BEFORE THE PATENT TRIAL AND APPEAL BOARD NOKIA … · before the patent trial and appeal board _____ nokia solutions and networks us llc; ... a. “detaching, by the mme, the ue from

UNITED STATES PATENT AND TRADEMARK OFFICE

____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD

____________

NOKIA SOLUTIONS AND NETWORKS US LLC; AND

NOKIA SOLUTIONS AND NETWORKS OY,

Petitioners

v.

HUAWEI TECHNOLOGIES CO. LTD.,

Patent Owner

____________

Case: IPR2017-00657

U.S. Patent No. 8,031,677

____________

PETITION FOR INTER PARTES REVIEW

UNDER 35 U.S.C. § 312 AND 37 C.F.R. § 42.104

Mail Stop PATENT BOARD

Patent Trial and Appeal Board

US Patent and Trademark Office

PO Box 1450

Alexandria, Virginia 22313-1450

i

TABLE OF CONTENTS

LIST OF EXHIBITS ................................................................................................ v

ACRONYM GLOSSARY ..................................................................................... ix

I. MANDATORY NOTICES UNDER 37 C.F.R. § 42.8 ................................ 1

A. REAL PARTY IN INTEREST ........................................................................ 1

B. RELATED MATTERS ................................................................................. 1

C. DESIGNATION OF COUNSEL ...................................................................... 1

D. SERVICE INFORMATION............................................................................ 2

II. GROUNDS FOR STANDING UNDER 37 C.F.R. § 42.104(a) ................. 2

III. PAYMENT OF FEES ................................................................................... 2

IV. OVERVIEW OF CHALLENGES AND RELIEF REQUESTED ............ 2

V. INTRODUCTION ......................................................................................... 3

VI. STATE OF THE ART ................................................................................... 5

A. 3GPP ORGANIZATION.............................................................................. 5

B. THE 3G 3GPP PACKET-SWITCHED NETWORK ......................................... 6

C. THE DETACH PROCEDURE AT THE TIME OF THE PURPORTED

INVENTION .............................................................................................15

VII. THE ’677 PATENT .....................................................................................28

A. OVERVIEW OF THE ’677 PATENT ............................................................28

B. PURPORTED PROBLEM AND ALLEGED NOVELTY ...................................28

C. PROSECUTION HISTORY OF THE ’677 PATENT ........................................30

VIII. CLAIM CONSTRUCTION ........................................................................34

A. “DETACHING, BY THE MME, THE UE FROM THE 3GPP NETWORK”

(CLAIM 1) AND “DETACH THE UE FROM THE 3GPP NETWORK”

(CLAIM 8) ...............................................................................................34

B. THE PREAMBLE OF CLAIM 1 IS LIMITING ...............................................37

IX. PRIOR ART REFERENCES .....................................................................39

ii

A. THE CATT SUBMISSION (NSN677-1006) .............................................41

B. TS 23.401 V1.1.0 (NSN677-1007) .......................................................42

C. THE ’677 APA (NSN677-1001) ............................................................43

X. OVERVIEW OF INVALIDITY ANALYSIS ...........................................46

XI. INVALIDITY OF CLAIMS 1-3 AND 8-10 OF THE ’677 PATENT .....48

A. COUNT 1: CLAIMS 1-3 AND 8-10 ARE UNPATENTABLE UNDER 35

U.S.C. § 103(A) OVER THE CATT SUBMISSION IN LIGHT OF TS

23.401 ...................................................................................................48

B. COUNT 2: CLAIMS 1-3 AND 8-10 ARE UNPATENTABLE UNDER 35

U.S.C. § 103(A) OVER THE ’677 APA IN LIGHT OF TS 23.401 ...............63

C. THE GROUNDS ARE NOT REDUNDANT ..................................................72

XII. CONCLUSION ............................................................................................73

iii

TABLE OF AUTHORITIES

Page(s)

CASES

Catalina Mktg. Int’l, Inc. v. Coolsavings.com, Inc.,

289 F.3d 801 (Fed. Cir. 2002) ............................................................................ 39

Constant v. Advanced Micro-Devices, Inc.,

848 F.2d 1560 (Fed. Cir. 1988) .......................................................................... 45

Deere & Co. v. Bush Hog, LLC,

703 F.3d 1349 (Fed. Cir. 2012) .................................................................... 37, 39

Huawei Technologies Co., Ltd. v. T-Mobile US, Inc. and T-Mobile

USA, Inc.,

Case No. 2:16-cv-0056 (E.D. Tex. Jan. 15, 2016) ............................................... 1

In re NTP,

654 F.3d 1279 (Fed. Cir. 2011) .................................................................... 44, 45

LG Elecs. v. Core Wireless Licensing S.A.R.L.,

IPR2015-01988, Paper 7 (PTAB Apr. 1, 2016) ................................................. 41

Liberty Mutual Ins. Co. v. Progressive Cas. Ins. Co.,

CBM2012-00003, Paper 7 (PTAB Oct. 25, 2012) ....................................... 72, 73

PharmaStem Therapeutics, Inc. v. ViaCell, Inc.,

491 F.3d 1342 (Fed. Cir. 2007) .......................................................................... 45

Tokyo Keiso Co., v. SMC Corp.,

307 F. App’x 446 (Fed. Cir. 2009) ..................................................................... 45

RULES

Rule 42.22(a)(1) ......................................................................................................... 2

Rule 42.104(b)(1)-(2) ................................................................................................. 2

STATUTES

35 U.S.C. § 102 .................................................................................................. 31, 40

iv

35 U.S.C. § 103(a) ............................................................................................passim

35 U.S.C. § 365(c) ................................................................................................... 39

OTHER AUTHORITIES

37 C.F.R § 42.10(b) ................................................................................................... 1

37 C.F.R. § 42.15(a) ................................................................................................... 2

37 C.F.R. § 42.100(b) .............................................................................................. 34

77 Fed. Reg. 48,756, 48,766 (Aug. 14, 2012) ......................................................... 34

MPEP § 211.01(c) .................................................................................................... 39

v

LIST OF EXHIBITS

Exhibit Short Name Description

NSN677-1001 ’677 Patent U.S. Patent No. 8,031,677

NSN677-1002

’677

Application File

History

File History of U.S. Patent No. 8,031,677

NSN677-1003 Lanning

Declaration

Declaration of Mark Lanning under 37

C.F.R. § 1.68

NSN677-1004 Bertenyi

Declaration

Declaration of Balazs Bertenyi under 37

C.F.R. § 1.68

NSN677-1005

Patent Owner’s

District Court

Complaint

Huawei Techs. Co. Ltd. v. T-Mobile US,

Inc., 2:16-cv-00052, D.I. 1 (E.D. Tex. Jan.

15, 2016)

NSN677-1006 CATT

Submission

3GPP TSG SA WG2 Architecture – S2#58,

TDoc S2-072603, EPS bearer release

procedure during handover from 3GPP to

non 3GPP, submitted by CATT, available

as “S2-072603.zip at

http://www.3gpp.org/ftp/tsg_sa/WG2_Arch/

TSGS2_58_Orlando/Docs/ (uploaded

6/19/2007 at 12:17 PM)

NSN677-1007 TS 23.401

V1.1.0

3GPP TS 23.401 V1.1.0 (2007-07), 3rd

Generation Partnership Project; Technical

Specification Group Services and System

Aspects; GPRS enhancements for E-

UTRAN access (Release 8),

http://list.etsi.org/scripts/wa.exe?A2=ind070

7&L=3GPP_TSG_SA_WG2&F=&S=&P=2

61969 (uploaded 7/16/2007)

http://www.3gpp.org/ftp/tsg_sa/WG2_Arch/TSGS2_58_Orlando/Docs/


http://list.etsi.org/scripts/wa.exe?A2=ind0707&L=3GPP_TSG_SA_WG2&F=&S=&P=261969



vi


NSN677-1008 S2#58 Attendee

List

List of Registered Attendees, Meeting

SA2#58, available at

http://webapp.etsi.org/3GPPRegistration/fVi

ewPart.asp?mid=26045#Bottom (last

accessed 1/9/2017)

NSN677-1009 About 3GPP

About 3GPP Home, 3GPP: A Global

Initiative, available at

http://www.3gpp.org/about-3gpp/about-

3gpp (last accessed 1/10/2017)

NSN677-1010

3GPP

Delegates’

Corner

Delegates Corner, 3GPP: A Global

Initiative, available at

http://www.3gpp.org/specifications-

groups/delegates-corner (last accessed

1/10/2017)

NSN677-1011 3GPP FAQ

3GPP FAQs, 3GPP: A Global Initiative,

available at

http://www.3gpp.org/contact/3gpp-faqs (last

accessed 1/10/2017)

NSN677-1012 TS 23.060

V4.6.0

3GPP TS 23.060 V4.6.0 (2002-09), 3rd



Aspects; GPRS Service description Stage 2

(Release 4), available at

https://portal.3gpp.org/desktopmodules/Spe

cifications/SpecificationDetails.aspx?specifi

cationId=758 (uploaded October 02, 2002)

NSN677-1013 S2#58

Document List

3GPP Public FTP File Server TSG S2#58

Document List, available at

http://www.3gpp.org/ftp/tsg_sa/WG2_Arch/

TSGS2_58_Orlando/Docs/ (last accessed

1/9/2017)

http://webapp.etsi.org/3GPPRegistration/fViewPart.asp?mid=26045#Bottom

http://webapp.etsi.org/3GPPRegistration/fViewPart.asp?mid=26045#Bottom

http://www.3gpp.org/about-3gpp/about-3gpp

http://www.3gpp.org/about-3gpp/about-3gpp

http://www.3gpp.org/specifications-groups/delegates-corner

http://www.3gpp.org/specifications-groups/delegates-corner

http://www.3gpp.org/contact/3gpp-faqs

https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=758





vii


NSN677-1014 TS 32.251

V7.3.0

3GPP TS 32.251 V7.3.0 (2007-03), 3rd



Aspects; Telecommunication management;

Charging Management; Packet Switched

(PS) domain charging (Release 7), available

at



cationId=1898 (uploaded 3/26/2007)

NSN677-1015 Joint Claim

Construction

Chart

Joint Claim Construction Chart, Huawei

Techs. Co. Ltd. v. T-Mobile US, Inc., 2:16-

cv-00056, Paper 110, Ex. A (E.D. Tex. Jan.

15, 2016)

NSN677-1016 TS 23.401

V8.0.0

3GPP TS 23.401 V8.0.0 (2007-12), 3rd



Aspects; General Packet Radio Service

(GPRS) enhancements for Evolved

Universal Terrestrial Radio Access Network

(E-UTRAN) access (Release 8), available at




NSN677-1017 Lanning CV Curriculum Vitae of Mark R. Lanning

NSN677-1018 TS 32.423

3GPP TS 32.423 V7.4.0 (2006-12), 3rd



Aspects; Telecommunication management;

Subscriber and equipment trace; Trace data

definition and management (Release 7),

available at,













viii


NSN677-1019 * * * European File History of EP 08 78 3835

NSN677-1020 Newton’s

Dictionary

Newton’s Telecom Dictionary (18th ed.

2002)

NSN677-1050 TR 21.900

3GPP TS 21.900 V6.0.0 (2003-09), 3rd



Aspects; Technical Specification Group

working methods (Release 5) available at



cationId=555




ix

ACRONYM GLOSSARY

Acronym Term

3GPP 3rd Generation Partnership Project

2G Second Generation

3G Third Generation

4G Fourth Generation

AAA Authentication, Authorization, and Accounting

BRI Broadest Reasonable Interpretation

BSS Base Station System

eNB evolved NodeB

ePDG evolved Packet Data Gateway

EPS Evolved Packet System

E-UTRAN Evolved Universal Terrestrial Radio Access Network

FFS For Further Studies

GGSN Gateway GPRS Support Node

GPRS General Packet Radio Service

GW Gateway

HLR Home Location Register

HSS Home Subscriber Server

IE Information Element

IMSI International Mobile Subscriber Identity

LTE Long Term Evolution

x

Acronym Term

MM context Mobility Management Context

MME Mobility Management Entity

MS Mobile Station

MSC Mobile Switching Center

NB NodeB

PCRF Policy and Charging Rules Function

PDN Packet Data Network

PDN GW Packet Data Network Gateway

PDP context Packet Data Protocol context

POSITA Person of Ordinary Skill in the Art

PS Packet Switched

RAN Radio Access Network

RNC Radio Network Controller

S-GW Serving Gateway

SAE System Architecture Evolution

SGSN Serving GPRS Support Node

TEID Tunnel Endpoint Identifier

UE User Equipment

UMTS Universal Mobile Telecommunications System

UTRAN Universal Terrestrial Radio Access Network

VLR Visitor Location Register

- 1 -

I. MANDATORY NOTICES UNDER 37 C.F.R. § 42.8

A. Real Party in Interest

The real party in interest for Petitioners are (1) Nokia Solutions and Networks

US LLC, (2) Nokia Solutions and Networks Oy, collectively (“NSN” or

“Petitioners”), (3) T-Mobile USA, Inc. and (4) T-Mobile US, Inc.

B. Related Matters

The ’677 Patent is at issue in Huawei Technologies Co., Ltd. v. T-Mobile US,

Inc. and T-Mobile USA, Inc., Case No. 2:16-cv-0056 (E.D. Tex. Jan. 15, 2016). On

June 10, 2016, NSN filed a motion to intervene, which was granted by the district

court on June 14, 2016.

In that matter, Patent Owner also asserts, inter alia, U.S. Patent Nos.

8,638,750 and 8,537,779. The ’677 Patent is not related to either of these two patents.

Petitioners are concurrently filing a petition for an IPR challenging certain claims of

U.S. Patent No. 8,537,779.

C. Designation of Counsel

Lead counsel is S. Benjamin Pleune (Reg. No. 52,421) and backup counsel

are John D. Haynes (Reg. No. 44,754) and Michael C. Deane (Reg. No. 70,389) each

of Alston & Bird LLP, 101 S. Tryon Street, Suite 4000, Charlotte, NC 28280, Tel:

704.444.1098, Fax: 704.444.1935. Pursuant to 37 C.F.R § 42.10(b), Powers of

Attorney are being submitted with this Petition.

- 2 -

D. Service Information

Petitioners consent to electronic service directed to [email protected]

and [email protected].

II. GROUNDS FOR STANDING UNDER 37 C.F.R. § 42.104(a)

Petitioner certifies that U.S. Patent No. 8,031,677 (“the ’677 Patent”) is

available for inter partes review (“IPR”) and that Petitioners are not barred or

estopped from requesting an IPR challenging Claims 1-3 and 8-10 (“the Challenged

Claims”) on the grounds identified herein.

III. PAYMENT OF FEES

Petitioners authorize the Patent Office to charge Deposit Account No. 16-

0605 for the Petition fee set forth in 37 C.F.R. § 42.15(a) and for any additional fees.

IV. OVERVIEW OF CHALLENGES AND RELIEF REQUESTED

Pursuant to Rules 42.22(a)(1) and 42.104(b)(1)-(2), Petitioners request

cancellation of Claims 1-3 and 8-10 in the ’677 Patent on the following grounds:

Count 1: Claims 1-3 and 8-10 are unpatentable under 35 U.S.C. § 103(a) over

the CATT Submission in view of TS 23.401.

Count 2: Claims 1-3 and 8-10 are unpatentable under 35 U.S.C. § 103(a) over

the Admitted Prior Art (“the ’677 APA”) in view of TS 23.401.

- 3 -

V. INTRODUCTION

The alleged invention of U.S. Patent No. 8,031,677 (“the ’677 Patent”) is

simply “a specific parameter sent within a known message, within a known system”

as well as a “known detach solution.” NSN677-1003, ¶38. “The parameter

capitalizes on an obvious consequence of gradual changes being made during the

standardization process,” and the solution proposed for detaching was already

present in the prior art. Id. Ultimately, the ’677 Patent claims functionality that “was

taught in ‘Computer Communications 101.’” Id.

The ’677 Patent is directed to the long-existing principle of placing an

information element into a network message during a handover procedure. The ’677

Patent also discloses the long-existing principle of detaching a mobile phone by

deleting the data record of the mobile phone that is stored in the network (the so-

called MM context).

As explained in greater detail below, the concept of handover from a 3GPP

(LTE) base station to a non-3GPP (Wi-Fi) access point (such as a Wi-Fi router) was

a known method. At the time of the purported invention, the foundational aspects of

exactly how the procedure would occur were being developed by the 3GPP standards

body. The 3GPP standards body had already decided on multiple types of detach

procedures and had already contemplated detaching the mobile phone when a

handover from 3GPP (LTE) to non-3GPP (Wi-Fi) occurred. However, the standards

- 4 -

body had not yet implemented the routine and minor aspects of this procedure, which

is all that Patent Owner’s purported invention covers.

The ’677 Patent’s purported novelty has two parts. First, the purported novelty

is to use a cause “information element” (IE) in a delete bearer request message

during LTE (3GPP) to Wi-Fi (non-3GPP) handover. An information element is

nothing more than the name for a data field inside of a message. NSN677-1020, at

4. Further, the use of a cause information element for this purpose was already

proposed to the standards body before Patent Owner’s alleged priority date.

Second, the purported novelty is a “specific” detaching procedure that

involves deleting the data record (MM context) of the mobile phone in the network.

However, this specific detach solution was already being implemented in another

detach procedure that the standards body contemplated would be used for LTE

(3GPP) to Wi-Fi (non-3GPP) handover.

Foreseeing that the standards body might adopt the proposal made in the

primary prior art reference discussed herein—the CATT Submission—and

implement elements that were deemed “for further studies” by the 3GPP standards

body, Patent Owner filed a Chinese application covering these obvious details and,

eventually, turned that application into the ’677 Patent.

Petitioners respectfully request institution of inter partes review of Claims 1-

3 and 8-10 of the ’677 Patent because the CATT Submission was never disclosed to

- 5 -

the USPTO during prosecution of the ’677 Patent (despite one of the inventor’s

attendance at the meeting where the CATT Submission was disclosed to the 3GPP

standards body). Neither the primary count alleged in this Petition, nor the expert

declaration of Mark Lanning, were considered by the examiner, which together

demonstrate the invalidity of the ’677 Patent.

VI. STATE OF THE ART

The ’677 Patent is closely related to the Patent Owner’s work involving

modifications to 3GPP’s 4G LTE standard. NSN677-1003, ¶40. For example, the

face of the ’677 Patent cites various 3GPP LTE specifications, and Patent Owner’s

complaint in the co-pending district court litigation references Patent Owner’s

involvement in development of 3GPP standards in support of its allegations.

NSN677-1005, ¶¶7-9. Therefore a brief discussion about 3GPP is warranted.

A. 3GPP Organization

The 3rd Generation Partnership Project (“3GPP”) is a standards-setting

organization. NSN677-1003, ¶41. As cellular telecommunications technology

developed in the late 1980s, network operators began to realize that standardization

was necessary to ensure subscriber mobility and compatibility of the equipment

provided from multiple suppliers. Id. In other words, mobile phone subscribers

wanted to be able connect to their home mobile networks and “roam” on a third-

party networks. Id. Thus, the 3GPP began in 1998 as a joint partnership between

- 6 -

several telecommunications companies to develop and standardize various aspects

of mobile network operator systems. Id.

The development of specifications by 3GPP is an ongoing, collaborative effort

involving hundreds of engineers from many companies. NSN677-1003, ¶44.

Members of the various 3GPP working groups meet monthly and submit written

contributions and discussion documents, ultimately capturing accepted proposals

and changes in Technical Reports and Technical Specifications. Id.; NSN677-1004,

¶2. 3GPP stores and controls all of these documents electronically and retains them

on the public 3GPP server indefinitely. NSN677-1003, ¶44; see also NSN677-1004,

¶21.

Major changes to the 3GPP standards are introduced as “Releases,” which

comprise several Technical Specifications. NSN677-1003, ¶43. Certain groups of

releases are informally referred to as a “generation.” Id. For example, a 2G network

is the second generation network, a 3G network is the third generation network, and

a 4G network is the fourth generation network.

B. The 3G 3GPP Packet-Switched Network

3GPP originally developed and maintained the Universal Mobile

Telecommunications System (“UMTS”) 3G cellular network. NSN677-1003, ¶49.

Starting in the mid-2000s, however, 3GPP began developing its Long Term

Evolution (“LTE”) 4G cellular network. Id. ¶57. The relevant technology for the

- 7 -

purported invention of the ’677 Patent relates to modifications to the 4G LTE cellular

network. Id. ¶40.

The ’677 Patent’s alleged point of novelty was disclosed in prior generation

networks. To appreciate the routine nature of the purported novelty, it is helpful to

trace 3GPP’s network evolution from the 2G architecture to the 4G LTE

architecture.

3GPP UMTS Network Architecture—Early releases of the 3GPP standards

created a network that could only offer voice calls to landline phones or other mobile

phones. NSN677-1003, ¶48. This network, commonly called the 2G network, can be

divided into two main areas: radio access, which enabled a phone to connect to the

network over a wireless interface, and the core network, which typically provided

wired connections across a wide geographic area. Id. Given that these early 2G

networks only supported voice calls, they only needed a circuit-switched core

network. Id. A simplified diagram of the 2G circuit-switched core network appears

in the simplified diagram below.

- 8 -

Id. However, by the late 1990s, mobile phone subscribers required more from their

devices than just voice calling capability and wanted access to services like e-mail

and Internet. Id. ¶49. These services required transferring data to and from

subscribers in small chunks called packets. Id. Therefore, 3GPP added a packet-

switched core network. Id. A simplified diagram of the 3G network with both a

circuit-switched and packet-switched core network appears below:

- 9 -

Id. The 3G packet-switched core network (shown in the bottom green rectangle in

the “Core Network” box above) transferred data packets between User Equipment

(UE) (e.g., a mobile phone) and a Packet Data Network (PDN) (e.g., the Internet).

Id. ¶52.

A basic feature of any packet-switched network is the use of intermediate

nodes to route data packets from source to destination. Id. ¶51. To create a

connection (i.e., a bearer) between the nodes, the 3G UMTS network used a Packet

Data Protocol Context (PDP context) between the User Equipment (UE) (e.g., a

mobile phone) and the network nodes in order to transfer the data packets. Id. ¶52.

A simplified diagram of the logical architecture for the 3G nodes contained within

the packet-switched core network appears below:

NSN677-1003, ¶51. In the 3G architecture, User Equipment (UE) (e.g., a mobile

phone) uses a wireless radio connection to connect to a mobile phone tower,

- 10 -

commonly referred to in the art as a NodeB (NB). Id. ¶52. The NB typically uses a

wired connection to connect to a Radio Network Controller (RNC). Id. Generally,

several NBs are connected to a given RNC. Id. The RNC is connected using a wired

connection to a nearby Serving GPRS Support Node (SGSN), which retrieves

subscriber information from the Home Location Register (HLR) database. Id. Based

on this information and the user’s desired packet data service (e.g., e-mail, Internet

connection, etc.), the SGSN selected a Gateway GPRS Support Node (GGSN). Id.

In a 3G packet-switched network, the bearer (i.e., connection) from mobile phone to

GGSN is referred to as a specific PDP context, and once the PDP context

(connection) was established the mobile phone could send and receive data to and

from the service. Id.

In order to route packets between a mobile phone and the PDN (e.g., the

Internet), the 3G architecture required the SGSN to perform both control-plane and

user-plane functions. Id. ¶53.

The 3G Network Control Plane—In a 3G network, the SGSN is the main

control element. NSN677-1003, ¶54. When initially establishing a PDP context (i.e.,

at “attach”), the SGSN is responsible for control-plane functions, such as selecting

a GGSN that could exchange packets with the user’s desired packet data service. Id.

Once the PDP context (i.e., connection) is established, the SGSN is also responsible

for maintaining the connection. Id. If the user physically moves and their mobile

- 11 -

phone connects to a new cell phone tower (NB) and possibly to a new RNC (a

process generally referred to as “handover”), the SGSN had to ensure that user data

packets from the GGSN were sent to the new RNC and/or NB. Id. These tasks

required the SGSN to exchange control-plane messages with the RNC and GGSN.

Id. A person of ordinary skill in the art (POSITA) would have understood this as

“control-plane messaging.” Id.

The 3G Network User Plane—In a 3G network, the SGSN was also

responsible for routing the user data packets to the GGSN. NSN677-1003, ¶55.

These user data packets allowed the mobile phone to communicate with the PDN to

receive services like e-mail and Internet. Id. A POSITA would have understood this

as “user-plane messaging.” Id.

This dual-role configuration meant that the SGSN was responsible for both

controlling functions such as mobility as well as routing user data to and from the

PDN (e.g., Internet). NSN677-1003, ¶56. However, when many mobile phones were

connected to the same SGSN requiring data packet connections, this configuration

could create a bottleneck: the SGSN could become too busy with user-plane

messaging and not have sufficient processing power or memory to devote to control-

plane messaging. Id. Stated differently, because the SGSN was tasked with

performing both control-plane and user-plane functions, it could not be optimized

for either. Id. So in Release 8, 3GPP decided to define a new architecture for the

- 12 -

packet-switched domain that separated the network equipment that would handle the

user plane functions from the network equipment that would handle the control-

plane functions. Id. That new architecture is commonly referred to today as a 4G

Long Term Evolution (LTE) network. Id.

At the time of the ’677 Patent, the 3GPP standards body was in the process of

evolving the 3G UMTS network into the 4G LTE network. Id. ¶57.

3GPP 4G LTE Architecture at the Time of the Purported Invention—The

4G LTE network was, among other things, designed to improve speed and efficiency

by separating the equipment that would handle the control-plane and the user-plane

functions. NSN677-1003, ¶57. The 4G LTE network also allowed a mobile phone

to access the packet-switched core network through a non-3GPP (e.g., Wi-Fi) access

point, such as a Wi-Fi router. Id. ¶58. A simplified version of the logical architecture

for a 4G LTE packet-switched core network where a mobile phone connects through

a Wi-Fi (non-3GPP) access point appears below:

- 13 -

Id. In general, the new architecture gave the SGSN’s control-plane functionality to

the new Mobility Management Entity (MME) and gave the SGSN’s user-plane

functionality to the new Serving Gateway (S-GW). NSN677-1003, ¶60. In other

words, control-plane messages that were previously sent to the SGSN are now sent

to the MME, and user-plane messages that were previously sent to the SGSN are

now sent to the S-GW. Id. ¶57 (and accompanying figure).

4G LTE Node Terminology—More details about the network equipment

relevant to the ’677 Patent in the 4G LTE packet-switched core network is illustrated

in the following the figure and described below:

- 14 -

NSN677-1003, ¶59.

eNB (eNodeB): In general terms, the eNB performs the function of a base

station. NSN677-1003, ¶60. The eNB communicates wirelessly with

many mobile devices and typically communicates over wired

connections with the core network. Id.

S-GW (Serving Gateway): An S-GW supports one or more eNBs for

management and transmission of user-plane packet data. Id. The S-

GW is connected to one or more MMEs, one or more eNBs, and one

or more PDN GWs through a wired connection. Id. The S-GW

forwards user-plane data packets from the eNB to the PDN GW. Id.

PDN GW (Packet Data Network Gateway): The PDN GW is responsible

for interworking between the 4G LTE packet-switched network and

the Internet. Id. In other words, the PDN GW is the demarcation point

- 15 -

between the 4G LTE cellular network and the public Internet. Id.

When a mobile phone seeks to handover its data connection from a

Wi-Fi access point to an eNB, the PDN GW serves as the anchor

where the switch is made. Id.

MME (Mobility Management Entity): The MME is responsible for

managing the mobility of the mobile phone and other control-plane

functions. Id. The MME keeps track of the mobile phone’s location

and keeps the other network elements informed about the status of the

mobile phone. Id.

HSS (Home Subscriber Server): The HSS stores subscriber information

about the mobile phone. Id. The HSS also stores information about

which PDN GW a particular mobile phone is connected to. Id.

ePDG (evolved Packet Data Gateway): The ePDG communicates with the

Wi-Fi router and PDN GW to allow a mobile phone to access the 4G

LTE network through a Wi-Fi access point. Id.

C. The Detach Procedure at the Time of the Purported Invention

The “detach” procedure—the subject of the claims of the ’677 Patent—is an

existing procedure long used in 3GPP architecture. In all generations of 3GPP

networks (2G, 3G, and 4G), the mobile phone undergoes a process to disconnect

itself from the network. NSN677-1003, ¶62. For example, a mobile phone will

- 16 -

typically disconnect from the network when it is turned off, it no longer needs a

currently assigned data bearer connection, or its subscription to the network was

cancelled. Id. Upon disconnection, the network can release the data bearer

connection so this resource can be reallocated to other mobile phones. Id. This

process of disconnecting came to be known as a “detach.”

3G UMTS Detach Procedure—The standards propose that multiple network

entities could initiate a detach procedure, and different steps can be taken depending

on the type of detach that is being performed. NSN677-1003, ¶63. For example, in

the 3G UMTS network, (1) an SGSN could initiate a detach procedure (SGSN-

initiated detach), (2) the HLR could initiate a detach procedure (HLR-initiated

detach), or (3) the mobile phone itself could initiate a detach procedure (UE-initiated

detach). Id. Each method had different steps depending on the type of detach to be

performed. Id. The specific network entity that initiated the detach procedure was

based on the reason for the detach. Id.

As an example, this section explains how an HLR performs a detach

procedure in the 3G UMTS network. A POSITA would have understood at the time

of the purported invention that the HLR stored the subscriber’s information.

NSN677-1003, ¶73. For example, when a subscriber decided to cancel his contract

(i.e., withdraw his subscription), the HLR would be notified and would initiate the

HLR-initiated detach procedure. Id. As the standards note, the “HLR use[d] this

- 17 -

procedure for operator-determined purposes to request the removal of a subscriber’s

MM and PDP contexts at the SGSN.” NSN677-1012, § 6.6.2.2, at 52. A POSITA

would have understood that a PDP context contains the subscriber’s session

information for a specific data “bearer” (i.e., connection). NSN677-1003, ¶64. The

following message flow diagram is taken from the 2002 version of TS 23.060 V4.6.0

(five years before the priority date of the ’677 Patent):

NSN677-1012, § 6.6.2.2, at 52 & Fig. 25.

In the first step, the HLR initiates the detach procedure by sending a Cancel

Location message to the SGSN. Id. ¶65. The description of step 1 states: “If the HLR

wants to request the immediate deletion of a subscriber’s MM and PDP contexts

from the SGSN, the HLR shall send a Cancel Location (IMSI, Cancellation Type)

message to the SGSN with Cancellation Type set to Subscription Withdrawn.”

- 18 -

NSN677-1012, § 6.6.2.2, at 52. As can be seen, the known Cancel Location message

contains “information elements” such as IMSI and Cancellation Type, which can be

used to distinguish Cancel Location messages caused by different events. Id.; see

also NSN677-1014, § 4.4, at 21 (listing in a table under the heading “IE name”—or

information element name—the values of “IMSI” and “Cancellation Type.”).

Indeed, disclosing information elements inside of parentheses is a common format

employed by the standards body. NSN677-1003, ¶65. Below is a representation of

this step in the system architecture.

NSN677-1003, ¶65.

At the second step in the procedure, the SGSN notifies the mobile phone that

it was detached by sending a Detach Request to the mobile phone (depicted as step

2 in the message diagram above and with reference to the system architecture

below). NSN677-1003, ¶67.

- 19 -

Id.

At the third step, the SGSN sends a Delete PDP Context Request to the GGSN,

informing the GGSN to delete the bearer that is now unused in the network (depicted

in step 3 in the message flow diagram above and with reference to the system

architecture below). Id. ¶68.

Id.

- 20 -

During this procedure, the MM context stored in the SGSN is also deleted. Id.

¶69.

Id.

A POSITA would have understood that the MM context is a data record

stored, in the 3G UMTS network, in the SGSN that contains information about a

mobile phone critical to the mobile phone’s successful operation in the network.

NSN677-1003, ¶¶70 & 78.

A POSITA also would have understood that when the UE (e.g., mobile phone)

was expected to rejoin the network within a relatively short period of time—for

example, if the phone was just being restarted or the mobile phone temporarily lost

contact with the cell phone tower—the network may not delete the MM context of

that particular mobile phone stored in the SGSN. Id. ¶71. By not deleting the MM

context, the network would not need to engage in the inefficient messaging required

to repopulate the data record once the mobile phone rejoined the network. Id. ¶72.

- 21 -

On the other hand, a POSITA also would have understood that the MM

context stored in the SGSN could be deleted if the mobile phone was not expected

to return to the network within a relatively short period of time; for example, if the

user cancelled his or her contract. Id. ¶73. By deleting the MM context stored in the

SGSN, the network could reallocate the computing resources taken up by the now-

unused MM context. Id. For this reason, the HLR-initiated detach procedure would

delete the mobile phone’s MM context stored in the SGSN when the user cancelled

his contract. Id.

4G LTE Detach Procedure During Handover from 3GPP to Wi-Fi—At the

time of the purported invention, the standards body was contemporaneously

developing (1) the 4G LTE detach procedure, and (2) the 4G LTE detach procedure

that would be used during handover from a 3GPP (LTE) base station to non-3GPP

(Wi-Fi) access point. NSN677-1003, ¶74. However, a person of ordinary skill in the

art would have understood that the goal of both 4G LTE detach procedures was the

same as the goal of the 3G UMTS detach procedure; namely, efficiently releasing

resources of the disconnected mobile phone so that those resources could be

reallocated to a new mobile phone joining the network. Id.

As in the 3G UMTS detach procedure, the standards body had already decided

that multiple network elements could initiate a detach procedure in the 4G LTE

network. NSN677-1003, ¶75. For example, the MME, the mobile phone (UE), and

- 22 -

the HSS could initiate a detach procedure. NSN677-1007, § 5.3.9.1 to § 5.3.9.1. A

POSITA would have understood that the HSS-initiated detach procedure was the 4G

LTE equivalent of the 3G UMTS HLR-initiated detach procedure described above.

Id.

At the time of the purported invention, TS 23.401 § 5.3.9.3 (NSN677-1007,

§ 5.3.9.3) defined the 4G LTE HSS-initiated detach procedure. Just as in the 3G

UMTS HLR-initiated detach procedure, the standards stated, “If the HSS wants to

request the immediate deletion of a subscriber’s MM contexts and EPS Bearers, the

HSS shall send a Cancel Location (IMSI, Cancellation Type) message to the

MME . . . .” NSN677-1007, § 5.3.9.3, at 46 (emphasis added). A person of ordinary

skill in the art would have understood that “Cancellation Type” is an information

element. NSN677-1003, ¶76; see also NSN677-1014, § 4.4, at 21 (listing in a table

under the heading “IE name” both “IMSI” and “Cancellation Type”); NSN677-

1003, ¶76. A person of ordinary skill in the art would have understood that IE stands

for information element.

The standards body contemplated that one of the information elements in the

Cancel Location message might be set to inform the MME that the reason for detach

was “implicit detach because of UE’s accessing RAT changed from 3GPP to Non-

3GPP.” NSN-677-1007, § 5.3.9.3, at 46 (internal quotations omitted); NSN677-

1003, ¶76. RAT stands for Radio Access Type, which just means the network type

- 23 -

(e.g., 4G LTE or Wi-Fi). NSN677-1003, ¶76. In other words, the standards body

contemplated that the information element could also indicate handover from LTE

to Wi-Fi.

However, when that same information element was set to “Subscription

Withdrawn,” the reason that the HSS deleted the MM context stored in the MME

was the same reason the HLR deleted the MM context stored in the SGSN: the user

of the mobile phone had cancelled his subscription. NSN677-1003, ¶77. Thus, the

network had no expectation that the mobile phone would be rejoining the network

within a relatively short period of time. NSN677-1003, ¶77.

However, due to the new 4G LTE network architecture, a fourth network

element could also initiate a detach procedure: the PDN GW. A person having

ordinary skill in the art would have understood that Patent Owner disclosed a PDN

GW-initiated detach procedure that was prior art at the time of the purported

invention in the specification of the ’677 Patent. NSN677-1003, ¶79.

As the ’677 Patent states, Figure 2 “is a flow chart of a process that the UE is

handed over or switched from a 3GPP network to a non-3GPP network in the prior

art”:

- 24 -

NSN677-1001, at 4:63-65 & Fig. 2 (emphasis added).

In the procedure admitted by the Patent Owner, at step 201, the mobile phone

is connected to the 3GPP (LTE) network and triggers a handover to the non-3GPP

(Wi-Fi) network. Just as in the 3G UMTS network, an MM context exists for the

- 25 -

mobile phone, which is stored in the MME in the 4G LTE network. NSN677-1003,

¶78.

NSN677-1003, ¶80.

Steps 202-207 in the message flow diagram above describe the prior art steps

that were used to switch the connection from the 3GPP network to the Wi-Fi

network. NSN677-1003, ¶81. Given that the claims of the ’677 Patent focus on what

occurred in the 3GPP network immediately after the network switched the message

flow to Wi-Fi (i.e., what occurred after step 207), the details of Figure 2, steps 202-

207 are skipped. However, a simplified representation of the resulting system

architecture diagram after step 207 is depicted below:

- 26 -

Id. ¶81.

Next, in Figure 2, step 208, the ’677 Patent states that it was known that “the

PDN GW sends a delete bearer request message to the serving GW, and the serving

GW sends the delete bearer request message to the MME” (depicted as step 208 in

the message diagram above and with reference to the system architecture below).

NSN677-1001, at 2:45-48.

- 27 -

NSN677-1003, ¶82.

Consequently, the now-unused bearers could be deleted from the 3GPP

network, which allowed another mobile phone to use them. NSN-1003, ¶83.

Id.

The description of the prior art procedure in the ’677 Patent stops short of

disclosing that the MM context in the MME would be deleted. Id. ¶84. However,

deleting the MM context in the core network was a part of the process in the 3G

UMTS system, as noted above, and was explicitly disclosed to be a part of the 4G

LTE HSS-initiated detach procedure (as described in detail above). In addition, the

description of the prior art procedure in the ’677 Patent stops short of explaining that

an information element informing the MME of the reason for the detach would be

contained in the delete bearer request message. NSN677-1001, at 2:45-51

(describing the prior art steps without mentioning a cause information element).

- 28 -

However, as explained above, an information element performing this task was in

the 4G LTE HSS-initiated detach procedure (and was disclosed in the primary prior

art referenced discussed in this Petition). Patent Owner’s purported invention merely

ports these two ideas into the prior art 4G LTE PDN GW-initiated detach procedure

disclosed in the ’677 APA.

VII. THE ’677 PATENT

A. Overview of the ’677 Patent

The ’677 Patent discloses “the long-existing principle of placing an

information element into a network message.” NSN677-1003, ¶87. In doing this, the

MME could distinguish a detach caused by Wi-Fi handover from a detach caused by

other reasons. Id. ¶87. The ’677 Patent also discloses “the long-existing principle of

deleting the MM context” so that the resources could be reallocated to a new mobile

phone joining the network.” Id. at ¶88.

B. Purported Problem and Alleged Novelty

The purported novelty of the ’677 Patent is (1) to add an information element

to a delete bearer request message and (2) to impose the specific detach solution of

deleting the MM context stored in the MME. See NSN677-1001, at 2:45-51

(describing the prior art steps without mentioning a cause information element); id.

3:10-13; id. at 3:22-26 (noting the lack of a specific detach solution). In other words,

the ’677 Patent’s alleged novelty is not directed to the message flow, as that was

- 29 -

prior art. The purported novelty is also not directed to which network elements

would receive those messages, as that was also prior art. A simplified diagram of the

process “Before” and “After” the supposed invention is depicted below.

BEFORE THE ’677 PATENT

AFTER THE ’677 PATENT

NSN677-1003, ¶89.

- 30 -

However, as discussed above, these two concepts were not novel. The 4G

HSS-initiated detach procedure disclosed the routine ideas of (1) deleting the MM

context stored in the MME and (2) including an information element that would

inform the MME that the detach was due to handover from 3GPP (LTE) to non-

3GPP (Wi-Fi). NSN677-1003, ¶90. Instead, the purported novelty is merely

“conventional features for distinguishing messages in a network and common steps

for detaching the mobile phone from the network.” Id.

C. Prosecution History of the ’677 Patent

The prosecution history of the ’677 Patent reveals two important points. First,

the prior art standard TS 23.401 was only discussed as § 102(a) anticipation

reference and was not discussed in combination with the CATT Submission under

§ 103. Second, Patent Owner limited its specific “detaching” solution to a solution

that deletes the MM context stored in the MME.

Foreign Prosecution—Patent Owner filed one foreign priority application in

the Chinese patent office, CN 2007 1 10137568, on August 7, 2007. NSN677-1001,

at [30]. Patent Owner then filed a Chinese-language PCT application,

PCT/CN2008/071842, on July 31, 2008. NSN677-1001, at [63]. On October 19,

2009, Patent Owner filed a continuation of its Chinese PCT in the United States,

which was assigned Application No. 12/479,216. Id. Patent Owner then filed a

- 31 -

continuation of that Application, which was given Application No. 13/169,619 that

would later issue as the ’677 Patent. Id.; id. at [21].

United States Prosecution History—On June 27, 2011, Patent Owner filed

the continuation application that would become the ’677 Patent. On the same day,

Patent Owner petitioned for accelerated examination. NSN677-1002, at 8. In support

of its petition for accelerated examination, Patent Owner filed an Accelerated

Examination Support Document. NSN677-1002, at 278-330. In the Accelerated

Examination Support Document, Patent Owner was required to provide support for

each and every claim limitation. Id. In doing so, Patent Owner continually repeated

that the concept of deleting the MM context supported the claim limitation of

“detaching.” Id. In addition, Patent Owner addressed TS 23.401 in the Accelerated

Examination Support Document, but only in terms of 35 U.S.C. § 102, noting that

the document did not disclose the known message flows.

Supplementary European Search Report—While the USPTO allowed the

claims of the ’677 Patent, the European Patent Office originally stated that a similar

“detaching” claim element was not novel in light of TS 23.401. At the time of the

European Search Report, the relevant claim element of Claim 1 read “determining,

by a network element on a network side, whether to detach the UE from the source

network; if yes, detaching the UE from the source network.” NSN677-1002, at 272;

see also NSN677-1019, at 300.

- 32 -

With respect to the “detaching” step, the European Search Report states:

The scenario of detaching from a source network (i.e. update/remove

MM context and deleting the EPS bearers) in response to a 3GPP to

non-3GPP handover is described as being ‘FFS’ in [TS 23.401 V1.1.0].

‘FFS’ means ‘for further study’ in the context of 3GPP standardization

documents. This means that it was not yet decided at the time of

generating V1.1.0 of 3GPP TS 23.401 whether this will be indeed

implemented. However, the option was already there.

NSN677-1002, at 272 (emphasis added); see also NSN677-1019, at 300.

In other words, the idea to delete the MM context had been conceived and

presented, and all that was left was a decision on whether and where to implement

the idea.

The Supplementary European Report goes on to state, “As a consequence,

Claim 1 does not meet the requirements . . . in that its subject-matter lacks novelty

and is thus not allowable.” NSN677-1002, at 272 (emphasis added); see also

NSN677-1019, at 300. In other words, the European Patent Office found the claim

element anticipated.

With respect to TS 23.401, the Supplementary European Search Report goes

on to say, “It is further noted that even if Patent Owner would interpret the disclosure

of [TS 23.401] in a slightly different manner than the examiner has done in the above

analysis, and based on his interpretations would come to the conclusion that there

- 33 -

are differences between the subject-matter of present Claim 1 and [TS 23.401] which

would then establish novelty . . . then these differences, even if they could be

acknowledged as such would only be of so minor nature that they could not be the

basis for establishing the presence of any inventive step . . . .” NSN677-1002, at 272-

73 (emphasis added); see also NSN677-1019, at 300-01. The Report States: “[TS

23.401] discloses the same object and the same type of solution as the present

application . . . .” NSN677-1002, at 273 (emphasis added); see also NSN677-1019,

at 301. In other words, the European Search Report also found the claim element

obvious.1

1 Ultimately, claim 1 of the European counterpart application was allowed

when Patent Owner amended the claim and added additional limitations not

present in independent claim 1 of the ’677 Patent, including (1) a step that requires

the MME to “find[] all the bear source [sic] of the UE are deleted,” and (2) a step

that requires “determining, by the MME, to detach the UE from the source network

if the cause IE carried in the received delete bearer request message is represented

as ‘UE’s accessing RAT changed from a 3GPP network to a non-3GPP network.’”

NSN677-1019, at 351. Therefore, the European claim is narrower because of these

additional limitations, namely, a (1) finding step and (2) determining step based on

the specific nature of the information element. However, importantly, the European

- 34 -

VIII. CLAIM CONSTRUCTION

In an IPR, claim terms are interpreted according to their broadest reasonable

interpretation (“BRI”) in view of the specification in which they appear. 37 C.F.R.

§ 42.100(b); Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756, 48,766 (Aug.

14, 2012). Thus, as required by the applicable rules, this Petition uses the BRI

standard, and all proposed constructions are under the BRI standard. Petitioners

reserve all rights to take a different position with respect to claim construction in any

other proceeding that does not rely on the BRI standard.

A. “detaching, by the MME, the UE from the 3GPP network” (claim

1) and “detach the UE from the 3GPP network” (claim 8)

In the co-pending district court litigation, both Patent Owner and the

Petitioners agree that “detaching, by the MME, the UE from the 3GPP network”

(claim 1) and “detach the UE from the 3GPP network” (claim 8) have a meaning

narrower than the plain and ordinary meaning. Both parties agree that detaching

includes deleting an MM context stored in the MME. See NSN677-1015, Ex. A, at

30-33.

Patent Office, like Patent Owner, treated TS 23.401 as an anticipatory reference.

Neither the USPTO nor the European Patent Office analyzed TS 23.401 in

combination with the CATT Submission.

- 35 -

More specifically, in the co-pending district court litigation, Patent Owner

proposes that the terms mean “delete/deleting, by an MME, an MM context,” and

Petitioners propose that the terms mean “delete/deleting, by an MME, the MM

context.” NSN677-1015, Ex. A, at 30-33. As evidenced by the dispute over the

words “an” and “the” in the district court litigation, the parties disagree about

whether more than one MM context for a particular mobile phone is stored in the

MME at any given time.

The Petitioners argue that construing the term to require deleting “the MM

context” is correct because there is only one MM context for each mobile phone

stored in the MME.2 NSN677-1003, ¶110. Patent Owner argues that “an MM

context” is correct because there is more than one MM context for each mobile

phone stored in the MME, and therefore, it would be unclear which context is “the”

context to be deleted. Ultimately, this disagreement has no relevance here. The prior

art cited by Petitioners disclose the concept under either construction.

2 Both parties agree that there is also an MM context stored in the mobile

phone. However, both parties agree that neither proposed construction refers to or

requires a deletion of an MM context that is stored in the mobile phone itself.

Thus, the dispute over “an” or “the” does not implicate this MM context.

- 36 -

However, Petitioners’ proposed construction is nevertheless correct. First, a

POSITA would have understood that there is only one MM context stored in the

MME for each mobile phone, and it contains the relevant attributes of the mobile

phone. NSN677-1003, ¶110. Moreover, the 3GPP specifications explicitly state

there is only one MM context per mobile phone: “There can be only one MM context

per UE/MS [i.e., mobile phone] at a time . . . .” NSN677-1014, § 5.2.1.2, at 20. This

single MM context is the MM context that the inventors are referring to in the ’677

Patent and is the MM context to be deleted. NSN677-1003, ¶110.

Second, the Petitioners construe the term in the same way that the ’677 Patent

defines the term. Indeed, when the ’677 Patent describes deleting an/the MM

context, the patent specification uses Petitioners’ proposed construction of “the MM

context” seventy times. See, e.g., NSN677-1001, at 18:47-49 (“In step 710, if the

MME finds that the default bearer of the UE is deleted, the MME deletes the MM

context of the UE (that is, the MME detaches the UE from the 3GPP network).”);

see also NSN677-1003, ¶111 (providing a citation to all seventy instances).

However, the ’677 Patent only uses Patent Owner’s proposed construction of “an

MM context” once. NSN677-1001, at 13:29. In other words, Patent Owner cherry-

picks one example from the ’677 Patent in an attempt to fundamentally change the

scope and meaning of “MM context” to imply there are multiple MM contexts for a

mobile phone stored in the MME. This is improper.

- 37 -

But again, this specific dispute has no relevance here. The prior art relied on

in the invalidity analysis in this Petition discloses deleting an MM context stored in

the MME at detach, whatever the MM context may mean in the district court

litigation.

Finally, to the extent that this claim is defined by the Board to be broader than

that proposed by both Patent Owner and Petitioners in the district court litigation,

the prior art discloses “detaching,” which would satisfy any construction associated

with that term.

B. The Preamble of Claim 1 is Limiting

The preamble of claim 1 is limiting because the preamble (1) is necessary to

give life, meaning, and vitality to the claims and (2) serves as the antecedent basis

for numerous claim terms. See Deere & Co. v. Bush Hog, LLC, 703 F.3d 1349, 1357

(Fed. Cir. 2012) (holding the preamble to be limiting when it is necessary to give

life, meaning, and vitality to the claim and serves as the antecedent basis for claim

terms).

First, the preamble of claim 1 states that the method for detaching occurs when

a handover from a 3GPP (LTE) network to a non-3GPP (Wi-Fi) network occurs.

NSN677-1001, at cl. 1 (emphasis added). This limitation is a necessary part of the

claim because it was the precise problem the inventors sought to solve: “To sum up,

during researches and applications, the inventor(s) of the present invention finds that

- 38 -

the prior art has at least the following problems: the prior art [does not] provide[] a

specific solution for user detachment when a handover or change occurs in a

heterogeneous network . . . .”3 NSN677-1001, at 3:49-52 (emphasis added). In other

words, the purported invention centers on the procedure for handover from 3GPP to

non-3GPP networks.

This concept is so fundamental to the purported invention that it is contained

in the title of the ’677 Patent: “Method, System, and Device for User Detachment

when a Handover or Change Occurs in Heterogeneous Network.” NSN677-1001, at

[54]. This concept is described as the “present invention” as well: “The present

invention relates to the network communication technology and more particular to a

method, system, and device for user detachment when a handover or change occurs

in a heterogeneous network.” Id. at 1:21-24 (emphasis added). The first sentence of

the abstract also confirms the purported invention takes place when a handover

occurs: “A method for user detachment when a handover or change occurs in a

heterogeneous network is provided.” Id. at [57] (emphasis added). Where the

inventors describe a claim limitation as the “present invention,” use the claim

3 A person having ordinary skill in the art would have understood that when

the ’677 Patent says a “heterogeneous network,” it means a network of two

different types, i.e., 3GPP (LTE) and non-3GPP (Wi-Fi). NSN677-1003 ¶115.

- 39 -

limitation in the title, describe it as the problem to be solved, and confirm the claim

limitation in the abstract, the claim limitation is necessary to provide meaning to the

claims. See Deere & Co. v. Bush Hog, LLC, 703 F.3d 1349, 1358 (Fed. Cir. 2012)

(holding the preamble limiting when the term in the preamble “describes a

fundamental characteristic of the claimed invention” (internal quotations omitted));

id. (holding the preamble limiting when the title refers to the claim term and the

specification refers to the claim limitation as the “present invention”).

Second, if further proof was necessary, the preamble also serves as an

antecedent basis for numerous terms, including “user equipment (UE),” “3GPP

network,” and “non-3GPP network.” Catalina Mktg. Int'l, Inc. v. Coolsavings.com,

Inc., 289 F.3d 801, 808 (Fed. Cir. 2002) (“[D]ependence on a particular disputed

preamble phrase for antecedent basis may limit claim scope because it indicates a

reliance on both the preamble and claim body to define the claimed invention.”).

For both these reasons, the preamble of claim 1 is limiting.

IX. PRIOR ART REFERENCES

The ’677 Patent claims priority to a foreign patent application (described

above), filed on August 7, 2007, and a PCT application, filed on July 31, 2008. Thus,

for the ’677 Patent, this Petition assumes that the earliest effective priority date is

August 7, 2007, and the earliest U.S. effective filing date is July 31, 2008. 35 U.S.C.

§ 365(c); MPEP § 211.01(c). Thus, assuming that the prior filings actually support

- 40 -

the current claims, any art published before August 7, 2007, is prior art under

§ 102(a), and any art published before July 31, 2007, is prior art under § 102(b). 35

U.S.C. § 102 (pre-AIA).

As described in the declaration of Balazs Bertenyi (NSN677-1004), each

3GPP reference cited by Petitioners was available on the 3GPP website as of the

date and (if available) time indicated in the table provided at the beginning of this

petition. See NSN677-1011, at 8 (“When the secretary copies from the meeting

server[,] . . . the files on the public server, . . . will now get an upload date/time-

stamp of the new upload.”); id. at 9 (“[T]he time stamp of the Zip file can be relied

upon to indicate when the upload occurred.”); NSN677-1010, at 3 (“3GPP has

always operated 100% electronic (0% paper) as far as contribution documents are

concerned. Documents are not deleted following the meeting, but are retained on the

public server indefinitely.”); see also NSN677-1004, ¶¶13-24. Mr. Bertenyi’s

declaration establishes the public storage and availability of each 3GPP document,

and describes in detail how a member of the public would access such documents,

including through searches using readily available search engines like Google.

NSN677-1004, ¶¶13-24.

In particular, by navigating 3GPP’s public website and accessing the provided

hyperlinks (provided in the exhibit list at the beginning of this petition), or by

executing a simple Google search, a member of the public could have downloaded

- 41 -

each of the references without restriction. See NSN677-1004, ¶¶13-32; see also LG

Elecs. v. Core Wireless Licensing S.A.R.L., IPR2015-01988, Paper 7, at 12-14

(PTAB Apr. 1, 2016) (instituting IPR based on prior art that included 3GPP draft

specifications and proposals).

Second, Petitioners rely on the ’677 Admitted Prior Art (the ’677 APA)

contained within the specification of the ’677 Patent. Specifically, the following

portions of the ’677 Patent specification are admitted prior art: 1:30-48 (describing

figure 1), 2:3-51 (describing figure 2), 4:61-65 (describing the prior art figures), and

figures 1-2.4

A. The CATT Submission (NSN677-1006)

The CATT Submission is a contribution to 3GPP Working Group SA-2 for

meeting #58 that took place in Orlando, Florida from June 25, 2007, to June 29,

4 See, e.g., NSN677-1001, at 2:3-6 (“FIG. 2 is a flow chart of a process that

the UE is handed over or switched from a 3GPP network to a non-3GPP network

in the prior art. The process includes the following steps.”); id. at 4:61-65 (“FIG. 1

is a schematic structural view of an evolution network system for a 3GPP network

in the prior art; FIG. 2 is a flow chart of a process that the UE is handed over or

switched from a 3GPP network to a non-3GPP network in the prior art);

- 42 -

2007. The CATT Submission was publicly available at least as early as June 19,

2007 at 12:17 PM. NSN677-1004, ¶29.

The CATT Submission discloses a delete bearer request message containing

a “cause” information element that indicates handover from a 3GPP base station to

a Wi-Fi access point. NSN677-1006, at 4. Further, a person having ordinary skill in

the art would have understood that the CATT Submission discloses the message

flows of a PDN GW-initiated detach procedure. NSN677-1003, ¶123. Although the

CATT Submission discloses a detaching solution, the CATT Submission does not

disclose the specific detaching solution contemplated by both parties in the co-

pending district court litigation (i.e., deleting an/the MM context).

The CATT Submission was neither disclosed nor considered during the

original prosecution of the ’677 Patent.

B. TS 23.401 V1.1.0 (NSN677-1007)

TS 23.401 discloses the specific detach solutions that were contemplated at

the time of the ’677 Patent. TS 23.401 was publicly available at least as early as July

16, 2007. NSN677-1004, ¶30.

Specifically, TS 23.401 discloses an HSS-initiated detach procedure.

NSN677-1007, § 5.3.9.3, at 46. TS 23.401 also discloses that it was for further

studies (FFS) whether the PDN GW could initiate a detach procedure (like that

proposed by CATT). Id. § 5.3.9, at 44.

- 43 -

In other words, at the time of the purported invention, the standards body

contemplated that the HSS-initiated detach procedure might be used during

handover from 3GPP (LTE) to non-3GPP (Wi-Fi), and discloses (1) the specific

solution of using an information element to indicate this fact and (2) the specific

solution of deleting the MM context of the mobile phone stored in the MME. Id.

§ 5.3.9.3, at 46.

C. The ’677 APA (NSN677-1001)

As discussed above, the ’677 APA discloses the known prior art 3GPP (LTE)

to non-3GPP (Wi-Fi) handover procedure. Figure 2 is admitted to be “a flowchart of

a process that the UE [e.g., mobile phone] is handed over or switched from a 3GPP

[LTE] network to a non-3GPP (Wi-Fi) network in the prior art.” NSN677-1001, at

4:63-65.

- 44 -

NSN677-1001, at Fig. 2.

The ’677 APA discloses every element of every claim except the elements

containing the purported novelty of the ’677 Patent as described above. Specifically,

the elements requiring (1) a cause information element be present in the detach

request message and (2) the specific detach solution of deleting an MM context

stored in the MME.

The PTAB and Federal Circuit have used admissions by the Applicant in the

specification itself as APA in determining the validity of patent claims. See In re

- 45 -

NTP, 654 F.3d 1279, 1289 (Fed. Cir. 2011) (“In the Background Art section, the

patent presents a definition of electronic mail as understood by a person of ordinary

skill in the art . . . . While this statement does not rise to the level of the inventor

acting as its own lexicographer, it does provide insight into the understanding of the

person of ordinary skill in the art at the time of the invention.”) (emphasis added);

id. at 1298 (“[O]ur construction of “electronic mail [message]” is irrelevant to this

basis for rejection because the []APA is the “Background Art” of the subject

specifications that includes the four-item description of electronic mail. Further, the

[]APA clearly teaches the other limitations of the claim with the exception of the RF

network.”). PharmaStem Therapeutics, Inc. v. ViaCell, Inc., 491 F.3d 1342, 1362

(Fed. Cir. 2007) (“Admissions in the specification regarding the prior art are binding

on the patentee for purposes of a later inquiry into obviousness.”); Tokyo Keiso Co.,

v. SMC Corp., 307 F. App’x 446, 452-53 (Fed. Cir. 2009) (“We also agree with SMC

that one of ordinary skill in the art would have been motivated to combine the

disclosure of Lynnworth with the admitted prior art described in the ’004 patent.”);

Constant v. Advanced Micro-Devices, Inc., 848 F.2d 1560, 1569-70 (Fed. Cir. 1988)

(“Appellant conceded in the specification of the [patent-in-suit] that everything

described in the patent was prior art technology except the use of [one particular

element]. A statement in a patent that something is in the prior art is binding on the

applicant and patentee for determinations of anticipation and obviousness.”)

- 46 -

X. OVERVIEW OF INVALIDITY ANALYSIS

Below is a summary table showing where each element of each claim can be

found in the prior art references. Claim elements with common limitations are

grouped together in the detailed invalidity analysis.

Claim Count 1 Count 2

1. [1preamble] A method for detaching a user

equipment (UE) when a handover from a 3rd

generation partnership project (3GPP) network to a

non-3GPP network occurs, comprising:

CATT

Submission

’677 APA

[1a] receiving, by a mobility management entity

(MME) of the 3GPP network, a delete bearer request

sent by a serving gateway (GW) of the 3GPP network

which carries a cause information element (IE),

CATT

Submission

TS 23.401

[1b] wherein the cause IE indicates the UE handovers

from the 3GPP network to the non-3GPP network;

CAT

Submission

TS 23.401

[1c] deleting, by the MME, bearer resources of the

UE;

CATT

Submission

’677 APA

[1d] detaching, by the MME, the UE from the 3GPP

network when all the bearer resources of the UE are

deleted.

TS 23.401 TS 23.401

2. [2preamble] The method according to claim 1, CATT ’677 APA

[2a] wherein the cause IE is set to “UE’s accessing

RAT changed from a 3GPP network to a non-3GPP

network”.

TS 23.401 TS 23.401

- 47 -


3. [3preamble] The method according to claim 2,

further comprising:

CATT

Submission

’677 APA

[3a] setting, by a packet data network gateway (PDN

GW), the cause IE to “UE’s accessing RAT changed

from a 3GPP network to a non-3GPP network”;

TS 23.401 TS 23.401

[3b] sending, by the PDN GW, the delete bearer

request message carrying the cause IE to the serving

GW; and

CATT

Submission

TS 23.401

[3c] sending, by the serving GW, the delete bearer

request message carrying the cause IE to the MME.

CATT

Submission

TS 23.401

8. [8preamble] A mobility management entity,

configured to:

CATT

Submission

’677 APA

[8a] receive a delete bearer request sent by a serving

gateway (GW) of a 3GPP network when a handover

from the 3GPP network to a non-3GPP network

occurs,

CATT

Submission

’677 APA

[8b] wherein the delete bearer request carries a cause

information element (IE) which indicates a user

equipment handovers from the 3GPP network to the

non-3GPP network;

CATT

Submission

TS 23.401

[8c] delete bearer resources of the user equipment;

and

CATT

Submission

’677 APA

[8d] detach the UE from the 3GPP network when all

the bearer resources of the UE are deleted.

TS 23.401 TS 23.401

- 48 -


9. [9preamble] The mobility management entity

according to claim 8,

CATT

Submission

’677 APA

[9a] wherein the cause IE is set to “UE’s accessing


network”.

TS 23.401 TS 23.401

10. [10preamble] The mobility management entity

according to claim 9,

CATT

Submission

’677 APA

[10a] wherein the delete bearer request is sent from a

packet data network gateway to the mobility

management entity via the serving gateway,

CATT

Submission

’677 APA

[10b] wherein the cause IE is set to “UE’s accessing


network” by the packet data network gateway.

TS 23.401 TS 23.401

XI. INVALIDITY OF CLAIMS 1-3 AND 8-10 OF THE ’677 PATENT

A. Count 1: Claims 1-3 and 8-10 are unpatentable under 35 U.S.C.

§ 103(a) over the CATT Submission in light of TS 23.401

Motivation to Combine

A person of ordinary skill in the art would have been motivated to combine

the CATT Submission with TS 23.401. NSN677-1003, ¶139. Both the CATT

Submission and TS 23.401 deal with the non-3GPP handover procedure and the

resulting detaching process. Id.

- 49 -

A POSITA would have looked to TS 23.401 to determine the baseline

infrastructure and instructions for various detach processes. NSN677-1003, ¶140.

However, TS 23.401 explicitly identified that the then-current detach procedures

“need to be updated” to “cover the case that detach is required because the UE

[mobile phone] is attached to a non-3GPP” access point. NSN677-1007, § 5.3.9, at

44. The CATT Submission provided the foundational aspects of that update.

NSN677-1003, ¶140. Specifically, the CATT Submission, in its disclosure to the

same working group responsible for updating TS 23.401, noted that its solution

describes “EPS bearer release procedure during handover from 3GPP to non 3GPP.”

NSN677-1006, at 1. In other words, the CATT Submission, by disclosing the PDN

GW-initiated detach procedure, provided large swaths of the update needed to cover

the use case that TS 23.401 explicitly stated was needed. NSN677-1003, ¶140.

Thus, a person having ordinary skill in the art would have a reasonable

expectation of success implementing the CATT Submission along with the minor,

already-agreed-upon details for non-3GPP handover contained in TS 23.401;

specifically, (1) the specific detaching solution of deleting the MM context, (2) the

specific information element to alert the MME to the reason for the detach, and (3)

the specific contents of that information element. NSN677-1003, ¶141.

Further, such an ordinarily skilled person would have found it a predictable

and common sense implementation to use the specific solutions already associated

- 50 -

with non-3GPP handover in TS 23.401 with the message flow outlined in the CATT

Submission. NSN677-1003, ¶142. TS 23.401 taught—in the same detach procedure

the standards-body thought would be used for non-3GPP handover—the ideas of (1)

the specific solution of deleting the MM context during detach, (2) the information

element indicating the cause of the detach to the MME, and (3) the specific contents

of that information element. NSN677-1007, § 5.3.9.3, at 46. Thus, a person having

ordinary skill in the art would have a reasonable expectation of success in

implementing these known ideas in the CATT Submission to achieve a similar

result. NSN677-1003, ¶142.

Finally, one of ordinary skill in the art at the time of the alleged invention

would have been motivated to include the step of deleting the MM context in the

detach solution because doing so is one of a finite number of identified, predictable

solutions to the problem posed by TS 23.401; namely that no current detach

procedure covered the use case associated with non-3GPP access points. NSN677-

1007, § 5.3.9, at 44; NSN677-1003, ¶143. An MM context can either be “deleted”

or “not deleted” during a detach procedure. Id. Given that the HSS-initiated detach

procedure from TS 23.401 taught the “deleting” option, and further given that the

HSS-initiated detach procedure directly associated the “deleting” option with the

non-3GPP handover process, a person having ordinary skill in the art would have a

- 51 -

reasonable expectation of success by choosing the “delete” option. NSN677-1003,

¶143; NSN677-1007, § 5.3.9.3, at 46.

1preamble: A method for detaching a user equipment (UE) when a handover

from a 3rd generation partnership project (3GPP) network to a non-3GPP

network occurs, comprising:

2preamble: The method according to claim 1,

3preamble: The method according to claim 2, further comprising:

To the extent 1preamble, 2preamble, and 3preamble are limiting, these claim

elements are disclosed by the CATT Submission. For example, the title of the CATT

Submission is “EPS bearer release procedure during handover from 3GPP to non

3GPP.” NSN677-1006, at 1 (emphasis added). Thus, a person having ordinary skill

in the art would have understood that an EPS bearer release procedure involves the

steps associated with a detach procedure that occurs when a handover from 3GPP

(LTE) to non-3GPP (Wi-Fi) occurs. NSN677-1003, ¶150. Thus, a person of ordinary

skill in the art would have understood that the CATT Submission shows a method

for detaching:

- 52 -

NSN677-1006, at Fig. 1.

Thus, the CATT Submission discloses claim limitations 1preamble,

2preamble, and 3preamble.

8preamble: A mobility management entity, configured to:

9preamble: The mobility management entity according to claim 8,


To the extent the preambles are limiting, the CATT Submission discloses a

mobility management entity. A POSITA would have understood that “mobility

management entity” is abbreviated “MME,” and that CATT discloses the use of an

MME (see blue box in figure below). NSN677-1003, ¶153.

- 53 -

NSN677-1006, at Fig. 1 (blue box added).

Thus, the CATT Submission discloses the claim elements of claim limitations

8preamble and 10preamble.

1a: receiving, by a mobility management entity (MME) of the 3GPP network,

a delete bearer request sent by a serving gateway (GW) of the 3GPP network


8a: receive a delete bearer request sent by a serving gateway (GW) of a 3GPP

network when a handover from the 3GPP network to a non-3GPP network

occurs,

3b: sending, by the PDN GW, the delete bearer request message carrying the

cause IE to the serving GW; and

3c: sending, by the serving GW, the delete bearer request message carrying

the cause IE to the MME.

- 54 -

10a: wherein the delete bearer request is sent from a packet data network

gateway to the mobility management entity via the serving gateway,

The CATT Submission discloses claim limitations 1a, 8a, 3b, 3c, and 10a.

For example, Step 4 of the message flow diagram in Figure 1 from the

CATT Submission shows a delete bearer request message (1) sent by a PDN GW

to the Serving GW, (2) received by the Serving GW, (3) sent by the Serving GW to

the MME, and (3) received by the MME. NSN677-1003, ¶156.


- 55 -

In the corresponding description of the message flow diagram, the CATT

Submission discloses that the Delete EPS Bearer Request carries a “cause”

information element:

4. PDN GW has discovered that UE has attached to non 3GPP system,

then PDN GW checks the EPS bearer associated with UE in 3GPP

system, and if there are bearers for UE in 3GPP system, then PDN GW

sends the Delete EPS Bearer Request ( cause )to serving GW and

serving GW sends this message to MME.

NSN677-1006, at 2 (emphasis added).

A person having ordinary skill in the art would have understood the common

technical means of adding a “cause” information element in messages to represent

the cause value of those messages. NSN677-1003, ¶159. Illustrating the common

understanding of the “cause” language, the Chinese Patent Office rejected the claims

in a counterpart application by stating, “[I]n the mobile communication field, a

‘cause’ IE is added in some messages to represent the cause value of a certain

operation, which is a common technical means.” NSN677-1002, at 258–59.

But further, if there is any doubt, the 3GPP standards routinely portray

information elements using the format used by the CATT Submission. NSN677-

1003, ¶158. A POSITA would have understood that elements disclosed in

parentheses after a disclosed message indicate the presence of an information

element. Id. Indeed, the TS 23.401 specification uses the same format in the

- 56 -

corresponding Cancel Location message: “the HSS shall send a Cancel Location

(IMSI, Cancellation Type) message to the MME.” NSN677-1007, § 5.3.9.3, at 47.

Another section of the standard shows a table with the heading “IE name”—or

information element name. NSN677-1014, § 4.4, at 21. Under that heading, the table

lists both IMSI and Cancellation Type as IEs that are a part of a Cancel Location

message. Id. As another example, the S1 Release Request from TS 23.401 follows

the same format: “S1 Release Request (Cause) message to the MME. Cause

indicates the reason for the release . . . .” NSN677-1007, § 5.3.5, at 42.

Thus, every element of limitation 1a, 8a, 3b, 3c, and 10a was in the prior art

before the time of the ’677 Patent.

1b: wherein the cause IE indicates the UE handovers from the 3GPP network

to the non-3GPP network

8b: wherein the delete bearer request carries a cause information element

(IE) which indicates a user equipment handovers from the 3GPP network to

the non-3GPP network

The CATT Submission discloses claim elements 1b and 8b. A person having

ordinary skill in the art would have understood that the “cause” information element

in the CATT Submission indicates that the mobile phone is handing over from the

3GPP network to the non-3GPP network. NSN677-1003, ¶161.

A POSITA would have understood that the entire point of the CATT

Submission is to meet the “requirement of service continuity” during handover from

- 57 -

3GPP to non-3GPP. NSN677-1006, at 1; NSN677-1003, ¶162. To meet the

“requirement of service continuity,” the “IP address of the UE shall be unchanged

after handover from 3GPP to non 3GPP.” NSN677-1006, at 1. In other words, a

person having ordinary skill in the art would have understood that the MME needs

to know whether to release the IP address or not during a detach procedure. NSN677-

1003, ¶162. If the mobile phone is still connected to the network through a Wi-Fi

access point, the MME needs to know to keep the IP address “unchanged.” NSN677-

1003, ¶162. This requirement is stated in the CATT Submission, and a PHOSITA

would have understood the “cause” information element is the solution proposed to

meet that requirement. NSN677-1003, ¶162. To the extent the “cause” information

element in the CATT Submission could imply something other than handover, TS

23.401 also discloses the need for such an information element. NSN677-1007,

§ 5.3.9.3, at 46. Thus, at minimum, it would have been obvious to a person of

ordinary skill in the art to use the pre-existing “cause” information element disclosed

in the CATT Submission for the purposes of handover for the same reasons as

discussed above. NSN677-1003, ¶162.

As noted, TS 23.401 discloses a variety of information elements, such as an

information element called “Cancellation Type” that indicates handover from 3GPP

(LTE) to non-3GPP (Wi-Fi) and discloses the same reason the information element

is necessary:

- 58 -

It is FFS, If the Cancellation type is set to “implicit detach because of

UE[’s] accessing RAT changed from 3GPP to Non-3GPP”, after the

PDN deletes the EPS Bearer, the PDN GW should not release the UE’s

PDP address of the Bearer. If the Cancellation type is set to

“Subscription Withdrawn”, after the PDN deletes the EPS Bearer, the

PDN GW should release the UE’s PDP address of the Bearer and assign

the PDP address to other UE.

NSN677-1007, § 5.3.9.3 (emphasis added).

Thus, TS 23.401 confirms that a potential problem during handover from

3GPP to non-3GPP is that the IP addresses might change and that the information

element solves this problem. NSN677-1003, ¶164.

As a result, the CATT Submission discloses elements 1b and 8b. To the extent

the Patent Owner argues otherwise, TS 23.401 certainly discloses elements 1b and

8b as well.

2a: wherein the cause IE is set to “UE’s accessing RAT changed from a 3GPP

network to a non-3GPP network”.

3a: setting, by a packet data network gateway (PDN GW), the cause IE to

“UE’s accessing RAT changed from a 3GPP network to a non-3GPP

network”;



10b: “wherein the cause IE is set to ‘UE’s accessing RAT changed from a

3GPP network to a non-3GPP network’ by the packet data network gateway.”

- 59 -

The CATT Submission discloses a “cause” information element as described

above. TS 23.401 discloses the contents of that information element: “UE’s

accessing RAT changed from 3GPP to Non-3GPP.” NSN677-1007, § 5.3.9.3, at 46.

A PHOSITA would understand that the known information element in the CATT

Submission would contain the language used in TS 23.401. NSN677-1003, ¶167.

The Patent Owner capitalized on the fact that the 3GPP standards body had already

decided what the information element indicating non-3GPP to 3GPP handover

would say. Therefore, the Patent Owner merely ported that language from TS 23.401

into the ’677 Patent disclosure. Id. Copying this language would be well within the

capability of a person with ordinary skill in the art. Id.

Further, a person having ordinary skill in the art would have understood that

the network entity sending the message would also be the network entity setting the

values of the information element in the message. NSN677-1007 ¶168. In the HSS-

initiated procedure, the HSS would set the value, but it would be common sense to

a POSITA that the PDN GW would set the value in a PDN GW-initiated procedure.

Id.

Thus, claim limitations 2a, 3a, 9a, and 10b are disclosed by TS 23.401.

- 60 -

1c: deleting, by the MME, bearer resources of the UE;

8c: delete bearer resources of the user equipment; and

The CATT Submission discloses claim elements 1c and 8c. For example, step

4 and step 5 of the message flow diagram discloses this claim limitation:


Further, the corresponding description for steps 4 and 5 make clear that the

MME receives the request to delete the EPS bearer, which a POSITA would have

understood is a bearer that runs along the wired connection between the eNB and the

PDN GW. NSN677-1003, ¶171. A POSITA would have understood that once the

MME receives the request to delete the EPS bearer, the MME executes that request

- 61 -

and deletes the EPS bearer. Id. Further, the corresponding description for step 5

states, “5. All of radio access bearers between MME and eNodeB shall be released.

MME sends Delete Bearer Request message to eNodeB.” NSN677-1006, at 2. Thus,

a person having ordinary skill in the art would have understood that the MME can

also delete the radio access bearers (the wireless radio bearer between the UE and

eNB) by sending a request to the eNB. NSN677-1003, ¶171.

Thus, the CATT Submission discloses elements 1c and 8c.

1d: detaching, by the MME, the UE from the 3GPP network when all the

bearer resources of the UE are deleted.

8d: detach the UE from the 3GPP network when all the bearer resources of

the UE are deleted.

Although the CATT Submission discloses a detaching solution (i.e.,

disconnecting the all the radio and EPS bearers), the CATT Submission does not

disclose the specific detaching solution contemplated by the ’677 Patent (and

proposed by both parties in the co-pending district court litigation). NSN677-1006,

at 1. However, TS 23.401 discloses detaching, by the MME, the UE from the 3GPP

network when all bearer resources of the UE are deleted (by deleting an/the MM

context stored in the MME). NSN677-1003, ¶173.

More particularly, it would be common sense for a POSITA to implement this

specific detach solution disclosed by the HSS-initiated detach procedure from TS

23.401 because, at the time, the standards body contemplated that procedure might

- 62 -

be used for 3GPP (LTE) to non-3GPP (Wi-Fi) handover. NSN677-1003, § 5.3.9.3,

at 46 (“It is FFS, if the HSS initiates a detach procedure to update the subscriber’s

MM context at the MME and to delete the EPS bearer because that the UE ‘s

accessing RAT is changed from 3GPP to Non-3GPP.”) Specifically, Step 1 of the

HSS-initiated detach procedure states, “If the HSS wants to request the immediate

deletion of a subscriber’s MM contexts5 and EPS Bearers, the HSS shall send a

Cancel Location (IMSI, Cancellation Type) message to the MME . . . .” NSN677-

1007, § 5.3.9.3, at 46 (emphasis added). Further, step 9 confirms the deletion of the

MM context stored in the MME. Id. at 47.

A person having ordinary skill in the art would have understood that the MM

context stored in the MME is deleted when all the bearer resources of the mobile

phone (UE) are deleted. NSN677-1003, ¶174. More specifically, a POSITA would

have understood that the MM context stored in the MME contains numerous fields

with attributes about the mobile phone, and that information is still being used by

the network up and until all the bearer resources have been released. Id. Therefore,

5 Although TS 23.401 refers to MM contexts (plural), the Petitioners do not

dispute that there is a second MM context—one stored at the mobile phone. But

both parties have agreed that only an/the MM context stored in the MME is at issue

in these claims. Id.

- 63 -

a person of ordinary skill in the art would have understood that the MM context

stored in the MME must be deleted when the EPS bearer is released, not before. Id.

Thus, all claim elements of limitations 1d and 8d are disclosed in the prior art.

B. Count 2: Claims 1-3 and 8-10 are unpatentable under 35 U.S.C.

§ 103(a) over the ’677 APA in light of TS 23.401

Motivation to Combine

A person of ordinary skill in the art would have been motivated to combine

the ’677 APA with TS 23.401. NSN677-1003, ¶197. Both the ’677 APA and TS

23.401 deal with non-3GPP handover procedure and the resulting detach process.

Id.

A POSITA would have looked to TS 23.401 to determine the baseline

infrastructure and instructions for various detach processes. Id. ¶198. TS 23.401

explicitly identified that the then-current detach procedures “need to be updated” to

“cover the case that detach is required because the UE [mobile phone] is attached to

a non-3GPP” access point. NSN677-1007, § 5.3.9, at 44. With knowledge of the

’677 APA—which covers a large portion of the update needed to cover the specific

use case that was needed—a person having ordinary skill in the art would have had

a reasonable expectation of success implementing the minor, already-agreed-upon

details for non-3GPP handover already contained and associated with the non-3GPP

handover procedure in TS 23.401. NSN677-1003, ¶198. Specifically, a PHOSITA

- 64 -

would have a reasonable expectation of successfully implementing (1) the specific

detaching solution of deleting the MM context, (2) the information element to alert

the MME to the reason for the detach, and (3) the specific contents of that

information element. Id.; NSN677-1007, § 5.3.9.3, at 46.

Further, such an ordinarily skilled person would have found it a predictable

and common sense implementation to use the specific solutions already associated

with non-3GPP handover in TS 23.401 with the message flow outlined in the ’677

APA. NSN677-1003, ¶199. TS 23.401 taught—in the same procedure that the

standards-body thought would be used for non-3GPP handover—the ideas of (1) the

specific solution of deleting the MM context during detach, (2) the specific solution

of including an information element containing the cause of the detach, and (3) the

specific contents of that information element. NSN677-1007, § 5.3.9.3, at 46. Thus,

a person having ordinary skill in the art would have had a reasonable expectation of

success in implementing these known ideas in the ’677 APA to achieve a similar

result. NSN677-1003, ¶199.

Finally, one of ordinary skill in the art at the time of the alleged invention

would have been motivated to include the step of deleting the MM context in the

detach solution disclosed in the ’677 APA because doing so is one of a finite number

of identified, predictable solutions to the problem posed by TS 23.401; namely, that

the detach procedures need to be updated to cover the use case associated with non-

- 65 -

3GPP access points. NSN677-1007, § 5.3.9, at 44; NSN677-1003, ¶200. The MM

context can either be “deleted” or “not deleted” during a detach procedure. Id. The

HSS-initiated process from TS 23.401 taught the idea that the MM context should

be “deleted” and associated that idea with the non-3GPP handover process.

NSN677-1007, § 5.3.9.3, at 46. Thus, a person having ordinary skill in the art would

have a reasonable expectation of success in implementing the idea in the known prior

art. NSN677-1003, ¶200.

1preamble: A method for detaching a user equipment (UE) when a handover

from a 3rd generation partnership project (3GPP) network to a non-3GPP

network occurs, comprising:

2preamble: The method according to claim 1,

3preamble: The method according to claim 2, further comprising:

To the extent the preambles are limiting, claim elements 1preamble,

2preamble, and 3preamble are admitted prior art. For example, the ’677 APA states

that “FIG. 2 is a flow chart of a process that the UE is handed over or switched from

a 3GPP network to a non-3GPP network in the prior art.” NSN677-1001, at 2:3-6

(emphasis added). Figure 2 is reproduced below:

- 66 -

NSN677-1001, at Fig. 2.

A POSITA would have understood the corresponding steps in Figure 2 to be a

method—although not the specific method proposed by the ’677 Patent—for

detaching the user when handover from LTE (3GPP) to Wi-Fi (non-3GPP) occurs.

NSN677-1003, ¶¶205-206. Thus, claim elements 1preamble, 2preamble, and

3preamble were admitted prior art.

8preamble: A mobility management entity, configured to:



- 67 -

To the extent the preambles are limiting, the ’677 APA discloses claim

elements 8preamble, 9preamble, and 10preamble.

A person of ordinary skill in the art would have understood that a mobility

management entity is abbreviated MME and that the ’677 APA discloses an MME.

Further, the ’677 APA discloses, in describing prior art Figure 1, “a mobility

management entity (MME), for mobility management of a control plane, including

management of a user context and a mobility state and allocation of temporary user

identities.” NSN677-1001, at 1:35-38.

1a: receiving, by a mobility management entity (MME) of the 3GPP network,

a delete bearer request sent by a serving gateway (GW) of the 3GPP network


8a: receive a delete bearer request sent by a serving gateway (GW) of a 3GPP

network when a handover from the 3GPP network to a non-3GPP network

occurs,

3b: sending, by the PDN GW, the delete bearer request message carrying the

cause IE to the serving GW; and

3c: sending, by the serving GW, the delete bearer request message carrying

the cause IE to the MME.

10a: wherein the delete bearer request is sent from a packet data network

gateway to the mobility management entity via the serving gateway,

Claim elements 1a, 8a, 3b, 3c, and 10a are admitted prior art. For example,

Figure 2 discloses a message flow diagram that shows a delete bearer request (1)

sent by a PDN GW to the serving GW, (2) received by the serving GW, (3) sent by

the serving GW to the MME, and (4) received by the MME.

- 68 -

NSN677-1001, at Fig. 2 (blue boxes added).

In the corresponding description of the message flow diagram above, the ’677

APA discloses that “the PDN GW sends a delete bearer request message to the

serving GW, and the serving GW sends the delete bearer request message to the

MME.” NSN677-1001, at 2:45-47.

- 69 -

Unlike the CATT Submission, the ’677 APA does not explicitly disclose that

the delete bearer request message would carry a cause information element.

However, a POSITA would have understood that a “cause” information element

added in some messages to represent the cause value of a certain operation is a

common technical means employed in the art. NSN677-1002, at 258-59 (“However,

in the mobile communication field, a ‘cause’ IE is added in some messages to

represent the cause value of a certain operation, which is a common technical

means.”).

Further, the need to inform the MME about the cause of the detach was

known, and the need to implement the cause information element in the delete bearer

request message was obviously the solution. NSN677-1003, ¶215. Indeed, TS

23.401 disclosed that an information element was needed because different events

occur depending on the value of the information element:

If the Cancellation type [information element] is set to “implicit detach

because of UE ‘s accessing RAT changed from 3GPP to Non-3GPP”,

after the PDN deletes the EPS Bearer, the PDN GW should not release

the UE’s PDP address of the Bearer. If the Cancellation type is set to

“Subscription Withdrawn”, after the PDN deletes the EPS Bearer, the

PDN GW should release the UE’s PDP address of the Bearer and assign

the PDP address to other UE.

NSN677-1007, § 5.3.9.3, at 46.

- 70 -

A person having ordinary skill in the art would have understood that there is

no fundamental technical difference between the information element shown in TS

23.401 and a “cause” information element. NSN677-1003, ¶216.

Thus, claim limitations 1a, 3b, 3c, 8a, and 10a are disclosed by the ’677 APA

and TS 23.401.

1b: wherein the cause IE indicates the UE handovers from the 3GPP network

to the non-3GPP network

8b: wherein the delete bearer request carries a cause information element

(IE) which indicates a user equipment handovers from the 3GPP network to

the non-3GPP network

Claim elements 1b and 8b are disclosed in TS 23.401. For example, TS 23.401

contains an information element that indicates that the mobile phone (UE) is handing

over from the 3GPP (LTE) network to the non-3GPP (Wi-Fi) network.

Specifically, TS 23.401 discloses that an information element titled

“Cancellation type,” which could indicate handover, is included when the mobile

phone hands over from 3GPP (LTE) to non-3GPP (Wi-Fi). TS 23.401 also states the

reason why this information element would be necessary (i.e., to keep the address

unchanged):

It is FFS, If the Cancellation type [information element] is set to

“implicit detach because of UE[’s] accessing RAT changed from 3GPP

to Non-3GPP”, after the PDN deletes the EPS Bearer, the PDN GW

should not release the UE’s PDP address of the Bearer. If the

- 71 -

Cancellation type [information element] is set to “Subscription

Withdrawn”, after the PDN deletes the EPS Bearer, the PDN GW

should release the UE’s PDP address of the Bearer and assign the PDP

address to other UE.

NSN677-1007, § 5.3.9.3, at 46 (emphasis added).

A person having ordinary skill in the art would have understood that there is

no fundamental technical difference between the information element shown in TS

23.401 and a “cause” information element claimed in the ’677 Patent. NSN677-

1003, ¶219.

Thus, claim elements 1b and 8b are disclosed by TS 23.401.



3a: setting, by a packet data network gateway (PDN GW), the cause IE to

“UE’s accessing RAT changed from a 3GPP network to a non-3GPP

network”;



10b: “wherein the cause IE is set to ‘UE’s accessing RAT changed from a

3GPP network to a non-3GPP network’ by the packet data network gateway.”

TS 23.401 discloses claim elements 2a, 3a, 9a, and 10b requiring setting

a cause IE to “UE’s accessing RAT changed from a 3GPP network to a non-

3GPP network. Section XI.A, Count 1, 2a, 3a, 9a, and 10b state in detail how

TS 23.401 discloses this claim limitation. Those paragraphs are incorporated

herein. See also NSN677-1007, § 5.3.9.3, at 46; NSN677-1003, ¶¶166-69.

- 72 -

1c: deleting, by the MME, bearer resources of the UE;

8c: delete bearer resources of the user equipment; and

The ’677 APA discloses claim elements 1c and 8c. Simply put, the ’677 APA

states, “[T]he MME deletes bearer resources related to the UE.” NSN677-1001,

2:48-49. The plain language of the Patent Owner’s admission meets this claim

element. See also NSN677-1003, ¶¶226-28. This disclosure squarely meets these

claim elements.

1d: detaching, by the MME, the UE from the 3GPP network when all the

bearer resources of the UE are deleted.

8d: detach the UE from the 3GPP network when all the bearer resources of

the UE are deleted.

TS 23.401 discloses claim elements 1d and 8d requiring detaching, by the

MME, the UE from the 3GPP network when all the bearer resources of the UE are

deleted. Section XI.A, Count 1, 1d and 8d state in detail how TS 23.401 discloses

this claim limitation. See also NSN677-1003, ¶¶173-75; NSN677-1007, § 5.3.9.3, at

46. That disclosure is incorporated herein.

C. The Grounds Are Not Redundant

There is no redundancy in this Petition. It applies references in combination

to complement each other rather than as distinct and separate alternatives. See

Liberty Mutual Ins. Co. v. Progressive Cas. Ins. Co., CBM2012-00003, Paper 7, at

3 (PTAB Oct. 25, 2012).

- 73 -

Although both Counts 1 and 2 rely on TS 23.401, the primary references in

each Count are different non-3GPP to 3GPP handover publications that provide

varying levels of disclosure relevant to the claims of the ’677 Patent. For example,

the CATT Submission provides additional details not discussed or disclosed in the

’677 APA. Specifically, the CATT Submission discloses the use of information

elements to convey information to the network while the ’677 APA does not (despite

this being an obvious solution). Indeed, the CATT Submission helps show the

obviousness of using information elements missing from the ’677 APA. Should the

Board find any redundancy in a ground, the Board should still institute an IPR

because the redundancy would neither “place a significant burden on the Patent

Owner and the Board” nor would it “cause unnecessary delays.” Id. at 2.

XII. CONCLUSION

For the foregoing reasons, Petitioners ask that inter partes review of the ’677

Patent be instituted and that the Challenged Claims be cancelled.

Date: January 20, 2017 By: / S. Benjamin Pleune /

S. Benjamin Pleune (52,421)

CERTIFICATION UNDER 37 C.F.R. § 42.24

Under the provisions of 37 CFR § 42.24, the undersigned hereby certifies that

the word count for the foregoing Petition for inter partes review totals 13,491 words,

which is less than the 14,000 allowed under 37 CFR § 42.24(a)(i).



CERTIFICATE OF SERVICE

Pursuant to 37 C.F.R. §§ 42.6(e), 42.105, and the agreement of the parties,

the undersigned hereby certifies service on the Patent Owner of a copy of this

Petition and its respective exhibits via electronic means to counsel for Huawei at

FishServiceList-Huawei/[email protected].



mailto:FishServiceList-Huawei/[email protected]