IN THE UNITED STATES PATENT AND TRADEMARK OFFICE. Filing Date: Nov. 27, 2002 CONTROL PLANE SECURITY AND TRAFFIC FLOW MANAGEMENT

Transcription

1 IN THE UNITED STATES PATENT AND TRADEMARK OFFICE In re Patent of: Smethurst et al. U.S. Patent No.: 7,224,668 Issue Date: May 29, 2007 Atty Docket No.: IP1 Appl. Serial No.: 10/307,154 Filing Date: Nov. 27, 2002 Title: CONTROL PLANE SECURITY AND TRAFFIC FLOW MANAGEMENT Mail Stop Patent Board Patent Trial and Appeal Board U.S. Patent and Trademark Office P.O. Box 1450 Alexandria, VA PETITION FOR INTER PARTES REVIEW OF UNITED STATES PATENT NO. 7,224,668 PURSUANT TO 35 U.S.C , 37 C.F.R. 42

2 TABLE OF CONTENTS Attorney Docket No IP1 I. MANDATORY NOTICES UNDER 37 C.F.R 42.8(a)(1)... 1 A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1)... 1 B. Related Matters Under 37 C.F.R. 42.8(b)(2)... 1 C. Lead And Back-Up Counsel and Service Information... 1 II. PAYMENT OF FEES 37 C.F.R III. REQUIREMENTS FOR IPR UNDER 37 C.F.R A. Grounds for Standing Under (a)... 2 B. Challenge Under (b) and Relief Requested... 2 IV. SUMMARY OF THE 668 PATENT... 4 A. Brief Description... 4 B. Level of Ordinary Skill in the Art as of the Critical Date... 7 V. CLAIM CONSTRUCTION... 8 A-1. specific, predetermined physical ports... 9 A-2. means for configuring a plurality of physical network interface ports (cl. 37) A-3. means for executing port services on packets entering and exiting the physical network interface ports (cl. 37) A-4. means for executing a plurality of control plane processes (cl. 37).. 11 A-5. means for accessing the collection of control plane processes as a control plane port entity (cl. 37) A-6. means for operating on packets received from specific, predetermined physical ports and destined to the collection of control plane processes in a way that is independent of the individual physical port interface configuration and port services applied thereto (cl. 37) A-7. means for processing packets originating at a plurality of physical ports, said means further comprising: means for passing packets through the control plane port, rather than directly from the physical ports to individual control plane processes (cl. 38) A-8. means for applying distributed control plane port services only to the packets received from the specific, pre-determined physical ports (cl. 43).. 13 i

3 A-9. means for applying port services to the control plane port additionally comprises means for applying services selected from a group consisting of Quality of Service functions, packet classification, packet marking, packet queuing, packet rate limiting, flow control, and other access policies for packets destined to the control plane port (cl. 53) A-10. means for configuring the control plane port services as an entity separate from physical port services (cl. 54) VI. MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH IPR IS REQUESTED, THUS ESTABLISHING A REASONABLE LIKELIHOOD THAT AT LEAST ONE CLAIM OF THE 668 PATENT IS UNPATENTABLE A. [Ground 1A] Claims 1-6, 8, 9, 15-22, 24-27, 33-40, 42, 45-47, 51-58, 60-63, and are anticipated by Amara under 35 U.S.C B. [Ground 2A] Claims 7, 23, 41, 59 are obvious over Amara in view of Moberg under 35 U.S.C C. [Ground 3A] Claims 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, and 67 are obvious over Amara in view of Subramanian under 35 U.S.C D. [Ground 4A] Claims 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, and 67 are obvious over Amara in view of Hendel under 35 U.S.C E. [Grounds 1B, 2B, 3B, and 4B] All Challenged Claims VII. CONCLUSION ii

4 EXHIBITS ARISTA-1001 U.S. Patent No. 7,224,668 to Smethurst et al. ( the 668 Patent ) ARISTA-1002 ARISTA-1003 ARISTA-1004 ARISTA-1005 ARISTA-1006 ARISTA-1007 ARISTA-1008 ARISTA-1009 ARISTA-1010 Declaration of Dr. Bill Lin Curriculum Vitae of Dr. Bill Lin U.S. Patent No. 6,674,743 ( Amara ) U.S. Patent No. 6,460,146 ( Moberg ) U.S. Patent No. 6,970,943 ( Subramanian ) U.S. Patent No. 6,115,378 ( Hendel ) IETF RFC 2661, Layer Two Tunneling Protocol L2TP ( IETF RFC 2661 ) IETF RFC 792, Internet Control Message Protocol ( IETF RFC 792 ) Joe Habraken, Practical Cisco Routers, QUE Corporation, 1999 ( Habraken ) iii

5 Arista Networks, Inc. ( Petitioner or Arista ) petitions for Inter Partes Review ( IPR ) under 35 U.S.C and 37 C.F.R. 42 of claims 1-10, 12, 13, 15-28, 30, 31, 33-43, 45-49, 51-64, 66, 67, and ( the Challenged Claims ) of U.S. Patent No. 7,224,668 ( the 668 Patent ). As explained below, there exists a reasonable likelihood that Petitioner will prevail in demonstrating unpatentability of the Challenged Claims. I. MANDATORY NOTICES UNDER 37 C.F.R 42.8(a)(1) A. Real Party-In-Interest Under 37 C.F.R. 42.8(b)(1) Arista Networks, Inc. is the real party-in-interest. B. Related Matters Under 37 C.F.R. 42.8(b)(2) Petitioner is not aware of any disclaimers, certificates or petitions for inter partes review for the 668 Patent. The 668 Patent is the subject of Civil Action No. 4:14-cv-5343-JSW, filed December 5, 2014 in the Northern District of California, and International Trade Commission Investigation No. 337-TA-945, instituted on January 20, C. Lead And Back-Up Counsel and Service Information Petitioner designates W. Karl Renner, Reg. No. 41,265, as Lead Counsel, and Kevin E. Greene, Reg. No. 46,031, as Backup Counsel, both available at 3200 RBC Plaza, 60 South Sixth Street, Minneapolis, MN (T: ; F: ), or electronically by at IPR IP1@fr.com. 1

6 II. PAYMENT OF FEES 37 C.F.R Attorney Docket No IP1 Petitioner authorizes the Patent and Trademark Office to charge Deposit Account No for the fee set in 37 C.F.R (a) for this Petition and further authorizes for any additional fees to be charged to this Deposit Account. III. REQUIREMENTS FOR IPR UNDER 37 C.F.R A. Grounds for Standing Under (a) Petitioner certifies that the 668 Patent is available for IPR. Petitioner was served with a complaint alleging infringement of the 668 Patent on December 9, The petition is being filed within one year of service of Petitioner. Petitioner is not barred or estopped from requesting this review on the below-identified grounds. B. Challenge Under (b) and Relief Requested Petitioner requests IPR of the Challenged Claims on the grounds set forth in the table below, and requests that the Challenged Claims be found unpatentable. An explanation of unpatentability is provided, indicating where each element is found in the prior art. Additional explanation and support for each ground is set forth in Ex. 1002, Declaration of Dr. Bill Lin. In the A grounds, the Petitioner demonstrates that the Challenged Claims are unpatentable based on Amara or combinations involving Amara. In doing so, the Petitioner uses expert testimony, corroborated by disclosure in, e.g., Habraken, to demonstrate that a POSITA would recognize certain features are implicitly or 2

7 inherently disclosed by Amara. The Patent Owner may nevertheless contend those features are not disclosed. The B grounds propose obviousness for those features that, even though a POSITA would recognize their existence in Amara, the Patent Owner may nevertheless argue are not disclosed. Institution of both the A and B grounds will ensure consideration of the prior art fully on the merits. Meanwhile, the amount of additional work required by institution of both is minimal, such that the one-year Congressional mandate would be easily observed despite institution of both. Ground 668 Patent Claims Basis for Rejection 1A 1-6, 8, 9, 15-22, 24-27, 33-40, Amara - 35 U.S.C , 45-47, 51-58, 60-63, B 1-6, 8, 9, 15-22, 24-27, 33-40, 42, 45-47, 51-58, 60-63, Amara, Habraken - 35 U.S.C A 7, 23, 41, 59 Amara, Moberg - 35 U.S.C B 7, 23, 41, 59 Amara, Moberg, Habraken - 35 U.S.C A 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, 67 3B 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, 67 4A 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, 67 4B 10, 12, 13, 28, 30, 31, 43, 48, 49, 64, 66, 67 Amara, Subramanian - 35 U.S.C. 103 Amara, Subramanian, Habraken - 35 U.S.C. 103 Amara, Hendel - 35 U.S.C. 103 Amara, Hendel, Habraken - 35 U.S.C

8 The 668 Patent issued from U.S. application number 10/307,154, which was filed on November 27, Because the 668 Patent does not include a priority claim, the filing date of November 27, 2002 (hereinafter the Critical Date ) is the earliest possible priority date to which this patent is entitled. Amara (ARISTA-1004), Moberg (ARISTA-1005), and Subramanian (ARISTA-1006) were filed before but issued/published after the Critical Date and thus are prior art under 35 U.S.C. 102(e). Hendel (ARISTA-1007) and Habraken (ARISTA-1010) each issued/published more than a year before the Critical Date and thus each qualifies as prior art under 35 U.S.C. 102(b). IV. SUMMARY OF THE 668 PATENT A. Brief Description The 668 Patent describes an internetworking device, such as a router, that routes packets received at the device towards their destination. A device 100 of the 668 Patent is illustrated in Figure 1: 4

9 Device 100 includes two logical components: a data plane 135 and a control plane 150. Ex. 1001, 3:22-34; 5:5-21. The data plane 135 is composed of physical interface ports 120, line cards 110, and a central switch engine 130. Id. at 5:5-9. The data plane 135 passes along, or forwards, packets received at the port interfaces 120 toward their ultimate destination. Id. at 1:54-56; 3:23-26; 5:8-9. The control plane 150 is a collection of processes 155 and is responsible for higher layer functions of the device, such as control and configuration of device 100. Id. at 1:56-59; 3:26-31; 4:58-61; 5: Device 100 applies port services to packets passing through device 100. Id. at 6:1-44; 6:67-7:14. Port services are a set of policies or rules that are applied to the packets. Id. at 4:3-8; 6:4-7; 6:24-27; 9:1-4. Port services may include Quality of Service processing or packet rate-limiting. Id. at 4:6-8; 6:4-23. For example, one policy may be to rate limit Telnet SYN packets to a specific rate that is a tolerable rate determined through a specific hardware configuration. Id. at 4:6-8. Port services may be defined using class maps, policy maps, or access control lists. Id. at 7:19-20; 7: Device 100 applies different port services to different packet types. Id. at 3:56-58; 6:16-18; 6: Some of the packets received by the internetworking device are normal transit packet[s], which are destined for other devices connected to the internetworking device. Id. at 7:3-8. Other packets, however, are 5

10 control plane packets, which are packets destined for the control plane so that the control plane can provide control and configuration of the internetworking device. Id. at 6:57-63; 5:56-58; 7:8-14. Device 100 includes normal input and output port services that are applied to normal transit packets. Id. at 6: Device 100 also includes control plane port services that are specifically for control plane packets. Id. at 7:5-14; 9:1-6. These control plane port services are applied to only packets destined to the control plane and not to normal transit packets that are forwarded out of the device. See, e.g., id. at 3:56-58; 6:16-18; 6:41-43; 7:5-14. To this end, device 100 includes the control plane port services 145 and a control plane port 140. The control plane port 140 may or may not be a single physical port. Id. 5:1-2. For example, it may be a virtual address through which packets travel or are routed from the data plane 135 to the control plane 150. Id. at 5:2-4. The packets bound for the control plane 150 are routed through the control plane port 140. Id. at 7:5-12; 9:1-6. The control plane port services 145 are applied to only those packets routed through the control plane port 140. Id. at 6: During operation, a packet enters device 100 through one of the interface ports 120. Id. at 4: The associated line card [110] detects [the] packet and delivers it to the central switch engine 130, which makes a routing decision. Id. at 6:66-7:4. In the case of a normal transit packet, the packet would be routed to a 6

11 destination port 120 on an associated line card 110 and the control plane port services 145 are not applied to the packet. Id. at 7:5-7. If, however, the packet is destined for a known control plane 150 address, or to an address not on a forwarding table 160, the packet is tagged as being destined to [the] control plane port. Id. at 7:8-11. The packet is then routed through the aggregate control plane port 140 and the aggregate control plane port services [145 are applied to] the packet. Id. 7: Because the control plane port services are applied to only packets passing through the control plane port, these services are applied to only control plane packets and not to normal transit packets forwarded out of the device. See, e.g., id. at 3:56-58; 6:16-18; 6:41-43; 7:5-14. B. Level of Ordinary Skill in the Art as of the Critical Date A person of ordinary skill in the art as of the Critical Date of the 668 Patent (hereinafter a POSITA ) would have had a Masters of Science Degree (or a similar technical Masters Degree, or higher degree) in an academic area emphasizing computer networking or, alternatively, a Bachelor Degree (or higher degree) in an academic area emphasizing the design of electrical, computer, or software engineering and having several years of experience in computer network engineering and the design of computer networks. Additional education in a relevant field, such as computer science, computer engineering, or electrical engineering, or industry experience may compensate for a deficit in one of the 7

12 other aspects of the requirements stated above. Unless noted otherwise in this Petition, references to what would have been known or understood by a POSITA refers to the knowledge of a POSITA as of the Critical Date, or before. V. CLAIM CONSTRUCTION A claim subject to IPR is given its broadest reasonable construction in light of the specification of the patent in which it appears. 37 C.F.R (b). For this proceeding only, Petitioner submits constructions for the following terms. All remaining terms should be given their broadest reasonable meaning. 1 1 Petitioner s claim construction proposals are for the sole purpose of determining whether the prior art anticipates or renders obvious the Challenged Claims. Neither by making these proposals, nor by analyzing the cited art, does Petitioner concede that any Challenged Claim meets statutory standards for patent claiming. Petitioner recognizes that IPR is not an appropriate forum to address certain issues, such as failure to comply with 35 U.S.C. 112, and, therefore reserves all rights to contend that one or more Challenged Claims are invalid for reasons out of scope for IPR, including but not limited to lack of definiteness under 112, 2 and lack of written description under 112, 1. The presence of definiteness and description problems in the Challenged Claims is no bar to IPR in appropriate circumstances; 8

13 A-1. specific, predetermined physical ports Under the broadest reasonable interpretation standard, this term should be construed broadly enough to encompass all of the ports of the internetworking device, rather than being limited to a subset of the ports. The 668 Patent does not provide an explicit definition for the term specific, predetermined physical ports. Under a broadest reasonable interpretation, the terms specific and predetermined are themselves not necessarily limited to a subset of items. As a result, applying the broadest reasonable interpretation standard, the terms specific and predetermined do not limit the physical ports to a subset of less than all physical ports. The dependent claims are instructive on this point. Claim 8 (dependent on claim 1) specifies that the control plane port services are implemented as an aggregate control plane function, which is apparently related to a case in which control plane port services are applied to all of the ports of the device. Ex. 1001, 4:24-25; 6:48-61 ( The central, aggregate control plane services 145 provide a the Board may set aside such issues when reviewing claims under 102 and 103. E.g., Vibrant Media, Inc. v. Gen l Elec. Co., IPR , 2014 WL , at *6 7 (Patent Tr. & App. Bd. July 28, 2014). 9

14 10 Attorney Docket No IP1 level of service (or control) for all packets received from any port on the device 100 ). Since claim 8 is dependent on claim 1 and therefore should be encompassed by claim 1, the term specific, predetermined physical ports under the broadest reasonable interpretation should have a construction that can encompass all of the ports so as to include the scenario of claim 8. Accordingly, under the broadest reasonable interpretation standard, the term specific, predetermined physical ports should be construed broadly enough to encompass all of the ports of the internetworking device. The following limitations are subject to 35 U.S.C. 112, 6: A-2. means for configuring a plurality of physical network interface ports (cl. 37) The recited function is configuring a plurality of physical network interface ports. The 668 Patent does not clearly link sufficient structure to this function. Claim 37 states that the ports [are] configurable by control plane processes. According to the 668 Patent, these control plane 150 processes could be implemented as software at any level of a system. Ex. 1001, 4: A softwareimplemented means-plus-function element is indefinite unless the specification discloses the specific algorithm used to perform the recited function. Function Media, LLC v. Google, Inc., 708 F.3d 1310, 1318 (Fed. Cir. 2013). The 668 Patent does not disclose a specific algorithm for configuring a plurality of physical network interface ports.

15 While means-plus-function claims lacking corresponding structure are invalid under 35 U.S.C. 112, 2, special circumstances may permit the Board to nevertheless review claims for patentability under sections 102 and 103, while setting aside definiteness contentions. E.g., Vibrant Media, Inc. v. Gen l Elec. Co., IPR , 2014 WL , at *6 7 (Patent Tr. & App. Bd. July 28, 2014). Under Vibrant Media, for the purposes of assessing anticipation and obviousness in this proceeding, control plane processes should be considered the closest potentially corresponding structure. Ex. 1001, 5: A-3. means for executing port services on packets entering and exiting the physical network interface ports (cl. 37) The recited function is executing port services on packets entering and exiting the physical network interface ports. To the extent the 668 Patent discloses corresponding structure, that structure is a switch engine. Ex. 1001, Figs. 4 & 6, 6:67-7:2, 8:7-9. A-4. means for executing a plurality of control plane processes (cl. 37) The recited function is executing a plurality of control plane processes. To the extent the 668 Patent discloses corresponding structure, that structure is a processor. Ex. 1001, 4:58-60, 4:62-64, 5: A-5. means for accessing the collection of control plane processes as a control plane port entity (cl. 37) The recited function is accessing the collection of control plane processes as a control plane port entity. To the extent the 668 Patent discloses 11

16 corresponding structure, that structure is a control plane port. Ex. 1001, 3:48-50, 4:65-5:4, 8: A-6. means for operating on packets received from specific, predetermined physical ports and destined to the collection of control plane processes in a way that is independent of the individual physical port interface configuration and port services applied thereto (cl. 37) The recited function is operating on packets received from specific, predetermined physical ports and destined to the collection of control plane processes in a way that is independent of the individual physical port interface configuration and port services applied thereto. To the extent the 668 Patent discloses corresponding structure, that structure is a switch engine. Ex. 1001, Figs. 4 & 6, 8: A-7. means for processing packets originating at a plurality of physical ports, said means further comprising: means for passing packets through the control plane port, rather than directly from the physical ports to individual control plane processes (cl. 38) This limitation recites two functions: (1) processing packets originating at a plurality of physical ports and (2) passing packets through the control plane port, rather than directly from the physical ports to individual control plane processes. The claim further specifies that the control plane port additionally comprises the means for processing packets. The 668 Patent fails to disclose structure for these functions. The 668 Patent does not disclose any structure for the control plane port, much less any structure that is part of the control plane port that processes 12

17 packets or that passes packets through the control plane port. While means-plusfunction claims lacking corresponding structure are invalid under 35 U.S.C. 112, 2, if the apparent indefiniteness of claim 38 is set aside under Vibrant Media for the purposes of assessing anticipation and obviousness in this proceeding, a switch engine should be considered the closest potentially corresponding structure. See infra A-2; Ex. 1001, 6:65-7:12, 8: A-8. means for applying distributed control plane port services only to the packets received from the specific, pre-determined physical ports (cl. 43) The recited function is applying distributed control plane port services only to the packets received from the specific, pre-determined physical ports. To the extent the 668 Patent discloses corresponding structure, that structure is a switch engine. Ex. 1001, Fig. 6, 8: A-9. means for applying port services to the control plane port additionally comprises means for applying services selected from a group consisting of Quality of Service functions, packet classification, packet marking, packet queuing, packet rate limiting, flow control, and other access policies for packets destined to the control plane port (cl. 53) This limitation recites two functions: (1) applying port services to the control plane port and (2) applying services selected from a group consisting of Quality of Service functions, packet classification, packet marking, packet queuing, packet rate limiting, flow control, and other access policies for packets destined to the control plane port. To the extent the 668 Patent discloses 13

18 corresponding structure, that structure is a switch engine. Ex. 1001, Figures 4 & 6, 8: A-10. means for configuring the control plane port services as an entity separate from physical port services (cl. 54) The recited function is configuring the control plane port services as an entity separate from physical port services. To the extent the 668 Patent discloses corresponding structure, that structure is a control plane. Ex. 1001, 5: However, the control plane is a collection of processes and, according to the 668 Patent, these control plane 150 processes could be implemented as software at any level of a system. Infra, A-2; Ex. 1001, 4: The 668 Patent does not disclose a specific algorithm for configuring the control plane port services as an entity separate from physical port services, as required for a software implemented means-plus-function element. Infra, A-2. While means-plus-function claims lacking corresponding structure are invalid under 35 U.S.C. 112, 2, if the apparent indefiniteness of claim 54 is put aside under Vibrant Media for the purposes of assessing anticipation and obviousness in this proceeding, control plane processes should be considered the closest potentially corresponding structure. See infra A-2; Ex. 1001, 5:

19 VI. MANNER OF APPLYING CITED PRIOR ART TO EVERY CLAIM FOR WHICH IPR IS REQUESTED, THUS ESTABLISHING A REASONABLE LIKELIHOOD THAT AT LEAST ONE CLAIM OF THE 668 PATENT IS UNPATENTABLE As detailed below, this request shows a reasonable likelihood that the Requester will prevail with respect to the Challenged Claims of the 668 Patent. Overview of Amara A. [Ground 1A] Claims 1-6, 8, 9, 15-22, 24-27, 33-40, 42, 45-47, 51-58, 60-63, and are anticipated by Amara under 35 U.S.C. 102 Amara describes a packet-forwarding device, such as a router, that routes packets received at the device towards their destination. Ex. 1004, 1:9-21, 4:15-21; Ex. 1002, A device 200 of Amara is illustrated in Figure 3: Device 200 includes physical interface ports , packet classifiers , and a packet forwarder 222. Id. at Fig. 3; 5: The physical interface ports are able to transmit packets to and to receive packets from nodes [208-12], which may be either hosts or packet-forwarding devices, such as routers, 15

20 that are connected to device [200] via digital networks. Id. at 4: The packet classifiers and packet forwarder 222 operate together to pass along, or forward, packets received at the interface ports toward their ultimate destination. Id. at 5: Device 200 also includes internal applications 230 that run on device 200. The internal applications serve to control or configure [the] device [200]. Id. at 4: The internal applications communicate with other devices remote to device 100, through the use of protocols such as PPTP, L2TP, SNMP or Telnet. Id. at 4: Device 200 further includes policy engines and 232. Id. at Fig. 3. The policy engines and 232 apply policies to packets passing through device 200. Id. at 6:9-14. In general, the policies encompass any disposition of packets that involves more than simply routing them based on their destination addresses. Id. at 1: For example, the policies may include dropping [selected] packet[s], logging [selected] packet[s], encrypting or decrypting [selecting] packet[s], performing network address translation and/or port address translation on [selected] packet[s], and prioritizing [selected] packet[s] for QoS. Id. at 1:36-38; 5: Device 200 applies different policies to different packet types. Ex. 1002, 37. Some of the packets received by device 200 are external packets. Ex. 1004, 16

21 4:44-48, 4:61-63; Ex. 1002, 38. The external packets are those that are destined for devices other than device 200. Ex. 1004, 4:44-48, 4: In contrast, some of the received packets are internally-destined packets. Ex. 1004, 4:59-61, 5:5-6; Ex. 1002, 38. The internally-destined packets are those packets that are destined for internal applications 230. Ex. 1004, 4:59-61, 5:5-6. The policy engines execute and apply policies to external packets. Id. at 6: On the other hand, policy engine 232 executes and applies policies to the internally-destined packets. Id. at 6:9-12. Notably, policy engine 232 does not apply [its] policies to the external packets and, instead, [applies its policies] only to internal packets. Id. at 5:34-35; 5:43-44; 5: To this end, device 200 also includes an internal interface 220. Id. at 5: The internal interface 220 may be a pseudo interface implemented by software, rather than a physical interface. Id. at 4:67 to 5:2. The internallydestined packets (but not the external packets) received on interface ports are routed through the internal interface 220, which then forwards the internallydestined packets to policy engine 232. Id. at 5:63-67; Ex. 1002, 40. Because only internally-destined packets are routed through the internal interface 220 to policy engine 232, policy engine 232 applies its policies to only the internally-destined packets but not to the external packets. Ex. 1004, 5:33-35; 6:9-16; Ex. 1002,

22 Accordingly, during operation, packets enter device 200 through one of interface ports , and are passed to a corresponding packet classifier Ex. 1004, 4:55-59; 5: Packet classifiers classify the packets as either internally-destined packets or external packets. Id. at 4: If the packet classifiers determine the packet is an external packet, the packet classifiers forward the external packets to packet forwarder 222, which provides a routing functionality by determining to which of interfaces [202-06] to forward each packet. Id. at 5:28-31; 5: Once the packet forwarder determines the appropriate interface port , packet forwarder 222 forwards the packet to the corresponding interface port Id. at 6:3-8. On the other hand, if the packet is an internally-destined packet, the [p]acket classifiers forward the internally-destined packets to [the] internal interface 220. Id. at 5:58-60; 4: The internal interface 220 then forwards the internally-destined packets to internal applications 230 via policy engine 232. Id. at 5:63-67; 4:2-7. Policy engine 232 applies policies to the internally-destined packets and, if appropriate, forwards the packet to internal applications 230. Id. at 5:63-67; 6:9-12. Amara accordingly discloses the salient features of the 668 Patent, as illustrated in the following annotated Fig. 3: 18

23 As explained more fully below, this disclosure anticipates claims 1-6, 8, 9, 15-22, 24-27, 33-40, 42, 45-47, 51-58, Claims 1/19/37/55 [1.0]: An internetworking device ; [19.0]: A method for processing packets in an internetworking device comprising the steps of: ; [37.0]: A device for processing packets in an internetworking device comprising: ; and [55.0]: A computer readable storage medium containing instructions readable by a computer to configure the computer to perform a method for processing packets in an internetworking device comprising: Amara describes a packet-forwarding device 200. Ex. 1004, 4:15-21; Ex. 1002, 32. Like the 668 Patent, Amara discloses that device 200 may be a router. Ex. 1004, 4:15-21; Ex. 1002, 32. Device 200, for example, may be connected to another router or other device via a wide area network (WAN) and a host or other device via a local area network (LAN). Ex. 1004, 4:25-28; Ex. 1002, 34. Amara also discloses that device 200 processes and routes packets received at the device towards their destination. Ex. 1004, 4:15-21; 4:55-65; 5:25-32; Ex. 1002, 32. Amara therefore describes an internetworking device and a method [and device] for processing packets in an internetworking device. 19

24 Furthermore, a POSITA would have understood that a router is implemented, at least in part, using a computer readable medium, such as a memory, to store instructions that configure the router, and all of its components, to operate as expected. Ex. 1002, 47. Accordingly, Amara discloses a computer readable storage medium containing instructions readable by a computer to configure the computer to perform a method for processing packets in an internetworking device. [1.1]: a plurality of physical network interface ports, each for providing a physical connection point to a network for the internetworking device, the ports being configurable by control plane processes [19.1]/[37.1]/[55.1]: [means for] configuring a plurality of physical network interface ports, each port for providing a physical connection point into a network, and the ports being configurable by control plane processes; Amara discloses a plurality of physical network interface ports. In particular, device 200 of Amara includes physical network interface ports 202, 204, and 206. Ex. 1004, Fig. 3, 5:53-55; Ex. 1002,

25 Amara discloses that each of the physical network interface ports provide[s] a physical connection point to [or into] a network for the internetworking device. Specifically, interface ports are connected to nodes and are able to transmit packets to and receive packets from the nodes Ex. 1004, 5:53-55; Ex. 1002, 34. Interface ports can connect to the nodes , for example, through a wide area network (WAN) or local area network (LAN). Ex. 1004, 4:25-33; Ex. 1002, 34. The interface ports therefore each provide a physical connection point to a network for device 200. Amara also discloses that the ports are configured by control plane processes. As discussed below with respect to [1.3]/ [19.3]/[37.3]/[55.3], internal applications 230 of Amara correspond to control plane processes. Amara discloses that internal applications 230 serve to to [sic] control or configure device [200] and that device 200 may be a router. Ex. 1004, 4:15, A POSITA would have read these aspects of Amara as disclosing that internal applications 230 configure interface ports 202, 204, and 206 in appropriate circumstances. Ex. 1002, 46. In particular, a POSITA would have understood that the internal applications of a router that provide control and configuration were designed to configure the status of the router s ports, for example, as either enabled or disabled, and other characteristics of the ports. Id. Accordingly, a POSITA would have understood that Amara describes the interface ports being configurable by internal 21

26 applications 230 and, when appropriate, internal applications 230 configuring ports Id. As a result, Amara discloses a plurality of physical network interface ports, with the ports being configurable by control plane processes, as well as configuring the ports and means for doing so. [1.2]: port services, for operating on packets entering and exiting the physical network interface ports, the port services providing an ability to control and monitor packet flows, as defined by control plane configurations; [19.2]/[37.2]/[55.2]: [means for] executing port services on packets entering and exiting the physical network interface ports, the port services for controlling and monitoring packet flows as defined by control plane configurations; Amara discloses port services that execute or operate on packets entering and exiting the physical network interface ports. In particular, its device 200 includes policy engines that execute and apply policies to external packets passing through device 200. Ex. 1004, Fig. 3, 6:12-16; Ex. 1002, 36, 38-39, 45. Policy engines apply the policies to the external packets forwarded by packet classifiers , respectively. Ex. 1004, 6: The external 22

27 packets forwarded by packet classifiers to policy engines are external packets that entered interface ports , respectively. Ex. 1004, 5:56-62; Ex. 1002, 38, 45. Policy engines also apply the policies to the external packets forwarded by packet forwarder 222. Ex. 1004, 6: The external packets forwarded by packet forwarder 222 to policy engines are external packets that exit the interface ports , respectively. Ex. 1004, 6:3-8; Ex. 1002, 45. The policies therefore execute or operate on packets entering and exiting the interface ports In addition, the policy engines are a component of a switch engine. See infra, [9.0]/[25.0]/[45.0]/[61.0]. Amara therefore discloses the means for executing port services. Amara also discloses that the port services [are] for controlling and monitoring [or provide an ability to control and monitor] packet flows as defined by control plane configurations. In particular, Amara s policies may include dropping [selected] packet[s], logging [selected] packet[s], encrypting or decrypting [selecting] packet[s], performing network address translation and/or port address translation on [selected] packet[s], and prioritizing [selected] packet[s] for QoS. Ex. 1004, 1:36-38; 5: A POSITA would have understood that dropping selected packets or prioritizing selected packets each provide an ability to control packet flows. Ex. 1002, 36. Similarly, a POSITA would have understood 23

28 that logging selected packets provides an ability to monitor packet flows. Id. Accordingly, the policies provide for controlling and monitoring packet flows. Furthermore, a POSITA would have understood Amara as describing the policies applied by the policy engines being configured by internal applications 230 based, for example, on inputs by administrators. Ex. 1002, 37. Amara therefore discloses the policies and resulting control and monitoring being defined by control plane configurations. [1.3]: a control plane, comprising a plurality of internetworking control plane processes, the control plane processes for providing high-level control and configuration of the ports and the port services; [19.3]/[37.3]/[55.3]: [means for] executing a plurality of control plane processes, the control plane processes providing high level control and configuration of the ports and port services, Amara discloses a control plane, comprising a plurality of internetworking control plane processes [and executing those processes], where the the control plane processes [provide] high-level control and configuration of the ports and the port services. In particular, Amara s device 200 executes internal applications 230, which form a control plane. Ex. 1004, Fig. 3, 4:34-38; Ex. 1002,

29 Internal applications 230 serve to control and configure [the] device [200] and are executed by a processor. Ex. 1004, 4:34-35, Ex. 1002, 35. As noted above with respect to limitations [1.1]/[19.1]/[37.1]/[55.1] and [1.2]/[19.2]/[37.2] /[55.2], that control and configuration includes configuring the interface ports and configuring the policies applied by the policy engines Amara thus discloses a control plane, comprising a plurality of internetworking control plane processes [as well as executing those processes and a means for doing so], the control plane processes providing high-level control and configuration of the ports and the port services. [1.4]: a control plane port entity provides access to the collection of control plane processes, so that a set of control plane port services can be applied thereto; and [19.4]/[37.4]/[55.4]: [means for] accessing the collection of control plane processes as a control plane port entity, so that a set of control plane port services are applied thereto as a set; and [1.5]: the control plane port services operate on packets received from specific, predetermined physical ports and destined to the collection of control 25

30 plane processes in a way that is independent of the physical port interfaces and services applied thereto. [19.5]/[37.5]/[55.5]: [means for] operating on packets received from specific, predetermined physical ports and destined to the collection of control plane processes in a way that is independent of the individual physical port interface configuration and port services applied thereto. Amara discloses limitations [1.4]/[19.4]/[37.4]/[55.4] and [1.5]/[19.5]/[37.5] /[55.5]. In particular, Amara s device includes an internal interface 220 and a policy engine 232. Ex. 1004, Fig. 3, 4:34-38; Ex. 1002, 39-40, 44. The internal interface 220 provides access to internal applications 230. All of the internally destined packets are routed through the internal interface 220 to internal applications 230. Ex. 1004, 5:63-67; Ex. 1002, 40, 44. The internallydestined packets are those packets received on interface ports and destined for internal applications 230. Ex. 1004, 4:59-61; 5:5-6; Ex. 1002, 38. External packets are not routed through the internal interface 220. Ex. 1004, 5:63-67; Ex. 1002, 40. External packets are those packets received on interface ports

31 and destined for a device other than device 200. Ex. 1004, 4:44-48; 4:61-63; Ex. 1002, 38. Policy engine 232 applies its policies to the internally-destined packets routed through the internal interface 220. Ex. 1004, 6:9-12. Because only internally-destined packets are routed through the internal interface 220 to policy engine 232, policy engine 232 does not apply its policies to the external packets. Ex. 1004, 5:34-35; 6:9-16; Ex. 1002, 39-40, 44. Accordingly, internal applications 230 are accessed through the internal interface 220 by internally-destined packets being routed through the internal interface 220. Ex. 1004, 5:63-67; 4:2-7; Ex. 1002, 44. Policy engine 232 then applies policies to those packets routed through the internal interface 220. Ex. 1004, 5:63-67; 6:9-12; Ex. 1002, 44. Because policy engine 232 is separate from the policy engines and does not apply its policies to the external packets, the policies of policy engine 232 operate on the internally-destined packets in a way that is independent of the configurations of the interface ports and the policies of policy engines applied to the external packets entering and exiting the interface ports Ex. 1002, 39-40, As described above, Amara s internal applications 230 are accessed through internal interface 220. Ex. 1004, 5: Amara s internal applications 230 form a control plane and, therefore, internal interface 220 corresponds to the control plane 27

32 28 Attorney Docket No IP1 port 140 in the 668 Patent. Ex. 1001, 3:48-50, 4:65-5:4, 8:52-54; Ex. 1002, 35, 40. Amara therefore discloses a means for accessing the collection of control plane processes as a control plane port entity. Policy engine 232 is a component of a switch engine. See infra, [9.0]/[25.0] /[45.0]/[61.0]. Amara thus discloses a means for operating on packets received from specific, predetermined physical ports and destined to the collection of control plane processes in a way that is independent of the individual physical port interface configuration and port services applied thereto. Claim 2 [2.0]: A device as in claim 1 wherein the control plane processes are accessible through a control plane port on the internetworking device, such that control plane packets originating at a plurality of physical ports and destined to one of a plurality of control plane processes are first processed through the control plane port, rather than to individual control plane processes. Claims 20/38/56 [20.0]/[38.0]/[56.0]: A method as in claim 19 [or a device as in claim 37 or a medium as in claim 55] wherein the control plane port processes [or additionally comprises means for processing] packets originating at a plurality of physical ports, and additionally comprising the step of [or said means further comprising]: [means for] passing packets through the control plane port, rather than directly from the physical ports to individual control plane processes. As described above, in Amara s device 200, the internal interface 220 provides access to internal applications 230. All of the internally-destined packets (that is, those packets received on interface ports and destined for internal applications 230) are forwarded to the internal interface 220 by packet classifiers after being received on the interface ports , rather than being sent

33 directly from the interface ports to internal applications 230. Ex. 1004, 4:63-66; 5:63-67; Ex. 1002, 40, 44. The internal interface 220 then forwards the internally-destined packets to internal applications 230 via policy engine 232, which applies its policies to the internally-destined packets. Ex. 1004, 4:63-66; 5:63-67; 6:9-12; Ex. 1002, 44. Amara therefore discloses limitations [2.0]/[20.0] /[38.0]/[56.0]. In addition, policy engine 232 is a component of a switch engine. See infra, [9.0]/[25.0]/[45.0]/[61.0]. Amara therefore discloses a means for processing packets originating at a plurality of physical ports, said means further comprising: means for passing packets through the control plane port, rather than directly from the physical ports to individual control plane processes. Claim 3 [3.0]: A device as in claim 2 wherein packets destined to the control plane port are identified using information implicit to the packets, or information specified in configuration of the internetworking device. Claims 21/39/57 [21.0]/[39.0]/[57.0]: A method as in claim 20 [or a device as in claim 37 or a medium as in claim 56] additionally comprising the step of: identifying packets destined to the control plane port using information implicit to the packet or using information specified in configuration of the internetworking device. Amara discloses packet classifiers that identify packets destined to internal applications 230 (and hence the internal interface 220) using information specified in a configuration of device 200. In particular, packet classifiers classify the packets as either internally-destined packets or external packets, based 29

34 on the packets destination addresses. Ex. 1004, 4: The internally-destined packets are those destined for the internal applications and, therefore, the internal interface 220 because all internally-destined packets are routed through the internal interface 220. Id. at 4:59-61; 5:5-6; 5:63-67; Ex. 1002, 38, 40. As Amara explains, the packet classifiers can classify internally-destined packets because internally-destined packets have a destination address that is one of the addresses assigned to the device [200] itself. Ex. 1004, 4: A POSITA would have understood that such information (the addresses of the device itself) necessarily would be specified in the configuration of device 200, at least so that the packet classifiers could determine internally-destined packets based on this information. Ex. 1002, 41. Furthermore, a POSITA, would have understood that device 200 necessarily would have stored its own addresses to also perform other typical router functions, such as communicating its address information to the network and including its address information as the source address in the packet header of packets originating from device 200. Id. Amara thus discloses packets destined to the control plane port [are identified using] information specified in configuration of the internetworking device. Claim 4 [4.0]: A device as in claim 3 wherein the control plane port services are applied after a transit packet forwarding decision is made. Claims 22/40/58 [22.0]/[40.0]/[58.0]: A method as in claim 21 [or a device as in claim 39 or a medium as in claim 57] additionally comprising the step of: 30

35 applying control plane ports services after a transit packet forwarding decision is made. Amara discloses policy engine 232 applying its policies to internallydestined packets after the packet classifiers classify a packet as internallydestined and forwards the packet to the internal interface 220. In particular, packet classifiers classify received packets as either internally-destined packets or external packets. Ex. 1004, 4: If a packet is an internally-destined packet, the [p]acket classifiers forward the internally-destined packets to [the] internal interface 220. Id. at 5:58-60; 4: The internal interface 220 then forwards the internally-destined packets to internal applications 230 via policy engine 232. Id. at 5:63-67; 4:2-7; Ex. 1002, 44. Policy engine 232 applies policies to the internally-destined packets and, if appropriate, forwards the packet to internal applications 230. Ex. 1004, 5:63-67; 6:9-12; Ex. 1002, 44. Thus, Amara discloses applying control plane port services (the policies of policy engine 232) after packet classifiers make a transit packet forwarding decision. Claims 5/26/46/62 [5.0]/[26.0]/[46.0]/[62.0]: A device as in claim 3 [or a method as in claim 25 or a device as in claim 45 or a medium as in claim 61] wherein Layer 2 control packets are identified and forwarded to the control plane port. As described above with respect to limitations [1.4]/[19.4]/[37.4]/[55.4] and [1.5]/[19.5]/[37.5]/[55.5], in Amara s device 200, all of the internally-destined packets (that is, those packets received on interface ports and destined for 31

36 32 Attorney Docket No IP1 internal applications 230) are routed through the internal interface 220 to internal applications 230. See supra, [1.4]/[19.4]/[37.4]/[55.4] and [1.5]/[19.5]/[37.5] /[55.5]. In addition, Amara s internal applications 230 communicate with remote devices using protocols such as L2TP, which is the Layer 2 Tunneling Protocol. Ex. 1004, 4:36-43; Ex. 1002, 35, 42; Ex Accordingly, a POSITA would have understood that, to have such communication, the remote devices would send L2TP packets to internal applications 230 and, as a result, some of the packets identified as internally-destined would be those L2TP packets. Ex. 1002, 42. Further, a POSITA would have understood that L2TP messages are layer 2 messages and that some of those messages necessarily are control messages that are carried in a Packet Transport, such as a User Datagram Protocol (UDP) packet. Id. As a result, a POSITA would have understood that some of the packets identified as internally-destined packets would be UDP packets carrying L2TP control messages (that is, would be layer 2 control packets). Id. Amara therefore discloses wherein Layer 2 control packets are identified and forwarded to the control plane port. Claims 6/27/47/63 [6.0]/[27.0]/[47.0]/[63.0]: A device as in claim 3 [or a method as in claim 25 or a device as in claim 45 or a medium as in claim 61] wherein Layer 3 control packets are identified and forwarded to the control plane port. As described above with respect to limitations [1.4]/[19.4]/[37.4]/[55.4] and [1.5]/[19.5]/[37.5]/[55.5], in Amara s device 200, all of the internally-destined

37 packets (that is, those packets received on interface ports and destined for internal applications 230) are routed through the internal interface 220 to internal applications 230. See supra, [1.4]/[19.4]/[37.4]/[55.4] and [1.5]/[19.5]/[37.5] /[55.5]. In addition, Amara discloses that device 200 may be a router. Ex. 1004, 4: A POSITA would have understood that routers send routing protocol control packets, such as ICMP packets, to neighboring routers in order to share routing information, and that these packets are processed by applications running on the router to update the router s routing tables. Ex. 1002, 43; Ex As noted above, Amara s internal applications 230 serve to control or configure device 200. Ex. 1004, 4: Based on this combination of disclosure and knowledge, a POSITA would have understood that some of the packets identified in Amara as being internally-destined are routing protocol control packets (that is, layer 3 control packets) directed to internal applications 230. Ex. 1002, 43. Amara therefore discloses wherein Layer 3 control packets are identified and forwarded to the control plane port. Claim 8/24/42/60 [8.0]/[24.0]/[42]/[63.0]: A device as in claim 1 [or a method as in claim 19 or a device as in claim 37 or a medium as in claim 55] wherein the control plane port services are implemented [or execute] as an aggregate control plane function [or means] applied to packets received from multiple physical ports on the internetworking device. As described above, Amara discloses that the policies are executed by policy engine 232, which applies the policies to the internally-destined packets. Ex. 1004, 33

38 6:9-12; Ex. 1002, 39. The internally-destined packets are those packets received from multiple interface ports on device 200 and destined for internal applications 230. Ex. 1004, 4:59-61; 5:5-6; Ex. 1002, 38. Amara therefore discloses wherein the control plane port services are implemented [or execute] as an aggregate control plane function [or means] applied to packets received from multiple physical ports on the internetworking device. Claims 9/25/45/61 [9.0]/[25.0]/[45.0]/[61.0]: A device as in claim 8 [or a method as in claim 24 or a device as in claim 43 or a medium as in claim 60] wherein a central switch engine [means] performs the [or provides] aggregate control plane port services. Claim 16 [16.0]: A device as in claim 1 wherein a central switch engine provides the control plane port services. Claims 34/52/70 [34.0]/52.0]/70.0]: A method as in claim 19 [or a device as in claim 37 or a medium as in claim 55] additionally comprising the step of: providing control plane port services in a central switch engine. In Amara, the combination of the packet classifiers , policy engines , packet forwarder 222, and policy engine 232 collectively constitute a central switch engine. Ex. 1002,

39 The packet classifiers classify packets as internally-directed or external. Ex. 1004, 4: They forward external packets to packet forwarder 222 via policy engines Id. at 5:28-3. Packet forwarder 222 determines to which of the interfaces to forward the external packets, id. at 5:60-62, and then forwards the packet accordingly, id. at 6:3-8. Packet classifiers forward internally-directed packets to internal interface 220, which forwards those packets to policy engine 232, id. at 4:2-7; 4:63-64; 5:58-67, which applies policies to the internally-destined packets., id. at 5:63-67; 6:9-12. As a result, the central switch engine, through policy engine 232, provides the policies applied to the internally-directed packets. Claims 15/33/51/69 [15.0]/[33.0]/[51]/[69.0]: A device as in claim 1 [or a method as in claim 19 or a device as in claim 37 or a medium as in claim 55] wherein a central switch engine [means] delivers control plane packets to the control plane port. As described above, the combination of the packet classifiers , policy engines , packet forwarder 222, and policy engine 232 collectively 35