`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`NOKIA CORP. and NOKIA OF AMERICA CORP.
`Petitioners
`
`v.
`
`PACKET INTELLIGENCE LLC,
`Patent Owner
`____________
`In re Inter Partes Review of:
`
`U.S. Patent Nos. 6,651,099, 6,665,725, 6,771,646, 6,839,751, and 6,954,789
`____________
`
`DECLARATION OF DR. KEVIN JEFFAY
`
`
`Mail Stop PATENT BOARD
`Patent Trial and Appeal Board
`US Patent and Trademark Office
`PO Box 1450
`Alexandria, Virginia 22313-1450
`
`
`
`NOAC Ex. 1006 Page, 1
`
`

`

`
`
`
`
`B.(cid:1)
`
`TABLE OF CONTENTS
`INTRODUCTION .................................................................................... 23(cid:1)
`I.(cid:1)
`BACKGROUND ...................................................................................... 24(cid:1)
`II.(cid:1)
`III.(cid:1) STATEMENT OF LEGAL PRINCIPALS ............................................. 28(cid:1)
`A.(cid:1) Anticipation ......................................................................................... 28(cid:1)
`B.(cid:1)
`Obviousness ......................................................................................... 29(cid:1)
`IV.(cid:1) SUMMARY OF THE CHALLENGED PATENTS ............................... 30(cid:1)
`A.(cid:1) Overview of the Technology ................................................................ 30(cid:1)
`1.(cid:1) Network Protocols and Protocol Layering..................................... 30(cid:1)
`2.(cid:1) Network Packets ........................................................................... 42(cid:1)
`3.(cid:1) Monitoring Network Traffic ......................................................... 43(cid:1)
`4.(cid:1) Control and Data Transmission in Network Protocols ................... 46(cid:1)
`Overview of the Challenged Patents ..................................................... 49(cid:1)
`1.(cid:1) “Connection Flow” vs. “Conversational Flow” ............................. 50(cid:1)
`2.(cid:1) The ’099 Patent ............................................................................. 53(cid:1)
`3.(cid:1) The ’725 Patent ............................................................................. 57(cid:1)
`4.(cid:1) The ’646 Patent ............................................................................. 59(cid:1)
`5.(cid:1) The ’751 Patent ............................................................................. 62(cid:1)
`6.(cid:1) The ’789 Patent ............................................................................. 64(cid:1)
`The Prosecution History of the Challenged Patents .............................. 66(cid:1)
`1.(cid:1) The Prosecution History of the ’099 Patent ................................... 66(cid:1)
`2.(cid:1) The Prosecution History of the ’725 Patent ................................... 67(cid:1)
`3.(cid:1) The Prosecution History of the ’646 Patent ................................... 68(cid:1)
`4.(cid:1) The Prosecution History of the ’751 Patent ................................... 72(cid:1)
`5.(cid:1) The Prosecution History of the ’789 Patent ................................... 74(cid:1)
`Prior Inter Partes Reviews ................................................................... 75(cid:1)
`D.(cid:1)
`German Nullity Proceeding .................................................................. 77(cid:1)
`E.(cid:1)
`V.(cid:1) CLAIM CONSTRUCTION ..................................................................... 81(cid:1)
`A.(cid:1)
`“Conversational Flow[s]” or “Conversational Flow Sequence” ............ 81(cid:1)
`1.(cid:1) Examples of “Conversational Flows”............................................ 82(cid:1)
`2.(cid:1) Dispute over the Scope of “Conversational Flow[s]” or
`“Conversational Flow Sequence” ................................................................. 96(cid:1)
`B.(cid:1)
`“State of the Flow” ............................................................................. 102(cid:1)
`C.(cid:1)
`“State Operations” .............................................................................. 104(cid:1)
`D.(cid:1)
`“Flow-entry database” ........................................................................ 107(cid:1)
`E.(cid:1)
`“Parser Record” ................................................................................. 108(cid:1)
`
`C.(cid:1)
`
`NOAC Ex. 1006 Page, 2
`
`

`

`
`
`
`
`F.(cid:1)
`“Child Protocol” ................................................................................. 109(cid:1)
`“Parsing/Extraction Operations” ........................................................ 109(cid:1)
`G.(cid:1)
`H.(cid:1) Means-Plus-Function Terms .............................................................. 109(cid:1)
`VI.(cid:1) OVERVIEW OF THE CHALLENGES ............................................... 113(cid:1)
`A.(cid:1)
`Level of Ordinary Skill in the Art ....................................................... 113(cid:1)
`B.(cid:1)
`Priority Date ....................................................................................... 115(cid:1)
`C.(cid:1)
`Prior Art ............................................................................................. 115(cid:1)
`1.(cid:1) Riddle ......................................................................................... 115(cid:1)
`a)(cid:1)
`Summary of the Problem and Solution ................................ 117(cid:1)
`b)(cid:1)
`The Operation of Riddle ...................................................... 120(cid:1)
`2.(cid:1) Cheriton ...................................................................................... 132(cid:1)
`3.(cid:1) RFC 1945 - Hypertext Transfer Protocol -- HTTP/1.0 ................ 133(cid:1)
`4.(cid:1) RFC 1889 - RTP: A Transport Protocol for Real-Time Applications
`139(cid:1)
`5.(cid:1) RFC 2326 - Real Time Streaming Protocol (RTSP) .................... 142(cid:1)
`6.(cid:1) Baker .......................................................................................... 144(cid:1)
`7.(cid:1) Wakeman .................................................................................... 148(cid:1)
`8.(cid:1) Bruins ......................................................................................... 154(cid:1)
`9.(cid:1) Hasani ......................................................................................... 156(cid:1)
`Summary of the Challenges................................................................ 157(cid:1)
`D.(cid:1)
`VII.(cid:1) THE CLAIMS OF THE ’099 PATENT ARE UNPATENTABLE ...... 158(cid:1)
`The ’099 Patent Count 1: Riddle in View of Cheriton and Bruins
`A.(cid:1)
`Renders claims 1, 2, 4, and 5 Obvious ................................................ 158(cid:1)
`1.(cid:1) Claim 1 ....................................................................................... 158(cid:1)
`a)(cid:1)
`Limitation [1 Pre] “A packet monitor for examining packets
`passing through a connection point on a computer network in
`real-time, the packets provided to the packet monitor via a
`packet acquisition device connected to the connection point,
`the packet monitor comprising:” ......................................... 158(cid:1)
`Limitation [1a] “(a) a packet-buffer memory configured to
`accept a packet from the packet acquisition device;”........... 164(cid:1)
`Limitation [1b] “(b) a parsing/extraction operations memory
`configured to store a database of parsing/extraction operations
`that includes information describing how to determine at least
`one of the protocols used in a packet from data in the packet;”
` ............................................................................................ 167(cid:1)
`Limitation [1c] “(c) a parser subsystem coupled to the packet
`buffer and to the pattern/extraction operations memory, the
`parser subsystem configured to examine the packet accepted
`NOAC Ex. 1006 Page, 3
`
`b)(cid:1)
`
`c)(cid:1)
`
`d)(cid:1)
`
`

`

`
`
`by the buffer, extract selected portions of the accepted packet,
`and form a function of the selected portions sufficient to
`identify that the accepted packet is part of a conversational
`flow-sequence;” .................................................................. 176(cid:1)
`(cid:1) Riddle identifies “conversational flow[s]” or
`“conversational flow-sequences” through Riddle’s
`disclosure of “service aggregates” .............................. 178(cid:1)
`(cid:1) Riddle identifies “conversational flow[s]” or
`“conversational flow-sequences” through Riddle’s ability
`to classify PointCast traffic ........................................ 186(cid:1)
`Limitation [1d] “(d) a memory storing a flow-entry database
`including a plurality of flow-entries for conversational flows
`encountered by the monitor;” .............................................. 191(cid:1)
`Limitation [1e] “(e) a lookup engine connected to the parser
`subsystem and to the flow-entry database, and configured to
`determine using at least some of the selected portions of the
`accepted packet if there is an entry in the flow-entry database
`for the conversational flow sequence of the accepted packet;”
` ............................................................................................ 198(cid:1)
`Limitation [1f] “(f) a state patterns/operations memory
`configured to store a set of predefined state transition patterns
`and state operations such that traversing a particular transition
`pattern as a result of a particular conversational flow-sequence
`of packets indicates that the particular conversational flow-
`sequence is associated with the operation of a particular
`application program, visiting each state in a traversal including
`carrying out none or more predefined state operations;” ..... 200(cid:1)
`Limitation [1g] “(g) a protocol/state identification mechanism
`coupled to the state patterns/operations memory and to the
`lookup engine, the protocol/state identification engine
`configured to determine the protocol and state of the
`conversational flow of the packet; and” .............................. 214(cid:1)
`Limitation [1h] “(h) a state processor coupled to the flow-entry
`database, the protocol/state identification engine, and to the
`state patterns/operations memory, the state processor,
`configured to carry out any state operations specified in the
`state patterns/operations memory for the protocol and state of
`the flow of the packet,” ....................................................... 216(cid:1)
`Limitation [1i] “the carrying out of the state operations
`furthering the process of identifying which application
`NOAC Ex. 1006 Page, 4
`
`e)(cid:1)
`
`f)(cid:1)
`
`g)(cid:1)
`
`h)(cid:1)
`
`i)(cid:1)
`
`j)(cid:1)
`
`

`

`
`
`program is associated with the conversational flow-sequence
`of the packet, the state processor progressing through a series
`of states and state operations until there are no more state
`operations to perform for the accepted packet, in which case
`the state processor updates the flow-entry, or until a final state
`is reached that indicates that no more analysis of the flow is
`required, in which case the result of the analysis is
`announced.” ........................................................................ 220(cid:1)
`2.(cid:1) Claim 2 ....................................................................................... 223(cid:1)
`a)(cid:1)
`Limitation [2] “A packet monitor according to claim 1,
`wherein the flow-entry includes the state of the flow, such that
`the protocol/state identification mechanism determines the
`state of the packet from the flow-entry in the case that the
`lookup engine finds a flow-entry for the flow of the accepted
`packet.” ............................................................................... 223(cid:1)
`3.(cid:1) Claim 4 ....................................................................................... 225(cid:1)
`a)(cid:1)
`Limitation [4a] “A packet monitor according to claim 1,
`further comprising: a compiler processor coupled to the
`parsing/extraction operations memory, the compiler processor
`configured to run a compilation process that includes:” ...... 225(cid:1)
`Limitation [4b] “receiving commands in a high-level protocol
`description language that describe the protocols that may be
`used in packets encountered by the monitor, and” ............... 226(cid:1)
`Limitation [4c] “translating the protocol description language
`commands into a plurality of parsing/extraction operations that
`are initialized into the parsing/extraction operations memory.”
` ............................................................................................ 229(cid:1)
`4.(cid:1) Claim 5 ....................................................................................... 230(cid:1)
`a)(cid:1)
`Limitation [5a] “A packet monitor according to claim 4,
`wherein the protocol description language commands also
`describe a correspondence between a set of one or more
`application programs and the state transition
`patterns/operations that occur as a result of particular
`conversational flow-sequences associated with an application
`program, ” ........................................................................... 230(cid:1)
`Limitation [5b] “wherein the compilation process further
`includes translating the protocol description language
`commands into a plurality of state patterns and state operations
`that are initialized into the state patterns/operations memory.”
` ............................................................................................ 232(cid:1)
`NOAC Ex. 1006 Page, 5
`
`b)(cid:1)
`
`b)(cid:1)
`
`c)(cid:1)
`
`

`

`
`
`B.(cid:1)
`
`C.(cid:1)
`
`b)(cid:1)
`c)(cid:1)
`
`The ’099 Patent Count 2: Riddle in View of Cheriton, Bruins, and
`Further in View of RFC 1945 Renders Claims 1, 2, 4, and 5 as Obvious
` ........................................................................................................... 233(cid:1)
`The ’099 Patent Count 3: Riddle in View of Cheriton, Bruins, and
`Further in View of RFC 1889 and RFC 2326 Renders Claims 1, 2, 4, and
`5 as Obvious....................................................................................... 241(cid:1)
`VIII.(cid:1) THE CLAIMS OF THE ’725 PATENT ARE UNPATENTABLE ...... 246(cid:1)
`A.(cid:1)
`The ’725 Patent Count 1: Riddle in view of Baker Renders Claims 10,
`12, 13, 16, and 17 Obvious ................................................................. 246(cid:1)
`1.(cid:1) Claims 10 and 17 ........................................................................ 246(cid:1)
`a)(cid:1)
`Limitation [10 Pre] and [17 Pre] “A method of performing
`protocol specific operations on a packet passing through a
`connection point on a computer network, the method
`comprising:” ....................................................................... 246(cid:1)
`Limitation [10(a)] and [17(a)] “(a) receiving the packet;” ... 248(cid:1)
`Limitations [10(b)] and [17(b)] (b) receiving a set of protocol
`descriptions for a plurality of protocols that conform to a
`layered model, a protocol description for a particular protocol
`at a particular layer level including: .................................... 249(cid:1)
`(cid:1) Riddle ........................................................................ 249(cid:1)
`(cid:1) Baker .......................................................................... 250(cid:1)
`(cid:1) Motivation to Combine .............................................. 258(cid:1)
`Limitations [10(b)(i)] and [17(b)(i)] (i) if there is at least one
`child protocol of the protocol at the particular layer level, the-
`one or more child protocols of the particular protocol at the
`particular layer level, the packet including for any particular
`child protocol of the particular protocol at the particular layer
`level information at one or more locations in the packet related
`to the particular child protocol, ........................................... 260(cid:1)
`Limitations [10(b)(ii)] and [17(b)(ii)] (ii) the one or more
`locations in the packet where information is stored related to
`any child protocol of the particular protocol, ....................... 271(cid:1)
`Limitations [10(b)(iii)] and [17(b)(iii)] “(iii) if there is at least
`one protocol specific operation to be performed on the packet
`for the particular protocol at the particular layer level, the one
`or more protocol specific operations to be performed on the
`packet for the particular protocol at the particular layer level
` ............................................................................................ 271(cid:1)
`
`d)(cid:1)
`
`e)(cid:1)
`
`f)(cid:1)
`
`NOAC Ex. 1006 Page, 6
`
`

`

`
`
`B.(cid:1)
`
`g)(cid:1)
`
`h)(cid:1)
`
`Limitation [10(c)] and [17(c)] “(c) performing the protocol
`specific operations on the packet specified by the set of
`protocol descriptions based on the base protocol of the packet
`and the children of the protocols used in the packet,”.......... 278(cid:1)
`Limitation [10(d)] “wherein the protocol specific operations
`include one or more parsing and extraction operations on the
`packet to extract selected portions of the packet to form a
`function of the selected portions for identifying the packet as
`belonging to a conversational flow.” ................................... 280(cid:1)
`(cid:1) Riddle identifies a “conversational flow” “through
`Riddle’s disclosure of “service aggregates” ................ 281(cid:1)
`(cid:1) Riddle identifies “conversational flow[s]” through
`Riddle’s ability to classify PointCast traffic ............... 289(cid:1)
`Limitation [17(d)] “wherein the packet belongs to a
`conversational flow of packets having a set of one or more
`states, and wherein the protocol specific operations include one
`or more state processing operations that are a function of the
`state of the conversational flow of the packet, the state of the
`conversational flow of the packet being indicative of the
`sequence of any previously encountered packets of the same
`conversational flow as the packet.” ..................................... 295(cid:1)
`2.(cid:1) Claim 12 ..................................................................................... 301(cid:1)
`a)(cid:1)
`Limitation [12] “A method according to claim 10, wherein
`which protocol specific operations are performed is step (c)
`depends on the contents of the packet such that the method
`adapts to different protocols according to the contents of the
`packet.” ............................................................................... 301(cid:1)
`3.(cid:1) Claim 13 ..................................................................................... 303(cid:1)
`a)(cid:1)
`Limitation [13] “A method according to claim 10, wherein the
`protocol descriptions are provided in a protocol description
`language.” ........................................................................... 303(cid:1)
`4.(cid:1) Claim 16 ..................................................................................... 304(cid:1)
`a)(cid:1)
`Limitation [16] “A method according to claim 10, wherein the
`protocol specific operations further include one or more state
`processing operations that are a function of the state of the
`flow of the packet.” ............................................................. 304(cid:1)
`The ’725 Patent Count 2: Riddle in View of Baker and Further in View
`of RFC 1945 Renders Claims 10, 12, 13, 16, and 17 as Obvious ....... 304(cid:1)
`
`i)(cid:1)
`
`NOAC Ex. 1006 Page, 7
`
`

`

`
`
`b)(cid:1)
`
`c)(cid:1)
`
`C.(cid:1)
`
`The ’725 Patent Count 3: Riddle in View of Baker and Further in View
`of RFC 1889 and RFC 2326 Renders Claims 10, 12, 13, 16, and 17 as
`Obvious .............................................................................................. 313(cid:1)
`IX.(cid:1) THE CLAIMS OF THE ’646 PATENT ARE UNPATENTABLE ...... 318(cid:1)
`A.(cid:1)
`The ’646 Patent Count 1: Riddle in View of Wakeman and Bruins
`Renders Claims 1, 2, 3, 16, and 18 as Obvious; and Riddle in View of
`Wakeman, Cheriton, and Bruins Renders Claim 7 Obvious ............... 318(cid:1)
`1.(cid:1) Claim 1 ....................................................................................... 318(cid:1)
`a)(cid:1)
`Limitation [1 Pre] A packet monitor for examining packets
`passing through a connection point on a computer network,
`each packet conforming to one or more protocols, the monitor
`comprising:” ....................................................................... 318(cid:1)
`Limitation [1a] (a) a packet acquisition device coupled to the
`connection point and configured to receive packets passing
`through the connection point;” ............................................ 323(cid:1)
`Limitation [1b] “(b) a memory for storing a database
`comprising flow-entries for previously encountered
`conversational flows to which a received packet may belong, a
`conversational flow being an exchange of one or more packets
`in any direction as a result of an activity corresponding to the
`flow;” .................................................................................. 325(cid:1)
`(cid:1) Riddle identifies a “conversational flow” through
`Riddle’s disclosure of “service aggregates” ................ 331(cid:1)
`(cid:1) Riddle identifies “conversational flow[s]” through
`Riddle’s ability to classify PointCast traffic ............... 339(cid:1)
`Limitation [1c] “(c) a cache subsystem coupled to the flow-
`entry database memory providing for fast access of flow-
`entries from the flow-entry database;” ................................ 344(cid:1)
`Limitation [1d] “(d) a lookup engine coupled to the packet
`acquisition device and to the cache subsystem and configured
`to lookup whether a received packet belongs to a flow-entry in
`the flow-entry database, the looking up being via the cache
`subsystem; and” .................................................................. 352(cid:1)
`Limitation [1e] “(e) a state processor coupled to the lookup
`engine and to the flow-entry-database memory, the state
`processor being to perform any state operations specified for
`the state of the flow starting from the last encountered state of
`the flow in the case that the packet is from an existing flow,
`and to perform any state operations required for the initial state
`
`d)(cid:1)
`
`e)(cid:1)
`
`f)(cid:1)
`
`NOAC Ex. 1006 Page, 8
`
`

`

`
`
`b)(cid:1)
`
`of the new flow in the case that the packet is not from an
`existing flow.” .................................................................... 354(cid:1)
`2.(cid:1) Claim 2 ....................................................................................... 361(cid:1)
`a)(cid:1)
`Limitation [2a] “A packet monitor according to claim 1,
`further comprising: a parser subsystem coupled to the packet
`acquisition device and to the lookup engine such that the
`acquisition device is coupled to the lookup engine via the
`parser subsystem, the parser subsystem configured to extract
`identifying information from a received packet,” ................ 361(cid:1)
`Limitation [2b] “wherein each flow-entry is identified by
`identifying information stored in the flow-entry, and wherein
`the cache lookup uses a function of the extracted identifying
`information.”....................................................................... 362(cid:1)
`3.(cid:1) Claim 3 ....................................................................................... 363(cid:1)
`a)(cid:1)
`Limitation [3] “A packet monitor according to claim 2,
`wherein the cache subsystem is an associative cache subsystem
`including one or more content addressable memory cells
`(CAMs).” ............................................................................ 363(cid:1)
`4.(cid:1) Claim 7 ....................................................................................... 365(cid:1)
`a)(cid:1)
`Limitation [7 Pre] “A packet monitor for examining packets
`passing through a connection point on a computer network,
`each packet conforming to one or more protocols, the monitor
`comprising:” ....................................................................... 365(cid:1)
`Limitation [7a] “a packet acquisition device coupled to the
`connection point and configured to receive packets passing
`through the connection point;” ............................................ 366(cid:1)
`Limitation [7b] “an input buffer memory coupled to and
`configured to accept a packet from the packet acquisition
`device;” ............................................................................... 366(cid:1)
`Limitation [7c] “a parser subsystem coupled to the input buffer
`memory, the parsing subsystem configured to extract selected
`portions of the accepted packet and to output a parser record
`containing the selected portions;” ....................................... 369(cid:1)
`Limitation [7d] “a memory for storing a database of one or
`more flow-entries for any previously encountered
`conversational flows, each flow-entry identified by identifying
`information stored in the flow-entry;” ................................. 373(cid:1)
`Limitation [7e] “a lookup engine coupled to the output of the
`parser subsystem and to the flow-entry memory and configured
`to lookup whether the particular packet whose parser record is
`NOAC Ex. 1006 Page, 9
`
`e)(cid:1)
`
`f)(cid:1)
`
`b)(cid:1)
`
`c)(cid:1)
`
`d)(cid:1)
`
`

`

`
`
`h)(cid:1)
`
`i)(cid:1)
`
`j)(cid:1)
`
`k)(cid:1)
`
`g)(cid:1)
`
`output by the parser subsystem has a matching flow-entry, the
`looking up using at least some of the selected packet portions
`and determining if the packet is of an existing flow;” ......... 375(cid:1)
`Limitation [7f] “a cache subsystem coupled to and between the
`lookup engine and the flow-entry database memory providing
`for fast access of a set of likely-to-be-accessed flow-entries
`from the flow-entry database; and” ..................................... 376(cid:1)
`Limitation [7g] “a flow insertion engine coupled to the flow-
`entry memory and to the lookup engine and configured to
`create a flow-entry in the flow-entry database, the flow-entry
`including identifying information for future packets to be
`identified with the new flow-entry,”.................................... 379(cid:1)
`Limitation [7h] “the lookup engine configured such that if the
`packet is of an existing flow, the monitor classifies the packet
`as belonging to the found existing flow; and” ..................... 382(cid:1)
`Limitation [7i] “if the packet is of a new flow, the flow
`insertion engine stores a new flow-entry for the new flow in
`the flow-entry database, including identifying information for
`future packets to be identified with the new flow-entry,” .... 383(cid:1)
`Limitation [7j] “wherein the operation of the parser subsystem
`depends on one or more of the protocols to which the packet
`conforms.” .......................................................................... 385(cid:1)
`5.(cid:1) Claim 16 ..................................................................................... 387(cid:1)
`a)(cid:1)
`Limitation [16 Pre] “A method of examining packets passing
`through a connection point on a computer network, each
`packets conforming to one or more protocols, the method
`comprising:” ....................................................................... 387(cid:1)
`Limitation [16a] “(a) receiving a packet from a packet
`acquisition device; .............................................................. 387(cid:1)
`Limitation [16b] “(b) performing one or more
`parsing/extraction operations on the packet to create a parser
`record comprising a function of selected portions of the
`packet;” ............................................................................... 388(cid:1)
`Limitation [16c] “(c) looking up a flow-entry database
`comprising none or more flow-entries for previously
`encountered conversational flows, the looking up using at least
`some of the selected packet portions and determining if the
`packet is of an existing flow, the lookup being via a cache;”
` ............................................................................................ 388(cid:1)
`
`b)(cid:1)
`
`c)(cid:1)
`
`d)(cid:1)
`
`NOAC Ex. 1006 Page, 10
`
`

`

`
`
`e)(cid:1)
`
`f)(cid:1)
`
`(cid:1) Riddle identifies a “conversational flow” through
`Riddle’s disclosure of “service aggregates” ................ 394(cid:1)
`(cid:1) Riddle discloses looking up a flow-entry database for
`containing one or more flow-entries for previously
`encountered conversational flows through Riddle’s
`ability to classify PointCast traffic.............................. 402(cid:1)
`Limitation [16d] “(d) if the packet is of an existing flow,
`classifying the packet as belonging to the found existing flow;
`and” .................................................................................... 407(cid:1)
`Limitation [16e] “(e) if the packet is of a new flow, storing a
`new flow-entry for the new flow in the flow-entry database,
`including identifying information for future packets to be
`identified with the new flow-entry,”.................................... 407(cid:1)
`Limitation [16f] “wherein the parsing/extraction operations
`depend on one or more of the protocols to which the packet
`conforms.” .......................................................................... 407(cid:1)
`6.(cid:1) Claim 18 ..................................................................................... 407(cid:1)
`a)(cid:1)
`Limitation [18] “A method according to claim 16, wherein the
`function of the selected portions of the packet forms a
`signature that includes the selected packet portions and that
`can identify future packets, wherein the lookup operation uses
`the signatur and wherein the identifying information stored in
`the new or updated flow-entry is a signature for identifying
`future packets.” ................................................................... 407(cid:1)
`The ’646 Patent Count 2: Riddle in View Wakeman, Bruins, and Further
`in View of RFC 1945 Renders Claims 1, 2, 3, 16 and 18 as Obvious; and
`Riddle in View of Wakeman, Cheriton, Bruins and Further in View of
`RFC 1945 Renders Claim 7 as Obvious ............................................. 410(cid:1)
`THE CLAIMS OF THE ’751 PATENT ARE UNPATENTABLE ...... 418(cid:1)
`A.(cid:1)
`The ’751 Patent Count 1: Claims 1, 2, 5, 10, 14 and 15 are Anticipated
`by Riddle or Rendered Obvious by Riddle in view of Bruins ............. 418(cid:1)
`1.(cid:1) Claim 1 ....................................................................................... 418(cid:1)
`a)(cid:1)
`Limitation [1 Pre] “A method of analyzing a flow of packets
`passing through a connection point on a computer network, the
`method comprising:” ........................................................... 418(cid:1)
`Limitation [1a] “(a) receiving a packet from a packet
`acquisition device coupled to the connection point;” ........... 418(cid:1)
`Limitation [1b(i)] “(b) for each received packet, looking up a
`flow-entry database for containing one or more flow-entries for
`
`B.(cid:1)
`
`g)(cid:1)
`
`b)(cid:1)
`
`c)(cid:1)
`
`NOAC Ex. 1006 Page, 11
`
`X.(cid:1)
`
`

`

`
`
`e)(cid:1)
`
`f)(cid:1)
`
`d)(cid:1)
`
`previously encountered conversational flows, the looking up to
`determine if the received packet is of an existing flow,” ..... 419(cid:1)
`(cid:1) Riddle identifies a “conversational flow” through
`Riddle’s disclosure of “service aggregates” ................ 423(cid:1)
`(cid:1) Riddle identifies “conversational flow[s]” through
`Riddle’s ability to classify PointCast traffic ............... 431(cid:1)
`Limitation [1b(ii)] “a conversational flow including an
`exchange of a sequence of one or more packets in any
`direction between two network entities as a result of a
`particular activity using a particular layered set of one or more
`network protocols, a conversational flow further having a set
`of one or more states, including an initial state;” ................. 436(cid:1)
`Limitation [1c] “(c) if the packet is of an existing flow,
`identifying the last encountered state of the flow, performing
`any state operations specified for the state of the flow, and
`updating the flow-entry of the existing flow including storing
`one or more statistical measures kept in the flow-entry; and”
` ............................................................................................ 440(cid:1)
`Limitation [1d] “(d) if the packet is of a new flow, performing
`any state operations required for the initial state of the new
`flow and storing a new flow-entry for the new flow in the
`flow-entry database, including storing one or more statistical
`measures kept in the flow-entry,” ........................................ 443(cid:1)
`Limitation [1e] “wherein every packet passing though the
`connection point is received by the packet acquisition device,
`and” .................................................................................... 445(cid:1)
`Limita