`
`the same activity—e.g., use of the same print service or application program. For
`
`example, the ’903 Provisional, which the specification incorporates-by-reference
`
`
`5 Ex. 2061, ¶¶41, 44, 80-86.
`
`6 ‘099, 2:37-40.
`
`7 Id., 2:39-45.
`
`8 Id.
`
`3
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`(‘646, 1:7-11), describes identifying packets as part of a conversational flow when
`
`those packets originate from different clients:
`
`Some conversational flows involve more than one connection …. For
`
`example, SAP (Service Advertising Protocol) is a NetWare (Novell
`
`Systems, Provo, Utah) protocol used to identify the services and ad-
`
`dresses of servers attached to a network…. It is desirable for a network
`
`packet monitor to be able to “virtually concatenate” the first exchange
`
`that defines SAP #5 as the print service on the server with the second
`
`exchange that uses the print service. The two packet exchanges would
`
`then be correctly identified as being part of the same flow if the clients
`
`were the same. They would even be recognized if the clients were not
`
`the same. One feature of the invention is to correctly identify the sec-
`
`ond exchange as being associated with a print service on the server.
`
`Other protocols that are similar in that they may lead to disjointed
`conversational flows include ….9
`
`
`9 Ex. 1016, 3:9-4:2. The specification contains a similar disclosure, which PO se-
`
`lectively quotes by omitting the clarification that, even where the clients are differ-
`
`ent, exchanges with the same print service are part of the same conversational
`
`flow. Compare POR, 10-11, 37-38 with ’099, 3:44-51.
`
`4
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Similarly, the ’099 Patent describes embodiments involving the RPC protocol,
`
`whereby network monitor 300 associates packet communications involving differ-
`
`ent clients (CLIENT 1 and CLIENT 2) when they result from the same activity
`
`(e.g., use of an application program running on SERVER 2).10
`
`In these examples, the ’099 Patent describes connections involving different
`
`clients that the monitor recognizes as comprising the same conversational flow be-
`
`cause they result from the same activity. PO’s own expert agrees that communica-
`
`tions from different clients may be associated into a single “conversational flow,”
`
`stating: “By recognizing the context of a sequence of packets, packets can be asso-
`
`ciated with a conversational flow consisting of other sequences that may be other
`
`connections, other protocols, other client-server connections and so forth.”11
`
`PO’s proposed construction ignores these disclosures and statements by
`
`PO’s expert. Similarly, PO’s assertion that “if a second different client sends a
`
`
`10 ’099, 31:31-40; see Ex. 1016 (’903 Provisional), 31:3-32:7.
`
`11 Ex. 2061, 23; id., 43 (acknowledging connection flows may be related based on
`
`“users, clients, or servers”). These statements undermine PO’s and its expert’s sub-
`
`sequent conclusory assertion that, in the print service example, the print request
`
`from Client 2 is part of a different conversational flow, despite the clear teaching
`
`that it is tied to the same initial print service address request/reply connection as
`
`the print request from Client 1.
`
`5
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`print request to the print service [in the printing service embodiments], that ex-
`
`change … represents a different conversational flow,”12 contradicts the intrinsic
`
`record. Moreover, this conclusory assertion, repeated by PO’s expert, is under-
`
`mined by the expert’s statements, discussed above, that a conversational flow may
`
`include “other client-server connections” related based on “servers.”13
`
`PO’s assertion that the word “activity” (in the Board’s construction) is lim-
`
`ited to one involving only a “particular client device” contradicts the plain meaning
`
`of that term. The ’099 and ’646 Patents consistently use “activity” in its ordinary
`
`manner.14 There’s no lexicography or disclaimer that would alter the plain meaning
`
`of “activity” in the way PO proposes—and PO points to none. As the Board cor-
`
`rectly observed in its ID, and consistent with the SAP and RPC embodiments de-
`
`scribed above, multiple packet communications of the same service or application
`
`meet the “activity” requirement for conversational flows, regardless of the particu-
`
`lar client or clients.
`
`
`12 POR, 11.
`
`13 Ex. 2061, 23, 43; see supra fn.11.
`
`14 E.g., ’099, 3:51-4:38 (describing prior art that discloses a “network activity mon-
`
`itor”); ’646, 5:8-15; Ex. 1016 (’903 Provisional), 14:9-12 (“Any network activity...
`
`will produce an exchange of a sequence of packets, called a conversational
`
`flow....”).
`
`6
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Further, PO argues that certain prosecution statements compel a narrow in-
`
`terpretation of “activity,” but none of those statements provides the requisite “clear
`
`and unmistakable” disavowal of scope.15 Moreover, the PO-cited prosecution state-
`
`ments are inapposite to PO’s argument—indeed, during prosecution, Applicant
`
`juxtaposed identifying stations (e.g., client/server pairs) involved in a communica-
`
`tion with identifying a conversational flow.16
`
`PO also argues that the Board’s construction is incomplete because it omits
`
`exemplary language from the specification.17 The Board correctly noted that such
`
`language is non-limiting as a matter of law and, therefore, adding it to the con-
`
`struction wouldn’t change the meaning of “conversational flow.”18 PO attempts to
`
`distinguish Catalina by arguing that case didn’t involve lexicography.19 But the
`
`Federal Circuit explained there that phrases like “such as” and “for instance” aren’t
`
`limiting.20 This rationale applies equally here.
`
`
`15 POR, 38-39; Aylus Networks, Inc. v. Apple Inc., 856 F.3d 1353, 1359 (Fed. Cir.
`
`2017).
`
`16 Ex. 1020, 9.
`
`17 POR, 23-24.
`
`18 R’hrg Dec., 4 (citing Catalina Mktg. Int’l, Inc. v. Coolsavings.com, Inc., 289
`
`F.3d 801, 811 (Fed. Cir. 2002)).
`
`19 POR, 23.
`
`20 289 F.3d at 811.
`
`7
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Further, PO’s reliance on Sinorgchem Co. v. ITC21 is misplaced. The defini-
`
`tional language there—“e.g., up to about 4% H20 based on the volume of the reac-
`
`tion mixture when aniline is utilized as the solvent”—specified a limitation (“about
`
`4% H20”) when a given condition was met (“aniline is utilized as the solvent”).22
`
`The ’099 definitional language has no analogous limitation.
`
`Finally, contrary to PO’s suggestion, no tribunal has construed “conversa-
`
`tional flow” as limited to “application activity involving the same client.”23 In-
`
`stead, in NetScout, the Federal Circuit noted that “conversational flow” is “defined
`
`as ‘the sequence of packets that are exchanged in any direction as a result of an ac-
`
`tivity,’” and didn’t limit that construction to exclude disclosed embodiments, as PO
`
`advocates here.24
`
`III. RIDDLE DISCLOSES CONVERSATIONAL FLOWS (ALL
`GROUNDS).
`
`As the Petition and Dr. Weissman explain, Riddle teaches “applying ‘poli-
`
`cies’ to control traffic classified as to type of service required.”25 Riddle classifies
`
`
`21 511 F.3d 1132, 1137 (Fed. Cir. 2007).
`
`22 Id.
`
`23 POR, 25-26.
`
`24 Ex. 2060, 3.
`
`25 Petition, 17-18; Weissman, ¶110. While PO faults Petitioner for submitting Dr.
`
`Weissman’s declaration because it addresses five related patents across seven IPR
`
`8
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`traffic flows based on (a) information gathered from multiple layers in a multi-
`
`layer communication protocol (including the application layer) and (b) flow char-
`
`acteristics beyond protocol-layer categories, and then assigns service levels to clas-
`
`sified flows.26 Specifically, Riddle classifies network flows “based on selectable
`
`information obtained from a plurality of layers of a multi-layered communication
`
`protocol in order to define a characteristic class” by detecting the protocols and
`
`services in each packet.27 Riddle’s traffic classifier 304 parses the packets of a
`
`flow, determines those packets’ flow specifications including traffic type (e.g., pro-
`
`tocol family and type, pairs of hosts and ports), and stores those specifications in
`
`list 308 for classification.28 Riddle also teaches that traffic classes may be defined
`
`by application-level attributes.29 Based on these teachings, Riddle discloses identi-
`
`fying conversational flows.
`
`
`proceedings, PO similarly submitted one expert declaration across the related pro-
`
`ceedings. And Petitioner properly and appropriately relied Dr. Weissman analysis
`
`regarding the state of the art, claim construction, and why a POSITA would have
`
`found obvious the challenged claims.
`
`26 Riddle, Abstract, 4:7-10; Petition, 18, 35-36, 70.
`
`27 Riddle, 4:10-15, 12:27-32, 14:28-41, Fig. 3; Petition, 18-19, 39, 70, 72-73.
`
`28 Riddle, 12:37-41, 4:48-50, 12:42-63, Figs. 3-4A, claims 1, 8, 11; Petition, 18-19.
`
`29 Riddle, 8:58-9:11, 9:64-65, 13:43-62, Fig. 4B (step 426), Table 2; Ex. 1024
`
`(’864 Provisional), Table 2; Petition, 21-22.
`
`9
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`For applications with multiple connections in a conversation between com-
`
`puter hosts, Riddle discloses that those connections are classified as a “service ag-
`
`gregate” traffic class.30 These “service aggregates” are “conversational flows” be-
`
`cause they link multiple disjointed flows for a common application.31
`
`Further, Riddle discloses storing information about previously encountered
`
`conversational flows. For example, when a packet’s flow specification matches a
`
`traffic class, Riddle enters the identifying characteristics of the traffic into a corre-
`
`sponding flow-entry in the saved list and then checks the state of the flow (e.g.,
`
`whether the flow is a new flow or an existing flow, count of duplicates, most recent
`
`traffic time).32
`
`A.
`
`PO Does Not Dispute that Riddle Discloses Conversational Flows
`Under the Board’s Construction.
`
`PO doesn’t analyze Riddle under the Board’s construction, instead relying
`
`on its own incorrect construction of “conversational flows.” See §II. Under the
`
`Board’s construction, Riddle discloses “conversational flows” because Riddle
`
`
`30 Riddle, 11:10-23.
`
`31 Petition, 49-53 (citing Weissman, ¶¶128-131).
`
`32 Riddle, 12:48-60, Fig. 4A (steps 406, 408, 410, 412); Weissman, ¶¶121, 662-
`
`664; Petition, 20, 43-44, 59-60, 64-65.
`
`10
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`teaches identifying a sequence of packets that are exchanged in any direction as a
`
`result of an activity, e.g., an FTP program or PointCast application.33
`
`B.
`
`Even under PO’s Incorrect Construction, Riddle Discloses Con-
`versational Flows.
`
`When applying its erroneous “conversational flow” construction, PO
`
`misreads Riddle and disregards much of Riddle’s disclosures. Riddle does disclose
`
`“conversational flows” even under PO’s construction for that term.
`
`1.
`
`Riddle classifies activities based on a particular client.
`
`PO alleges that Riddle doesn’t distinguish the same type of activity between
`
`different clients.34 But Riddle specifies that its service aggregate “is provided for
`
`certain applications that use more than one connection in a particular conversation
`
`between a client and a server.”35 Hence, Riddle describes listing service aggre-
`
`
`33 Petition, 8-9; Riddle, 11:12-15; see Petition, 49-50; Weissman, ¶¶304-305, 632-
`
`633.
`
`34 POR, 40-43.
`
`35 Riddle, 11:10-19 (“…In cases where two or three TCP or UDP sessions exist for
`
`each conversation between one client and one server, it is useful to provide a com-
`
`mon traffic class i.e., the service aggregate.”) (cited in Petition, 21, 51).
`
`11
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`gates based on their source and/or destination, e.g., “host1,” where host1 can repre-
`
`sent a client or a server36 involved in an FTP flow.37
`
`Further, Riddle teaches defining a traffic class by URI-pattern (e.g.,
`
`“/sales/*”) and by the specific client/server pair involved (e.g., from “client Z” to
`
`“server Y”).38 Riddle exemplifies this, identifying in Table 2 an IP address as a
`
`component of a traffic class.39 In sum, Riddle discloses classifying traffic into cli-
`
`ent-specific conversational flows.
`
`Regarding Riddle’s teachings toward service aggregates and traffic classes,
`
`Ms. Quigley provides two paragraphs that repeat PO’s attorney arguments.40 Ms.
`
`Quigley’s analysis lacks any evidentiary support and is conclusory—it’s thus enti-
`
`tled to little weight.
`
`
`36 Riddle’s “host” can be a client (e.g., personal computer) or a server (e.g., work-
`
`station or mainframe). Riddle, 2:13-21, 7:12-21, Fig. 1C.
`
`37 Riddle, 13:8-26; Weissman, ¶¶311-312, 632-633.
`
`38 Riddle, 8:58-9:11; Petition, 70-71, 94-95.
`
`39 Riddle, 10:1-17; Petition, 71-72.
`
`40 Ex. 2061, ¶¶81-82.
`
`12
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Riddle aggregates inbound and outbound components of a
`conversational flow.
`
`2.
`
`In alleging that Riddle classifies inbound and outbound flows only
`
`separately,41 not bidirectionally, PO ignores Riddle’s teachings about service
`
`aggregates. In particular, Riddle discloses that all traffic in a particular conversa-
`
`tion between a client and a server is classified into a single service aggregate.42 For
`
`example, Riddle’s service aggregate applies to “an FTP client in conversation with
`
`an FTP server” based on exchanging “commands and responses,” i.e., bidirectional
`
`flows.43 Riddle explains that the service aggregate for an FTP session contains
`
`“each conversation” between the client and server for that session, i.e., all packets
`
`exchanged in either direction.44
`
`3.
`
`Riddle distinguishes between different activities of the same
`type.
`
`PO again ignores Riddle’s teachings when arguing that Riddle classifies
`
`traffic based only on port number or identity of server, and thus fails to
`
`
`41 POR, 44. And Ms. Quigley’s three-sentence analysis contradicts PO’s argument,
`
`noting that conversational flows “can,” and not must, include bidirectional packet
`
`exchanges Ex. 2061, ¶83.
`
`42 Riddle, 11:12-15; Petition, 49-50.
`
`43 Riddle, 11:13-15, 13:54-59.
`
`44 Id., 11:15-19; see id., 12:1-12 (describing detecting “H323-internet telephony
`
`over the internet (bidirectional)”); Petition, 50-51.
`
`13
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`“distinguish between different activities of the same type.”45 Even applying PO’s
`
`erroneous construction, Riddle isn’t limited to flow classification based on port or
`
`server identity.
`
`Instead, Riddle discloses that flow classification can use port numbers and
`
`can further “extend to examination of the data contained in a flow’s packets” via
`
`signature-based analysis because certain traffic isn’t determinable by port num-
`
`ber.46 Riddle also discloses that Telnet traffic’s multi-packet “option negotiations”
`
`“may indicate an appropriate class,” an example of classification from exchanged
`
`data, not port number.47
`
`IV. THE PRIOR ART DISCLOSES THE STATE-BASED LIMITATIONS
`(ALL GROUNDS).
`
`PO asserts that ’646 limitation 1(e) “implicates” state-based processing
`
`across multiple packets.48 And PO asserts that the Board found that “conversational
`
`flow state-based analysis … requires processing states across packets.”49 But the
`
`
`45 POR, 17-18.
`
`46 Riddle, 11:50-53.
`
`47 Id., 11:66-67.
`
`48 POR, 53-54.
`
`49 -00338 POR, 54.
`
`14
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Board’s rehearing determination in a related IPR belies PO’s assertion.50 Because
`
`of the language specific to the ’099 limitation, the Board interpreted ’099 claim 1
`
`as requiring “state transitions across multiple packets.”51 The Board also stated that
`
`the ’099 “[s]pecification clearly contrasts embodiments that require patterns cover-
`
`ing multiple packets with patterns that allow for a single packet.”52
`
`In contrast to the ’099 limitation, the challenged ’646 claim 1 recites “a con-
`
`versational flow being an exchange of one or more packets in any direction be-
`
`tween two network entities ... the state processor being to perform any state opera-
`
`tions … in the case that the packet is from an existing flow, and to perform any
`
`state operations … in the case that the packet is from an existing flow.” These lim-
`
`itations refer to the patent’s embodiments whereby information from an individual
`
`packet is sufficient for the state-based analysis of a conversational flow. None of
`
`these limitations requires state transitions to occur across a sequence of packets.
`
`Furthermore, even if the state-related limitations require analyzing more
`
`than one packet, Riddle meets them. Riddle classifies service aggregates based on
`
`
`50 IPR2020-00338 (Paper 28), 3-4 (distinguishing the ’751 Patent’s “state” limita-
`
`tions (e.g., “having… states,” “identifying” such states, and “performing... [speci-
`
`fied] state operations”) from the ’099 “state transition patterns” limitation) (em-
`
`phasis in original).
`
`51 Id.
`
`52 IPR2020-00335 (Paper 22), 5-6 (citing ’099, 9:14-23, 10:48-63, 16:10-20).
`
`15
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`a plurality of indicators across multiple packets.53 As shown in Fig. 4B, Riddles
`
`identifies traffic belonging to a service aggregate, which leads to the creation of a
`
`traffic class for the service aggregate (including patterns for other components of
`
`the same conversation), so that the disjointed flows of the same conversation will
`
`be classified together.54 And Riddle classifies a saved flow as belonging to a ser-
`
`vice aggregate (a state transition) only after classifying that flow’s specification,
`
`e.g., as being an FTP flow (a prior state transition), because service aggregate clas-
`
`sification operates on classified traffic list 308.55
`
`Riddle establishes that the classification process (e.g., Fig. 4A flowchart)
`
`may operate on state transitions across multiple packets.56 At step 402, Riddle
`
`teaches that “a flow specification is parsed from the flow being classified” – not
`
`just from an individual packet.57 As explained by Dr. Weissman, Riddle makes an
`
`entry in a list of “identifying characteristics” of newly classified packet traffic,
`
`compares the characteristics with those of previously classified traffic to identify
`
`
`53 Riddle, Fig. 4B, cl. 5; Weissman, ¶¶353, 356-357, 628, 632-634. Ms. Quigley
`
`never addresses the prior art’s teachings toward the state-based claim elements.
`
`54 Riddle, 13:52-59; Fig. 4B.
`
`55 Id. 11:11-20, 13:40-59.
`
`56 Id., 12:42-63 (flowchart “may execute on multiple instances of list 308”).
`
`57 Weissman, ¶¶120-121, 132; see id., 299, 330-332, 354-355, 361, 367-368, 628,
`
`632-634.
`
`16
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`duplication, and performs various state operations accordingly. A POSITA would
`
`have understood from these teachings “that these states relate to an indication of all
`
`previous events in the flow that lead to recognition of the content of all of the pro-
`
`tocol levels.”58
`
`PO also argues that the Yu reference doesn’t teach the requirements of this
`
`limitation.59 But Yu teaches that “multiple packets” may be required for flow clas-
`
`sification, so “the application’s flow classification logic keeps track of the flow’s
`
`state until a matching criteria is met.”60 Further, when there is a match and a stream
`
`is classified, the flow classifier binds a policy to the stream, and creates a “hash
`
`value” for subsequent packets to match them to the corresponding policy.61 Thus,
`
`Yu’s flow recognition and binding policy render obvious performing the claimed
`
`
`58 Weissman ¶369 (analyzing ’099 element 1.7); ¶¶665-666 (discussing related
`
`’646 element 1.5); Petition 64-66; see Weissman ¶¶360-361, 366-368.
`
`59 POR, 55.
`
`60 Yu, 4:55-64; Petition, 84.
`
`61 Yu, 4:62-5:2, 5:18-28; compare id. with ’646, 12:2-9 (“When enough packets re-
`
`lated to an application of interest have been processed, a final recognition state is
`
`ultimately reached …. The signature for that final state enables each new incoming
`
`packet of the same conversational flow to be individually recognized in real
`
`time.”).
`
`17
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`“state operations” for a new flow’s initial state or an existing flow’s last encoun-
`
`tered state.62
`
`V. THE RIDDLE-FERDINAND COMBINATION RENDERS OBVIOUS
`THE FLOW-ENTRY DATABASE LIMITATIONS (ALL GROUNDS).
`
`As the Petition explains, Riddle alone or in combination with Ferdinand ren-
`
`ders obvious the “flow-entry database” limitations.63 In particular, the Petition ex-
`
`plains that, based upon a POSITA’s knowledge of network devices, a POSITA
`
`would have been motivated and found it obvious to store Riddle’s classification in-
`
`formation, such as flow-entry lists 308, in a database.64 PO doesn’t address this as-
`
`pect of the trial ground, instead arguing that Riddle doesn’t disclose the “flow-en-
`
`try database” limitations because Riddle doesn’t teach conversational flows.65 For
`
`reasons discussed above, PO’s argument fails. See §§II-III.
`
`To further show the obviousness of flow-entry database, the Petition ex-
`
`plains that Ferdinand teaches storing information about parsed packets in a data-
`
`base, and “a POSITA would have been motivated and found it obvious to store
`
`
`62 Petition, 83-84.
`
`63 Id., 23-27, 46-48.
`
`64 Id., 46-47; Weissman, ¶¶328-335, 629.
`
`65 POR, 45-46.
`
`18
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`Riddle’s lists 308 in a flow-entry database based on Ferdinand’s teaching.”66 In-
`
`stead of addressing this combination, PO attacks Ferdinand individually, arguing
`
`that “Ferdinand never discloses or suggests storing ‘flow-entries for previously en-
`
`countered conversational flows.’”67 That argument is irrelevant to the trial
`
`ground.68 The “flow-entry database” limitations would have been obvious in view
`
`of Riddle’s teachings regarding flow-entries and relational databases based on Fer-
`
`dinand’s teachings regarding statistics databases for storing flow classification in-
`
`formation.69
`
`VI. YU IS PRIOR ART, TEACHES CONVERSATIONAL FLOWS, AND
`A POSITA WOULD HAVE BEEN MOTIVATED TO MODIFY RID-
`DLE’S TEACHINGS IN VIEW OF YU (GROUND 2).
`
`A. Yu is Prior Art.
`
`Yu qualifies as §102(e) prior art based on its December 16, 1999 filing
`
`
`66 Petition, 23-27, 46-48; Weissman, ¶¶336-339, 630-631.
`
`67 POR, 46.
`
`68 PO is also incorrect. In database 36, Ferdinand stores unique flow signatures
`
`(e.g., protocol identifiers, source/destination addresses, hashes), for identifying
`
`subsequent flows. Petition, 23. That Ferdinand stores flow-entry information in a
`
`database reinforces the conclusion that a POSITA would have been motivated to
`
`store Riddle’s flow-entry information in a database.
`
`69 Petition, 23-27, 46-48.
`
`19
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`date.70 PO hasn’t disputed that Yu is prior art based on that filing date, nor pre-
`
`sented argument or evidence that the ’646 Patent is entitled to an invention date
`
`earlier than its June 30, 2000 filing date. Accordingly, PO’s arguments about Yu’s
`
`entitlement to its provisional filing date are irrelevant.
`
`Even if PO had established an earlier priority date for the ’646 Patent, Peti-
`
`tioner has established that Yu is §102(e) prior art based on the filing date of the
`
`’859 Provisional. Petitioner produced charts mapping Yu’s disclosures to the writ-
`
`ten description of the ’859 Provisional.71 In particular, Petitioner showed that the
`
`’859 Provisional fully supports all elements of Yu’s claim 1, which under Dynamic
`
`Drinkware entitles that claim to the Provisional’s filing date.72 The Board has pre-
`
`viously found that such evidence establishes that a prior art reference is entitled to
`
`the benefit of an earlier-filed application.73
`
`PO doesn’t identify any limitation from Yu’s claim 1 that isn’t supported by
`
`the ’859 Provisional. Instead, PO argues that Yu’s claim recites “module” terms
`
`that invoke §112, ¶6, and that Petitioner failed to identify corresponding structure
`
`
`70 Yu lists a 12/16/1999 filing date and claims the benefit of the ’859 Provisional’s
`
`12/17/1998 filing date. Yu, cover, 1:4-6.
`
`71 Exs. 1047-1048.
`
`72 Petition, 81; Ex. 1048; Weissman, ¶¶158-162.
`
`73 E.g., Amazon.com, Inc. v. CustomPlay, LLC, IPR2018-01496 (Paper 34), 47-48
`
`(P.T.A.B. Mar. 4, 2020).
`
`20
`
`

`

`IPR2020-00337
`U.S. Patent No. 6,771,646
`in Yu’s provisional for those “module” terms. But PO has failed to rebut the pre-
`
`sumption that §112, ¶6 doesn’