Tnals@uspte. gov
`
`
`571-272-7822
`
`Paper 11
`Entered: August 1, 2024
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`APPLEINC.,
`Petitioner,
`
`V.
`
`CARBYNE BIOMETRICS, LLC,
`Patent Owner.
`
`IPR2024-00333
`Patent 11,475,105 B2
`
`Before JAMESON LEE, ARTHUR M. PESLAK,and
`STEVEN M. AMUNDSON,Administrative Patent Judges.
`
`LEE, Administrative Patent Judge.
`
`DECISION
`DenyingInstitution of/nter Partes Review
`35 US.C. $314
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`I.
`
`INTRODUCTION
`
`Apple Inc. (“Petitioner”) filed a Petition requesting an interpartes
`
`review of claims 1, 9-11, 14, 18, 28-30, 33, and 35 (“challenged claims”) of
`
`U.S. Patent No. 11,475,105 B2 (Ex. 1001, “the ?105 patent”). Paper3.
`
`Carbyne Biometrics, LLC (“Patent Owner’’) filed a Preliminary Response.
`
`Paper 8. Petitioner filed an authorized Preliminary Reply. Paper 9 (“Prelim.
`
`Reply”). Patent Ownerfiled an authorized Preliminary Sur-reply. Paper 10
`
`(Prelim. Sur-reply”).
`
`Wehave authority to determine whetherto institute an interpartes
`
`review. See 35 U.S.C. §314 (2018); 37 C.F.R. § 42.4(a) (2024). An inter
`
`partes review maynotbe instituted unless the information presented in the
`
`Petition “showsthat there is a reasonable likelihood that the petitioner would
`
`prevail with respect to at least 1 of the claims challenged in the petition.”
`
`35 U.S.C. §314(a). Upon consideration ofthe contentions andthe evidence
`
`of record before us, we conclude Petitioner has not shown a reasonable
`
`likelihood that it would prevail in establishing the unpatentability of at least
`
`one challenged claim ofthe’ 105 patent.
`
`Accordingly, we declineto institute interpartes review.
`
`A.
`
`Real Parties in Interest
`
`I. BACKGROUND
`
`Petitioner identifies itselfas real party in interest. Pet. 1. Patent
`
`Owneridentifies itselfas real party in interest. Paper4, 2.
`
`B.
`
`RelatedMatters
`
`The parties each identify the followinglitigation as related to the ’105
`
`patent (Pet. 1; Paper 4, 2): Carbyne Biometrics, LLC v. Apple Inc., 1:23-cv-
`
`00324 (WDTX).
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`Petitioner further identifies Samsung Electronics Co., Ltd. v.
`
`RightQuestion, LLC, IPR2022-00244 (PTAB) (Terminated July 26, 2022),
`
`which involvedan ancestral patent ofthe ’105 patent, as a related matter.
`
`Pet. 1-2.
`
`IPR2024-00334 is a proceeding involving U.S. Patent No. 11,514,138
`
`B1, based on Application 17/027,481, from which the application that issued
`
`as the 105 patent 1s a continuation-in-part application.
`
`C.
`
`The ’105 Patent
`
`The ’105 patent is directed to authentication techniques to provide
`
`credentials to aservice. Ex. 1001, 1:43-52. The goalis to reduce practices
`
`such as passwordre-use and/or selection ofpoor quality passwords. /d.
`
`Specifically, the ’105 patent pertains to authentication translation andstates:
`
`Authentication translation is disclosed. A request to access a
`resource 1s received at an authentication translator, as is an
`authentication input. The authentication input correspondsto at
`least one stored record. The stored recordis associatedat least
`with the resource.
`In response to the receiving, a previously
`stored credential associated with the resource 1s accessed. The
`credential is provided to the resource.
`Id. at code (57). Figure 1 ofthe ’105 patent is reproduced below:
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`
`
`FHG. 4
`
`Figure | illustrates an embodiment of an environment in which
`
`authentication translation is provided. Ex. 1001, 2:62—63. Variousclient
`
`service devices 102—108 are connected through one or more networks
`
`(represented as single network cloud 110) to various services 120-124,
`
`whichare also referred to as sites.
`
`/d. at 2:63—67.
`
`Client device 102 is a notebook computer ownedbyuserAlice and
`
`includes a camera, a microphone, anda fingerprint sensor. /d. at 2:67—3:3.
`
`Client device 104 is a smartphone ownedbyuser Alice and includes a
`
`camera.
`
`/d. at 3:3—4. Client device 106 is a tablet owned by user Bob and
`
`includes a camera anda fingerprint sensor, and device 106 is sometimes
`
`used by Bob’s son Charlie. /d. at 3:5—7. Client device 108 is a kiosk located
`
`in the lobby ofa hotel, and it includes acameraanda microphone. /d.
`
`at 3:7-9.
`
`Service 120 is a social networkingsite; service 122 isa website ofa
`
`bank; service 124 is the online store of a boutique cameraretailer; each
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`service requires a username and password(and/or a cookie) from a user
`
`prior to giving that user access to protected content and/or other features.
`
`Ex. 1001, 3:15—20. A user need not type such user names and passwords
`
`into the devices whenever required by a service, but can authenticate to an
`
`“authentication translator’ which will provide the appropriate credentials to
`
`the service “on the user’s behalf.” /d. at 3:21—26.
`
`For example, notebook computer 102 includes authentication
`
`translator module 132 that provides authentication translation services. /d.
`
`at 3:29-31. Devices 104-108 can also include, but need not include, their
`
`own respective authentication translator modules. /d. at 3:31—33. The
`
`ownerofbank website 122 operates authentication translator 134 associated
`
`with the bank. /d. at 3:34—-35. Authentication translator 136 provides
`
`authentication servicesto a variety ofbusinesses, including online camera
`
`retailer 124.
`
`/d. at 3:35-38.
`
`Figure 2 of the ?105 patent is reproduced below:
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`
`
`
` x
`
`
`Sin, URERSHNIS, SRGANwAl
`
`|
`
`aerercereceereoeen
`
`
`
`
`FIG. 2
`
`Figure 2 shows an embodimentof credential information stored on a
`
`device 200.
`
`/d. at 3:38-39. Device 200 stores three user profiles 202—206,
`
`each ofwhich contains a username andone or more templates associated
`
`with the user.
`
`/d. at 3:39-42. A template 1s a collection ofbiometric
`
`features, where a fingerprint is an example ofa biometric feature. /d. at
`
`3:42-44. A representation ofa single fingerprint may be included in
`
`multipletemplates, such as in different resolutions in accordance with
`
`different protocols (e.g., warm or cold conditions and/orby itself or in
`
`combination with multiple fingerprints). /d. at 3:48—53. Whenother
`
`biometrics are employed, for example facial recognition, voice print, or
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`retina scan, correspondingfeatures are includedin the template. /d. at 3:53—
`
`56.
`
`Policies can be included in profiles that govern how matchesare to be
`
`performed. /d. at 4:3—5. Policies can specify threshold/tolerances for what
`
`constitutes a match, and can specify that different levels ofmatches can
`
`result in different levels of access to different resources. /d. at 4:5—8.
`
`A profile is associated with a vault, for example vault 220.
`
`/d. at 4:9.
`
`A vault, in turn, containstriples specifying a service provider/domain, a
`
`username, andacredential. /d. at 4:9-11.
`
`Regarding policies, the ’105 patent further describes:
`
`Policies can be associated with devices, or with all vaults on a
`device. Such a policy maystate that vaults can only be backed
`up to computational devices of the same brand, or
`to
`computational devices that satisfy software requirements
`associated with the policy, such as having anti-virus software or
`using an operating system that is the most recent version or the
`version before that, but not older.
`
`Ex. 1001, 19:28-34.
`
`The credential for a service provider or domain can be a password ora
`
`cryptographic key.
`
`/d. at 4:14-17. The ’105 patent describes that profiles,
`
`templates, and vaults are collectively referred to as “authentication
`
`information”and that in some embodimentssecure storage techniquesare
`
`used tostore at least a portion ofthe authentication information. /d. at 4:18—
`
`23. Profiles and vaults can be updated whilein secure storage, andifthat
`
`occurs, they are encrypted before being written back to insecure storage,
`
`which mayin turn propagate them to external backup storage. /d. at 4:44—
`
`48. Figure 3 is reproducedbelow:
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`
`
`
`
`
`
`
`
`
`
`Meaneenenennnnenennenenennnnenenennenenennenenennencnennencnennencnnnnenenennenccennnl!
`
`a0g-—*
`
`FIG. 3
`
`Figure 3 shows an embodimentusing secured storage to hold authentication
`
`information. /d. at 4:21—25.
`
`Mobile phone 300 includeslarge and insecure storage 302 attached to
`
`fast processor 304, and smaller but secure storage 306 is attached to
`
`dedicated processor 308 and sensor 310, which can be acamera ora
`
`fingerprint reader. /d. at 4:25—29. “Users (and applications) can read from
`
`and write to the insecure storage area. However, users cannotaccessthe
`
`secure storage area, and the fast processor can only communicate with the
`
`dedicated processor/sensor viaa restricted API.” Jd. at 4:29-33.
`
`D.
`
`Illustrative Claim
`
`Claims 1, 18, and 35 are independent. All other challengedclaims
`
`depend,directly or indirectly, from claim 1 or claim 18. Claim 1 is
`
`reproducedbelow:
`
`[1.0] A system, comprising:
`1.
`[1.1] one or moreprocessors configured to:
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`[1.2] receive,at a first device, a request to access a resource
`external to the first device, wherein the resource external to the
`first device is associated with a user;
`
`[1.3a] access at least one record stored on thefirst device,the at
`least one record including authentication information associated
`with the user and credential information associated with the
`external resource to which the user has requested access,
`
`[1.3b] wherein the credential information comprises a
`cryptographic key;
`
`[1.4] receive authentication input from the user;
`[1.5] determine that the authentication input from the user
`matches the authentication information associated with the user
`includedin the at least one record stored on thefirst device;
`
`[1.6] retrieve at least a portion ofthe credential information
`from the at least one record stored in thefirst device;
`
`[1.7] facilitate access ofthe userto the external resourceat least
`in part by transmitting, on behalfofthe user, from the first
`device, output basedat least in part on the at least portion ofthe
`credential information retrieved from the at least one record,
`wherein the userofthefirst device is granted access to the
`external resource basedat least in part on the output transmitted
`from thefirst device on behalfofthe user; and
`
`[1.8] based at least in part on the first device beinga same
`brand as a seconddevice,initiatea backup, to the second
`device, of at least a portion ofthe at least onerecord; and
`[1.9] a memory coupled to the one or more processors and
`configured to provide the one or more processors with
`instructions.
`
`Ex. 1001, 24:47-25:13.!
`
`' The bracketed heading labels correspond to those used by Petitioner to
`reference the claim elements. See Pet.23—42. Weuse the same labels here
`for ease of reference, understanding, and consistency.
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`E.
`
`Prior Art and Declaration Evidence
`
`Petitioner relies on the following evidence:”
`
`Challener
`
`1007
`US Patent No. 8,099,789 B2
`1006
`USPatent No. 8,799,666 B2
`
`Jakobsson ’351°|US Patent No. 10,360,351 B2 1011
`US Pub. App. 2004/0117636 Al|1008
`EP 2 079 023 A2
`
`1010
`
`> The ’105 patent issued from Application No. 17/123,018,filed Dec.15,
`2020, which 1s acontinuation-in-part ofApplication No. 17/027,481, filed
`Sept. 21, 2020, now Patent No. 11,514,138, which is a continuation of
`Application No. 16/773,767, filed Jan. 27, 2020, now Patent No. 10,929,512,
`which is acontinuation ofApplication No. 16/563,715, filed Sept. 6, 2019,
`now Patent No. 10,824,696, which is a continuation ofApplication No.
`16/273,797, filed Feb. 12, 2019, now Patent No. 10,521,568, whichisa
`continuation ofApplication No. 15/042,636, filed Feb. 12, 2016, now Patent
`No. 10,360,351, which is a continuation ofApplication No. 13/706,254,
`filed Dec. 5, 2012, now Patent No. 9,294,452. Ex. 1001, codes (21), (22),
`(63). The ’105 patent also claims priority to Provisional Application
`61/587,387, filed Jan. 17, 2012, and Provisional Application 61/569,112,
`filed Dec. 9, 2011. /d. code (60).
`> Issued Jan. 17, 2012 from Application No. 11/529,795, filed Sept. 29,
`2006. Ex. 1007, codes (21), (22), (45).
`4 Issued Aug. 5, 2014, from Application No. 12/731,050,filed Mar. 24,
`2010. Ex. 1006, codes (21), (22), (45).
`> Issued July 23, 2019, from Application No. 15/042,636,filed Feb. 12,
`2016, which is acontinuation ofApplication No. 13/706,254,filed Dec. 5,
`2012, now Patent No. 9,294,452. Ex. 1011, codes (21), (22),(45), (63).
`Jakobsson °351 also claims priority to Provisional Application 61/587,387,
`filed Jan. 17, 2012, and Provisional Application 61/569,112, filed Dec. 9,
`2011. /d. code (60). Jakobsson 7351 is an ancestral patent to which the ’105
`patent claimspriority through a chain of continuation applications including
`a continuation-in-part application. Ex. 1001, code (63).
`° Published June 17, 2004. Ex. 1008, code (43).
`7 Published July 15,2009. Ex. 1010, code (43).
`
`10
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`Petitioner also relies on the Declaration ofPatrick McDaniel, Ph.D.
`
`(Ex. 1003). Patent Owner has not submitted any declaration testimony.
`
`I
`
`The Asserted Grounds ofUnpatentability
`
`Petitioner asserts that the challenged claims ofthe ’105 patent are
`
`unpatentable based on the following grounds(Pet. 12):
`
`1, 14, 18, 33, 35
`
`103
`
`103
`
`Kesanupalli, Cheng, Kodama
`
`Kesanupalli, Cheng, Kodama,
`Challener
`
`35 9-11, 28-30
`
`
`
`1, 9-11, 14, 18, 28-30, 33,|103 Jakobsson °351, Kodama
`
`G.
`
`Effective Filing Date and Applicable Law
`
`The Leahy-Smith America Invents Act (“AIA”), Pub. L. No. 112-29,
`
`125 Stat. 284, 287-88 (2011), in § 3(n)(1), provides that the amendments
`
`made by this section “shall apply to any application for patent, and toany
`
`patent issuing thereon,that contains or contained at any time—(A) aclaim
`
`to a claimed invention that has aneffective filing date as defined in section
`
`100(1) of title 35, United States Code,that is on or after [expiration ofthe 18
`
`month period beginning on the date of enactment ofthe AIA (September16,
`
`2011)].°8 ATA § 3(n)(1).
`
`Petitioner asserts that dependent claim 16 ofApplication No.
`
`17/123,018 as initially filed on December 15, 2020, which issued as the ’105
`
`patent, recites “the backup is performed in response toa determination that
`
`’ The date ofenactment ofthe AIA is September16, 2011.
`
`11
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`the first device is ofthe same brandasthe second device.” Pet. 6 (citing
`
`Ex. 1002, 417). Petitioner also asserts:
`
`As confirmed by Dr. McDaniel, no disclosure exists in any
`application to which the ’018 App claimspriority—aincluding the
`pre-AIA ’254 App—that provides written description support for
`a backup being performedin response to a determination that
`the first device is of the same brand as the second device.
`APPL-1003, §§[36-41. Accordingly, AIA § 3(n)(1) dictates the
`°105 patent be evaluated under post-AIA §§102, 103.
`
`Id.
`
`Similarly, Petitioner asserts that the effective filing date of each
`
`challenged claim is no earlier than the actualfiling date ofApplication No.
`
`17/123,018, December 15, 2020, becauseall independentclaims ofthe
`
`challenged claims require initiating a backupbasedatleast in part ona first
`
`device being ofthe same brand as a second device. Pet. 6. Petitioner
`
`explains:
`
`As confirmed by Dr. McDaniel, no written description
`exists in any application to which the ’018 Appclaims priority
`for initiating backup to a second devicebasedat least in part on
`the first device being a same brand as a second device. APPL-
`1003, 936-41. To the extent passages of the ’018 App discuss
`the term “brand”(/.e., those portions corresponding to 13:28-33
`and/or 19:29-35 ofthe ’105 patent), these passagesare not found
`in any application to which the ’018 App claimspriority. APPL-
`1003, 39-41. These passages
`fall under
`a_ heading
`“ADDITIONAL EMBODIMENTS.” APPL-1001,
`11:30;
`APPL-1002, 18. This heading begins a portion ofthe 018 App’s
`specification that spans pages numbered18 to 36; in contrast, the
`originally filed specification ofthe U.S. Application 17/027,481
`of which the ’018 App is a CIP, does not include this heading
`and begins its claim recitation at its page 17. APPL-1002, 395-
`414; APPL-1005, 38.
`
`Pet. 7-8.
`
`12
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`Patent Ownerassertsthat “the Petition contains no actual analysis of
`
`the actual Provisional application.” Prelim. Resp. 44. Accordingto Patent
`
`Owner,it “properly disclosed support for the ‘same brand’ backupin the
`
`Provisional.” /d. at 45. Patent Owner explains:
`
`Here, the Provisional application (Ex. 1005 at 298) discusses
`“synchronization of data between device 110...
`. and cloud
`storage or other storage 101.” Ex. 1005 at 315 (Fig. 5). The
`Provisional further discusses that a “secure channel’ can be
`established between the twoentities to authenticate each other
`and that “[i]t is determined, based on policies and the identity
`and access history of device 1/0 what data to upload 502 to
`storage 101 from device 110...” Id. (emphasis added)
`(reproduced below).
`
`
`
`Ex. 1005 (Provisional) at 315 (Fig. 5). A determination “based
`on”policies and the identity ofthe device would have conveyed
`toa POSITAthat the backup could have been based on a policy
`including the device being of the same brand as the second
`
`13
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`device. See, e.g., Ex. 1001 (105 Patent) at 19:29-35 (“Such a
`policy may state that vaults can only be backed up to
`computational devices of the same brand.) (emphasis added).
`Petitioner and its expert completely disregard this statement and
`the backup discussionsin the Provisional.
`Prelim. Resp. 45—46 (emphasis in original).
`
`These assertions ofPatent Ownerare unavailing. First, in light of
`
`Petitioner’s application ofJakobsson 351 as prior art, Patent Ownerbears
`
`the burden ofproduction to present persuasive argumentthatits claims are
`
`entitled to the benefit ofa filing date prior to the date ofJakobsson ’351 as
`
`prior art. See Dynamic Drinkware, LLC v. National Graphics, Inc.,
`
`800 F.3d 1375, 1379-80 (Fed. Cir. 2015).
`
`Second, as to Patent Owner’s arguments regarding support being
`
`found in Provisional Application No. 61/587,387,filed Jan. 17,2012, we are
`
`not sufficiently unpersuaded. The disclosure Patent Ownerrefers to in the
`
`provisional application is this: “It 1s determined, based on policies and the
`
`identity and access history of device 110 what data to upload 502 to storage
`
`101 from device 110 and component 114, and similarly, what data to
`
`download from storage 101 to device 110 and component 114.” Ex. 1005,
`
`315 (cited at Prelim. Resp. 45—46).
`
`The test for written description support is whether the application
`
`reasonably would have conveyed to one with ordinary skill in the art “the
`
`inventor possessed the inventionat the time ofthat original disclosure.”
`
`Pandrol USA, LP v. Airboss Ry. Prods., Inc., 424 F.3d 1161, 1165 (Fed. Cir.
`
`2005); see also Vas-Cath Inc. v. Mahurkar, 935 F.2d 1555, 1563-64 (Fed.
`
`Cir. 1991) (“the applicant must also convey with reasonable clarity to those
`
`skilled in the art that, as of the filing date sought, he or she wasin possession
`
`ofthe invention’).
`
`14
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`The disclosure in the provisional application as cited by Patent Owner
`
`regardingpolicies is broad and does not convey with reasonable clarity what
`
`specifically are the policies, such as a policy for backup based on whether
`
`the first and second devices are ofthe same brand. The broaddisclosure
`
`does not indicate possession by the inventor the narrow andspecific
`
`limitation recited in independent claims1, 18, and 25, 1.e., “based at least in
`
`part on thefirst device being asame brandas a second device,initiating a
`
`backup,to the second device,of at least a portion ofthe at least onerecord.”
`
`Ex. 1001, 25:7—10, 26:30-32, 28:23—25.
`
`Patent Ownerstates: “A determination ‘based on’ policies and the
`
`identity ofthe device would have conveyed to a POSITAthat the backup
`
`could have been based on a policy including the device being ofthe same
`
`brand as the second device.” Prelim. Resp. 46 (emphasisin original). The
`
`assertion is misplaced becauseit refers to what “could have been”a policy,
`
`rather than whatpolicy the provisional application disclosure conveys the
`
`inventor actually possessed. Whatpotentially “could have been”is mere
`
`speculation, not written description indicating possession.
`
`Similarly, the disclosure ofthe provisional application does not
`
`provide adequate written description support for dependent claim 16
`
`contained in Patent Application 17/123,018 asinitially filed, which issued as
`
`the ’105 patent. Claim 16 as initially filed recites: “the backup 1s performed
`
`in response to a determination thatthe first device is of a same brand as the
`
`second device.” Ex. 1002, 417.
`
`For the foregoing reasons, we apply the AIAversions of 35 U.S.C.
`
`§§ 102 and 103. Also, we determine,on this record, that the effectivefiling
`
`15
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`date of all challenged claims ofthe 105 patentis the actualfiling date of
`
`Patent Application No. 17/123,018, December 15, 2020.
`
`II. ANALYSIS
`
`A.—Legal Standards
`
`A claim is unpatentable under 35 U.S.C. § 103 “if the differences
`
`between the claimed invention andthe priorart are such that the claimed
`
`invention as a whole would have been obviousbefore the effectivefiling
`
`date ofthe claimed invention to a person having ordinary skill in the art to
`
`whichthe claimed invention pertains.” 35 U.S.C. § 103; see KSR Int’l Co. v.
`
`Teleflex Inc. , 550 U.S. 398, 406 (2007). The question of obviousness is
`
`resolved on the basis ofunderlying factual determinations, including (1) the
`
`scope and content ofthe priorart; (2) any differences between the claimed
`
`subject matter andthepriorart; (3) the level of skill in the art; and (4) where
`
`in evidence, so-called secondary considerations ofnonobviousness.’ See
`
`Graham v. John Deere Co., 383 U.S. 1, 17-18 (1966).
`
`B.
`
`Level ofOrdinary Skill in the Art
`Citing testimony from Dr. McDaniel, Petitioner asserts a person of
`
`ordinary skill in the art “would have hada bachelor’s degree in [] electrical
`
`en gineering, computer engineering, computer science, ora related field, and
`
`at least two years of experiencein the research, design, development, and/or
`
`testing of authentication techniques, andrelated firmware and software,or
`
`the equivalent, with additional education substituting for experience and vice
`
`versa.” Pet. 8 (citing Ex. 1003 4 18-22).
`
`” The record does not include any evidence of secondary considerations of
`nonobviousness.
`
`16
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`On this record, we adoptPetitioner’s statement ofthe level of ordinary
`
`skill in the art, except for the qualifier “at least” which applies to experience
`
`and which would improperly extend the scope of experience to the realm of
`
`an expert. Itis supported by the testimony ofDr. McDanieland notdisputed
`
`by Patent Owner (Prelim. Resp. 12). Further, it appears consistent with what
`
`is reflected by the content ofthe applied prior art. Cf Okajimav. Bourdeau,
`
`261 F.3d 1350, 1354-55 (Fed. Cir. 2001) (the applied prior art may reflect
`
`an appropriate level of skill).
`
`C.
`
`Claim Interpretation
`Weuse the same claim construction standard that would be used to
`
`construea claim in acivil action under 35 U.S.C. § 282(b), including
`
`construing the claim in accordance with the ordinary and customary
`
`meaning of such claim as understood by one of ordinary skill in the art and
`
`the prosecution history pertaining to the patent. 37 C.F.R. § 42.100(b). The
`
`claim construction standard set forth in Phillips v. AWH Corp., 415 F.3d
`
`1303 (Fed. Cir. 2005) (en banc) is applicable.
`
`Claim termsare generally given their ordinary and customary
`
`meaning as would be understood by one with ordinary skill in the art in the
`
`context ofthe specification, the prosecution history, other claims, and
`
`extrinsic evidence including expert and inventor testimony,dictionaries, and
`
`learnedtreatises, although extrinsic evidenceis less significant than the
`
`intrinsicrecord. Phillips,415 F.3d at 1312-17. Usually, the specificationis
`
`dispositive, andit is the single best guide to the meaning of a disputed term.
`
`Td. at 1315.
`
`The specification may reveal a special definition given to a claim term
`
`by the patentee, or the specification or prosecution history may reveal an
`
`17
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`intentional disclaimer or disavowal of claim scope by the inventor. /d.
`
`at 1316. “There are only two exceptionsto this general rule: 1) whena
`
`patentee sets outa definition and acts as his own lexicographer, or 2) when
`
`the patentee disavowsthe full scope ofa claim term either in the
`
`specification or during prosecution.” Thorner v. Sony Comput. Entm’t Am.
`
`LLC, 669 F.3d 1362, 1365 (Fed. Cir. 2012).
`
`If an inventor acts as his or her own lexicographer, the definition must
`
`be set forth in the specification with reasonableclarity, deliberateness, and
`
`precision. Renishaw PLC v. Marposs Societa’per Azioni, 158 F.3d 1243,
`
`1249 (Fed. Cir. 1998). The disavowal,if any, can be effectuated by
`
`languagein the specification or the prosecution history. Poly-Am., L.P.v.
`
`API Indus., Inc., 839 F.3d 1131, 1136 (Fed. Cir. 2016).
`
`Only thoseclaim termsthat are in controversy need to be construed,
`
`and only to the extent necessary to resolve the controversy. Realtime Data,
`
`LLC v. lancu, 912 F.3d 1368, 1375 (Fed. Cir. 2019) (“The Boardis required
`
`to construe ‘only those terms. .
`
`. that are in controversy, and only to the
`299
`
`extent necessary to resolve the controversy.’”
`
`(quoting Vivid Techs., Inc. v.
`
`Am. Sci. & Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999))).
`
`D.
`
`Alleged Obviousness ofClaims 1, 14, 18, 33, and 35
`over Kesanupalli, Cheng, andKodama
`
`l.
`
`Overview ofKesanupalli (Exhibit 1006)
`
`Kesanupalli discloses systems and methods whichrelate to biometric
`
`authentication ofusers. Ex. 1006, 2:30—31. Biometric informationrefers to
`
`measurable biological characteristics of a user, such as fingerprint, facial
`
`characteristics, eye characteristics, and voice characteristics. /d. at 2:31—35.
`
`Figure 2 of Kesanupalli is reproduced below:
`
`18
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`204
`Le
`
`ENCRYPTION
`KEY
`
`5w
`
`e
`
`20Xe.
`
`SEQURE STORAGE
`
`FIG, 2
`
`Figure 2 illustrates sample system 200 for performing biometric user
`
`enrollment and authentication. Ex. 1006, 6:26—28. System 200 includes
`
`sensor 204, host PC 202, WinUSBdriver 210, biometric service 212,
`
`application 214, andsecurestorage206.
`
`/d. at 6:26—49.
`
`During an enrollment processthat uses a fingerprint sensor as the
`
`biometric sensor, a user swipesa finger across the fingerprint sensor several
`
`timesto create a fingerprinttemplate. Ex. 1006, 3:32—35. Aftercreating a
`
`fingerprint template, the user provides user credentials, such as a password,
`
`cryptographic key, or random seed.
`
`/d. at 3:41—44. The system then binds
`
`the user’s fingerprint template with the user’s credentials and stores the
`
`template and the credentials in a secure storage device. /d. at 3:44—47.
`
`During a subsequentuseridentification process, referred to as user
`
`verification process, a user Swipesa finger across a fingerprint sensor.
`
`Ex. 1006, 3:52—53. The processthen determines whetherthe user’s
`
`fin gerprint information matchesa fingerprint template associated with the
`
`fingerprint sensor. /d. at 3:54—56. Ifthe user’s fingerprint information
`
`matchesa fingerprint template, the user’s credentials are released to the user
`
`and/or a service or process requesting the user verification. /d. at 3:56—59.
`
`19
`
`wet
`f
`HOST PC
`
`SENSOR
`ko
`
`S8k
`
`1
`
`WinUSB
`oaveR
`\
`a0
`
`BIOMETRIC
`SERVICE
`‘
`BE
`
`.
`APPLICATION
`\
`214
`
`
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`The usercredentials are not released from the secure storage device until a
`
`matching fingerprint template is confirmed. /d. at 3:59-61.
`
`Figure 9 is reproduced below:
`
`
`
`WENTIE? 4 LSIQUE IDENTIF:
`FINGER?!
`
`
`
`Figure 9 illustrates a procedurefor authenticating a user in a biometric
`
`authentication system. Ex. 1006, 2:6—7.
`
`Kesanupalli describes that its system will send user credentialsto a
`
`predetermined address or location:
`
`The described systems and methods communicate user
`credentials to a specific address, location, or other recipient
`identifier. Thus, even if an imposter can gain accessto the user
`credentials, the system will send those user credentials to a
`predetermined address or location, thereby preventing the
`imposter from attempting to have theuser credentials sent to an
`alternate address or
`location.
`The address or
`location
`information is
`stored within the user credentials and is
`established as part ofthe enrollment process.
`
`Ex. 1006, 4:3—11. Kesanupalli describes that its systems and methodsare
`
`useful in performing Website authentication.
`
`/d. at 4:36-37. Kesanupalli
`
`explains:
`
`20
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`After a user has enrolled with a particular Website that
`supports biometric authentication, subsequentvisits to the same
`Website cause the Web browserplug-in to detect that the user
`has already enrolled withthe Website. In this situation, the Web
`site prompts the user to perform user authentication (e.g., using
`the biometric device). In the case of a fingerprint sensor, the user
`swipestheir finger across the fingerprint sensor or places their
`finger on the fingerprint sensor. If the fingerprint information
`matches a fingerprint template associated with the fingerprint
`sensor, the Web browserplug-in releases user secrets from the
`user credentials.
`In particular embodiments, the fingerprint
`sensor releases an OTP token or an RSA signature instead of
`plain-text credential. After the credentials are released, they are
`communicated to the Web site to complete the user
`authentication process.
`
`Ex. 1006, 5:9-24. Kesanupalli also describesthat “different user credentials
`
`are associated with each Website with which the user enrolls.” /d. at 5:35—
`
`37,
`
`2.
`
`Overview ofCheng (Ex. 1008)
`
`Chengdiscloses a method “to securely backup andrestore a user’s
`
`portable biometrics-based authentication device without compromising the
`
`security thereof.” Ex. 1008, code (57). The method has atwo-tier backup
`
`encryption structure which allowsdecryption of lower-tier data only when
`
`uppertier data has been decrypted and validated. /d. The lower-tier data
`
`contain encrypted electronic identity ofa user and authentication
`
`information associated therewith such as private keys and corresponding
`
`certificates. /d. The upper-tier data contain the encrypted lower-tier data
`
`and the user’s biometrics information. /d. Figure 2 of Cheng is reproduced
`
`below:
`
`21
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`Biometrics Enrollment, Processing and
`Feature Comparison 201
`
`User
`Interface
`203
`
`
`
`Encryption/Decryption Engine 202
`
`Memory 204
`
`FIG, 2
`
`Figure 2 shows a sample portable biometrics-based authentication device
`
`according to Cheng. Ex. 10089422. Portable device 200 includesuser-
`
`interface means 203, memory means 204, encryption/decryption engine 202,
`
`and biometrics processing means 201.
`
`/d. Onboard microprocessor and
`
`communication meansare not shown.
`
`/d.
`
`Chengdescribes that to backup a device, the lower-tier dataarefirst
`
`enciphered using a first encryption means, and the upper-tier data are then
`
`enciphered using a second encryption means. Ex. 100898. Cheng
`
`describes:
`
`In an embodiment, the encryption keys for both the upper and
`lower tiers are separately generated within the device.
`Ina
`preferred embodiment, the device obtainsa first encryption key
`from a first user service bureau. The lowertier data is encrypted
`with this encryption key. Then, the device obtains a second
`encryption key from a seconduser service bureau, which may or
`may not be the same asthefirst user service bureau, and the
`uppertier data are further encrypted using the second encryption
`key, generating a multiple-encrypted backupfile. The multiple-
`encrypted backupfile is then copied to a storage medium of
`user’s choice.
`
`Ex. 1008 4 8. Cheng further describes:
`
`The storage means could be, for instance, an online proprietary
`or Internet-based storage service, a remote server, a floppydisk,
`a hard drive, a data drive, a CD-ROM,anoptical storage means,
`
`22
`
`

`

`IPR2024-00333
`Patent 11,475,105 B2
`
`a removable disk, a smart card, amemory storage device or any
`other storage media capable of storing data. The user service
`bureau could be proprietary or Internet-based and could also
`provide the storage service.
`Id. § 29.
`
`To restore already backed-up data onto a new device, Chengstates as
`
`follows:
`
`To restore the multiple-encrypted backup data onto a new
`biometrics-based authentication device, the user first needs to
`enroll the relevant biometrics in