.EXHIBIT A
`
`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Page 1
`
`HTC EX. 1026
`HTC v. Ancora
`US Patent No. 6,411,941
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,4ll,941
`
`Claim Element of the '941 Patent
`
`iOSDevices
`
`I
`
`1. A method of restricting software
`operation within a license for use with
`a computer including an erasable, non(cid:173)
`volatile memory area of a BIOS of the
`computer, and a volatile memory area;
`the method comprising the steps of:
`
`For devices operating on the iOS platform ("iOS devices"), Apple uses a secure boot
`procedure that restricts non-verified programs from operating. (ANCA 421-422, 856, 879,
`902, 925, 937.) The secure boot procedure includes: a Secure Bootloader, a Low Level
`Bootloader (LLB) and an iBoot. (ANCA 854-960.) Devices operating on the iOS platform
`are designed to include: (1) volatile RAM memory (e.g., ANCA 875, ii 0082; ANCA 921, ii
`0067); (2) non-volatile, erasable memory such as Read Only Memory (ROM), or flash
`memory {e.g.; ANCA 875, ii 0083; ANCA 921-9222, i10067 & ii 0068); (3) and a processor.
`(See also, ANCA 756-787, 788-789, 880, 994, 926) The volatile memory and non-volatile
`memory "may store firmware for the [iOS deviCe], such as a basic input/output system
`(BIOS)."(ANCC 1027 i10080) The secure booting procedure is allegedly performed during:
`(1) manufacture of an iOS device and (2) recovery, update and/or restore procedures of an
`iOS device. (ANCA916.) (APL10102-10117)
`
`selecting a program residing in the
`volatile memory,
`
`Kernel cache is loaded into volatile RAM memory and "causes a kernel and operating
`system components to be loaded into [volatile RAM memory] memory from storage." .
`(ANCA 875, ii 0082; ANCA 921, ii 0067; ANCA 952.) (APL10102-10117)
`
`using an agent to set up a verification
`structure in the erasable, non-volatile
`memory of the BIOS, the verification
`structure accommodating data that
`includes at least one license record,
`
`The agent, for example, includes a "ticket retrieving module 217," an Apple "authorization
`server" ("Apple Server") as well as any other additional Apple software or hardware that is
`used to set-up the ''ticket" . within the erasable, non-volatile memory area of the BIOS.
`(ANCA 917, ii 0042) (APL10102-10117)
`
`The "ticket retrieving module 217" first sends a "ticket request" to . the Apple Server
`requesting the boot components used for the secure boot procedure. (ANCA 917, ii 0039,
`
`2
`
`EXHIBIT A
`
`Page 2
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`l
`iOS Devices
`0042) The Apple Server generates a "signed ticket" that operates as a verification structure
`for the iOS device. Each "sighed ticket" includes a cryptographic digest and "version
`identifiers" which are a license record used to verify the program. (ANCA 854-855, 904,
`912, 916-923.) ·The "signed ticket" is returned to the iOS device and is "validated" to ensure
`the returned "signed ticket" matches the "ticket request" sent. (ANCA 918, ~ 0048) Once
`validated, the "signed ticket" is stored as a "local ticket" in the erasable, non-volatile
`memory of the BIOS. Id. (APL10102-10117)
`
`verifying the program using at least .
`the verification structure from the
`erasable non-volatile memory of the
`BIOS, and
`
`During the boot procedure for the iOS device, the cryptographic digest of the program is
`verified against the "signed ticket" that is stored in the erasable, non-volatile memory area of
`BIOS. (ANCA 854-855; 918-920.} (APL10102-10117)
`
`acting on the program according to the
`verification.
`
`If the program's digest is verified, the program is allowed to operate. If the program's digest
`is not verified, the program is determined to be invalid and the iOS device begins operation
`under an alternative operating mode (e:g., DFU). (ANCA 854-855; 918-920.) (APL10102-
`10117)
`
`Claim: 2
`
`2. A method according to claim 1,
`further comprising the steps of:
`
`establishing. a license authentication
`bureau.
`
`Claim: 3
`
`Apple has established an Apple Server for the iOS devices. (ANCA 903, 916-917.)
`(APL10102-101l7)
`
`3
`
`EXHIBIT A
`
`Page 3
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`3. A method according to claim 2,
`wherein setting up a verification
`structure further comprising the steps
`of:
`
`establishing, between the computer
`and the bureau, a two-way data(cid:173)
`communications linkage;
`
`transferring, from the computer to the
`bureau, a request-for-license including
`an identification of the computer and
`the license-record's contents from the
`selected program;
`
`iOS Devices
`
`I
`
`A "ticket retrieving module" located on the iOS device establishes a two~way data
`communication link between the iOS device and the Apple Server. (ANCA 903, 916-917.)
`(APL10102-10117)
`
`The iOS device transfer a "ticket request" or Plist file to the authorization center that may
`include: (1) a cryptographic digest of each program, (2) a nonce value, and (3) a unique
`identifier (i.e., UID, ECID or GID) that is a unique identification of a particular iOS device.
`(ANCA 854-855, 904, 912, 916-923.) (APL7846-49) (APL10102-10117)
`
`forming an encrypted license-record at .
`the bureau by encrypting parts of the
`request-for-license using part of the
`identification as an encryption key;
`
`The Apple Server validates the "ticket request" and transfers a signed personalized code
`signature that includes a "signed ticket" having a digest corresponding to each program
`identified in the request. Each digest may be "a unique cryptographic value." (ANCA 918, ii
`0044) Each "signed ticket" may further include a "signature cryptographically signed" by
`the Apple Server. (ANCA 918, ii 0046) (APL10102-10117)
`
`transferring, from the bureau to the
`computer, the encrypted license(cid:173)
`record; and
`
`The "signed ticket" is then transferred from the Apple server to the iOS device. (ANCA 918,
`ii 0048) (APL10102-10117)
`
`4
`
`EXHIBIT A
`
`Page 4
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`iOS Devices
`
`I
`storing the encrypted license record in The "signed ticket is "validated" to verify it matches the "ticket request" originally sent by
`the erasable non-volatile memory area
`the iOS device. (ANCA 918, ~ 0048) (APL10102-10117)0nce validated, the "signed ticket"
`of the BIOS.
`is stored as a ''local ticket" in the erasable, non.:. volatile memory of the BIOS. Id ..
`
`I
`
`Claim: 5
`
`5. A method according to claim 3
`wherein the identification of the
`computer includes the unique key.
`
`Claim: 6
`
`6. A method according to claim 1
`wherein selecting a program includes
`the steps of:
`
`licensed-software-
`a
`establishing
`program in the volatile memory of the
`computer wherein
`said
`licensed-
`software-program
`includes contents
`used to form the license-record.
`
`Claiin: 7
`
`The iOS devices include unique keys, such as "UID," "ECID" and "GID" keys. (ANCA
`854-855, 912, 917, 951-952.) (APL 7846-49) (APL10102-10117)
`
`Loading the OS in volatile RAM (ANCA 875, ~ 0082; ANCA 921, ~ 0067) includes
`establishing the contents of the . OS used to form the "signed ticket" (ANCA 952.)
`(APL10102-10117)
`
`~
`
`r
`
`7. A method according to claim 6
`wherein using an agent to set up the
`verification structure includes the steps
`of: .
`
`The iOS devices establish or certify pseudo-unique keys stored in a non-volatile
`memory area, such as a "GID," "ECID," or "UID." (ANCA 854-855, 912, 916-923,
`951-952.) (APL 7846-49) (APL10102-10117)
`
`5
`
`EXHIBIT A
`
`Page 5
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`iOS Devices
`
`~
`l
`
`establishing or certifying the existence
`of a pseudo-unique key in a first non-
`volatile memory area of the computer; .
`and
`
`establishing at least one license-record
`location in the first nonvolatile
`memory area or in the erasable, non- .
`volatile memory area of the BIOS.
`
`Claim: 8
`
`8. A method according to claim 6
`wherein establishing a license-record
`includes the steps of:
`
`The "signed ticket," which includes cryptographic digests, is stored in the erasable, non-
`volatile BIOS, and is established by the iOS devices. (ANCA 854-855, 912, 916-923, 951-
`952.) (APL10102-10117)
`
`..
`
`The "signed ticket" received from the Apple Server is encrypted using "a unique identifier
`forming a license-record by encrypting for a device." (ANCA 854-855, 912, 918.) (APLl 0102-10117)The "signed ticket". includes
`cryptographic digests that are encrypted using "a unique identifier[.]" Id.
`of the contents used to form a license-
`record with other predetermined data
`contents, using the key; and
`
`establishing the encrypted license-
`record in one of the at least one
`established license-record locations.
`
`The "signed ticket" which includes the cryptographic digest is then stored or established in
`the erasable, non.:.volatile memory area of the BIOS. Id
`
`6
`
`EXHIBIT A
`
`Page 6
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`· With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`iOS Devices
`
`I
`
`Claim: 9
`
`9. A method according to claim 7
`wherein verifying the program
`includes the steps of:
`
`encrypting the licensed-software(cid:173)
`program's license-record contents from
`the volatile memory area or decrypting
`the license-recordin the erasable, non".'
`volatile memory area bf the BIOS,
`using the pseudo-unique key; and
`
`comparing the encrypted licenses(cid:173)
`software-program's license-record
`contents with the encrypted license(cid:173)
`record in the erasable, non~volatile
`memory area of the BIOS, or
`comparing the license-software(cid:173)
`program's license-record contents with
`the decrypted license-record in
`erasable non-volatile memory area of
`the BIOS.
`
`Claim: 10
`
`The "signed ticket" that is stored in the. erasable, non-volatile memory area of the BIOS
`includes cryptographic digests that are decrypted using a key stored on the iOS device (e.g.,
`UID, ECID or GID).
`(ANCA 854-855, 912, 916-923, 951-952.)
`(APL7846-49)
`(APL10102-l0117)
`
`Cryptographic digests corresponding to a particular program (e.g., a kemalcache) are
`retrieved from the "sign:ed ticket" and decrypted. Id. When the iOS device is in "autoboot"
`mode, a "kemelcache digest" is generated from the "kemelcache" component. (ANCA 919,
`it 0054) The decrypted digest from the "signed ticket" is compared against a program digest
`that is generated by the iOS device. Id. (APL10102-10117)
`
`7
`
`EXHIBIT A
`
`Page 7
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`10. A method according to claim 9
`wherein acting on the program
`includes the step: .·
`
`restricting the program's operation
`with predetermined limitations if the
`comparing yields non-unity or
`insufficiency.
`
`Claim: 11
`
`11. A method according to claim 1
`wherein the volatile memory is a
`RAM.
`
`Claim: 12
`
`iOS Devices
`
`I
`
`The "signed ticket" that is stored in the erasable, non-volatile memory area of the BIOS
`includes cryptographic digests that are decrypted using a key stored on the iOS device (e.g.,
`UID, ECID or GID).
`(ANCA 854-855, 912, . 916-923, 951-952.)
`(APL7846-A9)
`(APL10102-10117) Cryptographic digests of each program are compared against the
`If the
`corresponding cryptographic . digest stored · within the "signed ticket." Id.
`cryptographic digest of the program is determined to be invalid, the iOS device will stop
`boot operations or refuse operation of the program. Id.
`
`Every device running the iOS platform includes volatile RAM memory. (ANCA 756-787,
`788-789, 857, 880, 926, 994.) (APL10102-10117)
`
`12. The method of claim 1, wherein a
`pseudo-unique key is stored in the
`non-volatile memory of the BIOS.
`
`The iOS devices include keys stored in the erasable, non-volatile memory area of the BIOS, ·
`such as "UID," "ECID," "GID" or "trusted keys." (ANCA 854-855, 912, 917, 951-952.)
`(APL7846-49) (APL10102-10117)
`
`Claim: 13
`
`· The iOS devices include keys stored in the erasable, non-volatile memory area of the BIOS,
`13. The method of claim 1, wherein a
`such as "UID," "ECID," "GID" or "trusted keys." (ANCA 854-855, 912, 917, 951-952.)
`unique key is stored in a first non-
`volatile memory area of the computer. · (APL7846-49) (APL10102-10117)
`
`Claim: 14
`
`8
`
`EXHIBIT A
`
`Page 8
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`iOS Devices
`
`I
`I
`
`14: The method according claim 13,
`wherein the step of using the agent to
`set up the verification record,
`including the license record, includes
`encrypting a license record data in the .
`program using at least the unique key.
`
`The iOS .devices generate a "property list" (Plist) or "ticket request" that is transmitted to an
`Apple "Ticket Authorization Server" ("Apple Server"). (ANCA 854-855, 904, 912, 916-
`923.) The Apple Server generates a "personalized code signature" that includes a "signed
`.. ticket." Id. The "signed ticket" is encrypted using "a unique identifier for a device." (ANCA
`854-855, 912, 918.) (APL10102-10117) The "signed ticket" includes cryptographic digests
`that are encrypted using "a unique identifier" and "version identifiers" corresponding to the
`program. Id The "signed ticket" is then stored in the erasable, non-volatile memory area of
`the BIOS; Id The program is encrypted using a key that may be stored in a "key tag." The
`key tag is wrapped using one of the keys stored in the erasable, non-volatile memory area of
`the iOS device, such as the "UID," "ECID," or "GID." (ANCA 872.)
`(APL7846-49)
`(APL10102-10117)
`
`·Claim: 15
`
`15. The method according to claim 14,
`wherein the verification comprises:
`
`extracting the license record from the
`software program;
`
`encrypting the license record using the
`unique key stored in the first non(cid:173)
`volatile memory area of the computer
`to form second encrypted license
`information; and
`
`The iOS device "may extract a header value from the code image" such as a "kemelcache"
`(ANCA 1130, ii 45 & 58) (APL10102-10117) The header value is "extracted based on a
`preset attribute in an attribute value pair inside the code image." Id. The header value
`includes "a signature value signed over the code image according to the UID of the device
`through well-known hashing and encryption algorithms."Id (APL7846-49) (APL10102-
`10117)
`
`The iOS device "derives another signature value from the code image according to the UID
`through the same well-known hashing and encryption algorithms." (ANCA 1130, ii 45)
`(APL 7846-49) (~PL 10102-10117)
`
`9
`
`EXHIBIT A
`
`Page 9
`
`

`

`Ancora Technologies First Supplemental Infringement Contentions
`With Respect To U.S. Patent No. 6,411,941
`
`Claim Element of the '941 Patent
`
`iOS Devices
`
`I
`
`comparing the encrypted license
`information stored in the erasable,
`non-volatile memory area of the BIOS .
`of the computer with the second
`encrypted license information.
`
`Claim: 16
`
`16. The method according to claim 13,
`wherein the step of verifying the
`program includes a
`
`decrypting the license record data
`accommodated in the erasable second
`non-volatile memory area of the BIOS ·
`using at least the unique key.
`
`Claim: 17
`
`1 7. The method according to claim 13, .
`wherein the step of verifying the
`program includes
`
`encrypting the license record that is
`accommodated in the program using at
`leastthe unique key.
`
`The iOS device "compare[s]the derived signature value and the extracted signature value to
`verify whether the code image is trusted." Id. (APL10102-10117)
`
`The "signed ticket" that is stored in the erasable, non-volatile memory area of the BIOS
`includes cryptographic digests that are decrypted using a key stored on the iOS device (e.g.,
`UID, ECID or GID). (ANCA 854-855, 912, 916-923, 951-952.) (APL7846-49)
`(APL10102-10117)
`
`The "signed ticket" received from the Apple Server is encrypted "using a unique identifier
`for a device." (ANCA 854-855, 912, 918.) (APL10l02-10117) The "signed ticket" includes
`cryptographic digests that are also encrypted using "a unique identifier[.]" Id.
`
`10
`
`EXHIBIT A
`
`Page 10
`
`