IN THE UNITED STATES PATENT AND TRADEMARK OFFICE

Transcription

1 IN THE UNITED STATES PATENT AND TRADEMARK OFFICE In re Patent of: Finn U.S. Patent No.: 8,051,211 Issue Date: Nov. 1, 2011 Atty Docket No.: IP1 Appl. Serial No.: 10/282,438 PTAB Dkt. No.: IPR Filing Date: Oct. 29, 2002 Title: MULTI-BRIDGE LAN AGGREGATION Mail Stop Patent Board Patent Trial and Appeal Board U.S. Patent and Trademark Office P.O. Box 1450 Alexandria, VA PETITION FOR INTER PARTES REVIEW OF UNITED STATES PATENT NO. 8,051,211 PURSUANT TO 35 U.S.C , 37 C.F.R. 42

2 TABLE OF CONTENTS I. MANDATORY NOTICES UNDER 37 C.F.R 42.8(a)(1)... 1 A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1)... 1 B. Related Matters Under 37 C.F.R. 42.8(b)(2)... 1 C. Lead And Back-Up Counsel and Service Information... 1 II. PAYMENT OF FEES 37 C.F.R III. REQUIREMENTS FOR IPR UNDER 37 C.F.R A. Grounds for Standing Under (a)... 2 B. Challenge Under (b) and Relief Requested... 2 IV. SUMMARY OF THE 211 PATENT... 3 A. Brief Description... 3 B. Level of Ordinary Skill in the Art as of the Critical Date... 4 V. CLAIM CONSTRUCTION... 5 A-1. LAN... 5 A-2. aggregate and aggregating... 5 A-3. host... 6 A-4. intermediate network device / intermediate device... 6 A-5. tunneling... 7 A-6. pass-through path... 7 A-7. directly... 8 VI. MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH IPR IS REQUESTED, THUS ESTABLISHING A REASONABLE LIKELIHOOD THAT AT LEAST ONE CLAIM OF THE 211 PATENT IS UNPATENTABLE... 9 A. [Ground 1] Claim 1 is anticipated by Wils under 35 U.S.C B. [Ground 2] Claims 2 and 6-9 are obvious over Wils in view of Kunzinger under 35 U.S.C C. [Ground 3] Claim 12 is obvious over Wils in view of Xia under 35 U.S.C D. [Ground 4] Claims 13 and are obvious over the combination of Wils and Kunzinger in view of Xia under 35 U.S.C i

3 E. [Ground 5] Claims 1 and 12 are anticipated by Perloff under 35 U.S.C F. [Ground 6] Claims 2, 6-9, 13 and are obvious over Perloff in view of Kunzinger under 35 U.S.C VII. CONCLUSION ii

4 EXHIBITS ARISTA-1001 ARISTA-1002 ARISTA-1003 ARISTA-1004 ARISTA-1005 ARISTA-1006 ARISTA-1007 ARISTA-1008 ARISTA-1009 ARISTA-1010 ARISTA-1011 ARISTA-1012 U.S. Patent No. 8,051,211 to Finn ( the 211 Patent ) Prosecution History of the 211 Patent ( the Prosecution History ) Declaration of Dr. Bill Lin Curriculum Vitae of Dr. Bill Lin U.S. Patent No. 6,608,812 ( Wils ) U.S. Patent No. 6,910,149 ( Perloff ) U.S. Patent No. 6,931,529 ( Kunzinger ) Network Working Group, RFC 2401 Security Architecture for the Internet Protocol (November 1998) ("RFC 2401") U.S. Patent No. 6,850,976 ( Xia ) U.S. Application Serial No. 09/540,534 ( Xia Application ) U.S. Patent No ,351 ( Hiscock ) U.S. Application Serial No. 09/014,548 ( Hiscock Application ) iii

5 Arista Networks, Inc. ( Petitioner or Arista ) petitions for Inter Partes Review ( IPR ) under 35 U.S.C and 37 C.F.R. 42 of claims 1-2, 6-9, and ( the Challenged Claims ) of U.S. Patent No. 8,051,211 ( the 211 Patent ). As explained below, there exists a reasonable likelihood that Petitioner will prevail in demonstrating unpatentability of the Challenged Claims. I. MANDATORY NOTICES UNDER 37 C.F.R 42.8(a)(1) A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1) Arista is the real party-in-interest. B. Related Matters Under 37 C.F.R. 42.8(b)(2) Petitioner is not aware of any disclaimers, certificates or petitions for inter partes review for the 211 Patent. The 211 Patent is the subject of Civil Action Number 14-cv JSW, filed December 5, 2014 in the Northern District of California, and of ITC Investigation No. 337-TA-945, instituted on January 20, C. Lead And Back-Up Counsel and Service Information Petitioner designates Petitioner designates W. Karl Renner, Reg. No. 41,265, as Lead Counsel, and Kevin Greene, Reg. No. 46,031, and David Goren, Reg. No. 34,609, as Backup Counsel, all available at 3200 RBC Plaza, 60 South Sixth Street, Minneapolis, MN (T: ; F: ), or electronically by at IPR IP1@fr.com. 1

6 II. PAYMENT OF FEES 37 C.F.R Petitioner authorizes the Patent and Trademark Office to charge Deposit Account No for the fee set in 37 C.F.R (a) for this Petition and further authorizes for any additional fees to be charged to this Deposit Account. III. REQUIREMENTS FOR IPR UNDER 37 C.F.R A. Grounds for Standing Under (a) Petitioner certifies that the 211 Patent is available for IPR. Petitioner was served with a complaint alleging infringement of the 211 patent on December 9, The petition is being filed within one year of service of Petitioner. Petitioner is not barred or estopped from requesting this review on the belowidentified grounds. B. Challenge Under (b) and Relief Requested Petitioner requests IPR of the Challenged Claims on the grounds set forth in the table below, and requests that the Challenged Claims be found unpatentable. An explanation of unpatentability is provided, indicating where each element is found in the prior art. Additional explanation and support for each ground is set forth in the accompanying Declaration of Dr. Bill Lin (ARISTA-1003). Ground 211 Patent Claims Basis for Rejection 1 1 Wils 35 U.S.C , 6-9 Wils and Kunzinger - 35 U.S.C Wils and Xia - 35 U.S.C

7 Ground 211 Patent Claims Basis for Rejection 4 13, Wils, Kunzinger and Xia - 35 U.S.C , 12 Perloff 35 U.S.C , 6-9, 13, Perloff and Kunzinger - 35 U.S.C. 103 The 211 Patent issued from U.S. application number 10/282,438, which was filed on October 29, The 211 Patent does not include a priority claim, and therefore the filing date of October 29, 2002 (hereinafter the Critical Date ) represents the earliest possible priority date to which the 211 Patent is entitled. Wils (ARISTA-1005), Perlof (ARISTA-1006), Kunzinger (ARISTA-1007) and Xia (ARISTA-1009) each qualifies as prior art under 35 U.S.C. 102(e). Wils was filed on January 15, Perloff was filed on September 24, Kunzinger was filed on January 5, Xia was filed March 31, IV. SUMMARY OF THE 211 PATENT A. Brief Description The 211 Patent describes techniques for multi-bridge LAN aggregation. Ex. 1001, Abstract. Specifically, the 211 Patent is directed to a computer network that enables link aggregation to be utilized on redundant physical connections between a host and multiple network devices. Id. at 4:22-24; 4: The alleged advantage of this technique is improving reliability and availability of data transmitted to and from the host. Id. at 4: Similarly, the 211 Patent 3

8 describes that Link aggregation (also known as trunking) alleviates some of the problems associated with multiple IP addresses by grouping LANs of the same medium type and speed together to form a link aggregation group, which is treated as a single link with the capacity of all the links combined. Id. at 2: In particular, the 211 Patent describes that the network includes two bridges connected by an inter-bridge link. Id. at 5: B. Level of Ordinary Skill in the Art as of the Critical Date A person of ordinary skill in the art as of the Critical Date of the 211 Patent (hereinafter a POSITA ) would have had a Masters of Science Degree (or a similar technical Masters Degree, or higher degree) in an academic area emphasizing computer networking or, alternatively, a Bachelor Degree (or higher degree) in an academic area emphasizing the design of electrical, computer, or software engineering and having several years of experience in computer network engineering and the design of computer networks. Additional education in a relevant field, such as computer science, computer engineering, or electrical engineering, or industry experience may compensate for a deficit in one of the other aspects of the requirements stated above. Ex. 1003, 9. Unless specifically noted otherwise in this Petition, references to what would have been known or understood by a POSITA refer to the knowledge of a POSITA as of the Critical Date, or before. 4

9 V. CLAIM CONSTRUCTION A claim subject to IPR is given its broadest reasonable construction in light of the specification of the patent in which it appears. 37 C.F.R (b). For this proceeding only, Petitioner submits constructions for the following terms. All remaining terms should be given their broadest reasonable meaning. A-1. LAN The 211 Patent provides a definition, stating that [a]lthough a LAN may refer to a computer network organized in a given locale, as used herein, the term LAN is used to refer to a physical connection between one or more hosts (e.g., a LAN Segment). Ex. 1001, 1:42-45 (emphasis added). Further, throughout the specification, the terms link and LAN are used interchangeably. By way of example, when discussing Figure 1, the patent states [w]ith bridge 106 and host 102 configured for link aggregation, the multiple links between them are seen as one link. Id. at 2:41-42 (emphasis added). In light of the explicit definition, a proper construction of the term LAN must be broad enough to include a physical connection to one or more hosts such as a LAN Segment or link. Ex. 1003, 27. A-2. aggregate and aggregating The specification of the 211 Patent states [l]ink aggregation (also known as trunking) alleviates some of the problems associated with multiple IP addresses by grouping LANs of the same medium type and speed together to form a link 5

10 aggregation group, which is treated as a single link with the capacity of all the links combined. Ex. 1001, 2:28-33 (emphasis added). In light of this description, which is consistent with the general usage of aggregation by a POSITA at the time of the Critical Date, the proper construction of aggregating must be broad enough to include trunking or grouping multiple LANs into one logical link with the capacity of all the links combined. Ex. 1003, 28. A-3. host The 211 Patent provides a definition, stating that [a]s used herein, the term host refers to an end-station which is the source of, or destination of, frames transmitted over a network. Ex. 1001, 1:45-47 (emphasis added). In light of the explicit definition, the proper construction of the term host must be broad enough to include an end-station. Ex. 1003, 29. The terms endsystem and end node are synonymous with end-station. Ex. 1003, 34 and 80. A-4. intermediate network device / intermediate device The 211 Patent states that [b]ridges are intermediate network devices which can be used to interconnect LANs at the link layer, [a] router is an intermediate network device which also interconnects a number of LANs and/or other types of transmission media, and that [t]he term switch is sometimes used for an intermediate network device that combines some or all of the functions of both a router and a bridge. Ex. 1001, 1: In light of this description, the 6

11 proper construction of intermediate network device must be broad enough to include a device that interconnects LANs and/or other types of transmission media, such as a bridge, router, or switch. Ex. 1003, 30. The 211 Patent also uses the term intermediate device interchangeably with intermediate network device, (see Ex. 1001, 4:49-53) and, therefore, both terms should be construed in the same fashion. Ex. 1003, 30. A-5. tunneling The 211 Patent provides a definition, stating that [a]s used herein, tunneling is used to refer to transmitting a frame without examination. Ex. 1001, 5:59-61 (emphasis added). In light of the explicit definition, the proper construction of the term tunneling must be broad enough to include transmitting a frame without examination. Ex. 1003, 31. A-6. pass-through path The term pass-through path is not expressly defined by the 211 Patent and is not a term of art or a term with a standard definition to a POSITA. Ex. 1003, 32. The plain meaning of pass-through path, when used in the context of network devices, is simply a path through which information passes. Ex. 1003, 32. Although the specification of the 211 Patent describes an implementation in which a pass-through path is configured by mapping a virtual port to a physical port (see, Ex. 1001, 10:37-40), there is no definition, disclaimer, or other language 7

12 that would suggest to a POSITA that this term should be limited accordingly. See In re Prater, 415 F.2d 1393, (1969) (admonishing against reading into the claim the limitations of the specification). Therefore, the proper construction of the term pass-through path must be broad enough to include a path through which information passes. Ex. 1003, 32. A-7. directly The 211 Patent does not include an explicit definition of directly. As shown by FIG. 4 of the 211 Patent, an excerpt of which is shown below, all ports are connected through other electronic components. Ex. 1001, FIG. 4. The 211 Patent uses the term directly to describe this situation, stating [f]or example, referring to FIG. 4 sub-port 4 is mapped directly to port 5 via tunnel engine 410 to provide a pass-through pass from sub-port 4 to port 5. In this configuration, a frame received by sub-port 4 will preferably be immediately transmitted directly to port 5. Id., 10: Therefore, the proper construction of 8

13 the term directly must be broad enough to encompass a frame passing through other components between two ports. Ex. 1003, 33. VI. MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH IPR IS REQUESTED, THUS ESTABLISHING A REASONABLE LIKELIHOOD THAT AT LEAST ONE CLAIM OF THE 211 PATENT IS UNPATENTABLE The 211 Patent acknowledges that commonly known protocols could be used to enable link aggregation. Ex. 1001, 2: The 211 Patent also acknowledges that it is possible to provide redundant connections between a host and LAN by coupling the host to multiple bridges. Ex. 1001, 2: This configuration is shown by FIG. 2 of the 211 Patent, reproduced below: The 211 Patent characterizes this configuration by stating that link aggregation was not available because then existing link aggregation techniques did not support multi-bridge configurations with a single host. Ex. 1001, 3:5-8. 9

14 In addition, during prosecution, the applicant attempted to distinguish the cited references by arguing the references failed to disclose either simultaneous transmission of information using a first LAN and a second LAN, or of an intermediate network device that receives the information transmitted via the first LAN and the second LAN. Ex. 1002, at pages 6-8 of Reply Brief filed December 8, On appeal, the Board reversed the Examiner, stating: [T]he Examiner does not explain how identifying the aggregator teaches subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device as recited in claim 1. Similarly, the Examiner cites portions of IEEE discussing link aggregation and aggregate wait time (Ans. 9-10) but does not explain how the cited sections of IEEE teach subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device as recited in claim 1. Ex. 1002, at page 4 of Decision on Appeal mailed June 14, However, all of these features were part of the prior art. For example, as shown by annotated FIG. 4, Wils discloses a method in which LANs from a host to a first and second intermediate networking device are aggregated, and in which information is transmitted simultaneously through both the first LAN and the second LAN to the second intermediate network device. 10

15 Specifically, when there is a failure of one of the links to edge device 3 or 5, data flows both along a first link 11 from edge device 7 to a first trunk switch 1 and then through intra-cluster link to a second trunk switch 2 (this path is shown in yellow), and along a second link 11 from edge device 7 to the second trunk switch 2 (this path is shown in blue). Ex. 1003, Similarly, Perloff discloses a method in which LANs from a host to a first and second intermediate networking device are aggregated, and in which information is transmitted simultaneously through both the first LAN and the second LAN to the second intermediate network device. The following annotated FIG. 4 from Perloff illustrates the process: 11

16 Specifically, when there is a failure of one of the links to server 420, e.g., failure of link 454, data flows both along a first link 118c from computer 402 to a first multi-device link aggregation (MDLA) device 102 and then through MDLA internal link 110 to a second MDLA device 104 (this path is shown in yellow), and along a second link 120c from computer 402 to the second MDLA device 104 (this path is shown in blue). Ex. 1003, Wils and Perloff are not redundant. Both Wils and Perloff are references under 102(e), but Wils has a priority date 32 months earlier than Perloff. On the other hand, Perloff has an explicit discussion of computer program products, which makes Perloff an anticipatory reference for claim

17 Moreover, by limiting the grounds to two primary references, the number of issues should not interfere with a just, speedy, and inexpensive resolution. A. [Ground 1] Claim 1 is anticipated by Wils under 35 U.S.C. 102 Claim 1 - [1.0]: A method comprising: aggregating a plurality of LANs, Aggregating includes trunking or grouping multiple LANs into one logical link with the capacity of all the links combined. See Section V(2), supra. LAN includes a physical connection to one or more hosts or a link. See Section V(1), supra. Wils describes a computer network that aggregates (e.g., trunks) together multiple LANS (e.g., links) to provide a data rate that is the sum of the data rates of the individual links. Ex. 1005, 1:12-13 and 1:27-35; Ex. 1003, 34 and 35. As such, Wils discloses trunking or aggregation to provide a single link with the capacity of all the links combined. Ex. 1003, 35. [1.1] wherein said aggregating comprises aggregating a first LAN and a second LAN, said first LAN couples a host to a first intermediate device and said second LAN couples said host to a second intermediate network device, said plurality of LANs comprising said first LAN and said second LAN, A host includes an end-station. See Section V(3), supra. Wils describes that the computer network includes at least one or more hosts (e.g., end-stations). In particular, Wils describes that the trunking arrangement consists of edge devices 3, 5 and 7. Ex. 1005, 3:52-54; FIG. 4 (reproduced below, annotated). 13

18 First Intermediate [Network] Device Second Intermediate Network Device Second link First Link Endsystem In addition, Wils incorporates by reference (see Ex. 1005, 1:43-44) U.S. Patent Application Serial No. 09/014,548 (the Hiscock Application ). The Hiscock Application describes edge devices that are connected by trunked links to multiple switches that provide a single logical device. See Ex. 1011, 3:27-29, 3:37-39 and FIG. 2; Ex. 1012, page 8, lines 10-11, and FIG. 2. The Hiscock Application, which was assigned to the same assignee and has overlapping inventors with Wils, concerns a trunking arrangement where each device is connected to a plurality of trunk switches. These devices are called edge devices. Ex. 1005, 1: According to Wils, [a] difficulty with these trunk cluster 14

19 occurs when one of the edge devices loses its connection to one of the trunk switches. Ex. 1005, 2: Wils then notes that It is a primary object of the present invention to provide a trunking arrangement where a failure of one or more links from an edge device to a trunk switch does not require that the entire trunk switch be removed from the trunking arrangement. Ex. 1005, 2: The system of Wils is plainly an improvement to the system of the Hiscock Application, and describes the same edge devices as the Hiscock Application. Ex. 1003, 36. In this situation, the disclosure of the Hiscock Application concerning the edge devices also applies to Wils. As a result, Wils discloses each edge device 3, 5, 7 can be an endsystem. Ex. 1003, 36. A POSITA would understand, therefore, that any of the edge devices 3, 5 and 7 of Wils can be end-stations. For example, edge device 7 can be an endsystem. Ex. 1003, 36. Wils describes that the trunking arrangement in the computer network includes trunk switches 1, 2. Ex. 1005, 3:52-53; Ex. 1003, 37. Because these trunk switches are switches and are used to connect the transmission media of links 11 (see Ex. 1005, 2:43-45), each trunk switch is an intermediate network device. Ex. 1003, 37. Thus, Wils includes a first intermediate device, e.g., trunk switch 1, and a second intermediate network device, e.g., trunk switch 2. Id. As shown in the annotated FIG. 1 above, the trunk switch 1 is coupled to edge device 7 by a first link 11, and the trunk switch 2 is coupled to edge device 7 15

20 by a second link 11. Wils thus discloses a first LAN (the first link 11) that couples a host (edge device 7 as an endsystem) to a first intermediate device (trunk switch 1) and a second LAN (the second link 11) that couples the host (edge device 7) to a second intermediate network device (trunk switch 2). Ex. 1003, 40. Moreover, the first link 11 (between edge device 7 and trunk switch 1) and the second link 11 (between edge device 7 and trunk switch 2) are two of the links that are aggregated ( trunked ). Ex. 1003, 40. [1.2] and subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device. Wils discloses that an edge device divides its packets between the links to which it is connected. Ex. 1005, 1:56-57; Ex. 1003, 41. Therefore, both the first link and the second link in the annotated Figure 1, supra, are usable to simultaneously transmit information from edge device 7 to trunk switches 1 and 2. Ex. 1003, 41. In addition, Wils discloses that edge devices 3 and 5 can become disconnected from a trunk switch, such as trunk switch 1. Ex. 1005, 4:1-4 and 5:33-35 ( This situation is shown in FIG. 4 where edge device 3 has a defective link 23 to trunk switch 1 and edge device 5 has a defective link 26 to trunk switch 1. ); Ex. 1003, 42. In this situation, the trunk switch 1 will forward the packets received from edge device 7 that are destined for edge devices 3 and/or 5 to trunk 16

21 switch 2. Ex. 1003, 43. That is, when link 23 or link 46 fails, packets travel from the edge device 7, through the trunk switch 1, to the trunk switch 2. Ex. 1003, 44. In particular, packets are sent from the trunk switch 1 through the intra-cluster port 19 and intra-cluster link 35 to trunk switch 2. Ex. 1005, 4:30-33; Ex. 1003, 43. This path is shown in yellow, green and blue in the drawing annotated FIG. 4 below: As previously discussed, the edge device 7 divides its packets between the link 11 connected to trunk switch 1 and the link 11 connected to trunk switch 2, 17

22 and thus simultaneously uses these two links. Ex. 1003, 45. Because the packets sent to trunk switch 1 are then forwarded to trunk switch 2, packets from edge device 7 will be sent over both the link 11 that is connected to trunk switch 1 (shown in yellow above) and the link 11 that is connected to trunk switch 2 (shown in orange above) to the trunk switch 2. Ex. 1003, 45. Consequently, Wils discloses a system in which, after aggregation (e.g., after the trunking arrangement is established), the first LAN (the first link, i.e., the link 11 that is connected to trunk switch 1) and the second LAN (the second link, i.e., the link 11 that is connected to trunk switch 2) are both usable to simultaneously transmit information (packets) from the host (the edge device 7 as an endstation) to the second intermediate network device (the trunk switch 2). Ex. 1003, 45. B. [Ground 2] Claims 2 and 6-9 are obvious over Wils in view of Kunzinger under 35 U.S.C. 103 Claim 2 - [2.0]: The method of claim 1, further comprising: tunneling said first LAN with a third LAN through said first intermediate network device, said plurality of LANs comprising said third LAN. Third LAN. As described at [1.2], Wils discloses that packets are sent from the trunk switch 1 through the intra-cluster link 35 to trunk switch 2. Ex. 1005, 4:30-33; Ex. 1003, 43. Wils discloses that the intra cluster link 35 preferably operates in a manner substantially similar to the other links. Ex. 1005, 5: Because the intra-cluster link 35 operates in substantially the same manner as the 18

23 other links, it provides a third LAN (e.g., a link) that is one of the plurality of LANs that includes the first LAN (the link 11 that is connected to trunk switch 1) and the second LAN (the link 11 that is connected to trunk switch 2). Ex. 1003, 59. Tunneling. Tunneling includes transmitting a frame without examination. See Section V(5), supra. Tunneling was a well-known method of transmitting packets through a network as of the Critical Date. Ex. 1003, 46. One form of tunneling is to encapsulate packets of data as they are traveling over a communication link, so that the encapsulated packet is forwarded based on consideration of the encapsulation rather than, for example, examination of the MAC or IP address of the frame itself. Ex. 1003, 47 and 51. As of the Critical Date of the 211 patent, techniques were known to create tunnels that, when employed on the network taught by Wils in the use cases discussed in [1.2], would result in tunneled frames being transmitted through trunk switch 1 from edge device 7 to trunk switch 2. Ex. 1003, 47. For example, Kunzinger discloses a method, system and computer program product for providing end-to end protection within a computer network. Ex. 1007, Abstract. In particular, Kunzinger discloses a technique to establish cascading tunnels to protect data through an entire network path, including network segments that would conventionally be assumed to be secure. Id. 19

24 Kunzinger further discloses that tunnels can be implemented using the IPSec Internet protocol (IPSec). Ex 1007, Abstract, 3:7-10; Ex. 1003, 50. IPSec is defined in RFC See Ex. 1007, 2: IPSec provides security services for traffic at the Internet Protocol or IP layer. Ex. 1007, 2:37-40; Ex. 1008, Section 1.1, Ex. 1003, 48. IPSec uses tunnels to provide secure data exchange over a path through a non-secure network. Ex. 1007, 2: In particular, the IPSec protocol includes a tunnel mode in which a tunnel is created from host to host over either an internet or an intranet, e.g., as shown by the following: Ex. 1008, page 24, Ex. 1007, 2:57-64; Ex. 1003, 49. As described by Kunzinger, tunneled packets in IPSec, and consequently Kunzinger, have an outer IP header whose source and destination addresses identify the endpoints of the tunnel, and an inner IP header whose source and destination addresses identify the originator and recipient of the packet. Ex 1007, 3:7-10. Kunzinger also discloses that, by operating in the tunnel mode, both the inner header and the payload of the entire packet is protected. Ex. 1007, 3:

25 ( When IPSec is used in tunnel mode, the complete inner packet, which is comprised of both the inner header and the payload, is protected as the packet travels through the tunnel. ); Ex. 1003, 51. As the packet travels through the tunnel, frames are forwarded based on consideration of the outer header from the encapsulation rather than, for example, examination of the MAC or IP address of the inner header. Ex. 1008, Section 4.4.2; Ex. 1007, 3:13-14 and Ex. 1003, 51. As a result, the content of a packet that is being tunneled is not examined. Ex. 1003, 51. Because the content of the packet includes both an inner header and a payload, it provides a frame that is being transmitted without examination. Ex. 1001, 1:21-25; Ex. 1003, 51 and 65. Kunzinger describes that it is well-known in the art that tunnels are used by IPSec to provide a secure exchange over a path through a non-secure network, thereby establishing a virtual private network (VPN). Ex. 1007, 2:53-57, Ex. 1003, 52. In addition, Kunzinger notes that IPSec makes no distinctions between public networks such as the Internet and private networks such as a corporate intranet, and can be deployed on either type of network. Ex. 1007, 2:41-44, Ex. 1003, 52. In fact, Kunzinger affirmatively asserts that security is needed even within corporate intranets, because [m]any corporate security breaches are in fact committed by insiders (such as employees) who have access to the corporate network by virtue of the corporation s intranet. Ex. 1007, 3:56-58; Ex. 1003,

26 Kunzinger teaches that it is preferable to provide end-to-end protection for user datagrams throughout the entire path through the network. Ex 1007, 3:56-58 and 3:63-65; Ex. 1003, 52. As noted in [1.1], one or more of the edge devices of Wils can be an endsystem. For example, edge device 5 can be an endsystem. Given the warnings of Kunzinger that even corporate intranets are vulnerable, it would have been obvious for a POSITA to establish a secure connection from edge device 7 to edge device 5 using a cascading tunnel as described by Kunzinger. Ex. 1003, 53. In the case described in [1.2], such a connection is depicted in the figure below: 22

27 In such a scenario, a tunnel would extend through each link and device between the edge device 7 and the edge device 5. That is, there would be tunneling of the first link 11 with the intra-cluster link 35, and the tunneling would go through the trunk switch 1. Ex. 1003, 53. Moreover, even apart from providing security within an intranet, a POSITA would still have reasons to modify Wils to include tunneling of Kunzinger. As noted in [1.1], one or more of the edge devices of Wils can be switches. A common situation would be for a switch to be connected to another network that is unsecured. Ex. 1003, 54. For example, edge device 5 could be a switch that is connected to an unsecured network, such as the Internet. Ex. 1003, 54. In such a case, it would have been obvious for a POSITA to establish a secure connection from edge device 7 to a host (H) on the unsecured network to which switch 5 is connected in order to address known problems of lack of security. Ex. 1003, 52. Such a connection is depicted in the figure below. 23

28 In such a scenario, a tunnel would extend through each link and device between the edge device 7 and the eventual host H. That is, there would be tunneling of the first link 11 with the intra-cluster link 35, and the tunneling would go through the trunk switch 1. Ex. 1003, 54. As a result, a POSITA would have been led to modify Wils to incorporate the tunnel of Kunzinger. Thus, Wils and Kunzinger render obvious tunneling the first LAN (the first link 11 from the edge device to the trunk switch 1) with a third LAN (the intra-cluster link 35) through the first intermediate network device (the trunk switch 1). Reasons To Combine Wils and Kunzinger 24

29 A POSITA would have modified Wils to incorporate the tunnel of Kunzinger, because the combination amounts to the use of a known technique to improve similar devices in the same way. See KSR v. Teleflex, 550 U.S. 398, 417 (2007); MPEP 2141 I(C). As described above, Kunzinger describes that the IPSec protocol can be used to improve security of communications by a tunnel through an intranet. Ex. 1007, 1: Kunzinger is similar to Wils because both concern operation of a communication network with multiple devices. Ex. 1003, 55. In addition, Kunzinger motivates creation of a tunnel from a host, such as the edge device 7 of Wils, to another host on the same intranet, such as the edge device 5 of Wils. Ex. 1003, 56. Specifically, Kunzinger identifies a problem that [p]rior art systems typically assume that traffic flowing through an intranet does not need to be protected, and thus encryption is not applied until a security gateway prepares packets for transmission into a network that is assumed to be non-secure. Experience has shown, however, that this may not be a valid set of assumptions. Ex. 1007, 3: A POSITA would have recognized that the computer network of Wils suffers from the same problems identified by Kunzinger. Ex. 1003, 56. Through Kunzinger s discussion of this problem and the benefit of the solutions proposed, which were understood as of the Critical Date, a POSITA would have been motivated to modify the computer network of 25

30 Wils to include a tunnel between two edge devices that are endsystems, as taught by Kunzinger. Ex. 1003, 56. A POSITA further would have recognized that the computer network of Wils, when modified by Kunzinger, would achieve the same benefits, thus motivating adoption of the tunnels of Kunzinger in Wils and rendering the combination predictable. Ex. 1003, 56. Similarly, Kunzinger motivates creation of a tunnel from a host, such as the edge device 7 of Wils, to a host on a separate unsecured network. Ex. 1003, 58. Specifically, Kunzinger identifies a problem of non-secure networks (such as the public Internet or corporate extranets). Ex. 1007, Abstract. A POSITA would have recognized that the computer network of Wils connected to an unsecured network suffers from the same problems identified by Kunzinger. Ex. 1003, 58. Through Kunzinger s discussion of this problem and the benefit of the solutions proposed, which were understood as of the Critical Date, a POSITA would have been motivated to modify the computer network of Wils to include a tunnel between an edge device that is endsystem and a host on a separate unsecured network, as taught by Kunzinger. Ex. 1003, 58. A POSITA would have recognized that the computer network of Wils, when modified by Kunzinger, would achieve the same benefits, thus motivating adoption of the tunneling of Kunzinger in Wils and rendering the combination predictable. Ex. 1003, 58. Claim 6 - [6.0] The method of claim 2 wherein said aggregating comprises: aggregating a first and a second port of said second intermediate network 26

31 device, wherein said first port is coupled to said first intermediate network device over said third LAN, and said second port is coupled to said host over said second LAN. Wils discloses that the intra-cluster port 29 of trunk switch 2 is connected to trunk switch 1 over the inter-cluster link 35, and that an edge port 9 of trunk switch 2 is connected to the edge device 7 over a link 11. Ex. 1005, 3:52-56 and 4:20-26; Ex. 1003, 60. Thus, Wils provides a second intermediate network device (trunk switch 2) that includes a first port (intra-cluster port 29, in blue) that is coupled to the first intermediate network device (trunk switch 1) over the third LAN (the intra-cluster link 35, blue) and a second port (edge port 9, in yellow) that is coupled to the host (edge device 7 as a endsystem) over the second LAN (the second link 11 between the edge device 7 and the trunk switch 2, in yellow). Ex. 1003,

32 Wils discloses that at trunk switch 2, the data received from both the intracluster port 29 and the edge port 9 is forwarded to an appropriate other port to reach the edge device 3 or 5. Ex. 1005, 3:57-62; Ex. 1003, 61. Even in the event of the loss of a link, the trunk switches continue to operate in a trunked manner, and the edge device that receives the data does not know which port in the trunk switch 2 received the data. Ex. 1003, 61. Consequently, the intra-cluster link 35 and the link 11 that connects trunk switch 2 to edge device 7 are grouped into one logical link. Id., 62. Therefore, the first port (the intra-cluster port 29, blue) and 28

33 the second port (edge port 9, in orange) are aggregated (trunked). Id., 1003, 62. Consequently, aggregating includes aggregating the first port and the second port of the second intermediate device (trunk switch 2) Claim 7 - [7.0] The method of claim 2, wherein said tunneling comprises: configuring a pass-through path on said first intermediate network device. A pass-through path includes a path through which information passes. See Section V(6), supra. In the event that edge device 3 or 5 becomes disconnected from trunk switch 1, trunk switch 1 begins forwarding packets that arrive from edge device 7 and are addressed for the disconnected edge devices to trunk switch 2. Ex. 1003, 63. Thus, the first intermediate network device (trunk switch 1) is configured to have a path (the edge port 9, first switch means 13, transmit only 25, and intra-cluster port 19) through which information passes. Ex. 1003, 63. When Wils is modified as taught by Kunzinger, as described in [2.0], the tunnel would extend along this path. Ex. 1003, 63. Therefore, Wils, as modified as taught by Kunzinger, would provide tunneling that includes configuring a path through which information passes on the first intermediate network device (the trunk switch 1). 29

34 Claim 8 - [8.0] The method of claim 7, wherein said tunneling further comprises: coupling a first port of said first intermediate network device to a second port of said first intermediate network device. Wils discloses that that, in the event that edge device 3 or 5 becomes disconnected from trunk switch 1, the edge port 9 of trunk switch 1 is connected to the intra-cluster port 19 of trunk switch 1. Ex. 1003, 64. When Wils is modified as taught by Kunzinger, as described in [2.0], the tunnel would include this connection. Ex. 1003, 64. Therefore, Wils as modified as taught by Kunzinger would provide tunneling that includes coupling a first port 30

35 (the edge port 9) of the first intermediate network device (trunk switch 1) to a second port (the intra-cluster port 19) of the first intermediate network device (trunk switch 1). Ex. 1003, 64. Claim 9 -[9.0] The method of claim 8, wherein said tunneling further comprises: transmitting a frame directly from said first port of said first intermediate network device to said second port of said intermediate network device. Wils discloses transmitting data packets from the edge port 9 of trunk switch 1 to the intra-cluster port 19 of trunk switch 2. Ex. 1005, 3:12-13; Ex. 1003, 65. To move through a network, a packet is encapsulated into one or more frames. Ex. 1003, 65. Thus, Wils discloses that frames are being transmitted from the edge port 9 to the intra-cluster port 19 of trunk switch 1. Ex. 1003,

36 Although Wils shows the data packets passing through the first switch means 13, this path is shown as the most direct route available within the trunk switch 2. Ex. 1003, 66. In addition, the term directly is broad enough to encompass a frame passing through other components. See V(7), supra. Thus, Wils discloses that frames are being transmitted directly from the edge port 9 of trunk switch 1 to the intra-cluster port 19 of trunk switch 1. Ex. 1003, 66. When Wils is modified as taught by Kunzinger, as described in [2.0], the tunnel would transmit frames from the edge port 9 to the intra-cluster port 19. Ex. 1003, 66. Therefore, the combination of Wils and Kunzinger would provide tunneling that includes transmitting a frame directly from the first port (edge port 9) of the first intermediate network device (trunk switch 1) to the second port (intra-cluster port 19) of that intermediate network device (trunk switch 1). Ex. 1003, 66. C. [Ground 3] Claim 12 is obvious over Wils in view of Xia under 35 U.S.C. 103 Claim 12 - [12.0]: A computer program product, said computer program product comprising: a non-transitory computer readable media, wherein the non-transitory computer readable medium stores a first set of instructions, executable on an intermediate network device, configured to aggregate a plurality of LANs, As described in [1.0], Wils describes an intermediate network device configured to aggregate a plurality of LANs. 32

37 For discussion of [a] computer program product instructions, executable on an intermediate network device, see [12.2], below. [12.1] wherein said first set of instructions is configured to aggregate a first LAN and a second LAN, said first LAN couples a host to a first intermediate device and said second LAN couples said host to a second intermediate network device, said plurality of LANs comprising said first LAN and said second LAN, As described in [1.2], Wils describes aggregating a first LAN and a second LAN, where the first LAN couples a host to a first intermediate [network] device and the second LAN couples the host to a second intermediate network device, with the plurality of LANs including the first LAN and the second LAN. [12.2] and subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device As described in [1.2], Wils describes subsequent to aggregating, the first LAN and the second LAN are both usable to simultaneously transmit information from the host to the second intermediate network device. A POSITA knew, as of the Critical Date, that software or firmware could perform the functionality of a switch. Ex. 1003, 67. For example, Xia concerns data routing and switching in a computer network and explains that [o] ne known software package that performs a number of routing protocols is known as GateD. GateD is a software package of IP routing protocols that was initially 33

38 developed for UNIX-based workstations. Ex. 1009, 1:8-9, 1: Ex. 1003, 68. Xia discloses a network with multiple routers. Ex. 1009, 2:46-48; Ex. 1003, 69. Each router can be a general purpose computer running software. Ex. 1009, 3:5-7; Ex. 1003, 69. The routers could also be implemented with firmware. Ex. 1009, 6:13-15; Ex. 1003, 69. In fact, Xia discloses and claims a computer readable medium containing instructions for execution by a processor that will control a router. Ex. 1009, claim 10; Ex. 1010, claim 13 of application as originally filed; Ex. 1003, 70. A POSITA would understand that a general purpose computer running software or firmware processor would include a nontransitory computer readable media. Ex. 1003, 71. Thus, as evidenced by Xia, a POSITA knew to use a computer program product including a non-transitory computer readable media that stores a first set of instructions executable on an intermediate network device (e.g., a router) for controlling the intermediate network device. Ex. 1003, 71. Wils describes the operation of the trunk switches in terms of pseudocode. Ex. 1005, 4:39-4:40. Pseudocode is used when making a high-level description of the operating principle of a computer program or other algorithm. Ex. 1003, 72. Thus, Wils itself implies that software code can be used to carry out the functionality of the switch. Ex. 1003,

39 A POSITA would have been led to implement any of the methods carried out by an intermediate network device (e.g., a trunk switch) of Wils using a computer program product including a non-transitory computer readable media that stores a first set of instructions executable on the intermediate network device as disclosed by Xia. Thus, Wils and Xia render obvious a computer program product, said computer program product comprising: a non-transitory computer readable media, wherein the non-transitory computer readable medium stores a first set of instructions, executable on an intermediate network device, configured to perform the operations discussed in [ ], supra. Reasons To Combine Wils and Xia A POSITA well understood, as of the Critical Date, that an advantage of software, e.g., over a hardware implementation such as an ASIC, is adaptability. Ex. 1003, 73. For example, a network switch in which the packet routing decisions are implemented using software can be reprogrammed with new routing logic. Ex. 1003, 73. A POSITA would have implemented the operations of the trunk arrangement of Wils using software or firmware, as implied by the pseudocode mentioned by Wils and as disclosed by Xia, because it would have amounted to the use of a known technique to improve similar devices in the same way. See KSR, 550 U.S. at 417 (2007); MPEP 2141 I(C). Ex. 1003, 74. Xia is similar to Wils 35

40 because both concern networks with multiple intermediate devices (routers or switches). Ex. 1003, 74. A POSITA would have been motivated to implement the operations of the trunk arrangement of Wils using software in order to have improved adaptability, e.g., to be able to reprogram the trunk switches with new switching logic. Ex. 1003, 74. Moreover, given that software implementations of routers were available, and that Wils describes the operations of the trunk switches with pseudocode, a POSITA would have a reasonable expectation of success in implementing the operations of the trunk switches of Wils using software. Ex. 1003, 74. Thus, a POSITA would have recognized that the trunk switches of Wils, when implemented using the computer program product taught by Xia, would achieve the same benefits, thus motivating the adoption of Xia s computer program product and rendering the combination predictable. Ex. 1003, 74. D. [Ground 4] Claims 13 and are obvious over the combination of Wils and Kunzinger in view of Xia under 35 U.S.C. 103 As discussed in [2.0], [6.0], [7.0], [8.0] and [9.0], the combination of Wils, Kunzinger provide the methods of claims 2 and 6-9. Claims 13 and are computer program product claims with limitations equivalent to those in claims 2 and 6-9, respectively. For example, where claim 2 recites comprising: tunneling said first LAN with a third LAN, claim 13 recites instructions, executable on said intermediate network device, configured to tunnel a first LAN with a third LAN. 36

41 Kunzinger discloses that its cascading tunneling can be carried out by computer program product embodied on computer-readable media. Ex. 1007, Abstract and claim 1. For the reasons discussed in [12.2], supra, a POSITA would have been led to implement any the methods of claims 2 and 6-9 by using a computer program product including a non-transitory computer readable media that stores a first set of instructions executable on the intermediate network device. Thus, Wils, Kunzinger, and Xia together render obvious a computer program product, said computer program product comprising: a non-transitory computer readable media, wherein the non-transitory computer readable medium stores a first set of instructions, executable on an intermediate network device, configured to perform the operations discussed in [2.0], [6.0], [7.0], [8.0] and [9.0], supra. See Ex. 1003, 80. Although claim 13 recites a second set of instructions, the 211 Patent does not prohibit the first and second sets of instructions from overlapping or otherwise require that the sets of instructions be distinct. Similarly, although claims recite first, second and third sub-sets of instructions, the 211 Patent does not prohibit these subsets from being the same as their respective set, or prohibit the subsets from overlapping with each other, or otherwise require that the subsets of instructions be distinct. Ex. 1003, 81. Moreover, even if the claims did require that that the sets or subsets be distinct, it would have been obvious to have 37

42 the different functionality implemented in distinct sets or subsets of instructions in the computer program product. Ex. 1003, 82. E. [Ground 5] Claims 1 and 12 are anticipated by Perloff under 35 U.S.C. 102 Claim 1 - [1.0]: A method comprising: aggregating a plurality of LANs, Aggregating includes trunking or grouping multiple LANs into one logical link. See Section V(2), supra. LAN includes a physical connection to one or more hosts or a link. See Section V(1), supra. Perloff describes a method and a computer program product for a computer network system that aggregates together multiple LANS (e.g., links) to provide a single aggregated link with increased bandwidth. Ex. 1006, 1:16-18 and 1:55-57; Ex. 1003, 83. Perloff discloses that the load is shared on the aggregated links, and that the aggregated links use a combination of speeds of the individual links. Ex. 1006, 6:47-49 and 2:9-13. As such Perloff discloses aggregation to provide an increased bandwidth of the single link that has the capacity of all the links combined. Ex. 1003, 83. [1.1] wherein said aggregating comprises aggregating a first LAN and a second LAN, said first LAN couples a host to a first intermediate device and said second LAN couples said host to a second intermediate network device, said plurality of LANs comprising said first LAN and said second LAN, A host includes an end-station. See Section V(3), supra. Perloff describes that the network includes one or more hosts (e.g., end nodes). Ex. 1006, 3:54-58 and 3:66-4:1; Ex. 1003, 84. In particular, Perloff describes a network that 38

43 includes multiple LAG partner devices, such as a computer 402, server 406 and printer 408. Ex. 1006, 8:21-8:22; Ex. 1003, 85. In addition, comparing Perloff and the 211 Patent, given the same positions of the end nodes and end-station relative to the aggregated links, a POSITA would understand that the terms endstation and end nodes are synonymous. Ex. 1003, 84. Devices such as the computer 402, server 406, printer 408 and server 420 are the source or destination of information, and as such are the end-nodes discussed by Perloff. Id., 85. Thus, a POSITA would understand that the various devices such as computer 402, server 406, printer 408 and server 420 are end-stations, i.e., hosts. Perloff describes that the network includes a plurality of links, e.g., links 118a,b,c and 120a,b,c, which can be physical information carrying media. Ex. 1006, 4:10-4:14 and 8:22-8:25; Ex. 1003, 86. Perloff also describes that the network includes two MDLA devices 102, 104, which can be switches or routers. Ex. 1006, 4:35-4:39; Ex. 1003, 87. Because each MDLA device can be a switch or router and is used to connect the physical information carrying media of several links, e.g., links 118a-118c or 120a-120c, each MDLA device is an intermediate network device. Ex. 1003, 87. Thus, Perloff includes a first intermediate device, e.g., the first MDLA device 102, and a second intermediate network device, e.g., the second MDLA 104. Ex. 1003,

44 As shown in the annotated FIG. 1 below, the first MDLA device 102 is coupled to computer 402 by a first link 118c, and the second MDLA device 104 is coupled to computer 402 by a second link 120c. Ex. 1003, 89. First Intermediate Network Device Second Intermediate Network Device First Link Second Link End node Thus, Perloff discloses a first LAN (the first link 118c) that couples a host (computer 402, an end node) to a first intermediate device (first MDLA device 102) and a second LAN (the second link 120c) that couples the host (computer 402) to a second intermediate network device (second MDLA device 104). See Ex. 1003,

45 Perloff also describes that the plurality of links, including the first link and the second link, are aggregated. Ex. 1006, 8:8-8:17; Ex. 1003, 90. For example, the first and second MDLA devices are able to trick the detected devices into behaving as though the two MDLA devices are a single device (Ex. 1006, Abstract), whereas the partner devices transparently aggregate links to the two MDLA devices. Ex. 1006, 4:15-17; Ex. 1003, 90. [1.2] and subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device. Perloff discloses that each device would send packets through each link within the aggregated logical link. Ex. 1006, 1:65-2:2; Ex. 1003, 91. This permits the network to perform load sharing and load balancing. Ex. 1006, 1:59-63; Ex. 1003, 91. Thus, both the first link 118c and the second link 120c (see annotated Figure 1, below) are usable to simultaneously transmit packets from computer 402 to the first MDLA device 102 and the second MDLA device 104. Ex. 1003,

46 In addition, Perloff discloses that links can fail. Ex. 1006, 2:24-25; Ex. 1003, 92. For example, link 454 between the first MDLA device 102 and the server 120 can fail. Ex. 1006, 11: The MDLA devices are configured such that if one link fails, data is sent through an internal link from one MDLA device to another, and then on to an end system. Ex. 1003, 92. For example, if link 454 were to fail, data from aggregated links 118a-d would be sent from MDLA device 102 through internal MDLA link 110 to MDLA device 104 and through link 450 to server 420. Ex. 1006, 11:20-23; Ex. 1003,

47 When link 454 fails, packets travel from the computer 402, through the first MDLA device 102, to the second MDLA device 104. Annotated FIG. 5 below shows this situation (in yellow and green). Ex. 1003, 93. As previously discussed, the first link and the second link are usable to simultaneously transmit packets from computer 402 to the first MDLA device 102 and the second MDLA device 104. Ex. 1003, 95. Since the packets sent to the first MDLA device 102 are forwarded to the second MDLA device 104, both the link 118c and the link 120c are useable simultaneously to send packets to the second MDLA device 104. Ex. 1003,

48 Consequently, Perloff performs a method in which, after aggregation, the first LAN (e.g., link 118c) and the second LAN (e.g., link 120c) are both usable to simultaneously send information (packets) from a host (the computer 402, an end node) to the second intermediate network device (the second MDLA device 104). See Ex. 1003, 95. Claim 12 - [12.0]: A computer program product, said computer program product comprising: a non-transitory computer readable media, wherein the non-transitory computer readable medium stores a first set of instructions, executable on an intermediate network device, configured to aggregate a plurality of LANs, As described in [1.0], Perloff describes an intermediate network device configured to aggregate a plurality of LANs. For discussion of [a] computer program product instructions, executable on an intermediate network device, see [12.2], below. [12.1] wherein said first set of instructions is configured to aggregate a first LAN and a second LAN, said first LAN couples a host to a first intermediate device and said second LAN couples said host to a second intermediate network device, said plurality of LANs comprising said first LAN and said second LAN, As described in [1.2], Perloff describes aggregating a first LAN and a second LAN, where the first LAN couples a host to a first intermediate [network] device and the second LAN couples the host to a second intermediate network device, with the plurality of LANs including the first LAN and the second LAN. 44

49 [12.2] and subsequent to said aggregating, said first LAN and said second LAN are both usable to simultaneously transmit information from said host to said second intermediate network device As described in [1.2], Perloff describes subsequent to aggregating, the first LAN and the second LAN are both usable to simultaneously transmit information from the host to the second intermediate network device. Perloff also discloses that any of the functional components, e.g., the various methods, can be implemented in software or firmware, such as a computer program product in a tangible machine readable medium. Ex. 1006, 12:40-62; Ex 1003, 96. Thus, Perloff discloses that the method described above could be implemented as a computer program product which is a non-transitory computer readable media that stores a set of instructions, executable on an intermediate network device. Ex 1003, 97. Consequently, Perloff discloses a computer program product, said computer program product comprising: a non-transitory computer readable media, wherein the non-transitory computer readable medium stores a first set of instructions, executable on an intermediate network device, configured to perform the operations discussed in [ ], supra. F. [Ground 6] Claims 2, 6-9, 13 and are obvious over Perloff in view of Kunzinger under 35 U.S.C. 103 Claim 2 - [2.0]: The method of claim 1, further comprising: tunneling said first LAN with a third LAN through said first intermediate network device, said plurality of LANs comprising said third LAN. 45

50 Third LAN. Perloff discloses an MDLA internal link 110 that is used to transmit data between the MDLA devices. Ex. 1006, 4:39-40; Ex 1003, 99. The MLDA internal link 102 can use the IEEE ad LACP standard. Ex. 1006, 4: Because both the internal link 110 and the links 118a-118c, 120a-120c use the same IEEE ad LACP standard, the internal link 110 provides a third LAN (e.g., link) that that is one of the plurality LANS that includes the first LAN (link 118c) and the second LAN (e.g., link 120c). Ex 1003, 98 Tunneling. Tunneling includes transmitting a frame without examination. See Section V(5), supra. Tunneling was a well-known method of transmitting packets through a network as of Critical Date. Ex. 1003, 46. As discussed in VI(B)[2.0], one form of tunneling is to encapsulate packets of data as they are traveling over a communication link, so that the encapsulated packet is forwarded based on consideration of the encapsulation rather than, for example, examination of the MAC or IP address of the frame itself, resulting in transmission of a frame without examination. As of the Critical Date of the 211 patent, techniques were known to create tunnels that, when employed on the network taught by Perloff in the use cases discussed in [1.2], would result in tunneled frames being transmitted through the first MDLA 102 from computer 402 to the second MDLA 104. Ex. 1003,

51 Kunzinger discloses a method, system and computer program product for providing end-to-end protection within a computer network. Ex. 1007, Abstract. In particular, Kunzinger discloses a technique to establish cascading tunnels to protect data through an entire network path, including network segments that would conventionally be assumed to be secure. Ex. 1007, Abstract. As discussed in VI(B)[2.0] above, Kunzinger discloses that tunnels can be implemented using the IPSec Internet protocol (IPSec). Ex 1007, Abstract, 3:7-10; Ex. 1003, 50. The IPSec protocol includes a tunnel mode in which a tunnel is created from host to host over either an internet or an intranet. Ex. 1008, page 24, Ex. 1007, 2:57-64; Ex. 1003, 49. As described by Kunzinger, tunneled packets in IPSec, and consequently Kunzinger, have an outer IP header whose source and destination addresses identify the endpoints of the tunnel, and an inner IP header whose source and destination addresses identify the originator and recipient of the packet. Ex 1007, 3:7-10. Kunzinger also discloses that by operating in the tunnel mode, both the inner header and the payload of the entire packet is protected. Ex. 1007, 1:46-49 ( When IPSec is used in tunnel mode, the complete inner packet, which is comprised of both the inner header and the payload, is protected as the packet travels through the tunnel ); Ex. 1003, 51. As the packet travels through the tunnel, frames are forwarded based on consideration of the outer header from the 47

52 encapsulation rather than, for example, examination of the MAC or IP address of the inner header. Ex. 1008, Section 4.4.2; Ex. 1007, 3:13-14; Ex. 1003, 51. As discussed in VI(B)[2.0] above, Kunzinger describes that it is well known in the art that tunnels are used by IPSec to provide a secure exchange over a path through a non-secure network, and that IPSec can be deployed on either a public network such as the Internet or a private network such as a corporate intranet. Ex. 1007, 2:41-44, 2:53-57, Ex. 1003, 52. And as discussed in VI(B)[2.0] above, Kunzinger affirmatively asserts that security is needed even within corporate intranets. Ex 1007, 3:56-58, 3:63-65; Ex. 1003, 52. As noted in [1.1], Perloff includes multiple end nodes, such as computer 402, server 406 and printer

53 Given the warnings of Kunzinger that even corporate intranets are vulnerable, it would have been obvious for a POSITA to establish a secure connection from computer 402 to another device, such as server 420, using a tunnel as described by Kunzinger. Ex. 1003, 101. In the case described in [1.2], such a connection is depicted in the annotated figure above. In this scenario, a tunnel would extend through each link and device between the computer 402 and the server 420. That is, there would be tunneling of the first link 118c with the internal link 110, and the tunneling would go through the MDLA 102. Ex. 1003,

54 Moreover, even apart from providing security within an intranet, there would still be reasons to modify Perloff to include tunneling of Kunzinger. Perloff describes that one of the LAG partner devices is a router 424 that is further connected to the Internet. Ex. 1006, 8:32-8:35; Ex. 1003, 102. If link 460 were to fail, an obvious possible mode of operation would be for data to continue to be sent through aggregated links 118a-d to the first MDLA device 102, and this data would be forwarded to the second MLDA device 104, and then to router 424 to the Internet 418. Ex. 1003, 102; Ex. 1006, 11:20-23 and 11: In such a case, it would have been obvious for a POSITA to establish a secure connection from computer 402 to a host (H) on a network connected to the Internet 418. Ex. 1003, 102. Such a connection is depicted in the annotated figure below. In this example, a tunnel would extend through each link and device between the computer 402 and the eventual host H. That is, there would be tunneling of the first link 118c with the internal MDLA link 110, and the tunneling would go through the first MDLA device 102. Ex. 1003,

55 As a result, a POSITA would have been led to modify Perloff to incorporate the tunnel of Kunzinger. Thus, Perloff and Kunzinger render obvious tunneling the first LAN (link 118c) with a third LAN (internal MDLA link 110) through the first intermediate network device (the first MDLA device 102). Reasons To Combine Perloff and Kunzinger A POSITA would have modified Perloff to incorporate the tunnel of Kunzinger, because the combination amounts to the use of a known technique to improve similar devices in the same way. See KSR, 550 U.S. at 417; MPEP

56 I(C). As described above, Kunzinger describes that the IPSec protocol can be used to improve security of communications by a tunnel through an intranet. Ex. 1007, 1: Kunzinger is similar to Perloff because both concern operation of a communication network with multiple devices. Ex. 1003, 104. In addition, Kunzinger motivates creation of a tunnel from a host, such as the computer 402 of Perloff, to another host on the same intranet, such as the edge server 420 of Perloff. Ex. 1003, 104. Specifically, as discussed in VI(B)[2.0] above, Kunzinger explains that intranets should not be assumed to be secure. Ex. 1007, 3: A POSITA would have recognized that the computer network of Perloff suffers from the same problems identified by Kunzinger. Ex. 1003, 104. Through Kunzinger s discussion of this problem and the benefit of the solutions proposed, which were understood as of the Critical Date, a POSITA would have been motivated to modify the computer network of Perloff to use tunneling between two hosts, as taught by Kunzinger. Ex. 1003, 104. A POSITA would have recognized that the computer network of Perloff, when modified by Kunzinger, would achieve the same benefits, thus motivating adoption of the tunnel of Kunzinger in Perloff and rendering the combination predictable. Ex. 1003, 104. Similarly, Kunzinger motivates creation of a tunnel from a host, such as the computer 402 of Perloff, to a host on the unsecured Internet 418. Specifically, 52

57 Kunzinger identifies a problem of non-secure networks (such as the public Internet or corporate extranets). Ex. 1007, Abstract. A POSITA would have recognized that the computer network of Perloff connected to Internet 418 suffers from the same problems identified by Kunzinger. Ex. 1003, 105. Through Kunzinger s discussion of this problem and the benefit of the solutions proposed, which were understood as of the Critical Date, a POSITA would have been motivated to modify the computer network of Perloff to include a tunnel between LAG partner device, e.g., computer 402, and a host on a separate unsecured network such as Internet 418, as taught by Kunzinger. Ex. 1003, 105. A POSITA would have recognized that the computer network of Perloff, when modified by Kunzinger, would achieve the same benefits, thus motivating adoption of the tunneling of Kunzinger in Perloff and rendering the combination predictable. Ex. 1003, 105. Claim 6 - [6.0] The method of claim 2 wherein said aggregating comprises: aggregating a first and a second port of said second intermediate network device, wherein said first port is coupled to said first intermediate network device over said third LAN, and said second port is coupled to said host over said second LAN. Perloff discloses that an MDLA device includes multiple ports. Ex. 1006, 6:64-67; Ex. 1003, 106. In particular, Perloff discloses that port 320Y is connected to a LAG partner device by an aggregated link, and port 320X is connected by the internal link 110 to the other MDLA device. Ex. 1006, 6:67-7:3; 53

58 Ex. 1003, 106. Thus, referring to annotated FIGS. 3 and 4 below, considering the case of the second MDLA device and the computer 402, Perloff provides a second intermediate network device (second MDLA device 104) that includes a first port (green, port 320X) that is coupled to the first intermediate network device (first MDLA device 102) over a third LAN (green, internal link 110), and a second port (blue, port 320Y) that is coupled to a host (computer 402, an end node) over the second LAN (blue, link 120c). Ex. 1003, 106. As discussed above, Perloff discloses that when link 454 fails, packets are sent from computer 402 both along the link 120c to the second MDLA device 104, and along the link 118c and internal link 110 to the second MDLA device 104. Ex. 1003, 107. Consequently, data is received at the second MDLA device from computer 402 through both the first port (port 320X) and the second port (port 320Y). Ex. 1003, 107. The data from both the first port and the second port needs 54

59 to be output on a single port (e.g., purple port) for a single link 450 (purple) to be sent to the server 420. Ex. 1003, 107. Thus, the data link 450 carries a combination of data from both the first port and the second port. Ex. 1003, 107. In addition, the bandwidth depends on the total bandwidth from both the first port and the second port, and the first and second MDLA devices are still tricking the computer 402 into behaving as though the two MDLA devices are a single device. Ex. 1003, 107. Therefore, Perloff discloses a system in which the first port (port 320X) and the second port (port 320Y) are being aggregated. Ex. 1003, 107. Claim 7 - [7.0] The method of claim 2, wherein said tunneling comprises: configuring a pass-through path on said first intermediate network device. A pass-through path includes a path through which something passes. See Section V(6), supra. In the event that link 454 fails, data received at the MDLA device 102 through the links 108a-d is sent from the MDLA device 102 through the internal link 110 to MDLA device 104. Ex. 1003,

60 In addition, FIG. 3, annotated supra, shows a path for data to travel through the MDLA device 102, namely from the port 320Y, through the backplane 325 and MDLA device processing engine 310, to the port 320X. Therefore, in the event of a link failure, a path (backplane 325 and MDLA device processing engine 310) for data to pass through the first intermediate network device (MDLA device 102) is configured. See Ex. 1003, 108. When Perlof is modified as taught by Kunzinger, as described in [2.0], the tunnel would extend along this path. Ex. 1003, 108. Therefore, the combination of Perloff and Kunzinger would provide tunneling that includes configuring a path through which information passes on the first intermediate network device (the first MDLA device 102). See Ex. 1003,

61 Claim 8 - [8.0] The method of claim 7, wherein said tunneling further comprises: coupling a first port of said first intermediate network device to a second port of said first intermediate network device. As previously discussed, Perloff discloses that in the event of the failure of link 454, data received at the MDLA device 102 through the links 108a-d is sent from the MDLA device 102 through the internal link 110 to MDLA device 104. Ex. 1003, 109. As shown in the annotated FIG. 3 below, the port 320Y is connected to the port 320X by DMLA device 310 and backplane 325. Ex. 1003, 109. Thus, in the event of a failure of link 454, data is sent through from the port for the LAG partner device (port 320Y) to the port for the MDLA internal link (port 320X). Ex. 1003, 109. Consequently, a POSITA would understand that in the event of a link failure, a first port (e.g., port 320Y) is coupled to a second port (e.g., port 320X) in the first MDLA device 102. Ex. 1003, 109. When Perloff is modified as taught by Kunzinger, as described in [2.0], the tunnel would include this coupling. Ex. 1003, 109. Therefore, Perloff as 57