IN THE UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF DELAWARE
`
`MZM SOLUTIONS LLC,
`
`a Delaware limited liability company,
`
`Plaintiff,
`
`V.
`
`MOTOROLA SOLUTIONS, INC., a
`Delaware corporation, TELIT
`COMMUNICATIONS PLC, a United
`Kingdom public limited company, and TELIT
`WIRELESS SOLUTIONS INC., a Delaware
`
`corporation,
`
`Defendants.
`
`
`CA‘ N°' ”'°33'RGA
`
`EXPERT REPORT OF KIMMO SAVOLAINEN ON THE
`
`INVALIDITY OF U.S. PATENT NO. 8,094,010
`
`I have been retained by Telit Communications PLC (“Telit PLC”) and Telit Wireless
`
`Solutions Inc. (“Telit Wireless”) (collectively with Telit PLC, “Telit”), Motorola Solutions, Inc.
`
`and Kowatec Corporation (“Kowatec”) to serve as an expert in this lawsuit.
`
`I expect to testify at
`
`trial regarding the matters discussed in this report if asked about them by the Court or the parties’
`
`attorneys]
`
`This report constitutes notice under 35 U.S.C. §282. Defendants reserve the right to rely
`'
`on prior art, invalidity contentions or information contained in the expert reports submitted by
`other defendants against which M2M asserted the ‘0l0 Patent.
`
`1
`
`M2M
`
`Ex. 2008
`
`1
`
`M2M
`Ex. 2008
`
`

`
`Expert Report of Kimmo Savolainen
`May 5, 2014
`
`US. Patent ‘No.“8,094,010*CIaiins5 t
`
`a memory module for storing the at
`least one telephone number or IP
`address from the authenticated
`transmission as one of one or more
`
`permitted callers if the processing
`module authenticates the at least one
`
`transmission by determining that the at
`least one transmission includes the
`
`coded number; and
`
`Page 20 of 57
`
`would have been obvious to add incoming call
`screening as described in the GSM standard.
`Further, it would have been dangerous, and would
`undermine the concept of call screening, to allow a
`stranger to program or change the allowed numbers.
`Therefore, it would have been obvious to modify the
`device to authenticate anyone trying to change the
`
`allowed caller numbers.
`
`“[T]he hot link communicator is able to select one of
`a plurality of numbers stored in the preprogrammed
`identity module. This can be realised [sic] in a
`number of ways such as programming the call
`initiate button 14 to toggle through the list of stored
`numbers wherein each is sequentially displayed on
`the screen." (Ex. 15, 0409, ll. 26-31).
`
`E. Wesby admitted that the Hotlink “include[d] a
`simple programming feature which was to populate
`a permitted callers list.” (Ex. 50, EW Tr. Aug. 14,
`2012 at 25:10-11).
`
`Further, E. Wesby admitted that a permitted caller
`list is “essentially a list of phone numbers to which
`that communicator is permitted to communicate,
`whether it isfor receiving a callfrom that number or
`to make a call to that number.” (Ex. 50, EW Tr.
`Aug. 14, 2012 at 25:14-16, emphasisladded).
`
`These admissions confirm my view that there was
`no significant difference between restricting
`incoming or outgoing calls.
`In fact, the same
`+CLCK command was used for both (see facilities
`FD for outgoing and NT-NA for incoming at Ex. 20,
`6474-5). The decision to restrict incoming calls,
`outgoing calls, or both was application dependent,
`and was easy to implement by any competent
`engineer.
`
`wherein the at least one transmission
`
`The ‘O10 Patent admitted that it would have been
`
`from a programmable transmitter
`comprises a Short Message Service
`
`obvious to use SMS for communicating with the
`Hotlink: “Existing and known methods of
`
`2
`
`M2M
`
`Ex. 2008
`
`2
`
`M2M
`Ex. 2008
`
`

`
`
`
`Expert RReport of Kimmmo Savolaiinen
`
`
`
`
`May 5, 22014
`
`
`Page 35
`
`of 57
`
`
`
`8.
`7
`
`
`
`
`
`
`
`
`
`
`
`“Harddware flow ccontrol” of thhe serial porrt was progrrammable too be turned oon (2)
`
`
`
`
`
`
`
`f data l the flow ofen to controlles the Raveontrol enablware flow co119). Hardwor off (0)) (Ex. 17, 4
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`over the
`
`serial port
`
`
`
`from the mmonitored tecchnical devicces. Ravenn disclosed pprogramminng the
`
`
`
`
`
`
`
`
`
`
`
`
`
`lessly 119) or wirel0 (Ex. 17, 41mand AT\Q0ing AT commerial port usol over the shardwaree flow contro
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`using thee Wireless AAce (Ex. 17,, 4150, 41166). AT&C aand AT&D aalso control
`
`
`
`
`
`
`
`
`
`
`
`
`
`the flow off data
`
`over the
`
`serial port
`
`
`
`(Ex. 20, 64447). M2MM asserted tthat these wwere programmmable inteerface
`
`
`
`
`
`
`
`
`
`
`
`
`
`Claim Contention Cfringement Climinary Infemental Prelcond Supplee Ex. 47, Seccommandds (e.g., see
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Chart agaainst Telit NNov. 18, 2013, for the claim elementt 1c, GE8633-QUAD/GPPS module, ppp. 1-
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`gainst m Chart agention Claimment Contery Infringeml Preliminar2; Ex. 448, First Supplemental
`
`
`
`
`
`
`
`
`
`es wireless M5200 Seriement 1c, SIM013, for elemKowatec, April 8, 20
`
`
`
`
`
`
`
`
`
`
`
`modules, p. 3). All of
`
`these
`
`
`
`commandds control thhe flow of daata through tthe serial porrt.
`
`
`
`
`
`
`
`
`
`
`
`Permmitted Callerr
`
`
`
`
`
`
`
`
`
`
`
`
`
`The RRaven has thhree modes oof operation:: “command d mode” for pprogramminng the
`
`
`
`
`
`
`
`iii.
`
`
`
`79.
`
`modem,
`
`
`
`“data modee” for sendinng outgoing
`
`
`
`
`
`ckets, ing data paciving incomidata packetts and recei
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`in response mand mode iout of commhing in and oe” for switchand “halff open mode
`
`
`
`
`
`
`
`to incomingg data
`
`
`
`packets ((Ex. 17, 41008). In half
`
`
`
`
`
`
`open mode,, if the destiination IP adddress was sset to 0.0.0.00, the
`
`
`
`
`
`
`
`
`
`3
`
`M2M
`Ex. 2008
`
`

`
`Expert Report of Kimmo Savolainen
`May 5, 2014
`
`CDPD modem could receive data packets from any destination IP address (Ex. 17, 4112). The
`
`Page 36 of 57
`
`incoming data packets include the destination IP address of the sending device (i.e., “the source
`
`address”) (Ex. 17, 4108). When the modem received its first incoming packet from a destination
`
`IP address, the modem “locks onto” that destination until a timer expires (Ex. 17, 4112). During
`
`the lockout period, the modem is “locked onto” and therefore could only receive incoming data
`
`packets from that destination IP address, i.e., a “permitted caller” (Ex. 17, 4112). To lock onto
`
`the destination IP address for a period of time (the duration of the half-open timer), the IP
`
`address must be stored for at least that period of time.
`
`iii. Authentication
`
`80. Raven disclosed programming the modem to operate in half-open mode using a
`
`“Wireless Ace” (AirLink Configuration Executive) (Ex. 17, 4112). The Wireless ACE required
`
`that a password is authenticated to program the modem: “When you have changed a parameter in
`
`your modem, using ACE, and click on Write to Modem, you will be prompted for a password.
`
`The default password is 12345. You need to change the password to your modem. Passwords
`
`can be case sensitive and include numbers. Use Options → Change Modem Password ... or Ctrl-
`
`H. The password can be up to eight characters in length.” (Ex. 17, 4104). To the extent that
`
`M2M asserted a 4-digit password is unique,6 Raven’s eight-character password must also be
`
`unique. Regardless, a person or ordinary skill in the art would have understood that an eight-
`
`digit password designated to be changed by a user was meant to be personalized to be a unique
`
`
`I have been informed that M2M asserts that the password identified in its infringement
`6
`contentions against Kowatec, PIN2 (e.g., see Ex. 48, p. 3), is a “‘coded number’ as construed by
`the Court” i.e. that the PIN2 is “unique” (Ex. 49, TELIT0068277). The PIN2 password is a 4-
`digit number (e.g., see Ex. 20, 6490).
`
`
`4
`
`M2M
`Ex. 2008
`
`

`
`Expert Report of Kimmo Savolainen
`May 5, 2014
`
`number. Additionally, it would have been obvious as a matter of design choice to require a
`
`Page 37 of 57
`
`unique password to increase the security of the device.
`
`iv. Wireless Programming
`
`81.
`
`The Wireless Ace programmed the modem wirelessly: “with our Windows
`
`application Wireless ACE, you can see the status and configure the modem both locally via the
`
`serial cable or remotely from the network” (Ex. 17, 4116, emphasis added). Therefore, the
`
`password would have been sent over the CDPD network, which is cellular (wireless), as a
`
`packet-switched (CDPD) transmission.
`
`82.
`
`The attached Appendix C shows the correspondence between Raven (Ex. 17) and
`
`the Asserted Claims of the ‘010 Patent. For these reasons, in my opinion, the Asserted Claims of
`
`the ‘010 Patent were anticipated by and/or would have been obvious over Raven and are invalid.
`
`
`
`D.
`
`The Asserted Claims Were Anticipated
`By and/or Obvious Over GSM 11.14
`
`83. GSM is the “Global System for Mobile Communication” that was developed in
`
`the 1980s. GSM 11.14 version 7.3.0 dated July 1999 (Ex. 18) described the SIM Application
`
`toolkit. GSM 11.14 incorporated by reference, for example:
`
` “the commands and protocols relevant to the SIM Application Toolkit in GSM
`11.11” (Ex. 18, 6118), the “Proactive SIM” (Ex. 18, 6122), and “proactive
`command” (Ex. 18, 6125) of GSM 11.11 (Ex. 19).
`
`
`
`
`
`the AT commands of GSM 07.07 at Ex. 18, 6191, 6140. See GSM 07.07, Ex. 20.
`
`the security features of GSM 03.48 at Ex. 18, 6195. See GSM 03.48, Ex. 22.
`
` The SMS interface of GSM 07.05 at Ex. 18, 6116. See GSM 07.05, Ex. 21.
`
`
`
`5
`
`M2M
`Ex. 2008
`
`

`
`Expert Report of Kimmo Savolainen
`May 5, 2014
`
`Page 54 of 57
`
`VIII. RIGHT TO SUPPLEMENT OR AMEND
`
`118.
`
`I reserve the right to supplement and/or amend the opinions expressed herein in
`
`response to positions taken by Plaintiff or experts retained on Plaintiff’s behalf. To amplify what
`
`is stated above, where necessary, and especially in view of information not presently known to
`
`me or new information presented by Plaintiff’s experts prior to, or at trial in this matter.
`
`I reserve
`
`the right to supplement and/or amend this report should additional information be brought to my
`
`attention during the course of this proceeding.
`
`Dated: May 5, 2014
`
`
`
`Kimmo Savolainen
`
`6
`
`M2M
`
`Ex. 2008
`
`6
`
`M2M
`Ex. 2008