`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`
`
`Compass Bank,
`Commerce Bancshares, Inc., and
`First National Bank of Omaha
`Petitioners
`
`v.
`
`Intellectual Ventures II LLC
`Patent Owner
`
`
`Case IPR2014-00724
`Patent 5,745,574
`
`
`PETITIONERS’ REPLY TO
`PATENT OWNER’S RESPONSE TO
`PETITION FOR INTER PARTES REVIEW
`
`
`
`
`
`
`
`NAI-102636686v9
`
`

`

`TABLE OF CONTENTS
`
`
`Page
`
`
`TABLE OF AUTHORITIES ................................................................................ ii
`I.
`DR. MUFTIC’S UNCORROBORATED STORY DOES NOT
`REMOVE THE KAPIDZIC PAPER AS PRIOR ART ............................ 1
`II. KAPIDZIC ANTICIPATES CLAIMS 18-31 ............................................ 3
`IV’s “Process” Argument for All Claims ....................................................... 3
`Dependent Claims 20 and 27 .......................................................................... 7
`Dependent Claim 22 ....................................................................................... 7
`Independent Claim 23 ..................................................................................... 8
`Dependent Claim 25 ....................................................................................... 8
`Dependent Claim 26 ....................................................................................... 9
`Independent Claim 28 ................................................................................... 10
`Independent Claim 30 ................................................................................... 10
`III. PKI STUDY ANTICIPATES AND/OR RENDERS OBVIOUS
`CLAIMS 18-31 ............................................................................................ 11
`IV’s “Process” Argument for All Claims ..................................................... 11
`Dependent Claims 20 and 27 ........................................................................ 12
`Dependent Claim 21 ..................................................................................... 13
`Independent Claim 23 ................................................................................... 13
`Dependent Claim 25 ..................................................................................... 13
`Dependent Claim 26 ..................................................................................... 14
`Independent Claim 30 ................................................................................... 14
`Independent Claim 31 ................................................................................... 15
`
`
`
`
`
`NAI-102636686v9
`
`-i-
`
`
`
`

`

`
`
`
`
`CASES
`
`TABLE OF AUTHORITIES
`
`Page
`
`Allergan, Inc. v. Apotex Inc.,
`754 F.3d 952 (Fed. Cir. 2014) .............................................................................. 1
`
`Corning Inc. v. DSM IP Assets B.V.,
`IPR2013-00053, Paper 66 (P.T.A.B. May 1, 2014) ............................................. 2
`
`i4i Ltd. P’ship v. Microsoft Corp.,
`598 F.3d 831 (Fed. Cir. 2010) .............................................................................. 7
`
`In re Johnston,
`435 F.3d 1381 (Fed. Cir. 2006) ............................................................................ 9
`
`In re Katz,
`687 F.2d 450 (CCPA 1982) .................................................................................. 2
`
`Pictometry Int’l Corp. v. Geospan Corp.,
`No. 2011-010700, 2011 WL 4857918 (BPAI Oct. 7, 2011) ................................ 2
`
`Sandt Tech. Ltd. v. Resco Metal & Plastics Corp.,
`264 F.3d 1344 (Fed. Cir. 2001) ............................................................................ 2
`
`Vehicle IP, LLC v. AT&T Mobility, LLC,
`No. 2013-1380, 2014 U.S. App. LEXIS 21960
`(Fed. Cir. Nov. 18, 2014) ...................................................................................... 7
`
`OTHER AUTHORITIES
`
`MPEP § 715 ............................................................................................................... 2
`
`MPEP § 715.01(c) ...................................................................................................... 2
`
`MPEP § 2111.04 ........................................................................................................ 9
`
`
`
`
`
`NAI-102636686v9
`
`-ii-
`
`
`
`

`

`IPR2014-00724 – Petitioners’ Reply
`
`Kapidzic is prior art to the ‘574 patent because there is no credible evidence
`
`that it reflects the sole work of inventor Sead Muftic. And IV’s arguments to
`
`distinguish the prior art lack merit, as they are based on unsupported, narrow claim
`
`constructions inconsistent with the broadest reasonable interpretation. The Board
`
`should issue a final decision invalidating claims 18-31 on all instituted grounds.
`
`I.
`
`DR. MUFTIC’S UNCORROBORATED STORY DOES NOT
`REMOVE THE KAPIDZIC PAPER AS PRIOR ART.
`
`IV tells a remarkable story based on the uncorroborated testimony of ‘574
`
`inventor, Dr. Sead Muftic, in an attempt to remove the Kapidzic paper as §102(a)
`
`prior art. (Paper 19 at 16-20; Ex. 2010.) But other than Muftic’s biased, self-
`
`serving declaration, IV cites no other evidence to support Muftic’s story.
`
`Moreover, none of the legal authority IV cites supports its position here.
`
`In Allergan, Inc. v. Apotex Inc., 754 F.3d 952 (Fed. Cir. 2014), the Federal
`
`Circuit held that the publications in question were prior art under §102(a),
`
`rejecting the patentee’s position that these publications described the work of a co-
`
`inventor. Id. at 968-69. The relevant inquiry here, like in Allergan, is whether the
`
`Kapidzic paper was solely Dr. Muftic’s work and his alone.
`
`First, Muftic is not even a co-author on the Kapidzic paper, a key fact IV
`
`cannot ignore. See id. at 969. This is particularly notable given that Muftic is a
`
`named co-author on several other papers with Kapidzic (and others). (See Ex.
`
`2007; Ex. 2009; Ex. 2011 at 3-4, 135, 137.) IV argues that Muftic need not be a
`
`NAI- 102636686v9
`
`
`1
`
`

`

`
`
`co-author, relying on Pictometry Int’l Corp. v. Geospan Corp., No. 2011-010700,
`
`IPR2014-00724 – Petitioners’ Reply
`
`2011 WL 4857918 (BPAI Oct. 7, 2011). But in Pictometry, the alleged prior art
`
`was a Boston Globe article about beta testing of software that identified the patent
`
`owner as the source of the software. There was no dispute that the Boston Globe
`
`reporter was writing about another person’s work. That is not the case here.
`
`IV asserts Muftic’s declaration alone is enough, citing In re Katz, 687 F.2d
`
`450 (CCPA 1982). But in Katz, the inventor was a co-author of the publication he
`
`sought to remove as art during initial examination of the application. Id. at 455.
`
`Indeed, MPEP § 715.01(c), to which IV also cites, discusses In re Katz under the
`
`section heading “Co-Authorship.” (The Board has previously held Rules 131/132
`
`do not govern IPR proceedings. See, e.g., Corning Inc. v. DSM IP Assets B.V.,
`
`IPR2013-00053, Paper 66 (P.T.A.B. May 1, 2014).) There is no suggestion in
`
`Katz (or elsewhere) that Muftic’s declaration alone suffices. See, e.g., Sandt Tech.
`
`Ltd. v. Resco Metal & Plastics Corp., 264 F.3d 1344, 1350 (Fed. Cir. 2001) (“[A]
`
`party claiming his own prior inventorship must proffer evidence corroborating his
`
`testimony.”) (citation omitted). Moreover, Muftic’s testimony is contradicted by
`
`contemporaneous documentary evidence showing the Kapidzic paper is not the
`
`sole work of Muftic – namely, the paper itself and Kapidzic’s 1997 thesis that
`
`reproduces the paper and explains that the paper is her and co-author Davidson’s
`
`work. (Ex. 2011 at 3-4, 25-38 (see 25 n.12 on permission to reproduce).)
`
`NAI-102636686v9
`
`
`2
`
`

`

`
`
`
`IPR2014-00724 – Petitioners’ Reply
`
`Further, Muftic admitted that: (a) no documentary evidence of conception
`
`was created before September 1995 – seven months after Kapidzic’s publication
`
`(Ex. 2017 at 31:6-32:17); (b) no reduction to practice occurred before filing the
`
`patent application (id. at 34:5-35:8); and (c) he is unable to separate the various
`
`contributions to the Kapidzic paper allegedly made by him from those of the two
`
`named authors (id. at 90:21-91:23). Moreover, Muftic cannot separate the portions
`
`of the Kapidzic paper describing his allegedly new concepts from those describing
`
`existing prior art, such as RFCs 1422 and 1424. (Id. at 95:16-97:22, 98:20-100:9.)
`
`Thus, nothing in the record shows what in Kapidzic allegedly constitutes Muftic’s
`
`sole work versus the work of the named authors or authors of the prior-art RFCs.
`
`II. KAPIDZIC ANTICIPATES CLAIMS 18-31.
`IV’s “Process” Argument for All Claims: For independent claims 18, 23,
`
`28, 30, and 31, IV argues that Kapidzic fails to describe the computer process
`
`recited in the claims. (Paper 19 at 20-23, 27-28, 33-34, 39-40, 40-41.) This is IV’s
`
`only argument for claims 18 and 31. (See id. at 20-23, 40-41.) Though the claims
`
`recite “computer process,” not just “process,” IV purports to base its argument on
`
`proposed definitions for “process”: (a) “computer program instructions running on
`
`a computer” (id. at 9) or (b) “a computer program loaded into memory and
`
`executing in a processor” (id. at 9, heading B).
`
`
`
`If IV simply asserted that the various computer processes described in the
`
`NAI-102636686v9
`
`
`3
`
`

`

`
`
`claims require computer instructions running on a computer, IV’s attempt to
`
`IPR2014-00724 – Petitioners’ Reply
`
`distinguish Kapidzic would clearly fail. For example, claim 18 requires that step b
`
`be performed “at said computer process….” The “verifying…” and “certifying
`
`and returning …” in step b all clearly take place at a computer running computer
`
`instructions because the emails Kapidzic describes require computers running
`
`instructions. IV concedes Kapidzic’s emails require computers running software.
`
`(See, e.g., Ex. 1010 at 44:6-8.)
`
`IV’s true “process” argument really turns on a different claim construction
`
`issue: whether, under the broadest reasonable interpretation, the claims preclude
`
`any human or manual interaction in or with the computer or software. (Paper 19 at
`
`20-23.) There is simply no support in the claim language or specification for
`
`grafting this limitation onto the claims, as IV asserts. Indeed, the specification
`
`describes using email messages and manual commands to invoke the various
`
`certificate management processes, for example:
`
`• “… certification functions … can be invoked by commands or by
`messages, such as an http command, an email message or program to
`program communication.” (Ex. 1002 at 5:65-67);
`• “FIGS. 7-27 describe a set of processes which collectively form the
`certification system, functions, and certification infrastructure of this
`invention. The processes may be invoked singularly or in combination
`and may be called by any other process. The commands and processes [in
`
`NAI-102636686v9
`
`
`4
`
`

`

`
`
`
`
`
`IPR2014-00724 – Petitioners’ Reply
`
`the figures] thus present a set of protocol and programming primitives
`which may be invoked either directly by a user or by part of an application
`process running on the user’s or CA’s computer.” (id. at 13:53-61);
`• “The appropriate process can be invoked manually by commands as
`well.” (id. at 17:66-67; see also Ex. 1010 at 49:21-25.)
`
`IV’s proposed constructions rely on one sentence in the specification (9:64-
`
`65) that relates to the blocks in FIG. 1A. (Paper 19 at 9.) But the blocks in FIG.
`
`1A represent various certification authorities (CAs) and users. (Ex. 1002 at 9:8-
`
`63.) And the patent discloses that CAs and users have access to computers with
`
`software and storage (id. at 9:64-10:10; 5:55-61) – not that these blocks are all sets
`
`of automated software instructions associated with nothing. Indeed, as the Board
`
`recognized in the institution decision, “computer processes” refers to nodes or
`
`entities. (Paper 12 at 3-4.) Moreover, the specification repeatedly refers to
`
`“entities” in describing the various flow charts and steps of the alleged inventions.
`
`(See, e.g., Ex. 1002 at 11:30-65; FIGS. 7, 9, 11, 12, 14-17, 19, 21 and associated
`
`descriptions at 13:64-16:50.) The Board does not need to construe “process,” other
`
`than to reject IV’s attempt to narrowly construe the claims to preclude any human
`
`or manual interaction with a computer.
`
`Moreover, IV’s application of its “process” argument is based on faulty
`
`assumptions by its expert. (See Paper 19 at 20-23 (citing to Ex. 2012, ¶¶34-43).)
`
`First, Dr. Chong states that “certification in Kapidzic ‘normally require[s] manual
`
`NAI-102636686v9
`
`
`5
`
`

`

`
`
`intervention.’” (Paper 19 at 21, citing Ex. 2012, ¶36.) But Kapidzic teaches
`
`IPR2014-00724 – Petitioners’ Reply
`
`otherwise: “It [the parent CA] verifies the identity of the requester according to
`
`whatever procedures are defined in the PCA’s security policy. This will normally
`
`require manual intervention ….” (Ex. 1004 at 13.) The “this” being referred to is
`
`verifying the identity of the requester – which is neither the entire certification
`
`process nor specifically recited in claim 18 (or the other independent claims).
`
`Furthermore, that identity checking “normally” requires manual intervention
`
`indicates there must be some instances without manual intervention.
`
`Second, Dr. Chong assumed that Kapidzic’s emails are processed manually,
`
`but he admitted that he did not know if all emails had to be processed manually or
`
`if emails could be processed in an automated manner in December 1995. (Ex.
`
`1010 at 44:9-21, 46:24-47:3.) His testimony is further undermined by his lack of
`
`experience with PKIs or certificate management systems at the relevant time (id. at
`
`10:19-11:1, 87:2-7) and his inability to answer even the simplest questions during
`
`his deposition. (See, e.g., id. at 109:12 (timestamp indicating over 6 hours 15
`
`minutes on the record, resulting in 109 transcript pages); 20:19-21:3, 67:2-7,
`
`81:18-22, 82:6-11 (timestamps indicating Dr. Chong waited over six minutes
`
`before answering each question; Dr. Chong, in fact, on over 20 occasions delayed
`
`more than two minutes before answering a question); 22:24-25:2, 30:8-32:10.)
`
`NAI-102636686v9
`
`
`6
`
`

`

`
`
`
`IPR2014-00724 – Petitioners’ Reply
`
`Dependent Claims 20 and 27:1 To distinguish claims 20 and 27, IV relies
`
`on the statement that a “common certificate repository may contain public key
`
`certificates for all certification authorities in the hierarchy” to argue that the
`
`repository recited in the claims is required to store certificates for all CAs. (Paper
`
`19 at 10-11, 23-24, 31-32 (emphasis added).) But “may” is permissive language,
`
`and IV’s attempt to turn this into a definition of the term should be rejected. See,
`
`e.g., i4i Ltd. P’ship v. Microsoft Corp., 598 F.3d 831, 844 (Fed. Cir. 2010); Vehicle
`
`IP, LLC v. AT&T Mobility, LLC, No. 2013-1380, 2014 U.S. App. LEXIS 21960 at
`
`*16 (Fed. Cir. Nov. 18, 2014). IV ignores other portions of the specification that
`
`demonstrate its construction is wrong. (See, e.g., Ex. 1002 at 5:48-50, 18:64-19:9.)
`
`Dependent Claim 22: IV asserts that Kapidzic describes performing
`
`certification only when a pair of keys expires not when the certificate expires.
`
`(Paper 19 at 24-25.) But Dr. Chong offered no explanation for why key expiration
`
`is not the same as certificate expiration to the skilled person, and he cites no
`
`
`1 IV concedes Kapidzic teaches the additional subject matter of claims 19, 21, 24,
`
`and 29, so this reply does not address those claims. (Paper 19 at 23, 24, 28, 34.)
`
`NAI-102636686v9
`
`
`7
`
`

`

`
`
`evidence for his assertion. (Ex. 2012 at ¶54.) The PKI Study (Ex. 1005), for
`
`IPR2014-00724 – Petitioners’ Reply
`
`example, describes that a certificate expires when the keys expire and that a
`
`certificate has a validity period for just this purpose. (Ex. 1005 at 71-72, 134-136.)
`
`Independent Claim 23: In addition to its “process” argument, IV also
`
`asserts that Kapidzic fails to teach “the sender” of claim 23. (Paper 19 at 26-27.)
`
`IV ties this argument to a half-hearted statement that all claim preambles are
`
`limiting (id. at 11, 26), but IV provides no support for its overall position on the
`
`preambles and, in any event, “sender” is in the body of claim 23. IV doesn’t
`
`otherwise distinguish any art based on the claim preambles, and it is thus
`
`unnecessary for the Board to address them to resolve IV’s arguments.
`
`More importantly, IV affirmatively argues elsewhere that Kapidzic teaches
`
`requesting and issuing certificates via email communications, so every signed data
`
`structure in Kapidzic is therefore from “a sender” (i.e., each certificate request and
`
`issued certificate was sent by some entity via email) and thus clearly meets claim
`
`23’s requirement. More specifically, the case where the UCA is “the sender” is
`
`clearly described in §4.1 of Kapidzic (at 13). Dr. Chong simply refused to engage
`
`when asked about §4.1. (Ex. 1010 at 70:1-71:18.)
`
`Dependent Claim 25: IV’s argument for claim 25 fails if the Board rejects
`
`IV’s construction for “verified by a direct inquiry to the certification authority.”
`
`(Paper 19 at 11-13, 28-30.) Claim 25 recites that the sender’s certificate “may
`
`NAI-102636686v9
`
`
`8
`
`

`

`
`
`also” be verified by a direct inquiry to the CA that issued the certificate. This is
`
`IPR2014-00724 – Petitioners’ Reply
`
`optional and thus does not further limit claim 23. See In re Johnston, 435 F.3d
`
`1381, 1384 (Fed. Cir. 2006) (“optional elements do not narrow the claim because
`
`they can always be omitted”); see also MPEP § 2111.04. Indeed, because the
`
`patentee repeatedly used “may” or “may also” in several dependent claims (see
`
`claims 21, 22, and 25-27), none of the language after “may” further limits these
`
`claims
`
`Even if claim 25 were entitled to patentable weight, all it requires is a “direct
`
`inquiry” to the issuing CA. The specification paragraph IV cites describes an
`
`inquiry to a common repository not the issuing CA, and it doesn’t teach that a
`
`direct inquiry is an exclusive alternative to an iterative approach. (See Ex. 1002 at
`
`13:42-52.) Moreover, the “direct verification” described there is achieved merely
`
`by the inquiring entity receiving the requested certificate, which Kapidzic (at 13)
`
`teaches, and IV’s expert could not specify anything else required to verify a
`
`certificate obtained in such a manner. (Ex. 1010 at 27:8-28:16.)
`
`Dependent Claim 26: Dependent claim 26’s additional limitation is entitled
`
`to no patentable weight because it merely recites that the certificate for each point
`
`between the sender and common point of trust “may be obtained from the
`
`respective individual computer processes.” (Ex. 1002 at 20:26-28 (emphasis
`
`added).) Though IV’s expert admits Kapidzic teaches that a requester can ask a
`
`NAI-102636686v9
`
`
`9
`
`

`

`
`
`certificate owner for its certificate (Ex. 1010 at 71:22-72:5), IV argues that
`
`IPR2014-00724 – Petitioners’ Reply
`
`Kapidzic is not explicit about going to every entity in the chain for its certificate.
`
`(See Paper 19 at 30-31.) This makes no sense. By teaching that the requester can
`
`query any certificate owner for its certificate, Kapidzic necessarily teaches that the
`
`requester can query every certificate owner if it so chooses.
`
`Independent Claim 28: In addition to its “process” argument, IV appears
`
`to also argue that Kapidzic is not explicit about using every CRL in the chain
`
`between a point of trust and the user whose certificate is being validated. (Paper
`
`19 at 32-33.) When asked, IV’s expert could not explain the argument, except to
`
`say that Kapidzic does not disclose checking CRLs “at other locations.” (Ex. 1010
`
`at 75:23-76:14.) This is another position without merit. Indeed, when IV’s expert
`
`was asked to explain what CRL of which entity was not used and checked in a
`
`three node chain (user-intermediary-common point of trust) according to Kapidzic,
`
`he could not identify a CRL of any of the three entities that was not used. (Ex.
`
`1010 at 75:23-77:8, 78:9-11.) Kapidzic (§6) clearly discloses claim 28.
`
`Independent Claim 30:
`
` Nevertheless, in addition to its “process” argument, IV asserts
`
`Kapidzic fails to teach three additional parts of claim 30. (Paper 19 at 34-38.) For
`
`step a.2, IV argues that although Kapidzic discloses revoking certificates of CAs, it
`
`NAI-102636686v9
`
`
`10
`
`

`

`
`
`is not explicit that any of the revoked certificates were “previously used” to verify
`
`IPR2014-00724 – Petitioners’ Reply
`
`subordinates. But disclosure of revoking CA certificates encompasses both those
`
`that were used and those that were not used. IV also argues that Kapidzic fails to
`
`disclose that the “new certificate” of the first computer process or CA received in
`
`step a.1 is copied to its immediate subordinates (part of step a.3) or further
`
`distributed to lower level subordinates (step b). IV is again wrong, as Figure 6 and
`
`the associated description in Kapidzic §5 clearly describe these limitations. (See
`
`Paper 1 at 31-32.) IV’s expert conceded this. (Ex. 1010 at 82:6-83:10.)
`
`III. PKI STUDY ANTICIPATES AND/OR RENDERS OBVIOUS CLAIMS
`18-31.
`IV’s “Process” Argument for All Claims: As with Kapidzic, IV argues
`
`that PKI Study (+ RFC 1424 for claim 18) fails to describe the computer “process”
`
`recited in independent claims 18, 23, 28, 30, and 31. (Paper 19 at 42-46, 48-49,
`
`53-54, 56, 59-60.) This is IV’s only argument for claims 18 and 28. (Id. at 42-46,
`
`53-54.) IV’s argument fails for the same reasons discussed above with respect to
`
`Kapidzic. (See supra at 3-6.) Further, as IV admits, PKI Study and RFC 1424
`
`describe using emails, for example, for the certification steps in claim 18. (See,
`
`e.g., Ex. 1010 at 84:3-8, 90:15-23; Paper 19 at 44-45.) Moreover, in §5 on
`
`“Operational Concepts” (§5.2 on “PKI Activities”), the PKI Study states “Within
`
`this section, the term CA is used in the generic sense to include CAs, PCAs and the
`
`PAA. The term entity is used in this section to mean any component of the PKI
`
`NAI-102636686v9
`
`
`11
`
`

`

`
`
`be they human or machine and include: users, processes, CAs, ORAs, CA
`
`IPR2014-00724 – Petitioners’ Reply
`
`operators and ORA operators.” (Ex. 1005 at 65 (emphasis added).)
`
`PKI Study confirms elsewhere that it fully contemplates and discloses the
`
`various PKI activities being performed by computers. (See, e.g., id. at 72-73
`
`(“During the verification process, the user or process running on his behalf
`
`should check all the certificates in the certification path against the appropriate
`
`CRL(s) ….”); 73 (“A user or the process running on his behalf looks first in the
`
`cache for a signer’s certificate before querying the Directory for the certificate.”);
`
`125 (“The Public Key Infrastructure must be able to support non-human users.”)
`
`(emphases added).) Separately, Petitioners’ expert identified various disclosures
`
`throughout PKI Study showing CAs are computer processes. (See Ex. 1011 at
`
`76:19-79:4, 139 (corrections).) Additional description of occasional human
`
`assistance is irrelevant given the clear disclosures of using emails and computer
`
`processes in the certification process. IV (Paper 19 at 46) also mischaracterizes
`
`Dr. Naccache’s testimony on RFC 1424 by taking out of context an excerpt created
`
`by IV’s counsel’s interruption. (See Ex. 1011 at 73:8-74:15, 139 (correction).)
`
`Dependent Claims 20 and 27:2 IV’s arguments to distinguish claims 20
`
`
`2 IV concedes PKI Study teaches the additional subject matter of claims 19, 22, 24,
`
`and 29, so this reply does not address those claims. (Paper 19 at 46, 48, 49, 54.)
`
`NAI-102636686v9
`
`
`12
`
`

`

`
`
`and 27 (Paper 19 at 46-47, 53) fail because they rely solely on IV’s erroneous
`
`IPR2014-00724 – Petitioners’ Reply
`
`construction of “common certificate repository.” (See supra at 7.) In addition,
`
`IV’s expert only addressed one sentence of PKI Study cited by Petitioners, and he
`
`ultimately conceded that the entire paragraph describes each CA storing its
`
`certificate at primary server and a secondary server – i.e., dual servers that each
`
`hold the certificates of all CAs and thus a “common certificate repository” even
`
`under IV’s incorrect construction. (Ex. 1010 at 93:2-16.)
`
`Dependent Claim 21: IV argues PKI Study fails to teach carrying out the
`
`recited steps when adding a new entity to the infrastructure. (Paper 19 at 47-48.)
`
`But an entity cannot be added to the “certification infrastructure” without being
`
`certified (which is what claim 18 recites). PKI Study specifically states the PAA
`
`adds (and certifies) PCAs to the PKI. Claim 21 requires nothing more.
`
`Independent Claim 23: In addition to its “process” argument, IV appears
`
`to argue that PKI Study does not disclose obtaining “every” certificate in the path
`
`to the common point of trust. (Paper 19 at 49.) IV ignores several cited portions
`
`of the art (see Paper 1 at 46-48), and its expert concedes that PKI Study discloses a
`
`receiver obtaining every certificate in the path. (Ex 1010 at 96:12-98:1.)
`
`Dependent Claim 25: IV’s argument for claim 25 (Paper 19 at 49-52) fails
`
`because it relies on IV’s erroneous construction for “verified by a direct inquiry to
`
`the certification authority.” (See supra at 8-9.) To the extent claim 25 requires
`
`NAI-102636686v9
`
`
`13
`
`

`

`
`
`anything, IV admits (Paper 19 at 50) that PKI Study teaches making a direct
`
`IPR2014-00724 – Petitioners’ Reply
`
`inquiry to the issuing CA and obtaining the certificate, which is all that is required.
`
`(See Ex. 1010 at 27:8-28:16.) With respect to obviousness, Dr. Naccache’s
`
`testimony (Ex. 1001, ¶112) does not rely on common sense to supply a missing
`
`element, and the substance of his testimony is unrebutted. (See Ex. 2012, ¶152.)
`
`Dependent Claim 26: For claim 26, IV’s argument appears to be exactly
`
`the same as for independent claim 23. (Compare Paper 19 at 52 with id. at 48.)
`
`Independent Claim 30: In addition to its “process” argument, IV also
`
`asserts that PKI Study fails to disclose that the “new certificate” of the first
`
`computer process or CA received in step a.1 is copied to its immediate
`
`subordinates (part of step a.3) or further distributed to lower level subordinates
`
`(step b). (Paper 19 at 54-56.) IV acknowledges that the CA reissues new
`
`certificates for its subordinates, and the PKI Study explains that senders may send
`
`certification paths when sending certificates. (Ex. 1005 at 67.) IV’s expert admits
`
`the certification path sent with the subordinate’s certificate includes the certificate
`
`of the issuing CA (Ex. 1010 at 96:12-98:1) – i.e, the CA’s “new certificate.”
`
`IV’s argument for step b relies solely on its erroneous position for step a.3,
`
`and thus also fails. With respect to the obviousness of step b, Dr. Naccache’s
`
`testimony (Ex. 1001, ¶120) does not rely on common sense to supply a missing
`
`element not taught in the references of record – PKI Study (and Kapidzic)
`
`NAI-102636686v9
`
`
`14
`
`

`

`
`
`explicitly describes distributing a CA’s new certificate to at least some
`
`IPR2014-00724 – Petitioners’ Reply
`
`subordinates. Dr. Naccache’s point is that distribution to all subordinates would
`
`have been obvious in view of that disclosure.
`
`Independent Claim 31: In addition to its “process” argument, IV asserts,
`
`with respect to step a, that the cited portions of PKI Study teach creating new
`
`entities but do not sufficiently disclose adding a new component to a
`
`“representation” of the infrastructure. (Paper 19 at 57-58.) In addition to portions
`
`already cited by Petitioners, PKI Study explains that for an entity in the PKI,
`
`“identity is contained in a unique name, that is the name which distinguishes this
`
`entity from any and all other PKI entities. Such a name is often formed by
`
`concatenating a sequence of locally unique names of some hierarchical
`
`substructure of the PKI.” (Ex. 1005 at 27; see also id. at 55 n.4 (“entities in the
`
`PKI must have unique names … one attractive approach is a naming scheme which
`
`parallels the certification hierarchy”).) Thus, the name alone is a representation of
`
`the location where the entity is added.
`
`With respect to the second part of step b, IV asserts that PKI Study fails to
`
`teach a certificate storage database at the certifying CA. (Paper 19 at 59.) Again,
`
`IV ignores several cited portions of PKI Study (see Paper 1 at 58), and its expert
`
`concedes that PKI Study discloses this limitation. (Ex 1010 at 104:22-105:9.)
`
`
`
`NAI-102636686v9
`
`
`15
`
`

`

`
`
`
`
`Dated: March 24, 2015
`
`IPR2014-00724 – Petitioners’ Reply
`
`/Geoffrey K. Gavin/
`Geoffrey K. Gavin
`Reg. No. 47,591
`JONES DAY
`1420 Peachtree Street, N.E.
`Suite 800
`Atlanta, GA 30309
`
`Lead Counsel for Petitioners
`
`
`NAI-102636686v9
`
`
`16
`
`

`

`IPR2014-00724 – Petitioners’ Reply
`
`
`
`CERTIFICATE OF SERVICE
`
`Petitioners hereby certify that the foregoing PETITIONERS’ REPLY TO
`
`PATENT OWNER’S RESPONSE TO PETITION FOR INTER PARTES REVIEW
`
`was served electronically via email on March 24, 2015, on Patent Owner’s lead
`
`and backup counsel as follows:
`
`Brenton R. Babcock (lead counsel)
`2brb@knobbe.com
`
`Ted M. Cannon (backup counsel)
`2tmc@knobbe.com
`
`Donald J. Coulman (backup counsel)
`dcoulman@intven.com
`
`Tim R. Seeley (backup counsel)
`tims@intven.com
`
`Scott Raevsky (backup counsel)
`2sxr@knobbe.com
`
`Bridget A. Smith (backup counsel)
`2bzs@knobbe.com
`
`BoxPGL11@knobbe.com
`
`
`
`/Geoffrey K. Gavin/
`Lead Counsel for Petitioners
`
`
`
`
`
`
`
`
`
`
`NAI-102636686v9
`
`