`
`
`
`
`PETITION FOR INTER PARTES
`REVIEW PURSUANT TO 37
`C.F.R. § 42.100 ET SEQ.
`
`In re U.S. Patent No. 6,857,067
`
`Currently in Litigation Styled: Uniloc USA, Inc.
`and Uniloc Luxembourg S.A. v. Distinctive
`Developments, Inc., Case No. 6:12-cv-00462-LED
`
`Issued: February 15, 2005
`
`Filed: February 26, 2001
`
`Applicant: Martin S. Edelman
`
`Title: System and Method for Preventing
`Unauthorized Access to Electronic Data
`
`Mail Stop Inter Partes Review
`Commissioner for Patents
`P.O. Box 1450
`Alexandria, VA 22313-1450
`
`
`DECLARATION OF DR. JUSTIN DOUGLAS TYGAR
`
`I, Justin Douglas Tygar, hereby declare the following:
`BACKGROUND AND EDUCATION
`I.
`1.
`I am a Professor of Computer Science and Electrical Engineering at the
`
`University of California (“UC”), Berkeley and a Professor in the School of Information at
`
`the UC Berkeley. Although I discuss my expert qualifications in more detail below, I
`
`also attach as [Exhibit 1009] a recent and complete curriculum vitae, which details my
`
`educational and professional background.
`
`2.
`
`I have been a professor since 1986. From 1986 to 1998, I was a professor
`
`(and received tenure) at Carnegie Mellon University in its Computer Science Department.
`
`In 1998, I moved to UC Berkeley, assuming my current tenured position.
`
`
`
`1
`
`PETITIONERS Ex. 1008 Page 1
`
`
`
`3.
`
`I perform research and teach classes in the fields of computer security,
`
`electronic commerce, and software engineering. Since my initial appointment as a
`
`professor in 1986 and continuing to the present day, I have taught courses to
`
`undergraduates, masters students, and Ph.D. students on a variety of topics related to
`
`computer security, electronic commerce, and software engineering. Starting in the 1990s
`
`and continuing to today, I regularly lecture on digital rights management systems.
`
`4.
`
`I received the Ph.D. Degree from Harvard University in Computer Science,
`
`and my A.B. Degree from UC Berkeley.
`
`5.
`
`I am an expert in the fields of computer security, computer networking, and
`
`electronic commerce, including without limitation digital rights. Although I discuss my
`
`expert qualifications in more detail below, I also attach as a recent and complete
`
`curriculum vitae, which details my educational and professional background.
`
`6.
`
`I have received research grants or contracts in the field of computer security
`
`from the U.S. National Security Agency, the U.S. National Science Foundation, the U.S.
`
`Department of Defense Advanced Research Projects Agency, the U.S. Naval Research
`
`Office, the U.S. Air Force Office of Sponsored Research, the Taiwan National Science
`
`Council, as well as from numerous private companies including IBM, Lockheed, and
`
`Microsoft. I have given several hundred presentations on computer security to
`
`government agencies, as keynote addresses at major conferences, and at leading research
`
`universities all over the world.
`
`7.
`
`I helped design several systems for electronic commerce and several
`
`systems for electronic commerce and digital rights management. In the mid-1990s, I
`
`
`
`2
`
`PETITIONERS Ex. 1008 Page 2
`
`
`
`helped design Strongbox software and the Dyad secure coprocessor system which was
`
`ultimately used as a software platform by IBM for its IBM 4758 and 4764 devices which
`
`support secure electronic commerce and digital rights management.
`
`8.
`
`I helped design and build the NetBill system which was an early electronic
`
`payment system. My NetBill work was captured in U.S. patents relating to the secure
`
`purchase of digital goods over a network. The first, U.S. Patent No. 5,809,144 is entitled,
`
`“Method and Apparatus for purchasing and delivering digital goods over a network,”
`
`while my second patent is U.S. Patent No. 6,076,078 and is entitled “Anonymous
`
`Certified Delivery.” In cooperation with Visa International, Mellon Bank, and the
`
`Defense Advanced Research Projects Agency, I co-directed a research group that
`
`demonstrated and built NetBill. Ultimately NetBill was licensed and used by CyberCash
`
`(later acquired by Verisign).
`
`9.
`
`From 1994 through 2006, I received major research contracts from the U.S.
`
`Postal Service for research in advanced postal technologies. I developed a two-
`
`dimensional bar-coding standard for a full closed-loop solution to protect envelope
`
`images including postal indicia that represent payment for postal services. My two-
`
`dimensional bar-code provides a full-closed system that detects postage meter fraud,
`
`changes to envelope data, and errors in scanning. My work became the basis of the U.S.
`
`Postal Service’s standards for Information Based Indicia (to which I was a major
`
`intellectual contributor.) These standards have been adopted, in modified form, by many
`
`different countries in the United Nation’s agency Universal Postal Union. I served on the
`
`U.S. Postal Service Mail Technology Strategy Council.
`
`
`
`3
`
`PETITIONERS Ex. 1008 Page 3
`
`
`
`10. Almost all American adults who receive mail have been exposed to my
`
`two-dimensional closed-loop bar-code standard. The majority of US metered mail now
`
`uses my standard (although there are still some older grandfathered postage metering
`
`equipment that predates my standard and is grandfathered by the US Postal Service.)
`
`Every postage meter indicia vendor, whether it is an equipment maker (such as Pitney-
`
`Bowes) or an Internet vendor (such as Endicia) makes indicia that conform with the US
`
`Postal Service’s two-dimension bar code standard – a standard that is fully based on my
`
`research work.
`
`11.
`
`Throughout the 1990s and on to the 2000s, I was actively involved in
`
`initiatives in digital rights management. I participated (and presented research) in the
`
`first major conference on digital rights management; the Coalition for Network
`
`Information’s 1994 “Technological Strategies for Protecting Intellectual Property in the
`
`Networked Multimedia Environment,” co-sponsored by Kennedy School of Government
`
`at Harvard University and the Massachusetts Institute of Technology.
`
`12.
`
`I was one of three founders of the major scientific group in the field of
`
`electronic commerce, SIGECOM, the Association of Computing Machinery’s Special
`
`Interest Group in Electronic Commerce. I ran a number of conferences in electronic
`
`commerce, including the 1996 Second USENIX Workshop on Electronic Commerce.
`
`13.
`
`IBM retained me as a consultant in 1995-6 to help IBM review companies
`
`focusing on digital rights management that IBM was considering for purchase or
`
`investment. One company that I reviewed during that time period was Electronic
`
`Publishing Resources (later known as Intertrust).
`
`
`
`4
`
`PETITIONERS Ex. 1008 Page 4
`
`
`
`14.
`
`I am the current coordinator of UC Berkeley’s TRUST Center. TRUST,
`
`the Team for Research in Ubiquitous Security Technologies, is the National Science
`
`Foundation's major Science and Technology Center in computer security. UC Berkeley
`
`is the headquarters of this effort, which also includes Stanford University, Carnegie
`
`Mellon University, Cornell University, and Vanderbilt University.
`
`15.
`
`I served as chair of the Department of Defense’s Information Science and
`
`Technology Study Group in Security with Privacy. I have consulted widely in both
`
`industry and government, both inside and outside the United States in the fields of
`
`computer security. I have won numerous awards, including the National Science
`
`Foundation’s Presidential Young Investigator Award and the (Japanese) Okawa
`
`Foundation Fellowship Award.
`
`16.
`
`I have written three books in the field of computer security. I have also
`
`written widely in the fields of general computer security. A list of my publications is
`
`included as part of my CV attached to this declaration.
`
`17.
`
`In sum, I have over thirty years of experience in the computer science
`
`industry as a professor, consultant and an inventor. During this time, I have worked
`
`extensively with computer security protocols, software programming and networking of
`
`computers, digital rights management and have witnessed first-hand the evolution of
`
`computer security, including specifically digital rights management.
`
`18.
`
`I am submitting this declaration to offer my independent expert opinion
`
`concerning certain issues raised in the petition for inter partes review (“Petition”). My
`
`compensation is not based on the substance of the opinions rendered here. As part of my
`
`
`
`5
`
`PETITIONERS Ex. 1008 Page 5
`
`
`
`work in connection with this matter, I have studied U.S. Patent No. 6,857,067 (the “‘067
`
`patent”), including the respective written descriptions, figures, and claims. I have also
`
`reviewed the Petition for Inter Partes Review of the ‘067 patent. I have also carefully
`
`considered the following references:
`
`• U.S. Patent No. 7,036,011 to Grimes, et al., filed June 29, 2001 and
`claiming priority to a provisional application filed on June 29, 2000, and
`issued April 25, 2006 (“Grimes”). [Exhibit 1005]
`
`• U.S. Patent No. 7,032,440 to Cronce, et al., filed February 14, 2000, and
`issued April 18, 2006 (“Cronce”). [Exhibit 1002].
`
`• Bill Rosenblatt, Bill Trippe, and Stephen Mooney, Digital Rights
`Management Business
`and Technology, M&T Books
`(2002)
`(“Rosenblatt”). [Exhibit 1010]
`
`• Mark Stefik, “Letting Loose the Light: Igniting Commerce in Electronic
`Publication” published in Internet Dreams: Archetypes, Myths, and
`Metaphors, MIT Press (1996) (“Stefik”). [Exhibit 1011]
`
`OPINION
`A.
`Level of a Person Having Ordinary Skill in the Art
`19.
`In my view a person of ordinary skill in the field of digital rights
`
`
`
`
`
`II.
`
`management in 2001 would have a B.S. in computer science or related engineering
`
`discipline and at least two years in the software development industry or equivalent
`
`experience or education. The person would also have some knowledge of data
`
`encryption/decryption techniques, networking of computers, databases, programming of
`
`microprocessors/microcontrollers, and digital rights management systems and their
`
`implementation.
`
`B.
`
`Background of Digital Rights Management Systems
`
`
`
`6
`
`PETITIONERS Ex. 1008 Page 6
`
`
`
`20.
`
`It is my understanding that the patent owner claims the priority date of the
`
`‘067 Patent is February 26, 2001. Digital rights management (“DRM”) systems that
`
`incorporated the concepts described and claimed in the ‘067 Patent were well-known in
`
`the art before the priority date of the ‘067 Patent. Starting in the late 1970s, DRM
`
`systems were available to protect electronic content on an electronic device. See e.g. ,
`
`Rosenblatt at pp. x-xi. At this time, hardware keys, such as dongles, were being used to
`
`prevent unauthorized copying of software distributed on floppy disks. Id. With the rise
`
`of the Internet in the mid-1990s, the piracy of software became a real threat to the
`
`software industry, and companies actively developed new methods to protect their
`
`electronic content. Id at pp. xi-xiii. Consequently, the DRM solution market experienced
`
`rapid growth in the late 1990s and early 2000s. Id. at p. 261.
`
`21.
`
`In 1996, Dr. Mark Stefik defined a networked DRM paradigm enabling
`
`users to store protected content on their portable “repository.” According to Stefik,
`
`“repositories could be portable entertainment devices, laptop readers, personal computers,
`
`credit-card-sized devices, [etc.] . . . . [used to] store digital works, together with their
`
`usage rights.” Stefik at p. 40. Stefik also contemplated using an “authorization server” to
`
`validate license data stored on the user’s repository prior to allowing access to a protected
`
`work. Id. at p. 21. By the late 1990s there were several commercially available systems
`
`implementing similar DRM architectures, including, for example, Musicrypt, Inc., which
`
`sold a system using a server to remotely monitor and update license data stored on users’
`
`personal computers and portable devices. See e.g., Rosenblatt at pp. 231-232.
`
`
`
`7
`
`PETITIONERS Ex. 1008 Page 7
`
`
`
`22.
`
`The prior art identified in the Petition illustrates the concepts described
`
`above that were claimed in the ‘067 Patent. For instance, Grimes and Cronce both
`
`describes a digital rights management system that controls access to protected content on
`
`a user machine by communicating with a server. Grimes at Abstract; Cronce at Abstract.
`
`In addition, Cronce provides an informative example of the state of the art in software
`
`protection during the relevant timeframe. See generally Cronce. More specifically,
`
`Grimes discloses a removable storage device that contains digital certificates for
`
`permitting access to protected content on a user machine, which can itself be portable,
`
`such as a palmtop computer. Grimes, at 4:36-41, 5:12-18, 10:30-32, 12:13-25. Grimes
`
`also describes communicating with a DRM server to verify the digital certificate on a
`
`user’s machine. Grimes, at 9:38-60, 10:53-11:19. Cronce also teaches verifying license
`
`data and, further teaches, updating the license data on a removable memory based on
`
`communications with an external licensing server. Cronce, at 5:35-37, 6:10-16. Upon
`
`reading the teachings of Cronce, a person of ordinary skill would have realized that the
`
`DRM server of Grimes could also be used to update the digital certificate information on
`
`the secondary storage device.
`
`23. At the time of the ‘067 Patent, persons having ordinary skill in the art were
`
`motivated to embrace technological advances, and combining various features from prior
`
`art DRM systems, like those discussed above, would have been obvious to such skilled
`
`persons. In addition, the computer industry, as with most industries, was interested in
`
`providing the most functionalities to their products at the lowest cost. Thus, combining
`
`functionalities from various known systems would not only be obvious, but desirable.
`
`
`
`8
`
`PETITIONERS Ex. 1008 Page 8
`
`
`
`Most important, the providers of electronic content were constantly looking for ways to
`
`protect their investment from losses associated with copyright infringement. Such
`
`combinations would have yielded predictable results using known methods in the art.
`
`Thus, a software vendor would have been led to modify the teachings of Grimes in order
`
`to provide a more efficient and cost effective way to provide updated software license
`
`data to its users as taught by Cronce.
`
`C. Grimes and Cronce
`
`24. While claims 1, 67, 107 and 108 are worded a little differently and directed
`
`to a system, a method, computer code and a computer program, respectively, it is my
`
`opinion that they disclose the same basic concepts that are obvious in view of the prior
`
`art. Specifically, claims 1, 67, 107 and 108 all describe the following four concepts: (1)
`
`storing license data on a portable licensing medium; (2) allowing access to electronic
`
`content on an electronic device based on the license data; (3) verifying the license data by
`
`communicating with an external authority that has license verification data; and, (4)
`
`providing updated license data received from the external authority to the portable
`
`licensing medium.
`
`25.
`
`It is my opinion that it would have been obvious to a person having
`
`ordinary skill in the art to combine the system described in Grimes to provide the
`
`functionality of providing updated license data to the licensing medium taught by Cronce.
`
`For instance, as discussed above, both references describe systems for preventing
`
`unauthorized access to electronic content on an electronic device through a licensing
`
`medium. Grimes at Abstract, 3:4-13; Cronce at Abstract, 4:48-5:16. Further, both
`
`
`
`9
`
`PETITIONERS Ex. 1008 Page 9
`
`
`
`references describe communicating with a server to determine access to electronic
`
`content based on the license data. Grimes at 9:38-60, 12:15-25, 12:62-13:3; Cronce at
`
`8:3-7, 8:22-24, 3:56-59, Fig. 2. The systems of Grimes and Cronce also describe
`
`verifying the license data by communicating with a server. See Grimes at 9:38-60, 10:53-
`
`11:19; Cronce at 15:39-58, Figs. 9 and 10. Specifically, as to all of the challenged claims,
`
`Cronce teaches the functionality of providing updated license data to the license medium.
`
`Cronce at 5:35-43, 5:53-65. The update occurs based on license information received
`
`from the license server, such as information demonstrating an expired or modified
`
`license. See id. As I discussed above, skilled artisans in the software protection industry
`
`were motivated by the marketplace to embrace technological sophistication and
`
`advances. And addition of the desirable functionality of providing updated digital
`
`certificate data based on information received from a DRM server as taught by Cronce to
`
`the system of Grimes would have yielded predictable results, and the combination of
`
`these familiar elements could have been accomplished using known methods in the art.
`
`III. CONCLUSION
`26.
`I declare under penalty of perjury that the above statements are true and
`correct.
`
`Date:
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`____________________________
`By:
`Justin Douglas Tygar
`
`10
`
`
`
`
`
`
`PETITIONERS Ex. 1008 Page 10
`
`