`Patent 6,993,658
`UNITED STATES PATENT AND TRADEMARK OFFICE
`________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`_________________
`
`AMAZON.COM, INC.,
`Petitioner,
`
`v.
`
`DYNAPASS IP HOLDINGS, LLC,
`Patent Owner.
`__________________
`
`Inter Partes Review No. IPR2024-00283
`Patent No. 6,993,658
`
`PATENT OWNER’S PRELIMINARY RESPONSE
`UNDER 37 C.F.R. § 42.107
`
`
`Filed on behalf of Patent Owner by:
`
`John Wittenzellner (Reg. No. 61,662)
`1735 Market Street, Suite 125, #453
`Philadelphia, PA 19103
`
`Mark McCarthy (Reg. No. 69,575)
`601 Congress Ave., Suite 600
`Austin, TX 78701
`
`Michael J. Fagan, Jr.
`2633 McKinney Ave., Suite 130
`Dallas, TX 75204
`
`WILLIAMS SIMONS & LANDIS PLLC
`
`
`
`
`
`TABLE OF CONTENTS
`
`IPR2024-00283
`Patent 6,993,658
`
`I.
`
`II.
`
`INTRODUCTION ........................................................................................... 2
`
`STATEMENT OF THE PRECISE RELIEF REQUESTED .......................... 3
`
`III. THE BOARD SHOULD EXERCISE ITS DISCRETION TO DENY THE
`
`PETITION. ...................................................................................................... 4
`
`A. The Board Should Deny the Petition Under 35 U.S.C. § 325(d). .......... 4
`
`1.
`
`2.
`
`The First Part of the Framework is Satisfied. ............................. 4
`
`The Second Part of the Framework is Also Satisfied. ................ 7
`
`B. The Board Should Deny the Petition Under 35 U.S.C. § 314(a). .......... 7
`
`1.
`
`2.
`
`3.
`
`4.
`
`5.
`
`General Plastic Factor One ........................................................ 8
`
`General Plastic Factor Two ......................................................10
`
`General Plastic Factor Three ....................................................11
`
`General Plastic Factors Four and Five .....................................12
`
`General Plastic Factor Six and Seven ......................................13
`
`IV. THE PETITION SHOULD BE DENIED BECAUSE IT DOES NOT
`
`ESTABLISH A REASONABLE LIKELIHOOD OF SUCCESS ON
`
`ANY CHALLENGED CLAIM .....................................................................14
`
`A. The ’658 Patent ..................................................................................... 14
`
`B. Level of Ordinary Skill in the Art ........................................................ 22
`
`C. Claim Construction ............................................................................... 22
`
`-i-
`
`
`
`IPR2024-00283
`Patent 6,993,658
`D. Cited Art ............................................................................................... 23
`
`E. Ground 1 – The Combination of Veneklase, Jonsson, and
`
`Sormunen Does Not Render Obvious Dependent Claim 7. ................ 31
`
`1.
`
`Independent Claim 5 .................................................................31
`
`i.
`
`5[c] “a control module . . . configured to create a new
`
`password based at least upon a token and a passcode” ..31
`
`ii. 5[d] “a communication module configured to transmit
`
`the token to the personal communication device
`
`through the cell phone network” ....................................37
`
`iii. 5[e] “an authentication module configured to receive the
`
`password from the user through a secure computer
`
`network” .........................................................................41
`
`iv. 5[f] “wherein the authentication module activates access
`
`to the account in response to the password and
`
`deactivates the account within a predetermined
`
`amount of time after activating the account” .................43
`
`2.
`
`3.
`
`Dependent Claim 6....................................................................49
`
`Dependent Claim 7....................................................................51
`
`F. Ground 2 – The Combination of Veneklase, Jonsson, Sormunen,
`
`and Kaufman Does Not Render Obvious Dependent Claim 2. ........... 54
`
`-ii-
`
`
`
`IPR2024-00283
`Patent 6,993,658
`Independent Claim 1 .................................................................54
`
`Dependent Claim 2....................................................................55
`
`1.
`
`2.
`
`G. Ground 3 – The Combination of Kew and Sormunen Does Not
`
`Render Obvious Dependent Claim 7. .................................................. 58
`
`1.
`
`Independent Claim 5 .................................................................58
`
`i.
`
`5[c] “a control module . . . configured to create a new
`
`password based at least upon a token and a passcode,
`
`wherein the token is not known to the user and wherein
`
`the passcode is known to the user” .................................58
`
`ii. 5[f] “wherein the authentication module . . . deactivates
`
`the account within a predetermined amount of time
`
`after activating the account” ...........................................63
`
`2.
`
`Dependent Claim 7....................................................................65
`
`H. Ground 4 – The Combination of Kew, Sormunen, and Kaufman
`
`Does Not Render Obvious Dependent Claim 2. ................................. 69
`
`1.
`
`2.
`
`Independent Claim 1 .................................................................69
`
`Dependent Claim 2....................................................................70
`
`-iii-
`
`
`
`TABLE OF AUTHORITIES
`
`IPR2024-00283
`Patent 6,993,658
`
`Cases
`Advanced Bionics, LLC v. MED-EL Elektromedizinische Geräte GmbH,
`IPR2019-01469, Paper 6 (P.T.A.B. Feb. 13, 2020) (precedential) ....................4, 7
`Code200, UAB v. Bright Data Ltd.,
`IPR2022-00861, Paper 18 (P.T.A.B. Aug. 23, 2022) (precedential) ...................12
`Cuozzo Speed Techs., LLC v. Lee,
`136 S. Ct. 2131 (2016) ........................................................................................... 7
`Ericsson Inc. v. Uniloc 2017, LLC,
`IPR2019-01550, Paper 8 (Mar. 17, 2020) .............................................................. 8
`General Plastic Indus. Co. v. Canon Kabushiki Kaisha,
`IPR2016-01357, Paper 19 (P.T.A.B. Sept. 6, 2017) (precedential) ....................... 8
`In re Ratti,
`270 F.2d 810 (CCPA 1959) ........................................................................... 33, 66
`KSR Int’l Co. v. Teleflex Inc.,
`550 U.S. 398 (2007) .............................................................................................67
`McGinley v. Franklin Sports, Inc.,
`262 F.3d 1339 (Fed. Cir. 2001) ............................................................................39
`Meiresonne v. Google, Inc.,
`849 F.3d 1379 (Fed. Cir. 2017) ............................................................................56
`Valve Corp. v. Electronic Scripting Products, Inc.,
`IPR2019-00064, Paper 10 (P.T.A.B. May 1, 2019) (precedential) ......................13
`Valve Corporation v. Electronic Scripting Products, Inc.,
`IPR2019-00062, Paper 11 (P.T.A.B. April 2, 2019) (precedential) ................8, 14
`Statutes
`35 U.S.C. § 112 ..................................................................................... 31, 54, 58, 69
`35 U.S.C. § 314 ......................................................................................................2, 7
`
`-iv-
`
`
`
`IPR2024-00283
`Patent 6,993,658
`35 U.S.C. § 316 .......................................................................................................... 2
`Other Authorities
`MPEP § 2143.01 ............................................................................................... 33, 66
`Regulations
`37 C.F.R. § 42.100 ...............................................................................................2, 22
`
`
`
`
`
`
`-v-
`
`
`
`IPR2024-00283
`Patent 6,993,658
`
`Exhibit
`
`EXHIBIT LIST
`
`Description
`
`2001
`
`Email authorizing Patent Owner to file a Motion for Additional
`
`Discovery (Mar. 21, 2024).
`
`Dynapass IP Holdings LLC’s Discovery Requests to Petitioner.
`
`Email correspondence between Patent Owner and Petitioner
`
`regarding Patent Owner’s request that Petitioner identify whether it
`
`has ever been a direct or indirect member of Unified Patents.
`
`https://www.unifiedpatents.com/success.
`
`Google Patents webpage for U.S. Patent No. 6,993,658,
`
`https://patents.google.com/patent/US6993658B1/
`
`U.S. Patent No. 6,173,400 (“Perlman”)
`
`U.S. Patent 7,058,974 (“Maher”)
`
`Microsoft Computer Dictionary (5th ed. 2002)
`
`2002
`
`2003
`
`2004
`
`2005
`
`2006
`
`2007
`
`2008
`
`-vi-
`
`
`
`I.
`
`INTRODUCTION
`
`IPR2024-00283
`Patent 6,993,658
`
`Dynapass IP Holdings, LLC (“Patent Owner”) respectfully submits this
`
`Preliminary Response (the “Response”) to the Petition for Inter Partes Review of
`
`U.S. Patent No. 6,993,658 (IPR2024-00283, the “Petition” or “Pet.”) filed by
`
`Amazon.com, Inc. (“Petitioner”).
`
`This Petition puts forth the same arguments and art as IPR2023-00425 filed
`
`by Unified Patents, but challenges different claims: IPR2023-00425 challenged
`
`claims 1 and 3-6, whereas this Petition challenges dependent claims 2 and 7 (the
`
`“Challenged Claims”) on the same art, as well as an additional prior-art reference
`
`for dependent claim 2. Petitioner concedes that by “adopting substantially the same
`
`unpatentability grounds and arguments, the Board’s analysis of independent claims
`
`1 and 5 in conjunction with [Unified Patents, LLC v. Dynapass IP Holdings LLC,
`
`IPR2023-00425, (P.T.A.B. Jan. 6, 2023) (“Unified IPR”)] will apply here as well,
`
`thus eliminating the need for the Board to re-analyze those independent claims.”
`
`Pet., p. 1 (emphasis added). Patent Owner notes under 35 U.S.C. § 316(a)(11), a
`
`Final Written Decision for the Unified IPR is expected on or before July 18, 2024,
`
`whereas under 35 U.S.C. § 314(b) an institution decision in this proceeding is not
`
`due until July 22, 2024. Accordingly, Patent Owner respectfully submits that the
`
`Board’s Final Written Decision in IPR2023-00425 with respect to independent
`
`2
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`claims 1 and 5 may warrant denial of institution of this Petition if those claims are
`
`found not unpatentable.
`
`Institution should be denied because Petitioner has not established that the
`
`cited references render the Challenged Claims unpatentable. Additionally, or
`
`alternatively, the Board should deny the Petition under 35 U.S.C. §§ 314(a) and/or
`
`325(d).
`
`II.
`
`STATEMENT OF THE PRECISE RELIEF REQUESTED
`
`Petitioner asserts that the Challenged Claims are unpatentable under the
`
`following grounds:
`
`Pet., p. 6. Patent Owner requests that the Board deny institution of the Petition with
`
`respect to all Challenged Claims and all asserted grounds. A full statement of the
`
`reasons for the relief requested is set forth in Sections III-IV of this Response.
`
`
`
`3
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`III. THE BOARD SHOULD EXERCISE ITS DISCRETION TO DENY
`THE PETITION.
`A. The Board Should Deny the Petition Under 35 U.S.C. § 325(d).
`
`The USPTO evaluates Section 325(d) using a “two-part framework.” See
`
`Advanced Bionics, LLC v. MED-EL Elektromedizinische Geräte GmbH, IPR2019-
`
`01469, Paper 6 at 8-9 (P.T.A.B. Feb. 13, 2020) (precedential).
`
`1.
`
`The First Part of the Framework is Satisfied.
`
`Veneklase, Jonsson, Sormunen, and Kew were previously presented to the
`
`USPTO in the Unified IPR. Sormunen was also presented to the Office in two
`
`additional IPRs challenging the ’658 Patent, where the Board considered the merits
`
`of Sormunen and ultimately denied institution. See Bank of America, N.A. v.
`
`Dynapass IP Holdings LLC, IPR2023-00367 (P.T.A.B. July 18, 2023) (“BOA
`
`IPR”); Experian Information Solutions, Inc. v. Dynapass IP Holdings LLC,
`
`IPR2023-01406 (P.T.A.B. March 28, 2024) (“Experian IPR”).
`
`Further, Kaufman is substantially the same as U.S. Patent No. 6,173,400
`
`(“Perlman”), which was both relied upon in the Experian IPR and considered by the
`
`Examiner during prosecution of the ’658 Patent. See Experian IPR, Paper 2 at 15,
`
`49 (P.T.A.B. Sept. 28, 2023). Perlman discloses a “system 100” including an
`
`“authentication token 170,” a “workstation 120” and a “server 140.” EX2006, 4:65-
`
`5:8, Fig. 1. Figure 1 of Perlman is reproduced below:
`
`4
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`
`
`
`EX2006, Fig. 1 (excerpted and annotation). Perlman discloses generating a
`
`“character string” using time-synchronized “authentication token 170.” See id.,
`
`4:38-55, 8:55-9:19, Fig. 1. The “character string” is communicated to “workstation
`
`120” along with a “PIN” provided by the user. See id. The “workstation 120”
`
`generates a “second character string” by executing a hash of the “character string”
`
`concatenated with the “PIN.” See id. The “workstation 120” transmits the “second
`
`character string” to “server 140” to authenticate the user. See id.
`
`In comparison, Kaufman discloses a security system
`
`including an
`
`“authentication token generator 520,” a “workstation 516,” and an “authentication
`
`server 502.” EX1008, Abstract, Fig. 5. Figure 5 of Kaufman is reproduced below:
`
`5
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`
`
`
`Id., Fig. 5 (excerpted and annotated). The “workstation 516” generates a
`
`“transmission code” based on a “password” entered by the user and a “token”
`
`generated by “authentication token generator 520.” See id., 9:15-10:7. The
`
`“transmission code” is calculated by hashing a concatenation of the “password” and
`
`the “token.” See id. The “transmission code” is transmitted to the “authentication
`
`sever 502” and the user is granted access to the system if the “authentication server
`
`502” can validate the received “transmission code.” See id., 10:46-11:25.
`
`Both Perlman and Kaufman employ an authentication token generator for
`
`authenticating a user. Compare EX2006, 4:38-55, 8:55-9:35, Fig. 1 with EX1008,
`
`9:15-10:7, Fig. 5. In both Perlman and Kaufman, a workstation executes a hash of
`
`a user’s PIN/password concatenated with a string/token from the authentication
`
`token generator. Compare EX2006, 4:38-55, 8:55-9:35, Fig. 1 with EX1008, 9:15-
`
`10:7. In both Perlman and Kaufman, the hashed value is transmitted to an
`6
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`authentication server to validate the user. Compare EX2006, 4:38-55, 8:55-9:35,
`
`Fig. 1 with EX1008, 10:46-11:25. Accordingly, Perlman and Kaufman are
`
`substantially the same. In fact, both Perlman and Kaufman were cited to disclose
`
`concatenating the user’s passcode with a token, as claim 2 requires. Compare Pet.,
`
`pp. 50-51 with Experian IPR, Paper 2 at 41-42 (P.T.A.B. Sept. 28, 2023).
`
`The first part of the § 325(d) framework is therefore satisfied for every
`
`reference cited in the Petition.
`
`2.
`
`The Second Part of the Framework is Also Satisfied.
`
`The second part of the framework is satisfied because Petitioner fails to allege,
`
`much less demonstrate, that “the Office erred in a manner material to the
`
`patentability of challenged claims.” Advanced Bionics, Paper 6 at 8-9. Petitioner
`
`has not alleged that the Office erred in its evaluation of Veneklase, Jonsson,
`
`Sormunen, Kew or Perlman (and thus Kaufman). To the contrary, Petitioner
`
`concedes there is no “need for the Board to re-analyze those independent claims” of
`
`the ’658 Patent. Pet., p. 1. Accordingly, the second part of the framework is also
`
`satisfied, and institution should be denied under 35 U.S.C. § 325(d).
`
`B.
`
`The Board Should Deny the Petition Under 35 U.S.C. § 314(a).
`
`The Board has discretion as to whether to institute inter partes review. See
`
`35 U.S.C. § 314(a); Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2140 (2016).
`
`7
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`In General Plastic, the Board recognized “the potential for abuse of the review
`
`process by repeated attacks on patents.” General Plastic Indus. Co. v. Canon
`
`Kabushiki Kaisha, IPR2016-01357, Paper 19 at 17 (P.T.A.B. Sept. 6, 2017)
`
`(precedential). To mitigate such abuse, the Board identified seven factors that it
`
`considers in determining whether to institute decision of a subsequent petition. Id.,
`
`Paper 19 at 16. In the present case, the General Plastic factors overwhelmingly
`
`favor denying institution.
`
`1.
`
`General Plastic Factor One
`
`In Valve Corporation, the Board clarified that “application of the General
`
`Plastic factors is not limited solely to instances when multiple petitions are filed by
`
`the same petitioner. Rather, when different petitioners challenge the same patent,
`
`[the Board considers] any relationship between those petitioners when weighing the
`
`General Plastic factors.” Valve Corporation v. Electronic Scripting Products, Inc.,
`
`IPR2019-00062, Paper 11 at 9 (P.T.A.B. April 2, 2019) (precedential) (emphasis
`
`added). In Ericsson Inc. v. Uniloc, the Board weighed the first General Plastic factor
`
`against institution because “[t]he instant Petitioner’s decision to use the prior
`
`petitions as a roadmap for its own petition ties the interests of all the petitioners
`
`together.” Ericsson Inc. v. Uniloc 2017, LLC, IPR2019-01550, Paper 8 at 12 (Mar.
`
`17, 2020).
`
`8
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`The first General Plastic factor weights heavily in favor of denying institution
`
`because the instant Petition was filed with the benefit of the BOA IPR Institution
`
`Decision, the Unified IPR Institution Decision, the Unified IPR Patent Owner
`
`Response, and the Experian IPR Petition. In other words, the instant Petition is the
`
`fourth attack on the ’658 Patent. Like the instant Petition, the BOA IPR and the
`
`Experian IPR challenged at least claims 2 and 7 of the ’658 Patent. Compare Pet.,
`
`p. 6 with IPR2023-00367, Paper 1 at 1 (P.T.A.B. Jan. 3, 2023) and IPR2023-01406,
`
`Paper 2 at 15 (P.T.A.B. Sept. 28, 2023). The Unified IPR challenged at least claims
`
`1, 5, and 6 of the ’658 Patent. See IPR2023-00425, Paper 1 at 2 (P.T.A.B. Jan. 6,
`
`2023). And under 35 U.S.C. § 112, ¶4, challenged claim 2 of the instant Petition
`
`necessarily incorporates all the limitations of claim 1, while challenged claim 7
`
`necessarily incorporates all the limitations of claims 5 and 6.
`
`There is also a significant relationship between Petitioner and the petitioners
`
`of the BOA IPR, the Experian IPR, and the Unified IPR1 because all were sued by
`
`Patent Owner for infringement of the ’658 Patent in the same district court. See Pet.,
`
`pp. 2-4. Petitioner even admits those lawsuits are related cases. Id. Accordingly,
`
`
`
`1JPMorgan Chase Bank was joined as a petitioner to the Unified IPR via Motion for
`
`Joinder. See IPR2023-00425, Paper 17 (P.T.A.B. Jan. 19, 2024).
`
`9
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`the overlap in the challenged claims and the significant relationship between all the
`
`petitioners favor denying institution.
`
`2.
`
`General Plastic Factor Two
`
`Here, Petitioner knew or should have known of the prior art references in the
`
`Petition—Veneklase, Jonsson, Kew, Sormunen, and Kaufman—when the Unified
`
`IPR Petition filed. That is because Veneklase, Jonsson, Kew, and Sormunen were
`
`cited in the Unified IPR Petition (IPR2023-00425, Paper 1 at 2 (P.T.A.B. Jan. 6,
`
`2023)), while Kaufman, Kew, and Sormunen were already cited in the slightly older
`
`BOA IPR Petition (IPR2023-00367, Paper 1 at 11, 12, 80 (P.T.A.B. Jan. 3, 2023)).
`
`The BOA IPR Institution Decision and the Unified IPR Institution Decision
`
`issued approximately five months after Petitioner was served with the complaint.
`
`Petitioner then waited an additional five months to file the instant Petition. As
`
`discussed above, Petitioner and the petitioners in the BOA IPR and Unified IPR were
`
`sued for infringement of the ’658 Patent in the same district court. Petitioner even
`
`admits it was aware of those lawsuits. Pet., pp. 2-4. Accordingly, Petitioner and the
`
`petitioners of the BOA IPR and the Unified IPR are similarly situated. Petitioner
`
`knew or should have known of the prior art references in the Petition around the time
`
`the BOA IPR and Unified IPR filed (i.e., early January 2023). This factor favors
`
`denying institution.
`
`10
`
`
`
`
`
`3.
`
`General Plastic Factor Three
`
`IPR2024-00283
`Patent 6,993,658
`
`Regarding the Unified IPR, Patent Owner’s preliminary response was filed on
`
`April 25, 2023, the Board instituted on July 18, 2023, and Patent Owner’s response
`
`was filed on Oct. 10, 2023. Regarding the BOA IPR, Patent Owner’s preliminary
`
`response was filed on April 27, 2023, and the Board denied institution on July 18,
`
`2023. The Petition was filed five months later on December 28, 2023. Accordingly,
`
`Petitioner had access to Patent Owner’s preliminary responses, Patent Owner’s
`
`response, and the Board’s decisions well before filing the Petition and thus would
`
`have been aware of Patent Owner’s and the Board’s arguments and positions. This
`
`factor favors denying institution.
`
`Petitioner argues that it “is not using this Petition to address any deficiencies
`
`that have been alleged concerning the grounds raised in those [earlier IPR]
`
`proceedings.” Pet., p. 8. But that is simply not true. In the BOA IPR, the Board
`
`found the combination of Sormunen and Guthrie insufficient to meet the limitations
`
`of challenged claims 2 and 7. See IPR2023-00367, Paper at 13 at 18. In response
`
`to that institution denial, Petitioner kept Sormunen but replaced Guthrie with other
`
`references (e.g., Kew, Veneklase, Jonsson, or Kaufman) to once again try to meet the
`
`limitations of challenged claims 2 and 7. Kew, Veneklase, and Jonsson were
`
`undoubtedly selected due to the Board instituting the Unified IPR, which relied on
`
`11
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`those references. As explained by Petitioner, “road-mapping concerns are
`
`minimized when a petitioner files a later petition that raises unpatentability
`
`challenges substantially overlapping with those in the previously-filed petition and
`
`the later petition is not refined based on lessons learned from later developments.”
`
`Pet., p. 9 (quoting Code200, UAB v. Bright Data Ltd., IPR2022-00861, Paper 18 at
`
`5 (P.T.A.B. Aug. 23, 2022) (precedential)) (cleaned up). But Petitioner concedes
`
`that the instant Petition does not raise unpatentability challenges that substantially
`
`overlap those in the BOA IPR. See Pet., p. 9 n.3 (“Petitioner’s grounds are different
`
`from those raised in the [BOA IPR]”). Further, the instant Petition is refined based
`
`on lessons “learned from later developments” (i.e., successful institution of the
`
`Unified IPR citing Veneklase, Jonsson, and Kew). See Pet., p. 1. Accordingly, there
`
`has been “road-mapping” with respect to at least the BOA IPR. This factor favors
`
`denying institution.
`
`4.
`
`General Plastic Factors Four and Five
`
`Petitioner knew or should have known about the prior art asserted in the
`
`Petition (Veneklase, Jonsson, Kew, Sormunen, and Kaufman) shortly after being
`
`served with the complaint (i.e., February 2023). See Pet., p. 8. That is because
`
`Petitioner was served the complaint less than two months after the BOA IPR and the
`
`12
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`Unified IPR were filed, and as discussed above, all the references relied upon in the
`
`instant Petition were at least cited in the BOA IPR and/or the Unified IPR.
`
`The institution decisions in the BOA IPR and the Unified IPR were issued
`
`nearly five months after Petitioner was served with the complaint (i.e., July 2023).
`
`Petitioner then waited an additional five months after those decisions—a total of ten
`
`months after service of the complaint—to take a fourth bite at the apple, filing the
`
`instant Petition on December 18, 2023.
`
` Accordingly, Petitioner waited
`
`approximately ten months to file the Petition after learning about the prior art.
`
`Further, the Petition provides no explanation for this ten-month delay. In Valve
`
`Corp. v. Electronic Scripting Products, Inc., the Board found that a five-month delay
`
`was sufficient to favor denying institution. Valve Corp. v. Electronic Scripting
`
`Products, Inc., IPR2019-00064, Paper 10 at 15 (P.T.A.B. May 1, 2019)
`
`(precedential) (“The fact that Valve waited five months after HTC’s petition to file
`
`the Petition in this case favors denying institution.”). These factors favor denying
`
`institution.
`
`5.
`
`General Plastic Factor Six and Seven
`
`The instant Petition uses the institution decisions in the BOA IPR and the
`
`Unified IPR as roadmaps, presenting prior art and arguments that have already been
`
`considered by the Office. The overlap in the challenged claims and the significant
`
`13
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`relationship between Petitioner and the petitioners of the Unified IPR and BOA IPR
`
`favors denying institution because this Petition would be redundant and a waste of
`
`the Board’s finite resources. See Valve Corporation v. Electronic Scripting
`
`Products, Inc., IPR2019-00062, Paper 11 at 15 (P.T.A.B. April 2, 2019)
`
`(precedential) (“Here, [Petitioner] waited until after the institution decision[s] in the
`
`[Unified and BOA] IPR[s], and then filed . . . [an] additional petition[]. These serial
`
`and repetitive attacks implicate the efficiency concerns underpinning General
`
`Plastic, and, thus, favor denying institution.”). Thus, the sixth and seventh General
`
`Plastic factors therefore favor denying institution.
`
`The General Plastic factors overwhelmingly favor denying institution.
`
`IV. THE PETITION SHOULD BE DENIED BECAUSE IT DOES NOT
`ESTABLISH A REASONABLE LIKELIHOOD OF SUCCESS ON ANY
`CHALLENGED CLAIM
`
`As shown below, the Petition fails to demonstrate a reasonable likelihood that
`
`Petitioner would prevail with respect to either of the Challenged Claims. As detailed
`
`herein, the proposed Grounds fail to disclose key limitations of each Challenged
`
`Claim, so trial should not be instituted.
`
`A. The ’658 Patent
`
`The ’658 Patent, which is titled “Use of Personal Communication Devices for
`
`User Authentication,” was filed on March 6, 2000, and issued on January 31, 2006.
`
`14
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`EX1001. The ’658 Patent relates to “the authentication of users of secure systems
`
`and, more particularly, the invention relates to a system through which user tokens
`
`required for user authentication are supplied through personal communication
`
`devices such as mobile telephones and pagers.” EX1001 at 1:7-11.
`
`At the time of the claimed inventions, “secure systems”2 used “a user ID and
`
`password pair to identify and authenticate system users.” See id. at 1:13-14.
`
`Although user ID/password pairs were ubiquitous, they suffered from several
`
`shortcomings, as recognized by the inventors of the ’658 Patent:
`
`Passwords created by users are often combinations of words and names,
`which are easy to remember but also easily guessed. Guessing
`passwords is a frequent technique used by “hackers” to break into
`systems. Therefore, many systems impose regulations on password
`formats that require mixtures of letters of different cases and symbols
`and that no part of a password be a word in the dictionary. A user’s
`inability to remember complex combinations of letters, numbers, and
`symbols often results in the password being written down, sometimes
`on a note stuck to the side of a workstation.
`
`Id. at 1:28-38.
`
`
`
`2The ’658 Patent describes many non-limiting examples of a “secure system,”
`including Novell NetWare-, Microsoft NT-, Windows 2000-, and UNIX/Linux-
`based computers, as well as “any system, device, account, “a user account on a
`network of computer workstations, a user account on a website, or a secure area of
`a building.” EX1001, 1:13-19, 4:13-23.
`15
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`The increasing use of remote connectivity at the time of the claimed
`
`inventions further exacerbated the shortcomings of user ID/password pairs. See id.
`
`at 1:20-26. As a result, then-current systems faced several issues:
`
`Present systems face several problems: users dread frequent password
`changes, frequent password changes with hard-to-remember passwords
`inevitably result in users surreptitiously writing down passwords, and
`security is compromised when users write down their passwords.
`
`Id. at 1:39-43. Two-factor authentication (a form of multi-factor authentication)
`
`improves user ID/password pairs by adding “unpredictable, one-time-only access
`
`codes.” See id. at 1:49-51. The first factor is “a user passcode or personal
`
`identification number.” See id. at 1:46-47. The second factor is the “unpredictable,
`
`one-time-only access codes.” See id. at 1:49-51. In two-factor authentication,
`
`system access is based upon:
`
`(cid:129) “nonsecret information known to the user, such as the user ID;”
`
`(cid:129) secret information known to the user, such as the passcode;” and
`
`(cid:129) “information provided to the user through an object possessed by the user,
`
`such as the token.”
`
`Id. at 2:11-15.
`
`The ’658 Patent acknowledges the existence of the RSA Security, Inc.
`
`SecurID product at the time of the claimed inventions, but identified significant
`
`deficiencies in the product:
`
`16
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`The SecurID product, however, requires users to carry an additional
`item on their person in order to access a secure system. It would be
`advantageous if the benefits of the SecurID system could be achieved
`using a device
`that many users already carry—a personal
`communication device such as a mobile phone or a pager.
`
`Id. at 1:54-59. The ’658 Patent requires the use of a personal communication device,
`
`which teaches away from a separate device like the SecurID product. See id.
`
`The ’658 Patent solves the deficiencies of the SecurID product and further
`
`improves two-factor authentication in a unique, novel, non-obvious way. Figure 1
`
`of the ’658 Patent, reproduced below, depicts an embodiment of a user
`
`authentication system (identified as “100” in the figure):
`
`17
`
`
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`
`EX1001 at Fig. 1; see also id. at 3:31-33.
`
`Authentication system (100) regulates access to secure system (110). Id. at
`
`4:9-13. User authentication server (102) “preferably includes a program or a suite
`
`of programs running on a computer system to perform user authentication services.”
`
`Id. at 4:27-29. “The authentication information preferably includes a user ID 152, a
`
`passcode 154 and a user token 156.” Id. at 4:36-39. Tokens are received on the
`
`user’s personal communication device (106), which can be, for example, “a pager or
`
`mobile phone having SMS (short message service) receive capability.” Id. at 4:13-
`
`15.
`
`It is important to be aware of the terminology used by the ’658 Patent. The
`
`“user ID may be publicly known and used to identify the user.” Id. at 4:39-40. The
`
`’658 Patent uses the term “passcode” to refer to what is commonly called a
`
`“password:” “For example, the user 108 can combine a valid, memorized passcode
`
`of ‘abcd’ . . . .” Id. 4:54-55; see also id. at 1:27-29 (“Passwords created by users are
`
`often combinations of words and names, which are easy to remember but also easily
`
`guessed.”), 4:40 (The passcode 154 is preferably secret and known only to the user
`
`108.”). The “token” can be, for example, “a random or pseudo-random sequence of
`
`numbers or digits or both numbers and digits.” Id. at 9:22-24.
`
`18
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`The ’658 Patent uses the term “password” to refer to the combination of at
`
`least the “passcode” and a “token.” Id. at 4:52-53 (“In the preferred embodiment,
`
`the user 108 combines the token 156 with the passcode 154 to form a password
`
`158.”). For example, if the passcode is “abcd” and the token is “1234,” the password
`
`could be “abcd1234” or “1234abcd.” See id. at 4:54-56. The components of the
`
`password (e.g., the passcode and token) can be combined or sent to the system as
`
`separate components. See id. at 4:52-65.
`
`Figure 5, reproduced below, depicts an embodiment of how the system
`
`provides tokens and authenticates users.
`
`19
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`
`
`
`Id. at Fig. 5; see also id. at 3:41-43.
`
`In step 502, the system associates the user’s user ID and passcode with the
`
`user’s personal communication device. Id. at 8:53-60. By doing so, the system
`
`transmits the token only to the associated user. See id. In steps 504, 506, and 508,
`
`the system receives a request for a token, determines which user made the request
`
`(i.e., associates the request with a user ID), and generates the token. See id. at 9:3-
`20
`
`
`
`
`
`IPR2024-00283
`Patent 6,993,658
`27, Fig. 5. Those steps differ from other systems that continually generate access
`
`codes. See, e.g., id. at 1:49-51 (“The SecurID card gener