UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD. ITRON, INC., Petitioner. CERTIFIED MEASUREMENT, LLC, Patent Owner

UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD ITRON, INC., Petitioner v. CERTIFIED MEASUREMENT, LLC, Patent Owner Case: IPR2015- U.S. Patent No. 6,289,453 PETITION FOR INTER PARTES REVIEW UNDER 35 U.S.C. 312 AND 37 C.F.R. 42.104 Mail Stop PATENT BOARD Patent Trial and Appeal Board US Patent and Trademark Office PO Box 1450 Alexandria, Virginia 22313-1450

TABLE OF CONTENTS I. REAL PARTY IN INTEREST UNDER 37 C.F.R. 42.8(b)(1)... 1 II. GROUNDS FOR STANDING UNDER 37 C.F.R. 42.104(a)... 1 III. IDENTIFICATION OF RELATED MATTERS UNDER 37 C.F.R. 42.8(b)(2)... 1 IV. DESIGNATION OF COUNSEL UNDER 37 C.F.R. 42.8(b)(3) and 42.10(a)-(b)... 2 V. SERVICE INFORMATION UNDER 37 C.F.R. 42.8(b)(4)... 2 VI. OVERVIEW OF CHALLENGE AND RELIEF REQUESTED... 2 a. Prior Art Patents and Printed Publications... 2 b. Grounds for Challenge... 4 VII. BACKGROUND OF THE 453 PATENT... 4 a. Overview of the 453 Patent... 4 b. Prosecution History of the 453 Patent... 5 VIII. CLAIM CONSTRUCTION... 7 a. Certifiable Measurement... 8 b. Cryptographic Operation... 10 IX. HOW THE CHALLENGED CLAIM IS UNPATENTABLE... 11 a. Count 1: The Challenged Claim Is Rendered Obvious by Johnson in View of Hershey... 11 i

1. Claim 43...13 b. Count 2: The Challenged Claim Is Rendered Obvious by Simmons in View of Peterson... 19 1. Claim 43...21 c. Count 1 and Count 2 Are Not Redundant... 26 d. Combined Claim Chart... 27 X. CONCLUSION... 28 ii

TABLE OF AUTHORITIES STATUTES Page(s) 35 U.S.C. 102(b)... 3 35 U.S.C. 102(e)... 2 35 U.S.C. 103(a)... 4 35 U.S.C. 112... 5 35 U.S.C. 301(a)(2)... 8 OTHER AUTHORITIES 37 C.F.R. 42.8(b)(1)... 1 37 C.F.R. 42.8(b)(2)... 1 37 C.F.R. 42.8(b)(3)... 2 37 C.F.R. 42.8(b)(4)... 2 37 C.F.R. 42.10(a)-(b)... 2 37 C.F.R. 42.22(a)(1)... 2 37 C.F.R. 42.100(b)... 7 37 C.F.R. 42.104(a)... 1 37 C.F.R. 42.104(b)(1)-(2)... 2 77 Fed. Reg. 48,756, 48,764 (Aug. 14, 2012)... 7 77 Fed. Reg. 48,756, 48,766 (Aug. 14, 2012)... 7 iii

LIST OF EXHIBITS Exhibit Description 1001 U.S. Patent No. 6,289,453 (Patent at Issue) 1002 Prosecution History of U.S. Patent No. 6,289,453 1003 U.S. Patent No. 5,673,252 to Johnson et al. 1004 U.S. Patent No. 5,239,584 to Hershey et al. 1005 Simmons, Gustavus J. "How to insure that data acquired to verify treaty compliance are trustworthy." Proceedings of the IEEE 76.5 (1988): 621-627 1006 OFR 82-703: Design Concepts for a Global Telemetered Seismograph Network, Peterson, Jon, Nicholas A. Orsini, 1982. 1007 Patent Owner s Infringement Contentions 1008 U.S. Congress, Office of Technology Assessment, Seismic Verification of Nuclear Testing Treaties, OTA-ISC-361 (Washington, DC: U.S. Government Printing Office, May 1988) 1009 Declaration of John Hershey 1010 Prosecution History of U.S. Patent No. 5,828,751 1011 Prosecution History of U.S. Patent Application No. 10/303,602 (Part 1) 1012 Prosecution History of U.S. Patent Application No. 10/303,602 (Part 2) iv

I. REAL PARTY IN INTEREST UNDER 37 C.F.R. 42.8(b)(1) The real party in interest for Petitioner is Itron, Inc. II. GROUNDS FOR STANDING UNDER 37 C.F.R. 42.104(a) Petitioner certifies that U.S. Patent No. 6,289,453 ( the 453 patent ) is available for inter partes review ( IPR ) and that Petitioner is not barred or estopped from requesting an IPR challenging Claim 43 ( the Challenged Claim ) on the grounds identified herein. III. IDENTIFICATION OF RELATED MATTERS UNDER 37 C.F.R. 42.8(b)(2) The 453 patent is at issue in the following cases: (1) Certified Measurement, LLC v. Centerpoint Energy Houston Electric LLC et al., Case No. 2:14-cv-00627 (E.D. Tex); and (2) Sensus USA, Inc. v. Certified Measurement LLC Case No. 3:14-cv-01069 (D. Conn.). As identified via the Public Patent Application Information Retrieval (Public PAIR) website, the 453 patent is a continuation of U.S. Patent No. 5,828,751 ( the 751 patent ). U.S. Patent Application Nos. 09/706,646 and 10/303,602 claim the benefit of the 453 patent. Of those prior applications, Petitioner is concurrently filing petitions for IPR challenging certain claims of U.S. Patent No. 6,282,648 (App. No. 09/706,646). Petitioner is also concurrently challenging certain claims of the 751 patent and U.S. Patent No. 8,549,310 via IPR. - 1 -

IV. DESIGNATION OF COUNSEL UNDER 37 C.F.R. 42.8(b)(3) and 42.10(a)-(b) Lead counsel is Kirk T. Bradley (Reg. No. 46,571) and backup counsel is Christopher TL Douglas (Reg. No. 56,950), both of Alston & Bird LLP. Pursuant to 37 C.F.R 42.10(b), Powers of Attorney are being submitted with this Petition. V. SERVICE INFORMATION UNDER 37 C.F.R. 42.8(b)(4) Petitioner consents to electronic service directed to kirk.bradley@alston.com and christopher.douglas@alston.com. VI. OVERVIEW OF CHALLENGE AND RELIEF REQUESTED Pursuant to Rules 42.22(a)(1) and 42.104(b)(1) (2), Petitioner requests cancellation of Claim 43 in the 453 patent. a. Prior Art Patents and Printed Publications Petitioner relies upon the following patents and printed publications: Ex. 1003 U.S. Patent No. 5,673,252 to Johnson et al. ( Johnson ) was filed on May 26, 1995 and issued on September 30, 1997. Johnson is a continuation of 07/247,988, which was filed on May 23, 1994, and further claims the benefit of Application Serial No. 08/451,386, filed December 26, 1991 and having an earliest priority date of February 15, 1990, which is prior art to the earliest filing date claimed by the 453 patent (April 8, 1996). Johnson is therefore available as prior art under at least pre-aia 35 U.S.C. 102(e). Johnson was not considered during - 2 -

the original prosecution of the 453 patent and is not cumulative of any prior art considered by the Examiner. Ex. 1004 U.S. Patent No. 5,239,584 to Hershey et al. ( Hershey ) issued on August 24, 1993, based on Application Serial No. 07/813,637, filed December 26, 1991, which is prior art to the earliest filing date claimed by the 453 patent (April 8, 1996). Hershey is therefore available as prior art under at least pre-aia 35 U.S.C. 102(b). Hershey was not considered during the original prosecution of the 453 patent and is not cumulative of any prior art considered by the Examiner. Ex. 1005 Simmons, Gustavus J., How to insure that data acquired to verify treaty compliance are trustworthy, Proceedings of the IEEE 76.5 (1988), pp. 621-627 ( Simmons ) was published by IEEE in 1988 and is prior art to the earliest filing date claimed by the 453 patent (April 8, 1996). Simmons is available as prior art under at least pre-aia 35 U.S.C. 102(b). A 1983 version of the Simmons article was cited in the original prosecution of the 453 patent, but was not the subject of an Office Action. The Simmons article cited herein is a different article, and is presented in a new light as a ground of rejection herein, especially in light of the Peterson reference and the expert declaration of John Hershey. Ex. 1006 OFR 82-703: Design Concepts for a Global Telemetered Seismograph Network, Peterson, Jon, Nicholas A. Orsini, 1982 ( Peterson ) was - 3 -

published by the United States Department of the Interior Geological Survey in 1982. This document is an open file report meaning that it was available to and accessible by the interested public by way of at least direct order from the USGS Information Services. Peterson was not considered during the original prosecution of the 453 patent and is not cumulative of any prior art considered by the Examiner. b. Grounds for Challenge Petitioner requests cancellation under the following statutory grounds: Count 1: Claim 43 is unpatentable under 35 U.S.C. 103(a) over Johnson in view of Hershey. Count 2: Claim 43 is unpatentable under 35 U.S.C. 103(a) over Simmons in view of Peterson. VII. BACKGROUND OF THE 453 PATENT a. Overview of the 453 Patent The 453 patent is directed to the well-known concept of acquiring and verifying a physical measurement taken by a sensor. 453 patent, Abstract. The 453 patent describes the ubiquitous use of sensors to acquire physical measurements, such as the Automated Surface Observing System developed by the National Weather Service. 453 patent, 1:40-48. In addition to sensors being well known, the 453 patent describes that cryptography is also old and well known. - 4 -

453 patent, 8:31-36. Not only were these concepts described as being known in the 453 patent, but also the inventors described the use of cryptography and sensors to certify or verify documents and, in one example, seismic readings from a nuclear test. Ex. 1009, 25-29. b. Prosecution History of the 453 Patent The application that matured into the 453 patent, U.S. Application No. 09/149,025 ( the 025 application ), was filed on September 8, 1998 with 143 claims. Ex. 1002, pages 22-68. Applicant canceled Claims 2-142 in a preliminary amendment. Ex. 1002, pages 89-90. A non-final action was issued on July 7, 1999, rejecting Claim 1 under non-statutory double patenting in view of U.S. Patent No. 5,828,751. Ex. 1002, pages 122-125. On December 7, 1999, Applicant filed a terminal disclaimer and added new Claims 144-187. Ex. 1002, pages 139-149. In a final action mailed February 1, 2000, the Examiner rejected each of the pending claims under 35 U.S.C. 112, second paragraph, for failing to point out and distinctly claim the subject matter which applicant regarded as the invention. Ex. 1002, pages 154-158. Specifically, the Examiner stated that configured to, adapted to, and certifiable were indefinite and unclear. Ex. 1002, page 156. The Office Action further stated that there is no recitation of measurement means or of measurement steps, so it is unclear how the measurements claimed are - 5 -

certifiable when the measurement means and steps are outside of the claimed apparatus or method. Ex. 1002, page 156. In a response, the Applicant argued the claims were definite, arguing that the sensor 8, which was omitted from the originally filed drawing, clarified that the sensor provided a measurement. Ex. 1002, page 171. Applicant further argued that the sensor could measure any physical parameter, the physical parameter can be any physical quantity, and an external signal receiver (e.g., a GPS receiver) could serve as the physical measurement sensor. Ex. 1002, page 171. In a further response, Applicant further argued that the terms configured to and adapted to were clear and definite. Ex. 1002, page 204. The Applicant argued that configured to be resistant to tampering meant being contained within a secure perimeter. Ex. 1002, pages 205-206. Applicant referred to the specification, which notes that the secure perimeter may include physical, electronic, or a combination of physical and electronic features to resist tampering. Id. The Applicant s response further confirmed that the processor may comprise any hardware or software engine capable of performing cryptographic operations and measurement of any physical parameter. Ex. 1002, page 207. The response clarified that time information can be received from any other trusted source. Ex. 1002, page 208. Finally, the response clarified that - 6 -

configured to receive the certifiable measurement refers to the sensor. Ex. 1002, page 210. A first notice of allowance was issued on August 4, 2000. Ex. 1002, pages 212-214. After a request for continued examination, a subsequent notice of allowance was issued on March 20, 2001. Ex. 1002, page 226. On November 25, 2002, Patent Owner filed a reissue application (serial no. 10/303,602), attempting to add additional apparatus claims. The reissue application was abandoned as the Patent Owner failed to respond to an Office Action dated September 28, 2009. At the time of abandonment, Claim 43 stood rejected as being anticipated by Cox, U.S. Patent No. 5,199,068. Ex. 1011, pages 1-10. VIII. CLAIM CONSTRUCTION In an IPR, claim terms in an unexpired patent are interpreted according to their broadest reasonable interpretation ( BRI ) in view of the specification in which they appear. 37 C.F.R. 42.100(b); Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756, 48,766 (Aug. 14, 2012). The USPTO uses BRI because, among other reasons, the patentee has the opportunity to amend its claims in this proceeding. See, e.g., Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756, 48,764 (Aug. 14, 2012) ( Since patent owners have the opportunity to amend their claims during IPR, PGR, and CBM trials, unlike in district court proceedings, they - 7 -

are able to resolve ambiguities and over breadth through this interpretive approach, producing clear and defensible patents at the lowest cost point in the system. ). Thus, as required by the applicable rules, this Petition uses the BRI standard. Petitioner also presents Petitioner s understanding of Patent Owner s infringement contentions in Certified Measurement, LLC v. Centerpoint Energy Houston Electric LLC et al., Case No. 2:14-cv-00627 (E.D. Tex), to prevent the Patent Owner from arguing broad constructions under Phillips while simultaneously arguing narrow constructions under the BRI. 35 U.S.C. 301(a)(2). The infringement contentions are attached as Ex. 1007. a. Certifiable Measurement The claim at issue uses the term certifiable measurement, like the 751 patent. In the 751 patent, the term certifiable measurement was added to the claims in the October 6, 1997 amendment, replacing the term certified measurement. Ex. 1010, pages 172-201. Applicant clarified its interpretation of the phrase certifiable measurement, explaining that the then-claimed certified measurement is more accurately stated as being certifiable because it has not yet been certified. The file history states: [a]ccording to the present invention, the claimed device and method output an encrypted code representing a measurement. The measurement may be certified at a later time by deciphering the encrypted code. Ex. 1010, pages 199-200; Ex. 1009, 34-35. - 8 -

The specification further describes the related term certified measurement in terms of verifiability. 453 patent, Abstract; Ex. 1009, 36. The specification correlates verification to the performance of a cryptographic operation. 453 patent, 4:10-13. The specification confirms that a certified measurement includes at least a portion of ciphertext comprising the (cleartext) augmented measurement and a (ciphertext) one-way function representative of at least a portion of the augmented measurement. 453 patent, 8:2-6. Thus, for a measurement to be certifiable, the measurement must include at least an encrypted or cipher text portion created by a cryptographic operation. Ex. 1009, 37-38. Accordingly, a person of ordinary skill in the art would consider the broadest reasonable interpretation in light of the specification of certified measurement to be: the result of performing a cryptographic operation on at least a portion of an augmented measurement, to be certified at a later time. Ex. 1009, 38. The construction incorporates the term augmented measurement. This term, as used in the 453 patent and in the construction of certifiable measurement, is described in the individual claims of the patent. As is pertinent here, where Claim 43 is the sole Claim at issue, claim 43 states that an augmented measurement includes the first signal, the second signal and the third signal. - 9 -

b. Cryptographic Operation The term cryptographic operation is described in terms of both integrity and authentication and is described as encompassing a broad variety of functions in the 453 patent. See Ex. 1009, 39. The 453 patent does not limit the use of cryptographic operation to any particular encryption algorithm and does not require that the term include only encryption by way of an encryption key. Ex. 1009, 39-43. The 453 patent indicates that a message authenticity code (MAC), a cyclic redundancy check (CRC), and a hash each of which is disclosed as versions of one-way functions are all cryptographic operations. Ex. 1009, 41. The specification uses the term hash (as a matter of convenience) to represent all such one-way functions. 453 patent, 8:15-17. The 453 patent further includes multiple other data assurance methodologies that are used in cases where authenticity is desired in addition to integrity, such as a device-specific private key, symmetric key (e.g., DES), key encryption, and challenge-response protocol (CRP). 453 patent, 9:23-28. The 453 patent broadly describes cryptographic operations as including one-way functions, encryption with an encryption key, and a variety of other data assurance methodologies. Ex. 1009, 43-44. Specifically, the 453 patent confirms that hashing (and thus all one-way functions, as explained above), asymmetric encryption, symmetric encryption, chaining, digital certificates, and - 10 -

challenge-response protocols, whether alone or in combination, are all types of cryptographic operations. 453 patent, 9:55-61. In addition to the above, the 453 patent describes a wide variety of other data assurance methodologies as suitable cryptographic operations. Ex. 1009, 44. Accordingly, a person of ordinary skill in the art would consider the broadest reasonable interpretation in light of the specification of cryptographic operation to be: an operation, such as an application of a one way function, encryption with an encryption key, or other data assurance methodology, that processes an augmented measurement. Ex. 1009, 45. IX. HOW THE CHALLENGED CLAIM IS UNPATENTABLE a. Count 1: The Challenged Claim Is Rendered Obvious by Johnson in View of Hershey The combination of Johnson and Hershey teaches, suggests or discloses all of the recitations of the Challenged Claim, and renders the subject matter of the claim as a whole obvious and unpatentable. Johnson is directed to a communications protocol for modules that are installable within a secure utility meter, referred to within Johnson as Network Service Modules ( NSM ). Ex. 1009, 46. Johnson discloses that the NSMs are part of an automatic meter reading system for utility meters that enables secure measurement acquisition and certification. Ex. 1009, 47-58. Hershey is - 11 -

properly combinable with Johnson, as Hershey describes particular encryption and/or authentication protocols for utility monitoring applications, such as the monitoring application in Johnson. Ex. 1009, 59-65. As confirmed by Petitioner s Expert, one of ordinary skill in the art would understand that Johnson and Hershey are both related to communications systems in an automated or remote metering system. Ex. 1009, 88-89. Accordingly, Hershey would improve Johnson in the same way that the system in Hershey was designed to improve prior art automated meter systems. Ex. 1009, 90. As disclosed, Johnson addressed security through its reliance on its secure enclosure and tamper detection sensors and through its reliance on a CRC to assure integrity of the communications system. Ex. 1009, 91. As the threat to the communications system evolved, the system of Hershey improves Johnson by emphasizing the prevention of unwanted access to the communications system. Ex. 1009, 91. The person of ordinary skill in the art would have understood such benefits and would have been motivated to combine Hershey with Johnson. Id. Additionally, Petitioner s Expert identifies an explicit motivation in Hershey as to why one of ordinary skill in the art would have combined Hershey with a communications system like Johnson. Ex. 1009, 90. Accordingly, the person of ordinary skill would have determined it to be an obvious improvement to Johnson - 12 -

to add an encryption algorithm of Hershey to provide for authentication and, thus, increased security in the communications system. Ex. 1009, 92. Petitioner provides an explicit mapping of the prior art references to the challenged claim below. A complete list of the claim and corresponding citations that render the claim obvious is provided below in the combined claim chart. 1. Claim 43 43[a] A method of generating secure physical measurements, comprising: Johnson discloses an automated meter reading system that comprises a device, namely an NSM module that includes a sensor that performs the method of measuring a physical parameter, namely energy consumption, by counting turns of a disk in a utility meter. Ex. 1009, 94; Johnson, 16:39-41. The NSM is secure in its construction, and the NSM module is able to detect tampering through a number of sensors, rendering Johnson able to acquire a secure measurement. Ex. 1009, 95-97; see also Johnson, 14:34-36, 15:7-16:21; Ex. 1007, pages 16-17, 30. Johnson confirms that all packets include a CRC for verification and, in terms of the 453 patent, for certifying the physical parameter. Ex. 1009, 96; Johnson, 35:65 36:4. 43[b] receiving a first signal, the first signal being based at least in part on a first physical measurement; Johnson describes a sensor that is capable of counting turns of a disk in a - 13 -

meter reading system. Johnson, 16:39-41 (describing measurement of disk rotations); see also 14:40-42, 15:54-16:4 Johnson discloses that the NSM processor is configured to receive a measurement signal, representative of the physical measurement, from the sensor. Johnson, 11:17-20. The signal is received in Johnson, as the received sensor measurement signal is included in at least NSM data. Johnson, 10:62-67. NSM data includes at least a measurement and a related time or interval. Ex. 1009, 99; Johnson, 11:17-20, 19:45-47. Accordingly, the receipt of the consumption signal meets the requirement of receiving a first signal that is based at least in part on a first physical measurement. Ex. 1009, 99-100. 43[c] receiving a second signal, the second signal being based at least in part on a second physical measurement; At least the battery level signal in Johnson renders obvious the step of receiving a second signal. Ex. 1009, 102-103. Johnson discloses a plurality of additional sensors that generate signals that are based on physical measurements, such as magnetic sensor 226, temperature sensor 227, and battery level sensor 228, along with various other sensors such as tamper sensors. Johnson, 15:2 16:21; Fig. 5. The sensors obtain physical measurements that are communicated to and received by the processor. Johnson, 15:42-46, 16:13-15. Such signals are received, as Johnson discloses the inclusion of housekeeping information in its packets. Johnson, 19:45 20:3. - 14 -

Should Patent Owner argue that a battery signal is not a second signal as recited in the challenged claim, there are a number of other sensors that provide a signal based on a physical measurement. For instance, Johnson discloses a consumption sensor, which is used to sense current draw based on a value of the magnetic field generated. Ex. 1009, 104; Johnson, 15:54-16:4.The consumption sensor is used to ensure that the consumption monitored by the disk is within a threshold value of what is monitored by the consumption sensor. Id. The signal received from the consumption monitor is stored, in the form of a tamper event, for later transmission in packets having at least a measurement and a related time or interval. Johnson, 16:18-21. Additionally, in an instance of an alarm condition, Johnson is configured to generate a message that comprises at least a consumption measurement along with an indication of lack of voltage received from a voltage sensor, such as when identifying a power outage. Ex. 1009, 104; Johnson, 12:2-4, 20:26-30. Accordingly, Johnson discloses the receipt of the battery level signal (and other housekeeping signals), tamper signals, and power outage signals, any of which meets the requirement of receiving a second signal that is based at least in part on a second physical measurement. Ex. 1009, 102-104. 43[d] receiving a third signal, the third signal being based at least in part on a time; - 15 -

Johnson discloses receiving a timing signal from the clock signal generator. Ex. 1009, 106-107; Johnson, 16:22-28. 10:45-53, 3:60-63. The clock in Johnson enables the creation of a plurality of time periods arranged sequentially and having a predetermined length. Johnson, 16:22-29, 10:50-53; see also Ex. 1010, pages 199-200. Such signals are received, as Johnson discloses the inclusion of time intervals in its packets. Johnson, 19:45 20:3. The clock of Johnson is synchronized via a RCN-synchronization signal that provides an external terrestrial time reference for updating a local clock. Johnson, 10:45-53, 3:60-63. Accordingly, Johnson discloses the receipt of the time signal, which meets the requirement of receiving a third signal that is based at least in part on a time. Ex. 1009, 106-109. 43[e] generating an augmented measurement based at least in part on the first signal, the second signal and the third signal; and For the purposes of this claim, an augmented measurement comprises at least a first signal, a second signal, and a third signal. Johnson discloses generating an augmented measurement based at least in part on the first signal (based on a first physical measurement), the second signal (based on a second physical measurement) and the third signal (based on a time). Johnson generates a packet, which includes an augmented measurement for storage and transmission. Ex. 1009, 111-115; see Johnson, 11:33-40, 19:45-16 -

20:3, Fig. 3. The packets of Johnson are configured to provide energy quantities for each interval (i.e., first signal), housekeeping signals or tampering signals (i.e., second signal), and the date and/or time of the interval (i.e., third signal) in the data field. Ex. 1009, 111-112; Johnson, 19:45 20:3. Each Johnson packet includes an accumulated value of utility usage and housekeeping information for a set period of time. Johnson, 19:45 20:3. As is shown in Figure 8 of Johnson, each eight hour interval includes a consumption reading confirming that the computing device in Johnson receives both consumption data and a time interval. Regarding the time interval, the Johnson processor receives a clock signal that allows for the creation of a plurality of time periods arranged sequentially and having a predetermined length. Johnson, 16:22-29, 10:50-53. Johnson further discloses that its system enables meter reading data, time of use (TOU) and 15-minute peak consumption recording, line power monitoring, i.e., outage and restoration, tamper sensing, and timekeeping. Johnson 11:16-20, 14:60-64. Additionally, Johnson discloses that an alarm message may include consumption information; an indication of electrical voltage, such as no voltage in the instance of a power outage; and a time. Johnson, 12:2-4, 20:40-53. 43[f] performing a cryptographic operation on at least a portion of the - 17 -

augmented measurement to generate a certifiable measurement. Johnson discloses that a cryptographic operation, such as a CRC, is performed on at least a portion of each of its packets. Ex. 1009, 117; Johnson, 37:57-59. Packets are verified or certified upon reception. Johnson, 35:66-36:1. Petitioner combines Hershey with Johnson. Hershey, like Johnson, discloses a system that is applicable to a utility meter system. Ex. 1009, 118-121. Hershey discloses symmetric cryptography, as both the transmitter and the receiver have access to the same secret keying variable. Ex. 1009, 119. Hershey explains that either the entire message can be encrypted or plain text and cipher text can be mixed in a single message. Hershey, 5:50-53. With a particular focus on encryption, Hershey describes generating the cipher text in such a way that it is applicable to any packet. Hershey, 5:56 6:4. Hershey is configured to decipher the message and to authenticate and/or certify its contents. Hershey, 1:61-64. As discussed above, the person of ordinary skill in the art at the time of the invention would have combined Johnson with Hershey, as Hershey improves Johnson in the same way that the system in Hershey was designed to improve prior art automated meter systems. As disclosed, Johnson was concerned with security through its reliance on its secure enclosure and tamper detection sensors and through its reliance on a CRC to assure integrity of the communications system. As the threat to the communications system evolved, the system of Hershey was - 18 -

usable in a system like Johnson to prevent unwanted access to the communications system. Ex. 1009, 118. b. Count 2: The Challenged Claim Is Rendered Obvious by Simmons in View of Peterson The combination of Simmons and Peterson teaches, suggests or discloses all of the recitations of the Challenged Claim, and renders the subject matter of the claim as a whole obvious and unpatentable. Simmons is directed to an encryption protocol that enables parties (e.g., the United States and Russia) to authenticate sensor readings. Ex. 1009, 66-70. Simmons describes an encryption methodology, a sensor in the form of a downhole seismometer package, and a prototype monitoring station. Ex. 1009, 71-77. Petitioner relies on Peterson in combination with Simmons. Peterson is directed to a seismograph network that was constructed in view of the experiences in operating the Regional Seismic Test Network (RSTN), a prototype monitoring station for monitoring a test ban treaty. Ex. 1009, 78-86. One of ordinary skill in the art would have understood that Simmons and Peterson are both related to communications systems in the seismic sensor field. Ex. 1009, 123. In the seismic sensor field, Simmons provides a discussion of multiple cryptographic algorithms. Simmons, pages 623-625. Simmons also identifies the type of seismometer used in his implementation, namely the KS - 19 -

36000. Simmons, Fig. 2, page 622. Simmons further describes a communications system that allowed for the transmission of messages. Simmons, page 624. Contemporaneously, the employer of the author of Simmons, Sandia National Laboratories, developed a prototype system to test and evaluate the use of seismometers like the system described in Simmons. Ex. 1009, 123. This system was known as the RSTN. In the same field, Peterson relies on the experiences of Sandia National Laboratories in operating the RSTN in developing the global network described in Peterson. Peterson, page 6. In view of the RSTN, Peterson discusses a stateside implementation of a system for acquiring seismic measurements. Peterson, page 3. Indeed, the Simmons and Peterson systems both relied on the same or similar seismometer, the KS 36000 seismometer. Ex. 1009, 122. Simmons illustrates the KS 36000 in Figure 2. Accordingly, as is explicitly shown, the person of ordinary skill in the art at the time of the invention of the 453 patent would have looked not only to the authentication options proposed in Simmons, but also to Peterson when building a sensor device and method, network protocols, and the like, as the combination of Simmons and Peterson results in the combination of known prior art elements according to known methods. Ex. 1009, 125-126. Indeed, the person of skill in the art would have been motivated to combine these references, as Peterson provides implementation details for a system like Simmons. Id. - 20 -

The addition of Peterson to the disclosure of Simmons has never before been considered by the Office. However, the 453 patent identified Simmons (1981) in its background, noting that Simmons (1981) disclosed a technique for providing a certifiable measurement that included both a physical measurement from the sensor and the representation of the time from the time generator. 453 patent, 2:20-31. Accordingly, Petitioner asserts that Patent Owner has effectively admitted that the challenged claim is at least rendered obvious by Simmons. Petitioner provides the following specific mappings to support this conclusion. See Ex. 1009, 127-130. Specifically, Petitioner provides an explicit mapping of the prior art references to the challenged claim below. A complete list of the claim and corresponding citations that render the claim obvious is provided below in the combined claim chart. 1. Claim 43 43[a] A method of generating secure physical measurements, comprising: Simmons and Peterson both disclose a downhole seismometer package for measuring seismic signals. Simmons, page 622, Fig. 2; Peterson, pages 12-14. Simmons is tamper resistant and configured to generate encrypted communications for certifying and thus generating secure physical measurements. Ex. 1009, 132, 134; Simmons, pages 623-624. Peterson also discloses a sensor, and supports the disclosure of Simmons. Peterson discusses a stateside implementation of a - 21 -

seismic monitoring system similar to Simmons. Peterson relies on the use of the same or a similar seismometer (KS 36000) for the ability to acquire seismic measurements. Ex. 1009, 133; Peterson pages 12-14; Simmons, page 622, Fig. 2. 43[b] receiving a first signal, the first signal being based at least in part on a first physical measurement; Simmons and Peterson both disclose a downhole seismometer package that comprises a KS 36000 seismometer that measures seismic signals (the first signal) and outputs a digital signal representative thereof. Ex. 1009, 136-139; Simmons, page 622, Fig. 2; Peterson, pages 12-14. Simmons discloses receiving a first signal based on a first physical measurement, namely, seismic data. For example, Simmons states: The most reliable technique for detecting underground tests, and essentially the only direct measurement method that can be used at a distance, is to measure the ground motions resulting from the underground detonation using seismic sensors. Simmons, page 621. Peterson likewise discloses measuring a physical parameter (seismic data) to provide a first signal based upon the physical measurement. Peterson discusses a stateside implementation of a seismic monitoring system similar to Simmons. Peterson relies on the use of the same or a similar seismometer (KS 36000) for the ability to acquire seismic measurements. Peterson, pages 12-14; Simmons, page 622, Fig. 2. - 22 -

Both Simmons and Peterson disclose the inclusion of the measurement data in their respective messages/packets. Thus, both Simmons and Peterson disclose receiving a first signal that is based at least in part on a first physical measurement. Ex. 1009, 139. 43[c] receiving a second signal, the second signal being based at least in part on a second physical measurement; Peterson discloses a second physical measurement that is obtained by way of an accelerometer. Peterson, page 12. The accelerometer is part of the disclosed accelerometer subsystem that is configured to measure body waves and surface waves. Peterson, pages 9, 14. Peterson confirms the receipt of a signal that is based upon the accelerometer data, as Peterson identifies that accelerometer data can be added to the message or packet. Peterson, pages 9-10. Accordingly, Peterson discloses to the person of ordinary skill in the art at the time of the invention receiving a second signal where the second signal is based at least in part on a second physical measurement. Ex. 1009, 141-144. As such, the combination of Simmons and Peterson likewise discloses receiving a second signal that is based at least in part on a second physical measurement. Ex. 1009, 144; Ex. 1007, page 30. 43[d] receiving a third signal, the third signal being based at least in part on a time; - 23 -

The 453 patent admits that Simmons (1981) discloses a third signal based at least in part on a time. Ex. 1009, 146; 453 patent, 2:20-31. Consistently, Simmons outputs messages that include a clock that is a representation of time that was provided by the Simmons system. Ex. 1009, 147; Simmons, page 624. The referenced clock is a representation of time that was generated by the Simmons system. Ex. 1009, 147. Peterson likewise discloses a system with a clock that provides a representation of time. Ex. 1009, 143; Peterson, page 14. Peterson receives an external clock signal. The clock of Peterson is updated externally by way of satellites or by way of a terrestrial connection to a satellite station. Peterson, pages 3 and 14. Because both Simmons and Peterson disclose the inclusion of measurement data and a time in their respective messages/packets, both Simmons and Peterson disclose receiving a third signal that is based at least in part on a time. 43[e] generating an augmented measurement based at least in part on the first signal, the second signal and the third signal; and 150. For the purposes of this claim, an augmented measurement comprises at least a first signal, a second signal, and a third signal. Simmons and Peterson disclose generating an augmented measurement based at least in part on the first signal (based on a first physical measurement), the second signal (based on a second physical measurement) and the third signal (based on time). Ex. 1009, - 24 -

150. Simmons generates a packet that includes at least the sensor data and the time. Simmons, page 624. Because the message in Simmons includes seismic data, clock data, and other information as described above, it would have been obvious for the Simmons system to include a second measurement signal, such as that provided by Peterson, in performing the step of generating an augmented measurement. Ex. 1009, 151-152; Simmons, page 624. Peterson generates an augmented measurement in the form of a generated packet or message, which includes the signal received from the seismometer (i.e., first signal), the signal received from the accelerometer (i.e., second signal), and the received time signal (third signal). Ex. 1009, 153-154; Peterson, page 9. Specifically, Peterson is configured to generate a message including seismic data formatted into 1-second frames together with station identification (8 bits), time of year to the nearest millisecond (56 bits), message text (80 bits), state-of-health flags (16 bits), frame synchronization (16 bits), and three accelerometer (AC) channels, sampled at 10 SPS (480 bits). Peterson, pages 9, 10. 43[f] performing a cryptographic operation on at least a portion of the augmented measurement to generate a certifiable measurement. Simmons discloses the performance of a cryptographic operation on a message comprising at least a measurement and a time, including performing a - 25 -

cryptographic operation on the measurement, the time, the station ID number, and other corroborative data. Simmons, page 624. Accordingly, it would have been obvious to the person of ordinary skill in the art at the time of the invention, to perform a cryptographic operation on a message comprising first and second physical measurements along with a time, such as the first and second physical measurements and time disclosed in Peterson. Ex. 1009, 156-157. Simmons describes the performance of multiple cryptographic operations, such as a single key cryptosystem, a two-key or public key system that allows for authentication without requiring secrecy for the message itself, and the Rivest- Shamir-Adleman (RSA) cryptoalgorithm. Ex. 1009, 156-161; Simmons, pages 623-625. c. Count 1 and Count 2 Are Not Redundant The grounds raised in Count 2 are meaningfully distinct from those of Count 1 and rely on fundamentally different combinations of the cited prior art. Count 1 relies on prior art that is directed to utility metering and the use of cryptography before the priority date of the 453 patent. Also, Count 1 relies on a system that uses a cyclic redundancy check (CRC) as its cryptographic operation. The reliance on a secondary reference, Hershey, with regard to particular encryption and/or authentication protocols beyond the CRC set forth in Johnson, is the inherent weakness of Count 1. - 26 -

Count 2 is unlike Count 1, as it relies on a prior seismometer implementation for a certified measurement system. An apparent earlier version of Simmons was before the Examiner, but not in combination with the Peterson reference. Count 2 relies on a large scale seismic sensor implementation. Also, Count 2 is stronger than Count 1 inasmuch as Patent Owner made admissions in the patent specification as to the disclosure of Simmons (1981), but is weaker than Count 1 in that a third version of Simmons (dated 1983) which is a version of Simmons (albeit without Peterson) was cited in the prosecution history of the 453 patent. Also, the references cited in Count 2 contain less detail than those presented in Count 1. Accordingly, as the counts are different and have varying strengths and weaknesses, Petitioner asserts that allowing the IPR to proceed on both counts is appropriate. If the Board is inclined to proceed on a single count, Petitioner identifies Count 1 as preferred as it most closely aligns with Ex. 1007 and the products accused in the related litigation. d. Combined Claim Chart Claim Language 43[a] A method of generating secure physical measurements, comprising: 43[b] receiving a first signal, the first signal being based at least in part on a first physical measurement; - 27 - Rejection Grounds COUNT 1: Johnson, 1:26-33, 3:20-23, 10:63 11:20, 13:66 14:15, 14:33-36, 35:65-36:4. COUNT 2: Simmons, pp. 622-624; Peterson, pp. 12-14. COUNT 1: Johnson, 11:17-20, 14:40-42, 16:39-41, 16:48-64. COUNT 2: Simmons, p. 622, Fig. 2; Peterson, pp. 9, 12-14.

Claim Language 43[c] receiving a second signal, the second signal being based at least in part on a second physical measurement; 43[d] receiving a third signal, the third signal being based at least in part on a time; 43[e] generating an augmented measurement based at least in part on the first signal, the second signal and the third signal; and 43[f] performing a cryptographic operation on at least a portion of the augmented measurement to generate a certifiable measurement. Rejection Grounds COUNT 1: Johnson, 11:67 12:4, 15:2 16:21, 20:26-30, Fig. 5. COUNT 2: Simmons, p. 622, Fig. 2; Peterson, pp. 9, 12-14. COUNT 1: Johnson, 3:60-63, 10:45-53, 16:22-29. COUNT 2: Simmons, p. 624; Peterson, pp. 3, 9, 12-14. COUNT 1: Johnson, 3:60-63, 5:20-23, 10:45-53, 11:36-40, 12:2-4, 16:22-29, 19:45 20:3, 20:40-53. COUNT 2: Simmons, p. 624; Peterson, pp. 9-10, 14-15. COUNT 1: Johnson, 11:33-40, 35:65-36:4, 37:57-59, Fig. 3; Hershey, 1:60-64, 3:66-4:4, 5:50-55, 5:56-6:4. COUNT 2: Simmons, pp. 623-625. X. CONCLUSION For the foregoing reasons, Petitioner asks that inter partes review of the 453 patent be instituted and that the Challenged Claim be cancelled. January 15, 2015 By /Kirk T. Bradley/ Date Kirk T. Bradley (46,571) Christopher TL Douglas (56,950) - 28 -

Inter Partes Review of U.S. Patent No. 6,289,453 Certificate of Service Pursuant to 37 C.F.R. 42.6(e), the undersigned hereby certifies service on the Patent Owner of a copy of this Petition and its respective exhibits via Express Mail at the correspondence address of record for the 453 patent: Patent Properties, Inc. Two High Ridge Park Stamford CT 06905 January 15, 2015 By /Christopher TL Douglas/ Date Christopher TL Douglas Reg. No. 56,950