`Patent 6,993,658
`UNITED STATES PATENT AND TRADEMARK OFFICE
`________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`_________________
`UNIFIED PATENTS, LLC,
`
`Petitioner,
`v.
`DYNAPASS IP HOLDINGS, LLC
`
`Patent Owner.
`__________________
`Inter Partes Review No. IPR2023-00425
`Patent No. 6,993,658
`PATENT OWNER’S RESPONSE TO THE PETITION
`FOR INTER PARTES REVIEW OF U.S. PATENT NO. 6,993,658
`
`Filed on behalf of Patent Owner by:
`
`John Wittenzellner (Reg. No. 61,662)
`1735 Market Street, Suite 125, #453
`Philadelphia, PA 19103
`
`Todd E. Landis (Reg. No. 44,200)
`2633 McKinney Ave., Suite 130
`Dallas, TX 75204
`
`Mark McCarthy (Reg. No. 69,575)
`601 Congress Ave., Suite 600
`Austin, TX 78701
`WILLIAMS SIMONS & LANDIS PLLC
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`TABLE OF CONTENTS
`
`INTRODUCTION ........................................................................................... 1
`I.
`PETITIONER’S ASSERTED GROUNDS OF UNPATENTABILITY ........ 1
`II.
`III. THE ’658 PATENT ......................................................................................... 1
`IV. CLAIM CONSTRUCTION ............................................................................ 9
`V.
`RESPONSE TO ISSUES RAISED IN THE PETITION AND THE
`INSTITUTION DECISION ..........................................................................12
`A. Ground 1 – The Combination of Veneklase and Jonsson Does Not
`Render Obvious Claim 5 of the ’658 Patent ......................................... 12
`1. Independent Claim 5 .................................................................16
`i.
`[5.3] “a control module . . . configured to create a new
`password based at least upon a token and a passcode” .....16
`ii. [5.4] “a communication module configured to transmit
`the token to the personal communication device through
`the cell phone network” ....................................................23
`iii. [5.5] “an authentication module configured to receive
`the password from the user through a secure computer
`network” ............................................................................28
`iv. [5.6] “wherein the authentication module activates
`access to the account in response to the password and
`deactivates the account within a predetermined amount
`of time after activating the account” .................................32
`B. Ground 2 – The Combination of Kew and Sormunen Does Not
`Render Obvious Claims 1 and 3-6 of the ’658 Patent .......................... 38
`1. Independent Claim 1 .................................................................41
`i.
`[5.3] “a control module . . . configured to create a new
`password based at least upon a token and a passcode,
`wherein the token is not known to the user and wherein
`the passcode is known to the user” ...................................42
`
`-i-
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`ii. [5.6] “wherein the authentication module . . . deactivates
`the account within a predetermined amount of time after
`activating the account” ......................................................47
`2. Dependent Claim 6....................................................................41
`3. Independent Claim 1 .................................................................55
`i.
`[1.2] “receiving a request from the user for a token via
`the personal communication device, over the second
`network” ............................................................................55
`4. Dependent Claims 3 and 4 ........................................................59
`VI. THE BOARD DOES NOT HAVE JURISDICTION OVER EXPIRED
`PATENTS. .....................................................................................................60
`VII. CONCLUSION ..............................................................................................61
`
`
`
`
`
`-ii-
`
`
`
`
`
`
`TABLE OF AUTHORITIES
`
`IPR2023-00425
`Patent 6,993,658
`
`Cases
`In re Ratti,
` 270 F.2d 810 (CCPA 1959) ........................................................................... 19, 58
`Intelligent Bio-Systems, Inc. v. Illumina Cambridge, Ltd.,
` 821 F.3d 1359 (Fed. Cir. 2016) ............................................................................57
`KSR Int’l Co. v. Teleflex Inc.,
` 550 U.S. 398 (2007) .............................................................................................59
`McGinley v. Franklin Sports, Inc.,
` 262 F.3d 1339 (Fed. Cir. 2001) ............................................................................26
`Oil States Energy Servs., LLC v. Greene’s Energy Grp., LLC,
` 138 S. Ct. 1365 (2018) .........................................................................................60
`Plas-Pak Indus. v. Sulzer Mixpac AG,
` 600 F. App’x. 755 (Fed. Cir. 2015) ............................................................... 19, 58
`Other Authorities
`MPEP § 2143.01 ............................................................................................... 19, 58
`
`
`
`
`
`-iii-
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`EXHIBIT LIST
`
`Description
`Google Patents webpage for U.S. Patent No. 6,993,658,
`
`https://patents.google.com/patent/US6993658B1/
`
`“Preliminary Constructions,” Dynapass IP Holdings, LLC v.
`
`JPMorgan Chase & Co., et al., No. 2:22-cv-00212-JRG-RSP (E.D.
`
`Tex.)
`
`Declaration of Rajeev Surati
`
`CV of Rajeev Surati
`
`Microsoft Computer Dictionary (5th ed. 2002)
`
`
`
`Exhibit
`
`2001
`
`2002
`
`2003
`
`2004
`
`2005
`
`-iv-
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`I.
`
`INTRODUCTION
`
`Dynapass IP Holdings, LLC (“Patent Owner”) respectfully submits this
`
`Response (the “Response”) to the Petition for Inter Partes Review of U.S. Patent
`
`No. 6,993,658 (IPR2023-00425, the “Petition”) filed by Unified Patents, LLC
`
`(“Petitioner”). Petitioner fails to show unpatentability of claims 1 and 3-6 of the
`
`’658 Patent (the “Challenged Claim(s)”) because Petitioner’s Grounds fail to
`
`disclose or render obvious one or more elements of each Challenged Claim. In
`
`addition, this proceeding should be terminated because the Board does not have
`
`jurisdiction over the expired ’658 Patent.
`
`II.
`
`PETITIONER’S ASSERTED GROUNDS OF UNPATENTABILITY
`
`Petitioner assert that claims 1 and 3-6 of the ’658 Patent are unpatentable
`
`under the following grounds:
`
`Pet., p. 2.
`
`III. THE ’658 PATENT
`
`The ’658 Patent, which is titled “Use of Personal Communication Devices for
`
`User Authentication,” was filed on March 6, 2000, and issued on January 31, 2006.
`
`
`
`-1-
`
`
`
`
`Ex. 1001. The ’658 Patent relates to “the authentication of users of secure systems
`
`IPR2023-00425
`Patent 6,993,658
`
`and, more particularly, the invention relates to a system through which user tokens
`
`required for user authentication are supplied through personal communication
`
`devices such as mobile telephones and pagers.” Ex. 1001 at 1:7-11.
`
`At the time of the claimed inventions, “secure systems”1 used “a user ID and
`
`password pair to identify and authenticate system users.” See id. at 1:13-14.
`
`Although user ID/password pairs were ubiquitous, they suffered from several
`
`shortcomings, as recognized by the inventors of the ’658 Patent:
`
`Passwords created by users are often combinations of words and names,
`which are easy to remember but also easily guessed. Guessing
`passwords is a frequent technique used by “hackers” to break into
`systems. Therefore, many systems impose regulations on password
`formats that require mixtures of letters of different cases and symbols
`and that no part of a password be a word in the dictionary. A user’s
`inability to remember complex combinations of letters, numbers, and
`symbols often results in the password being written down, sometimes
`on a note stuck to the side of a workstation.
`
`Id. at 1:28-38.
`
`
`1 The ’658 Patent describes many non-limiting examples of a “secure system,”
`including Novell NetWare-, Microsoft NT-, Windows 2000-, and UNIX/Linux-
`based computers, as well as “any system, device, account, “a user account on a
`network of computer workstations, a user account on a website, or a secure area of
`a building.” Ex. 1001 at 1:13-19, 4:13-23.
`
`-2-
`
`
`
`The increasing use of remote connectivity at the time of the claimed
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`inventions further exacerbated the shortcomings of user ID/password pairs. See id.
`
`at 1:20-26. As a result, then-current systems faced several issues:
`
`Present systems face several problems: users dread frequent password
`changes, frequent password changes with hard-to-remember passwords
`inevitably result in users surreptitiously writing down passwords, and
`security is compromised when users write down their passwords.
`
`Id. at 1:39-43. Two-factor authentication (a form of multi-factor authentication)
`
`improves user ID/password pairs by adding “unpredictable, one-time-only access
`
`codes.” See id. at 1:49-51. The first factor is “a user passcode or personal
`
`identification number.” See id. at 1:46-47. The second factor is the “unpredictable,
`
`one-time-only access codes.” See id. at 1:49-51. In two-factor authentication,
`
`system access is based upon:
`
` “nonsecret information known to the user, such as the user ID;”
`
` secret information known to the user, such as the passcode;” and
`
` “information provided to the user through an object possessed by the user,
`
`such as the token.”
`
`Id. at 2:11-15.
`
`The ’658 Patent acknowledges the existence of the RSA Security, Inc.
`
`SecurID product at the time of the claimed inventions, but identified significant
`
`deficiencies in the product:
`
`-3-
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`The SecurID product, however, requires users to carry an additional
`item on their person in order to access a secure system. It would be
`advantageous if the benefits of the SecurID system could be achieved
`using a device
`that many users already carry—a personal
`communication device such as a mobile phone or a pager.
`
`Id. at 1:54-59. The ’658 Patent requires the use of a personal communication device,
`
`which teaches away from a separate device like the SecurID product. See id.
`
`The ’658 Patent solves the deficiencies of the SecurID product and further
`
`improves two-factor authentication in a unique, novel, non-obvious way. Figure 1
`
`of the ’658 Patent, reproduced below, depicts an embodiment of a user
`
`authentication system (identified as “100” in the figure):
`
`
`
`-4-
`
`
`
`
`Ex. 1001, at Fig. 1; see also id. at 3:31-33.
`
`IPR2023-00425
`Patent 6,993,658
`
`Authentication system (100) regulates access to secure system (110). Id. at
`
`4:9-13. User authentication server (102) “preferably includes a program or a suite
`
`of programs running on a computer system to perform user authentication services.”
`
`Id. at 4:27-29. “The authentication information preferably includes a user ID 152, a
`
`passcode 154 and a user token 156.” Id. at 4:36-39. Tokens are received on the
`
`user’s personal communication device (106), which can be, for example, “a pager or
`
`mobile phone having SMS (short message service) receive capability.” Id. at 4:13-
`
`15.
`
`It is important to be aware of the terminology used by the ’658 Patent. The
`
`“user ID may be publicly known and used to identify the user.” Id. at 4:39-40. The
`
`’658 Patent uses the term “passcode” to refer to what is commonly called a
`
`“password:” “For example, the user 108 can combine a valid, memorized passcode
`
`of ‘abcd’ . . . .” Id. 4:54-55; see also id. at 1:27-29 (“Passwords created by users are
`
`often combinations of words and names, which are easy to remember but also easily
`
`guessed.”), 4:40 (The passcode 154 is preferably secret and known only to the user
`
`108.”). The “token” can be, for example, “a random or pseudo-random sequence of
`
`numbers or digits or both numbers and digits.” Id. at 9:22-24.
`
`The ’658 Patent uses the term “password” to refer to the combination of at
`
`least the “passcode” and a “token.” Id. at 4:52-53 (“In the preferred embodiment,
`
`-5-
`
`
`
`
`the user 108 combines the token 156 with the passcode 154 to form a password
`
`IPR2023-00425
`Patent 6,993,658
`
`158.”). For example, if the passcode is “abcd” and the token is “1234,” the password
`
`could be “abcd1234” or “1234abcd.” See id. at 4:54-56. The components of the
`
`password (e.g., the passcode and token) can be combined or sent to the system as
`
`separate components. See id. at 4:52-65.
`
`Figure 5, reproduced below, depicts an embodiment of how the system
`
`provides tokens and authenticates users.
`
`-6-
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`Id. at Fig. 5; see also id. at 3:41-43.
`
`In step 502, the system associates the user’s user ID and passcode with the
`
`user’s personal communication device. Id. at 8:53-60. By doing so, the system
`
`transmits the token only to the associated user. See id. In steps 504, 506, and 508,
`
`the system receives a request for a token, determines which user made the request
`
`(i.e., associates the request with a user ID), and generates the token. See id. at 9:3-
`
`-7-
`
`
`
`
`27, Fig. 5. Those steps differ from other systems that continually generate access
`
`IPR2023-00425
`Patent 6,993,658
`
`codes. See, e.g., id. at 1:49-51 (“The SecurID card generates and displays
`
`unpredictable, one-time-only access codes that automatically change every 60
`
`seconds.”). In step 510, the system generates a new “password” based on at least
`
`the “token” and “passcode.” Id. at 9:28-33, Fig. 5. That password is then stored and
`
`the user’s account can be activated if it was deactivated. Id. at 9:34-41, Fig. 5 (step
`
`512).
`
`In step 514, the system transmits the token to the user’s personal
`
`communication device. See id. at 9:44-53, Fig. 5. Claim 1 of the ’658 Patent
`
`requires that the “personal communication device” be “in communication over a
`
`second network, wherein said network is a cell phone network. . . .” Id. at 11:47-50.
`
`Claim 5 requires that the token is transmitted to the “personal communication
`
`device” through a “cell phone network.” Id. at 12:34-36. The claims also require
`
`that the user’s account is deactivated “within a predetermined amount of time” after
`
`the account is activated. Id. at 12:9-13 (claim 1), 12:41-47 (claim 5).
`
`The Patent Office issued the ’658 Patent issued after several office actions.
`
`Since then, the ’658 Patent has been cited by more than 200 patent applications. Ex.
`
`2001, https://patents.google.com/patent/US6993658B1/. Amongst those patent
`
`applications are patent applications filed by major industry entities, including IBM
`
`Corporation, Microsoft Corporation, Lucent Technologies, Honeywell International,
`
`-8-
`
`
`
`
`Inc., British Telecommunications PLC, AT&T, Visa, and Google Inc. See id. They
`
`IPR2023-00425
`Patent 6,993,658
`
`also include a patent application filed by JPMorgan Chase Bank, N.A., a defendant
`
`in the parallel district court proceedings in the Eastern District of Texas. See id.
`
`IV. CLAIM CONSTRUCTION
`
`Patent Owner respectfully submits that the Board instituted inter partes
`
`proceedings based, in part, on an incorrect interpretation of claim 5.
`
`As Patent Owner explained in its preliminary response, claim 5 requires
`
`activation of account access in response to generation of the claimed “new
`
`password.” See Paper 8, pp. 30-31. But the Board disagreed:
`
`Paper 9, p. 24. The Board’s interpretation of claim 5 is incorrect for the following
`
`
`
`reasons.
`
`The plain language of claim 5 requires activation of account access in
`
`response to generation of the claimed “new password.” See Ex. 2003, ¶¶65-67. The
`
`relevant portions of claim 5 are reproduced below:
`
`-9-
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`a control module executed on the computer processor configured to create a
`new password based at least upon a token and a passcode, wherein the
`token is not known to the user and wherein the passcode is known to
`the user, the control module further configured to set a password
`associated with the user to be the new password;
`* * * * *
`an authentication module configured to receive the password from the user
`through a secure computer network, said secure computer network
`being different from the cell phone network, wherein the user has an
`account on the secure computer network, wherein the authentication
`module activates access to the account in response to the password and
`deactivates the account within a predetermined amount of time after
`activating the account, such that said account is not accessible through
`any password via the secure computer network.
`Ex. 1001 at 12:27-47 (emphasis added). The “control module” creates a “new
`
`password.” Then it sets a “password” to be the “new password” that was created by
`
`the “control module.” Id. at 12:27-33. The “authentication module” claim element
`
`recites “the password” several times. See id. at 12:37-47. The “a password” term
`
`recited in the “control module” claim element provides the antecedent basis for “the
`
`password” term in the “authentication module” claim element. See id. at 12:27-47.
`
`Thus, when the claim recites “wherein the authentication module activates access to
`
`the account in response to the password,” it is referring to the “a password” that is
`
`introduced in the “control module” claim element. See id. So it follows, from the
`
`plain language of the claim, that creation of that password is a prerequisite to the
`
`“authentication module activat[ing] access to the account in response to the
`
`password.” See id.; Ex. 2003, ¶¶65-67.
`
`-10-
`
`
`
`That same process is depicted, for example, in Figure 5 of the ’658 Patent,
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`which is reproduced in pertinent part below:
`
`
`
`Ex. 1001, Fig. 5. The password is generated in step 512, which causes activation of
`
`access to the user’s account in step 512. See id; Ex. 2003, ¶¶65-67. Patent Owner’s
`
`interpretation of claim 5 is also consistent with the preliminary construction issued
`
`by the Eastern District of Texas on October 5:
`
`Ex. 2002. The Board is required to apply the same claim-construction standard as
`
`in Federal district court.
`
`
`
`-11-
`
`
`
`Accordingly, Patent Owner respectfully requests that the Board find that claim
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`5 requires activation of account access in response to generation of the claimed “new
`
`password,” and that the Board apply that finding to the grounds asserted by
`
`Petitioner.
`
`V. RESPONSE TO ISSUES RAISED IN THE PETITION AND THE
`INSTITUTION DECISION
`A. Ground 1 – The Combination of Veneklase and Jonsson Does Not
`Render Obvious Claim 5 of the ’658 Patent.
`
`Petitioner contends that the combination of Veneklase and Jonsson renders
`
`obvious claim 5 of the ’658 Patent. Pet. at 2, 13-46. That combination does not
`
`render obvious claim 5 of the ’658 Patent for at least the following reasons.
`
`Veneklase discloses a computer security system including a user’s “computer
`
`406,” a user’s “pager 420,” and a “host computer 402.” Ex. 1005, 7:29-51, Fig. 6.
`
`Figure 6 of Veneklase is reproduced below:
`
`-12-
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`Ex. 1005, Fig. 6 (annotated and cropped). During an authentication process, the user
`
`transmits a “password” from “computer 406” to “host computer 402.” Ex. 1005,
`
`7:58-8:27. “Host computer 402” then “cross references the received password []
`
`against a pager phone number list” stored within “host computer 402.” Id. The
`
`“pager phone number list” stores the passwords of authorized users and the pager
`
`numbers for the authorized users. See id., 6:10-26, Fig. 5. Assuming the user is an
`
`authorized user, the pager number for user’s “pager 420” would be associated with
`
`the user’s “password” in the “pager phone number list.” See id. A “pseudo-random
`
`code” is generated by “host computer 402” and transmitted to user’s “pager 420”
`
`using the pager number in the “pager phone number list” associated with the
`
`-13-
`
`
`
`
`“received password.” See id., 8:1-26. Accordingly, Veneklase’s computer security
`
`IPR2023-00425
`Patent 6,993,658
`
`system needs the user’s “password” to trigger generation of the “pseudo-random
`
`code” and to transmit the “pseudo-random code” to the user’s “pager 420.”
`
`The user’s “pager 420” displays the received “pseudo-random code” to the
`
`user. See id., 8:15-26. The user “enters the [pseudo-random] code he or she has
`
`received from the pager 420” into user “computer 406.” Id. The user-entered
`
`“pseudo-random code” is transmitted “back to computer 402, where it is compared”
`
`with the “pseudo-random code” sent to the user’s “pager 420.” See id. “If the
`
`comparison yields a match, the user 404 is allowed access to computer 402.” Id.,
`
`8:25-27.
`
`Accordingly, Veneklase’s system allows for authentication through user input
`
`of a password and a pseudo-random code at separate times in a two-step process.
`
`This two-step authentication process “ensure[s] that an authorized user of a
`
`computer system is notified that someone or something is seeking access to the
`
`computer system with his or her password . . . [and] allows for multiple levels of
`
`security before access to the computer system is achieved and provides enhanced
`
`security over the prior art.” Ex. 1005, 7:16-28.
`
`Jonsson discloses a user authentication apparatus including a “service node
`
`26,” an “authentication center 30,” a “personal unit 20,” and a user “terminal 22.”
`
`See Ex. 1006, 9:1-10:2, Fig. 1. Figure 1 of Jonsson is reproduced below:
`
`-14-
`
`
`
`
`
`
`IPR2023-00425
`Patent 6,993,658
`
`
`
`Ex. 1006, Fig. 1 (annotated). In Jonsson’s authentication process, “authentication
`
`center 30” generates a “challenge code” and sends the “challenge code” to the
`
`“personal unit 20.” Ex. 1006, 9:1-7. When the personal unit 20 receives the
`
`challenge code, “it prompts the user to input a PIN” and “generates a response code”
`
`using a stored algorithm that utilizes the PIN as an input. Id., 9:9-25. But the
`
`“challenge code” is not displayed to the user. See id. Instead, the calculated
`
`“response code” is displayed to the user “for manual input to terminal 22.”
`
`“Terminal 22” transmits the “response code” back to “authentication center 30
`
`which may then compare the response code to [an] expected response.” Id., 9:26-
`
`10:1. If there is a match between the received “response code” and the “expected
`
`response,” the “service node 26 permits the user to access the services offered.” Id.
`
`-15-
`
`
`
`
`
`1.
`Independent Claim 5
`The combination of Veneklase and Jonsson does not render obvious
`
`IPR2023-00425
`Patent 6,993,658
`
`independent claim 5 because the combination does not teach or suggest the following
`
`elements of the claim.
`
`i.
`
`[5.3] “a control module . . . configured to create a new
`password based at least upon a token and a passcode”
`Claim element [5.3] recites “a control module executed on the computer
`
`processor configured to create a new password based at least upon a token and a
`
`passcode, wherein the token is not known to the user and wherein the passcode is
`
`known to the user, the control module further configured to set a password associated
`
`with the user to be the new password.” Petitioner mapped Veneklase’s
`
`“user/password check” module to the claimed “control module” (see Pet., pp. 26-
`
`27), but concedes that Veneklase does not disclose this claim element. See Pet., p.
`
`28 (Veneklase “does not disclose creating a new password based on those two
`
`items.”). Petitioner argues that the combined teachings of Veneklase and Jonsson
`
`meet the requirements of claim element [5.3]. See Pet., pp. 28-34. But Petitioner’s
`
`proposed combination fails to support a conclusion of obviousness for multiple
`
`reasons. See Ex. 2003, ¶72.
`
`Petitioner argues that “Veneklase teaches a system which a user inputs a
`
`password known beforehand, receives a randomly generated previously-unknown
`
`code, and then inputs that [randomly generated code] for authentication purposes.”
`
`-16-
`
`
`
`
`Pet. at 31 (citing Ex. 1005, 7:52-8:27). In other words, “Veneklase’s system allows
`
`IPR2023-00425
`Patent 6,993,658
`
`for authentication through user input of a known and unknown code at separate times
`
`in a two-step process.” Id. (emphasis added). See Ex. 2003, ¶73.
`
`Jonsson discloses an authentication process in which a “personal unit 20
`
`receives an authentication challenge code, it prompts the user to input a PIN or other
`
`identifying information, and generates a response code by an algorithm having the
`
`challenge code . . . and the PIN.” See Ex. 1006, 9:1-13. This response code is then
`
`“displayed on a display unit [of personal unit 20] for manual input to [user’s]
`
`terminal,” and then transmitted from the user’s terminal to the system for
`
`comparison with an expected response code. Id., 9:26-35; see Ex. 2003, ¶74.
`
`Petitioner’s proposed combination includes replacing Veneklase’s two-step
`
`authentication process (i.e., user transmission of Veneklase’s password, and
`
`subsequent user transmission of Veneklase’s random code) with the single step in
`
`Jonsson (i.e., user transmission of Jonsson’s response code). See Pet. at 28
`
`(“Veneklase teaches an authentication system in which the user inputs both a token
`
`. . . and a passcode . . . it would have been obvious to combine those two steps and
`
`instead create a new password based on both of them”) (emphasis added), 31 (“A
`
`POSITA would have been motivated to make such a combination because having
`
`only the one password transmitted via the computer system is more efficient and
`
`secure . . . Veneklase’s system allows for authentication through user input of a
`
`-17-
`
`
`
`
`known and unknown code at separate times in a two-step process, while a POSITA
`
`IPR2023-00425
`Patent 6,993,658
`
`would look to Jonsson because it would provide the added benefit of reducing the
`
`steps to a single step”) (emphasis added), 34 (“A POSITA would have had a
`
`reasonable expectation of success in modifying Veneklase’s authentication system,
`
`which requires the use of both a known password and a previously-unknown
`
`randomly generated code, to create a new password based on those two values . . .
`
`because doing so would have merely made two steps into one without requiring any
`
`additional hardware.”) (emphasis added). See Ex. 2003, ¶75.
`
`But modifying Veneklase’s system by abolishing the two-step authentication
`
`process, as proposed by Petitioner, would violate Veneklase’s principle of operation.
`
`See Ex. 2003, ¶76. Veneklase’s two-step authentication process “ensure[s] that an
`
`authorized user of a computer system is notified that someone or something is
`
`seeking access to the computer system with his or her password . . . [and] allows for
`
`multiple levels of security before access to the computer system is achieved and
`
`provides enhanced security over the prior art.” Ex. 1005, 7:16-28. See Ex. 2003,
`
`¶76. Accordingly, this two-step authentication process is a key feature of
`
`Veneklase’s principle of operation, and a POSITA would not seek to remove steps
`
`as Petitioner proposes. See Ex. 2003, ¶76. The Board found in the Institution
`
`Decision that “Patent Owner has not adequately demonstrated that the two-step
`
`authentication process is a key feature of Veneklase’s principle of operation such
`
`-18-
`
`
`
`
`that the proposed modification would render Veneklase’s system inoperable.” Paper
`
`IPR2023-00425
`Patent 6,993,658
`
`9, p. 17. But Veneklase unequivocally states the opposite. See Ex. 1005, 7:16-28;
`
`Ex. 2003, ¶76.
`
`Accordingly, the proposed modification of Veneklase is far too drastic to be
`
`considered obvious, and thus the combination of Veneklase and Jonsson fails to
`
`render claim 5 obvious. See Ex. 2003, ¶76. See MPEP § 2143.01(VI) (citing In re
`
`Ratti, 270 F.2d 810, 813 (CCPA 1959)) (“If the proposed modification or
`
`combination of the prior art would change the principle of operation of the prior art
`
`invention being modified, then the teachings of the references are not sufficient to
`
`render the claims prima facie obvious.”); see also Plas-Pak Indus. v. Sulzer Mixpac
`
`AG, 600 F. App’x. 755, 758 (Fed. Cir. 2015) (“combinations that change the basic
`
`principles under which the [prior art] was designed to operate or that render the prior
`
`art inoperable for its intended purpose may fail to support a conclusion of
`
`obviousness.”) (cleaned up).
`
`Petitioner also argues, contrary to its previous argument, that “a POSITA
`
`would have been motivated to make such a combination because implementing
`
`Veneklase’s authentication system with the algorithm of Jonsson’s system provides
`
`an additional layer of security . . . a POSITA would have been motivated to use an
`
`algorithm for creating a new password based on the known password and the
`
`previously-unknown randomly generated code, such as described in Jonsson, to
`
`-19-
`
`
`
`
`provide additional security.” Pet., pp. 31-32 (emphasis added). But Petitioner
`
`IPR2023-00425
`Patent 6,993,658
`
`argued that a POSITA would have been motivated to reduce the number of steps in
`
`Veneklase. See Pet. at 31 (“a POSITA would look to Jonsson because it would
`
`provide the added benefit of reducing the steps to a single step.”) (emphasis added).
`
`Moreover, Veneklase’s two-step authentication process already “allows for multiple
`
`levels of security before access to the computer system is achieved.” Ex. 1005, 7:26-
`
`27. For example, Veneklase’s system does not transmit the randomly generated code
`
`to the user until Veneklase’s password is received from the user (i.e., the first step in
`
`the two-step authentication process) and “cross reference[d] . . . against a pager
`
`phone number list resident within the user table 414.” Ex. 1005, 8:2-5. Petitioner
`
`concedes as much. See Pet., p. 42 (“Veneklase discloses that this system is
`
`implemented only when the password is found within the master password list.”)
`
`(emphasis added). Veneklase identifies the two-step process as providing a security
`
`benefit: should a hacker or other unauthorized user gain access to the user’s
`
`password, this first step in Veneklase’s system also has the added bonus of notifying
`
`the user “that someone or something is seeking access to the computer system with
`
`his or her password.” See Ex. 1005, 7:16-21; Ex. 2003, ¶77.
`
`Petitioner’s proposed combination dismantles Veneklase’s existing multi-
`
`level security by discarding user transmission of the password and thus discarding
`
`the cross-referencing security feature and notification feature. Petitioner provides
`
`-20-
`
`
`
`
`zero evidence that the security of its proposed combination is superior to the existing
`
`IPR2023-00425
`Patent 6,993,658
`
`multi-layer/level security in Veneklase. See Ex. 2003, ¶78. Accordingly, there is no
`
`motivation to combine Veneklase and Jonsson.
`
`Petitioner also argues that combining the algorithm of Jonsson with Veneklase
`
`would thwart “SIM swapping” attacks. Pet., p.32. The Petition contends that “SIM
`
`swapping is a well-known trick of hackers in which they contact your service
`
`provider and activate a new SIM card on a different device in order to receive the
`
`user’s authentication token.” Id. at 32. It further contends that SIM swapping
`
`“would not work in the combined system, because [hackers] would need access to
`
`the device containing the correct algorithm.” Id. But SIM swapping would also not
`
`work in Veneklase’s existing system because the hackers would still need
`
`Veneklase’s password. See Ex. 2003, ¶79. Further, as discussed below regarding
`
`claim element [5.4], the combined system would be more prone to Denial of Service
`
`(DoS) attacks by hackers. See Ex. 2003, ¶79. Accordingly, a POSITA would not
`
`consider the combined system to be superior to Veneklase in terms of security, and
`
`thus there is no motivation to combine Veneklase and Jonsson. See Ex. 2003, ¶79.
`
`Petitioner also argues that “Veneklase explicitly provides a teaching,
`
`suggestion, and motivation for combining it with an authentication system that uses
`
`an algorithm, such as taught in Jonsson, because it explicitly discloses embodiments
`
`in which datastreams are encoded and decoded using algorithms for additional
`
`-21-
`
`
`
`
`security.” Pet., p. 32 (citing Ex. 1005, 9:26-10:11). The Petition fails to describe
`
`IPR2023-00425
`Patent 6,993,658
`
`that “algorithm” in any detail, which is not surprising, because the section of
`
`Veneklase cited by Petitioner does not pertain to an algorithm. See Ex. 2003, ¶80.
`
`The po